From: deraadt Date: Thu, 5 Sep 1996 08:55:23 +0000 (+0000) Subject: nc is *hobbit*'s netcat; let the sysadm have the same tools the crackers X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=e27b89427ac70d51d85c8d30b0d2899f30d582d0;p=openbsd nc is *hobbit*'s netcat; let the sysadm have the same tools the crackers have, so that he may learn what the network is about and protect it better. --- diff --git a/usr.bin/Makefile b/usr.bin/Makefile index add18a3f091..af84a9ea8de 100644 --- a/usr.bin/Makefile +++ b/usr.bin/Makefile @@ -1,4 +1,4 @@ -# $OpenBSD: Makefile,v 1.24 1996/09/04 22:52:05 deraadt Exp $ +# $OpenBSD: Makefile,v 1.25 1996/09/05 08:55:23 deraadt Exp $ # $NetBSD: Makefile,v 1.62 1996/03/10 05:45:43 thorpej Exp $ # from: @(#)Makefile 5.8.1.1 (Berkeley) 5/8/91 @@ -11,7 +11,8 @@ SUBDIR= apply apropos arch asa at awk banner basename bdes biff cal calendar \ fsplit fstat ftp gencat getconf getopt head hexdump id indent \ info_mkdb ipcrm ipcs join jot kdump ktrace lam last lastcomm leave \ less lex lndir locate lock logger login logname look lorder m4 machine \ - mail make man mesg mkdep mkfifo mkstr modstat msgs netstat newsyslog \ + mail make man mesg mkdep mkfifo mkstr modstat msgs nc \ + netstat newsyslog \ nfsstat nice nohup oldrdist pagesize passwd paste patch pr printenv \ printf quota rdist rdistd renice rev rlogin rpcgen rpcinfo rs \ rsh rup ruptime rusers rwall rwho \ diff --git a/usr.bin/nc/Makefile b/usr.bin/nc/Makefile new file mode 100644 index 00000000000..9170bcaba93 --- /dev/null +++ b/usr.bin/nc/Makefile @@ -0,0 +1,8 @@ +# $OpenBSD: Makefile,v 1.1 1996/09/05 08:55:31 deraadt Exp $ +# $NetBSD: Makefile,v 1.11 1995/10/03 21:42:34 thorpej Exp $ + +CFLAGS+= -DTELNET +PROG= nc +SRCS= netcat.c + +.include diff --git a/usr.bin/nc/README b/usr.bin/nc/README new file mode 100644 index 00000000000..4235bc41acf --- /dev/null +++ b/usr.bin/nc/README @@ -0,0 +1,946 @@ +Netcat 1.10 +=========== /\_/\ + / 0 0 \ +Netcat is a simple Unix utility which reads and writes data ====v==== +across network connections, using TCP or UDP protocol. \ W / +It is designed to be a reliable "back-end" tool that can | | _ +be used directly or easily driven by other programs and / ___ \ / +scripts. At the same time, it is a feature-rich network / / \ \ | +debugging and exploration tool, since it can create almost (((-----)))-' +any kind of connection you would need and has several / +interesting built-in capabilities. Netcat, or "nc" as the ( ___ +actual program is named, should have been supplied long ago \__.=|___E +as another one of those cryptic but standard Unix tools. / + +In the simplest usage, "nc host port" creates a TCP connection to the given +port on the given target host. Your standard input is then sent to the host, +and anything that comes back across the connection is sent to your standard +output. This continues indefinitely, until the network side of the connection +shuts down. Note that this behavior is different from most other applications +which shut everything down and exit after an end-of-file on the standard input. + +Netcat can also function as a server, by listening for inbound connections +on arbitrary ports and then doing the same reading and writing. With minor +limitations, netcat doesn't really care if it runs in "client" or "server" +mode -- it still shovels data back and forth until there isn't any more left. +In either mode, shutdown can be forced after a configurable time of inactivity +on the network side. + +And it can do this via UDP too, so netcat is possibly the "udp telnet-like" +application you always wanted for testing your UDP-mode servers. UDP, as the +"U" implies, gives less reliable data transmission than TCP connections and +some systems may have trouble sending large amounts of data that way, but it's +still a useful capability to have. + +You may be asking "why not just use telnet to connect to arbitrary ports?" +Valid question, and here are some reasons. Telnet has the "standard input +EOF" problem, so one must introduce calculated delays in driving scripts to +allow network output to finish. This is the main reason netcat stays running +until the *network* side closes. Telnet also will not transfer arbitrary +binary data, because certain characters are interpreted as telnet options and +are thus removed from the data stream. Telnet also emits some of its +diagnostic messages to standard output, where netcat keeps such things +religiously separated from its *output* and will never modify any of the real +data in transit unless you *really* want it to. And of course telnet is +incapable of listening for inbound connections, or using UDP instead. Netcat +doesn't have any of these limitations, is