There is a nasty exploit in the news lately, a perl-based script called "Apache Killer" that provides an easy way to issue a denial of service attack against an apache server from a single source. The Register has a complete write-up on the vulnerability and the exploit, SANS has started covering it in this article, and you could just grab it from the Full Disclosure mailing list or visit my friends over at PenTestIT for a writeup and download and they also have a workaround folks can implement via mod_rewrite (although it might not be appropriate for every site).
The exploit is fairly easy enough to modify but I assume that within the next day or so, anti-virus clients will start quarantining the exploit if found on the filesystem of certain machines. I've written a script, which might receive some heavy modifications over the next couple days, that attempts to assess whether a server (or site) is vulnerable to the Apache Range Header Denial of Service Vulnerability. The intent of my implementation is to assess the existence of the vulnerability but prevent more than one connection to the site and containing no exploit code.
It's still preliminary because I have unanswered questions/concerns with the exploit. The exploit appears to be sending the following request (with request headers) to the target server in order to determine if the server "seems" vulnerable:
HEAD / HTTP/1.1
Host: 10.0.0.16
Range:bytes=0-
Accept-Encoding: gzip
Connection: close
My test ubuntu server running apache 2.2.17 responds with the following http response headers:
HTTP/1.1 206 Partial Content
Date: Wed, 24 Aug 2011 18:44:32 GMT
Server: Apache/2.2.17 (Ubuntu)
Last-Modified: Thu, 04 Aug 2011 03:23:21 GMT
ETag: "20abb-b1-4a9a580b93ac0"
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Range: bytes 0-145/146
Content-Length: 146
Connection: close
Content-Type: text/html
The exploit seems to assume a server is vulnerable simply because it returned a 206 Partial Content status code. The problem is that the same test run against an IIS server gives the same 206 Parital Content response and, as far as I know at this particular point in time, IIS is not known to be exploitable. But maybe that's not the case? The original vulnerability was reported back in 2007 and listed both Apache and IIS as being vulnerable. I wonder if anyone tested this exploit against an IIS host. So, my current quandary with my implementation here is that I do not have the confidence yet that simply retrieving a 206 Partial Content status code is enough to formally declare the target system vulnerable. Update: Interestingly, the exploit finds tomcat to be vulnerable, too! See the discussion on ServerFault
I think I will have a better idea of what to test for when the new versions of apache httpd are released. Here is the current version of my script, it uses LWP::UserAgent and HTTP::Headers and is intended to work with perl version 5.10 or above:
#!/usr/bin/env perl
# Apache Killer assessor
use strict;
use warnings;
use feature ':5.10';
use HTTP::Headers;
use LWP::UserAgent;
my $host = $ARGV[0];
my $port = $ARGV[1];
my $scheme;
my $help = "Usage: $0 ";
if ( !@ARGV ) {
print $help . "\n";
exit 0;
}
if ( $port == 443 ) {
$scheme = 'https';
}
else {
$scheme = 'http';
}
my $message;
my $objHeader = HTTP::Headers->new;
$objHeader->header('Host' => $host);
$objHeader->header('Range' => 'bytes=0-');
$objHeader->header('Accept-Encoding' => 'gzip');
$objHeader->header('Connection' => 'close');
my $url = "$scheme://$host:$port/";
my $method = "HEAD";
my $ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->max_redirect(0);
$ua->env_proxy;
$ua->agent('techstacksRangeHeaderDoSTest/v0.1');
my $req = HTTP::Request->new( $method, $url, $objHeader );
my $resp = $ua->request($req);
given ($resp->code ) {
when (206) {
say "Response Status Code: " . $resp->status_line;
say "Web Server Seems Vulnerable to Apache Range Header DoS Vulnerability";
}
when (301) {
say "Redirect Present. Potential False Positive";
say "Retry request against: " . $resp->header('Location');
}
when (302) {
say "Redirect Present. Potential False Positive";
say "Retry request against: " . $resp->header('Location');
}
when (307) {
say "Redirect Present. Potential False Positive";
say "Retry request against: " . $resp->header('Location');
}
when (403) {
say $resp->status_line;
say "This is not an expected response code at this time."
}
when (404) {
say $resp->status_line;
say "This is not an expected response code."
}
when (405) {
say $resp->status_line;
say "HTTP Method HEAD is not permitted.";
say "This is overkill!";
}
when (501) {
say $resp->status_line;
say "HTTP Method HEAD is not implemented.";
say "This is overkill!";
}
default {
say $resp->status_line;
}
}
