File: rservice.c

package info (click to toggle)
netcat 1.10-41
  • links: PTS
  • area: main
  • in suites: jessie, jessie-kfreebsd, stretch
  • size: 1,740 kB
  • ctags: 2,171
  • sloc: ansic: 1,830; sh: 796; makefile: 128
file content (75 lines) | stat: -rw-r--r-- 1,440 bytes parent folder | download | duplicates (4)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
/* generate ^@string1^@string2^@cmd^@ input to netcat, for scripting up
   rsh/rexec attacks.  Needs to be a prog because shells strip out nulls.

   args:
	locuser remuser [cmd]
	remuser passwd [cmd]

   cmd defaults to "pwd".

   ... whatever.  _H*/

#include <stdio.h>

/* change if you like; "id" is a good one for figuring out if you won too */
static char cmd[] = "pwd";

static char buf [4096];

main(argc, argv)
  int argc;
  char * argv[];
{
  register int x;
  register int y;
  char * p;
  char * q;

  p = buf;
  memset (buf, 0, sizeof (buf));

  p++;				/* first null */
  y = 1;

  if (! argv[1])
    goto wrong;
  strncpy (p, argv[1], sizeof (buf) - y); /* first arg plus another null */
  x = strlen (argv[1]) + 1;
  p += x;
  y += x;
  if (y >= sizeof (buf))
    goto over;

  if (! argv[2])
    goto wrong;
  strncpy (p, argv[2], sizeof (buf) - y);	/* second arg plus null */
  x = strlen (argv[2]) + 1;
  p += x;
  y += x;
  if (y >= sizeof (buf))
    goto over;

  q = cmd;
  if (argv[3])
    q = argv[3];
  strncpy (p, q, sizeof (buf) - y); /* the command, plus final null */
  x = strlen (q) + 1;
  p += x;
  y += x;
  if (y >= sizeof (buf))
    goto over;

  strncpy (p, "\n", sizeof (buf) - y); /* and a newline, so it goes */
  y++;

  write (1, buf, y);		/* zot! */
  exit (0);

wrong:
  fprintf (stderr, "wrong!  needs 2 or more args.\n");
  exit (1);

over:
  fprintf (stderr, "out of memory!\n");
  exit (1);
}