rpc.mountd scanner that looks for servers open to the Linux rpc.mountd hole.
fd6d61db1e00fe3b708a890d699f92091d5a3de1ca9f338d3c2f53e1e8b9973e
/*
* rpc.mountd scanner by JWK - [ http://www.rootshell.com/ ]
*
* ripped from statd scanner made by -uh- unknown
* credits go to [The Warlords] on IRCNet, conflict on EFNet
* and lucian.net team (http://www.lucian.net)
* Thanx acey :-)
*
* gcc -o scan mountdscan.c
*
* you can use mscan ip database as input file or whatevr
*/
#include <stdio.h>
#include <netdb.h>
#include <stdlib.h>
#include <signal.h>
#include <rpc/rpc.h>
#include <arpa/inet.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <rpc/pmap_prot.h>
#include <rpc/pmap_clnt.h>
#define ERROR -1
void woopy(int s);
void usage(char *s);
void scan(char *i, char *o);
int statd(char *host);
unsigned long int res(char *p);
void usage(char *s)
{
printf("Usage: %s <inputfile> <outputfile>\nhttp://www.rootshell.com/\n",s);
exit(ERROR);
}
void main(int argc, char **argv)
{
if(argc < 3) usage(argv[0]);
scan(argv[1], argv[2]);
}
void scan(char *i, char *o)
{
FILE *iff, *of;
char buf[512];
if((iff=fopen(i,"r")) == NULL)
return;
while(fgets(buf,512,iff) != NULL)
{
if(buf[strlen(buf)-1]=='\n')
buf[strlen(buf)-1]=0;
if(statd(buf) && (of=fopen(o,"a")) != NULL) {
buf[strlen(buf)+1]=0;
buf[strlen(buf)]='\n';
fputs(buf,of);
fclose(of);
}
}
fclose(iff);
}
void woopy(int s)
{
return;
}
int statd(char *host)
{
struct sockaddr_in server_addr;
struct pmaplist *head = NULL;
int sockett = RPC_ANYSOCK;
struct timeval minutetimeout;
register CLIENT *client;
struct rpcent *rpc;
server_addr.sin_addr.s_addr=res(host);
server_addr.sin_family=AF_INET;
server_addr.sin_port = htons(PMAPPORT);
minutetimeout.tv_sec = 15;
minutetimeout.tv_usec = 0;
signal(SIGALRM,woopy);
alarm(15);
if ((client = clnttcp_create(&server_addr, PMAPPROG,
PMAPVERS, &sockett, 50, 500)) == NULL) {
alarm(0);
signal(SIGALRM,SIG_DFL);
return 0;
}
alarm(0);
signal(SIGALRM,SIG_DFL);
if (clnt_call(client, PMAPPROC_DUMP, (xdrproc_t) xdr_void, NULL,
(xdrproc_t) xdr_pmaplist, &head, minutetimeout) != RPC_SUCCESS)
return 0;
if (head != NULL)
for (; head != NULL; head = head->pml_next)
if((rpc = getrpcbynumber(head->pml_map.pm_prog)))
if(strcmp(rpc->r_name,"mountd") == 0)
return 1;
return 0;
}
unsigned long int res(char *p)
{
struct hostent *h;
unsigned long int rv;
h=gethostbyname(p);
if(h!=NULL)
memcpy(&rv,h->h_addr,h->h_length);
else
rv=inet_addr(p);
return rv;
}