much smaller and faster than telnet, +and has many other advantages. + +Some of netcat's major features are: + + Outbound or inbound connections, TCP or UDP, to or from any ports + Full DNS forward/reverse checking, with appropriate warnings + Ability to use any local source port + Ability to use any locally-configured network source address + Built-in port-scanning capabilities, with randomizer + Built-in loose source-routing capability + Can read command line arguments from standard input + Slow-send mode, one line every N seconds + Hex dump of transmitted and received data + Optional ability to let another program service established connections + Optional telnet-options responder + +Efforts have been made to have netcat "do the right thing" in all its various +modes. If you believe that it is doing the wrong thing under whatever +circumstances, please notify me and tell me how you think it should behave. +If netcat is not able to do some task you think up, minor tweaks to the code +will probably fix that. It provides a basic and easily-modified template for +writing other network applications, and I certainly encourage people to make +custom mods and send in any improvements they make to it. This is the second +release; the overall differences from 1.00 are relatively minor and have mostly +to do with portability and bugfixes. Many people provided greatly appreciated +fixes and comments on the 1.00 release. Continued feedback from the Internet +community is always welcome! + +Netcat is entirely my own creation, although plenty of other code was used as +examples. It is freely given away to the Internet community in the hope that +it will be useful, with no restrictions except giving credit where it is due. +No GPLs, Berkeley copyrights or any of that nonsense. The author assumes NO +responsibility for how anyone uses it. If netcat makes you rich somehow and +you're feeling generous, mail me a check. If you are affiliated in any way +with Microsoft Network, get a life. Always ski in control. Comments, +questions, and patches to hobbit@avian.org. + +Building +======== + +Compiling is fairly straightforward. Examine the Makefile for a SYSTYPE that +matches yours, and do "make ". The executable "nc" should appear. +If there is no relevant SYSTYPE section, try "generic". If you create new +sections for generic.h and Makefile to support another platform, please follow +the given format and mail back the diffs. + +There are a couple of other settable #defines in netcat.c, which you can +include as DFLAGS="-DTHIS -DTHAT" to your "make" invocation without having to +edit the Makefile. See the following discussions for what they are and do. + +If you want to link against the resolver library on SunOS [recommended] and +you have BIND 4.9.x, you may need to change XLIBS=-lresolv in the Makefile to +XLIBS="-lresolv -l44bsd". + +Linux sys/time.h does not really support presetting of FD_SETSIZE; a harmless +warning is issued. + +Some systems may warn about pointer types for signal(). No problem, though. + +Exploration of features +======================= + +Where to begin? Netcat is at the same time so simple and versatile, it's like +trying to describe everything you can do with your Swiss Army knife. This will +go over the basics; you should also read the usage examples and notes later on +which may give you even more ideas about what this sort of tool is good for. + +If no command arguments are given at all, netcat asks for them, reads a line +from standard input, and breaks it up into arguments internally. This can be +useful when driving netcat from certain types of scripts, with the side effect +of hiding your command line arguments from "ps" displays. + +The host argument can be a name or IP address. If -n is specified, netcat +will only accept numeric IP addresses and do no DNS lookups for anything. If +-n is not given and -v is turned on, netcat will do a full forward and reverse +name and address lookup for the host, and warn you about the all-too-common +problem of mismatched names in the DNS. This often takes a little longer for +connection setup, but is useful to know about. There are circumstances under +which this can *save* time, such as when you want to know the name for some IP +address and also connect there. Netcat will just tell you all about it, saving +the manual steps of looking up the hostname yourself. Normally mismatch- +checking is case-insensitive per the DNS spec, but you can define ANAL at +compile time to make it case-sensitive -- sometimes useful for uncovering minor +errors in your own DNS files while poking around your networks. + +A port argument is required for outbound connections, and can be