CVE-2018-7284 PoC — Digium Asterisk Open Source和Certified Asterisk 缓冲区错误漏洞

Source

Associated Vulnerability

Title:Digium Asterisk Open Source和Certified Asterisk 缓冲区错误漏洞 (CVE-2018-7284)
Description:Digium Asterisk Open Source和Certified Asterisk都是美国Digium公司的开源电话交换机（PBX）系统软件。该软件支持语音信箱、多方语音会议、交互式语音应答(IVR)等。 Digium Asterisk Open Source和Certified Asterisk中存在缓冲区溢出漏洞。攻击者可利用该漏洞造成拒绝服务（崩溃）。以下产品和版本受到影响：Digium Asterisk Open Source 13.19.1及之前的版本，14.x版本至14.7.5版本，

Description

Tool to exploit CVE-2018-7284 and CVE-2018-19278

Readme

# astDoS
Tool to exploit CVE-2018-7284 and CVE-2018-19278

## Usage
This tool is used as a command.

```
astDoS.py [-h] [-a {1,2}] [-sA SERVER_IP] [-sP SERVER_PORT] [-u USER]
                 [-p PASSWD] [-sub SUBUSER] [-dA DNS_IP] [-dP DNS_PORT]
                 [-v [VERSION]]

DoS attack against Astersisk, CVE-2018-7284 and CVE-2018-19278

optional arguments:
  -h, --help            show this help message and exit
  -a {1,2}, --attack {1,2}
                        Attack type. 1 for CVE-2018-7284 header (default
                        value). 2 for CVE-2018-19278 DNS
  -sA SERVER_IP, --server-address SERVER_IP
                        CVE-2018-7284 headers: Asterisk IP address to connect
                        to
  -sP SERVER_PORT, --server-port SERVER_PORT
                        CVE-2018-7284 headers: Astersik port to connect to
                        (5060 by default)
  -u USER, --user USER  CVE-2018-7284 headers: username to use in the attack
  -p PASSWD, --password PASSWD
                        CVE-2018-7284 headers: password to use in the attack
  -sub SUBUSER, --subscribeUser SUBUSER
                        CVE-2018-7284 headers: subscribe user to use in the
                        attack
  -dA DNS_IP, --dns-address DNS_IP
                        CVE-2018-19278 DNS: Address to bind the socket
  -dP DNS_PORT, --dns-port DNS_PORT
                        CVE-2018-19278 DNS: Port to bind the socket
  -v [VERSION], --version [VERSION]
                        Show tool version.

```

File Snapshot


 [4.0K]  /data/pocs/481049b657de7bd6572b50197c6398b44de39ec0
├── [4.0K]  Additional Resources
│   ├── [4.0K]  Asterisk Config
│   │   ├── [4.0K]  CVE-2019-19278
│   │   │   ├── [ 950]  extensions.conf
│   │   │   ├── [ 821]  pjsip.conf
│   │   │   └── [1.5K]  resolver_unbound.conf
│   │   └── [4.0K]  CVE-2019-7284
│   │       ├── [  58]  extensions.conf
│   │       └── [ 249]  pjsip.conf
│   ├── [4.0K]  Bind config
│   │   ├── [ 670]  db.aaaa.bbbb.es
│   │   ├── [ 554]  db.tel.testuc3m.com
│   │   └── [ 569]  named.conf.local
│   └── [4.0K]  Scripts
│       ├── [2.2K]  DNS.py
│       ├── [2.6K]  Headers1.py
│       ├── [2.7K]  Headers2.py
│       └── [2.8K]  Headers3.py
├── [8.3K]  astDoS.py
└── [1.5K]  README.md

6 directories, 14 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!