<![CDATA[/*
* WUFTPD 2.6.0 VULNERABILITY SCANNER
* by rasch [Adr017 crew]
* adr017@inorbit.com
*
* This program will check for the presence of wu-ftpd 2.6.0 on
* a single host or a number of hosts listed in a file. If the
* -f [get_ips_from_file] option is given it will dump the ips
* of the hosts running wu-ftpd 2.6.0 to the output file you've
* specified. Otherwise if -s [ for single host scan ] is given
* it will print the result of the scan on the screen.
*
*
* BTW a remote root exploit for Wuftpd 2.6.0 is available by tf8
* so you may find this scanner very useful.
*
* Greetz go to my crew!
* <-nj0y!
*/
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#define PORT 21
#define MAXDATASIZE 1200
#define LIGHT_BLUE "\033[36m"
#define NORMAL "\033[0m"
char opt;
void usage (char *progname)
{
printf("\n\t\twu-ftpd-2.6.0 scan by rasch / "LIGHT_BLUE"Adr017"NORMAL"(c)rew");
printf("\n Usage: \n");
printf(" %s -s 192.168.5.1 [single host scan] \n", progname);
printf(" %s -f infile outfile [get the IPs from a file] \n\n", progname);
exit(1);
}
int if_vuln(char *host)
{
int sockfd,reccnt;
char buffer[MAXDATASIZE];
struct sockaddr_in address;
struct hostent *he;
if ((he=gethostbyname(host)) == NULL) {
if (opt == 's') {
printf("\nHost name lookup failure\n\n");
exit(1);
}
return 0;
}
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if(sockfd < 0) {
printf("\nSocket error\n\n");
exit(1);
}
address.sin_family = AF_INET;
address.sin_addr = *((struct in_addr *)he->h_addr);
address.sin_port = htons(PORT);
bzero(&(address.sin_zero), 8);
if(connect(sockfd, (struct sockaddr *)&address, sizeof(address)) == -1)
{
if (opt == 's') {
printf(" \nError connecting to host or service not available\n\n");
exit(1);
}
close(sockfd);
return 0;
}
reccnt=recv(sockfd, buffer, MAXDATASIZE, 0);
buffer[reccnt] = '\0';
close(sockfd);
if(strstr(buffer, "wu-2.6.0"))
return 1;
else
return 0;
}
void read_n_write(char *infile, char *outfile)
{
FILE *iff, *of;
char linebuf[512];
if((iff=fopen(infile,"r")) == NULL)
return;
while(fgets(linebuf,512,iff) != NULL) {
if(linebuf[strlen(linebuf)-1]=='\n')
linebuf[strlen(linebuf)-1]=0;
if(if_vuln(linebuf) == 1 && (of=fopen(outfile,"a")) != NULL) {
linebuf[strlen(linebuf)+1]=0;
linebuf[strlen(linebuf)]='\n';
fputs(linebuf,of);
fclose(of);
}
}
fclose(iff);
}
int main(int argc, char *argv[])
{
if (argc < 3)
usage(argv[0]);
if (argv[1][0] != '-') {
printf("\nPlease pass an argument preceded with a - \n\n");
exit(1);
}
opt = argv[1][1];
if (opt != 's' && opt != 'f') {
printf("\nUnknown option!\n\n");
exit(1);
}
if (opt == 's')
{
if (if_vuln(argv[2]) == 1)
{
printf("\nHost "LIGHT_BLUE"VULNERABLE"NORMAL" .. enJoy!\n");
printf(" ^^^^^^^^^^\n");
exit(0);
}
else
{
printf("\nHost NOT vulnerable .. sorry \n\n");
exit(0);
}
}
if (opt == 'f')
{
read_n_write(argv[2],argv[3]);
return 1;
}
}
]]>