numeric or a +name as listed in /etc/services. If -n is specified, only numeric arguments +are valid. Special syntax and/or more than one port argument cause different +behavior -- see details below about port-scanning. + +The -v switch controls the verbosity level of messages sent to standard error. +You will probably want to run netcat most of the time with -v turned on, so you +can see info about the connections it is trying to make. You will probably +also want to give a smallish -w argument, which limits the time spent trying to +make a connection. I usually alias "nc" to "nc -v -w 3", which makes it +function just about the same for things I would otherwise use telnet to do. +The timeout is easily changed by a subsequent -w argument which overrides the +earlier one. Specifying -v more than once makes diagnostic output MORE +verbose. If -v is not specified at all, netcat silently does its work unless +some error happens, whereupon it describes the error and exits with a nonzero +status. Refused network connections are generally NOT considered to be errors, +unless you only asked for a single TCP port and it was refused. + +Note that -w also sets the network inactivity timeout. This does not have any +effect until standard input closes, but then if nothing further arrives from +the network in the next seconds, netcat tries to read the net once +more for good measure, and then closes and exits. There are a lot of network +services now that accept a small amount of input and return a large amount of +output, such as Gopher and Web servers, which is the main reason netcat was +written to "block" on the network staying open rather than standard input. +Handling the timeout this way gives uniform behavior with network servers that +*don't* close by themselves until told to. + +UDP connections are opened instead of TCP when -u is specified. These aren't +really "connections" per se since UDP is a connectionless protocol, although +netcat does internally use the "connected UDP socket" mechanism that most +kernels support. Although netcat claims that an outgoing UDP connection is +"open" immediately, no data is sent until something is read from standard +input. Only thereafter is it possible to determine whether there really is a +UDP server on the other end, and often you just can't tell. Most UDP protocols +use timeouts and retries to do their thing and in many cases won't bother +answering at all, so you should specify a timeout and hope for the best. You +will get more out of UDP connections if standard input is fed from a source +of data that looks like various kinds of server requests. + +To obtain a hex dump file of the data sent either way, use "-o logfile". The +dump lines begin with "<" or ">" to respectively indicate "from the net" or +"to the net", and contain the total count per direction, and hex and ascii +representations of the traffic. Capturing a hex dump naturally slows netcat +down a bit, so don't use it where speed is critical. + +Netcat can bind to any local port, subject to privilege restrictions and ports +that are already in use. It is also possible to use a specific local network +source address if it is that of a network interface on your machine. [Note: +this does not work correctly on all platforms.] Use "-p portarg" to grab a +specific local port, and "-s ip-addr" or "-s name" to have that be your source +IP address. This is often referred to as "anchoring the socket". Root users +can grab any unused source port including the "reserved" ones less than 1024. +Absence of -p will bind to whatever unused port the system gives you, just like +any other normal client connection, unless you use -r [see below]. + +Listen mode will cause netcat to wait for an inbound connection, and then the +same data transfer happens. Thus, you can do "nc -l -p 1234 < filename" and +when someone else connects to your port 1234, the file is sent to them whether +they wanted it or not. Listen mode is generally used along with a local port +argument -- this is required for UDP mode, while TCP mode can have the system +assign one and tell you what it is if -v is turned on. If you specify a target +host and optional port in listen mode, netcat will accept an inbound connection +only from that host and if you specify one, only from that foreign source port. +In verbose mode you'll be informed about the inbound connection, including what +address and port it came from, and since listening on "any" applies to several +possibilities, which address it came *to* on your end. If the system supports +IP socket options, netcat will attempt to retrieve any such options from an +inbound connection and print them out in hex. + +If netcat is compiled