Was looking randomly at my logs today.
noticed that I got a visit from shodan, witch I didn't like, having port open is one thing, having them listed on a search engine is less fun. I
get poked on all the open enough port thank you. (updated my host.can
for *.census.shodan.io we'll see if it help and I'll change my ip)
So for fun (actually as a precaution) I was looking if there where known exploit for synchronet. Seem old ( 2017 ) so must be old news for you guys.
So far only see that script for the version 3.16c for windows, the
script is at a few places, it's in python, primitive but will flood port
80 with a get to index.ssjs but with a referrer string of 'A' 4096 long.
I haven't check the code yet on synchronet side, but i bet they want to create a buffer overflow and make the service crash. and at the same
time each loop in the code is sending that 956 time (why 956?? ) then
wait 25 sec and do it again for 2 others attempt
so it has a CVE http://cve.circl.lu/cve/CVE-2017-6371 and the script can
be found https://packetstormsecurity.com/files/141396/Synchronet-BBS-3.16c-For -Windows-Denial-Of-Service.html
My recollection is that problem has been resolved, though I can't seem to locate any commit message in reference to that CVE. Anyone try the script to see if you can reproduce it?
see if you can reproduce it?
My recollection is that problem has been resolved, though I can't seem to locate any commit message in reference to that CVE. Anyone try the script to see if you can reproduce it?
I'll try it, but on my linux install. Any windows volunteer ?
You can hit vert.synchro.net with it, I won't be block ya. :-)
You can hit vert.synchro.net with it, I won't be block ya. :-)
ok, i did it around 7:39 eastern time
[*] Try: 75
[*] Try: 76
[-] The service seems to be down
[i] Waiting a few seconds before starting a second attack.
[*] Second run to trigger the DoS
[-] The service seems to be down.
[i] Wait before the final strike.
[*] Third run to trigger the DoS
[-] The service seems to be down.
[!] It can take a few seconds for the service to crash
on the website firefox said :
The connection has timed out
The server at vert.synchro.net is taking too long to respond.
The site could be temporarily unavailable or too busy. Try again in a few moments.
If you are unable to load any pages, check your computer’s network connection.
at 8:00, 20min later it still look down.
Yeah, it was down for a different reason (left a break point set in my attached debugger - oops!).
Sysop: | Chris Crash |
---|---|
Location: | Huntington Beach, CA. |
Users: | 557 |
Nodes: | 8 (0 / 8) |
Uptime: | 125:37:07 |
Calls: | 10,414 |
Calls today: | 1 |
Files: | 5 |
Messages: | 366,901 |