with -DGAPING_SECURITY_HOLE, the -e argument specifies +a program to exec after making or receiving a successful connection. In the +listening mode, this works similarly to "inetd" but only for a single instance. +Use with GREAT CARE. This piece of the code is normally not enabled; if you +know what you're doing, have fun. This hack also works in UDP mode. Note that +you can only supply -e with the name of the program, but no arguments. If you +want to launch something with an argument list, write a two-line wrapper script +or just use inetd like always. + +If netcat is compiled with -DTELNET, the -t argument enables it to respond +to telnet option negotiation [always in the negative, i.e. DONT or WONT]. +This allows it to connect to a telnetd and get past the initial negotiation +far enough to get a login prompt from the server. Since this feature has +the potential to modify the data stream, it is not enabled by default. You +have to understand why you might need this and turn on the #define yourself. + +Data from the network connection is always delivered to standard output as +efficiently as possible, using large 8K reads and writes. Standard input is +normally sent to the net the same way, but the -i switch specifies an "interval +time" which slows this down considerably. Standard input is still read in +large batches, but netcat then tries to find where line breaks exist and sends +one line every interval time. Note that if standard input is a terminal, data +is already read line by line, so unless you make the -i interval rather long, +what you type will go out at a fairly normal rate. -i is really designed +for use when you want to "measure out" what is read from files or pipes. + +Port-scanning is a popular method for exploring what's out there. Netcat +accepts its commands with options first, then the target host, and everything +thereafter is interpreted as port names or numbers, or ranges of ports in M-N +syntax. CAVEAT: some port names in /etc/services contain hyphens -- netcat +currently will not correctly parse those, so specify ranges using numbers if +you can. If more than one port is thus specified, netcat connects to *all* of +them, sending the same batch of data from standard input [up to 8K worth] to +each one that is successfully connected to. Specifying multiple ports also +suppresses diagnostic messages about refused connections, unless -v is +specified twice for "more verbosity". This way you normally get notified only +about genuinely open connections. Example: "nc -v -w 2 -z target 20-30" will +try connecting to every port between 20 and 30 [inclusive] at the target, and +will likely inform you about an FTP server, telnet server, and mailer along the +way. The -z switch prevents sending any data to a TCP connection and very +limited probe data to a UDP connection, and is thus useful as a fast scanning +mode just to see what ports the target is listening on. To limit scanning +speed if desired, -i will insert a delay between each port probe. There are +some pitfalls with regard to UDP scanning, described later, but in general it +works well. + +For each range of ports specified, scanning is normally done downward within +that range. If the -r switch is used, scanning hops randomly around within +that range and reports open ports as it finds them. [If you want them listed +in order regardless, pipe standard error through "sort"...] In addition, if +random mode is in effect, the local source ports are also randomized. This +prevents netcat from exhibiting any kind of regular pattern in its scanning. +You can exert fairly fine control over your scan by judicious use of -r and +selected port ranges to cover. If you use -r for a single connection, the +source port will have a random value above 8192, rather than the next one the +kernel would have assigned you. Note that selecting a specific local port +with -p overrides any local-port randomization. + +Many people are interested in testing network connectivity using IP source +routing, even if it's only to make sure their own firewalls are blocking +source-routed packets. On systems that support it, the -g switch can be used +multiple times [up to 8] to construct a loose-source-routed path for your +connection, and the -G argument positions the "hop pointer" within the list. +If your network allows source-routed traffic in and out, you can test +connectivity to your own services via remote points in the internet. Note that +although newer BSD-flavor telnets also have source-routing capability, it isn't +clearly documented and the command syntax is somewhat clumsy. Netcat's +handling of "-g" is modeled after "traceroute". + +Netcat tries its best to behave just like "cat". It currently does nothing to +terminal input modes, and does no end-of-line conversion. Standard input from +a terminal is read line by line with normal editing characters in effect. You +can freely suspend out of an interactive connection and resume. ^C or whatever +your interrupt character is will make netcat close the network connection and +exit. A switch to place the terminal in raw mode has been considered, but so +far has not been necessary. You can send raw binary data by reading it out of +a file or piping from another program, so more meaningful effort would be spent +writing an appropriate front-end driver. + +Netcat is not an "arbitrary packet generator", but the ability to talk to raw +sockets and/or nit/bpf/dlpi may appear at some point. Such things are clearly +useful; I refer you to Darren Reed's excellent ip_filter package, which now +includes a tool to construct and send raw packets with any contents you want. + +Example uses -- the light side +============================== + +Again, this is a very partial list of possibilities, but it may get you to +think up more applications for netcat. Driving netcat with simple shell or +expect scripts is an easy and flexible way to do fairly complex tasks, +especially if you're not into coding network tools in C. My coding isn't +particularly strong either [although undoubtedly better after writing this +thing!], so I tend to construct bare-metal tools like this that I can trivially +plug into other applications. Netcat doubles as a teaching tool -- one can +learn a great deal about more complex network protocols by trying to simulate +them through raw connections! + +An example of netcat as a backend for something else is the shell-script +Web browser, which simply asks for the relevant parts of a URL and pipes +"GET /what/ever" into a netcat connection to the server. I used to do this +with telnet, and had to use calculated sleep times and other stupidity to +kludge around telnet's limitations. Netcat guarantees that I get the whole +page, and since it transfers all the data unmodified, I can even pull down +binary image files and display them elsewhere later. Some folks may find the +idea of a shell-script web browser silly and strange, but it starts up and +gets me my info a hell of a lot faster than a GUI browser and doesn't hide +any contents of links and forms and such. This is included, as scripts/web, +along with several other web-related examples. + +Netcat is an obvious replacement for telnet as a tool for talking to daemons. +For example, it is easier to type "nc host 25", talk to someone's mailer, and +just ^C out than having to type ^]c or QUIT as telnet would require you to do. +You can quickly catalog the services on your network by telling netcat to +connect to well-known services and collect greetings, or at least scan for open +ports. You'll probably want to collect netcat's diagnostic messages in your +output files, so be sure to include standard error in the output using +`>& file' in *csh or `> file 2>&1' in bourne shell. + +A scanning example: "echo QUIT | nc -v -w 5 target 20-250 500-600 5990-7000" +will inform you about a target's various well-known TCP servers, including +r-services, X, IRC, and maybe a few you didn't expect. Sending in QUIT and +using the timeout will almost guarantee that you see some kind of greeting or +error from each service, which usually indicates what it is and what version. +[Beware of the "chargen" port, though...] SATAN uses exactly this technique to +collect host information, and indeed some of the ideas herein were taken from +the SATAN backend tools. If you script this up to try every host in your +subnet space and just let it run, you will not only see all the services, +you'll find out about hosts that aren't correctly listed in your DNS. Then you +can compare new snapshots against old snapshots to see changes. For going +after particular services, a more intrusive example is in scripts/probe. + +Netcat can be used as a simple data transfer agent, and it doesn't really +matter which end is the listener and which end is the client -- input at one +side arrives at the other side as output. It is helpful to start the listener +at the receiving side with no timeout specified, and then give the sending side +a small timeout. That way the listener stays listening until you contact it, +and after data stops flowing the client will time out, shut down, and take the +listener with it. Unless the intervening network is fraught with problems, +this should be completely reliable, and you can always increase the timeout. A +typical example of something "rsh" is often used for: on one side, + + nc -l -p 1234 | uncompress -c | tar xvfp - + +and then on the other side + + tar cfp - /some/dir | compress -c | nc -w 3 othermachine 1234 + +will transfer the contents of a directory from one machine to another, without +having to worry about .rhosts files, user accounts, or inetd configurations +at either end. Again, it matters not which is the listener or receiver; the +"tarring" machine could just as easily be running the listener instead. One +could conceivably use a scheme like this for backups, by having cron-jobs fire +up listeners and backup handlers [which can be restricted to specific addresses +and ports between each other] and pipe "dump" or "tar" on one machine to "dd +of=/dev/tapedrive" on another as usual. Since netcat returns a nonzero exit +status for a denied listener connection, scripts to handle such tasks could +easily log and reject connect attempts from third parties, and then retry. + +Another simple data-transfer example: shipping things to a PC that doesn't have +any network applications yet except a TCP stack and a web browser. Point the +browser at an arbitrary port on a Unix server by telling it to download +something like http://unixbox:4444/foo, and have a listener on the Unix side +ready to ship out a file when the connect comes in. The browser may pervert +binary data when told to save the URL, but you can dig the raw data out of +the on-disk cache. + +If you build netcat with GAPING_SECURITY_HOLE defined, you can use it as an +"inetd" substitute to test experimental network servers that would otherwise +run under "inetd". A script or program will have its input and output hooked +to the network the same way, perhaps sans some fancier signal handling. Given +that most network services do not bind to a particular local address, whether +they are under "inetd" or not, it is possible for netcat avoid the "address +already in use" error by binding to a specific address. This lets you [as +root, for low ports] place netcat "in the way" of a standard service, since +inbound connections are generally sent to such specifically-bound listeners +first and fall back to the ones bound to "any". This allows for a one-off +experimental simulation of some service, without having to screw around with +inetd.conf. Running with -v turned on and collecting a connection log from +standard error is recommended. + +Netcat as well can make an outbound connection and then run a program or script +on the originating end, with input and output connected to the same network +port. This "inverse inetd" capability could enhance the backup-server concept +described above or help facilitate things such as a "network dialback" concept. +The possibilities are many and varied here; if such things are intended as +security mechanisms, it may be best to modify netcat specifically for the +purpose instead of wrapping such functions in scripts. + +Speaking of inetd, netcat will function perfectly well *under* inetd as a TCP +connection redirector for inbound services, like a "plug-gw" without the +authentication step. This is very useful for doing stuff like redirecting +traffic through your firewall out to other places like web servers and mail +hubs, while posing no risk to the firewall machine itself. Put netcat behind +inetd and tcp_wrappers, perhaps thusly: + + www stream tcp nowait nobody /etc/tcpd /bin/nc -w 3 realwww 80 + +and you have a simple and effective "application relay" with access control +and logging. Note use of the wait time as a "safety" in case realwww isn't +reachable or the calling user aborts the connection -- otherwise the relay may +hang there forever. + +You can use netcat to generate huge amounts of useless network data for +various performance testing. For example, doing + + yes AAAAAAAAAAAAAAAAAAAAAA | nc -v -v -l -p 2222 > /dev/null + +on one side and then hitting it with + + yes BBBBBBBBBBBBBBBBBBBBBB | nc othermachine 2222 > /dev/null + +from another host will saturate your wires with A's and B's. The "very +verbose" switch usage will tell you how many of each were sent and received +after you interrupt either side. Using UDP mode produces tremendously MORE +trash per unit time in the form of fragmented 8 Kbyte mobygrams -- enough to +stress-test kernels and network interfaces. Firing random binary data into +various network servers may help expose bugs in their input handling, which +nowadays is a popular thing to explore. A simple example data-generator is +given in data/data.c included in this package, along with a small collection +of canned input files to generate various packet contents. This program is +documented in its beginning comments, but of interest here is using "%r" to +generate random bytes at well-chosen points in a data stream. If you can +crash your daemon, you likely have a security problem. + +The hex dump feature may be useful for debugging odd network protocols, +especially if you don't have any network monitoring equipment handy or aren't +root where you'd need to run "tcpdump" or something. Bind a listening netcat +to a local port, and have it run a script which in turn runs another netcat +to the real service and captures the hex dump to a log file. This sets up a +transparent relay between your local port and wherever the real service is. +Be sure that the script-run netcat does *not* use -v, or the extra info it +sends to standard error may confuse the protocol. Note also that you cannot +have the "listen/exec" netcat do the data capture, since once the connection +arrives it is no longer netcat that is running. + +Binding to an arbitrary local port allows you to simulate things like r-service +clients, if you are root locally. For example, feeding "^@root^@joe^@pwd^@" +[where ^@ is a null, and root/joe could be any other local/remote username +pair] into a "rsh" or "rlogin" server, FROM your port 1023 for example, +duplicates what the server expects to receive. Thus, you can test for insecure +.rhosts files around your network without having to create new user accounts on +your client machine. The program data/rservice.c can aid this process by +constructing the "rcmd" protocol bytes. Doing this also prevents "rshd" from +trying to create that separate standard-error socket and still gives you an +input path, as opposed to the usual action of "rsh -n". Using netcat for +things like this can be really useful sometimes, because rsh and rlogin +generally want a host *name* as an argument and won't accept IP addresses. If +your client-end DNS is hosed, as may be true when you're trying to extract +backup sets on to a dumb client, "netcat -n" wins where normal rsh/rlogin is +useless. + +If you are unsure that a remote syslogger is working, test it with netcat. +Make a UDP connection to port 514 and type in "<0>message", which should +correspond to "kern.emerg" and cause syslogd to scream into every file it has +open [and possibly all over users' terminals]. You can tame this down by +using a different number and use netcat inside routine scripts to send syslog +messages to places that aren't configured in syslog.conf. For example, +"echo '<38>message' | nc -w 1 -u loggerhost 514" should send to auth.notice +on loggerhost. The exact number may vary; check against your syslog.h first. + +Netcat provides several ways for you to test your own packet filters. If you +bind to a port normally protected against outside access and make a connection +to somewhere outside your own network, the return traffic will be coming to +your chosen port from the "outside" and should be blocked. TCP may get through +if your filter passes all "ack syn", but it shouldn't be even doing that to low +ports on your network. Remember to test with UDP traffic as well! If your +filter passes at least outbound source-routed IP packets, bouncing a connection +back to yourself via some gateway outside your network will create "incoming" +traffic with your source address, which should get dropped by a correctly +configured anti-spoofing filter. This is a "non-test" if you're also dropping +source-routing, but it's good to be able to test for that too. Any packet +filter worth its salt will be blocking source-routed packets in both +directions, but you never know what interesting quirks you might turn up by +playing around with source ports and addresses and watching the wires with a +network monitor. + +You can use netcat to protect your own workstation's X server against outside +access. X is stupid enough to listen for connections on "any" and never tell +you when new connections arrive, which is one reason it is so vulnerable. Once +you have all your various X windows up and running you can use netcat to bind +just to your ethernet address and listen to port 6000. Any new connections +from outside the machine will hit netcat instead your X server, and you get a +log of who's trying. You can either tell netcat to drop the connection, or +perhaps run another copy of itself to relay to your actual X server on +"localhost". This may not work for dedicated X terminals, but it may be +possible to authorize your X terminal only for its boot server, and run a relay +netcat over on the server that will in turn talk to your X terminal. Since +netcat only handles one listening connection per run, make sure that whatever +way you rig it causes another one to run and listen on 6000 soon afterward, or +your real X server will be reachable once again. A very minimal script just +to protect yourself could be + + while true ; do + nc -v -l -s -p 6000 localhost 2 + done + +which causes netcat to accept and then close any inbound connection to your +workstation's normal ethernet address, and another copy is immediately run by +the script. Send standard error to a file for a log of connection attempts. +If your system can't do the "specific bind" thing all is not lost; run your +X server on display ":1" or port 6001, and netcat can still function as a probe +alarm by listening on 6000. + +Does your shell-account provider allow personal Web pages, but not CGI scripts? +You can have netcat listen on a particular port to execute a program or script +of your choosing, and then just point to the port with a URL in your homepage. +The listener could even exist on a completely different machine, avoiding the +potential ire of the homepage-host administrators. Since the script will get +the raw browser query as input it won't look like a typical CGI script, and +since it's running under your UID you need to write it carefully. You may want +to write a netcat-based script as a wrapper that reads a query and sets up +environment variables for a regular CGI script. The possibilities for using +netcat and scripts to handle Web stuff are almost endless. Again, see the +examples under scripts/. + +Example uses -- the dark side +============================= + +Equal time is deserved here, since a versatile tool like this can be useful +to any Shade of Hat. I could use my Victorinox to either fix your car or +disassemble it, right? You can clearly use something like netcat to attack +or defend -- I don't try to govern anyone's social outlook, I just build tools. +Regardless of your intentions, you should still be aware of these threats to +your own systems. + +The first obvious thing is scanning someone *else's* network for vulnerable +services. Files containing preconstructed data, be it exploratory or +exploitive, can be fed in as standard input, including command-line arguments +to netcat itself to keep "ps" ignorant of your doings. The more random the +scanning, the less likelihood of detection by humans, scan-detectors, or +dynamic filtering, and with -i you'll wait longer but avoid loading down the +target's network. Some examples for crafting various standard UDP probes are +given in data/*.d. + +Some configurations of packet filters attempt to solve the FTP-data problem by +just allowing such connections from the outside. These come FROM port 20, TO +high TCP ports inside -- if you locally bind to port 20, you may find yourself +able to bypass filtering in some cases. Maybe not to low ports "inside", but +perhaps to TCP NFS servers, X servers, Prospero, ciscos that listen on 200x +and 400x... Similar bypassing may be possible for UDP [and maybe TCP too] if a +connection comes from port 53; a filter may assume it's a nameserver response. + +Using -e in conjunction with binding to a specific address can enable "server +takeover" by getting in ahead of the real ones, whereupon you can snarf data +sent in and feed your own back out. At the very least you can log a hex dump +of someone else's session. If you are root, you can certainly use -s and -e to +run various hacked daemons without having to touch inetd.conf or the real +daemons themselves. You may not always have the root access to deal with low +ports, but what if you are on a machine that also happens to be an NFS server? +You might be able to collect some interesting things from port 2049, including +local file handles. There are several other servers that run on high ports +that are likely candidates for takeover, including many of the RPC services on +some platforms [yppasswdd, anyone?]. Kerberos tickets, X cookies, and IRC +traffic also come to mind. RADIUS-based terminal servers connect incoming +users to shell-account machines on a high port, usually 1642 or thereabouts. +SOCKS servers run on 1080. Do "netstat -a" and get creative. + +There are some daemons that are well-written enough to bind separately to all +the local interfaces, possibly with an eye toward heading off this sort of +problem. Named from recent BIND releases, and NTP, are two that come to mind. +Netstat will show these listening on address.53 instead of *.53. You won't +be able to get in front of these on any of the real interface addresses, which +of course is especially interesting in the case of named, but these servers +sometimes forget about things like "alias" interface addresses or interfaces +that appear later on such as dynamic PPP links. There are some hacked web +servers and versions of "inetd" floating around that specifically bind as well, +based on a configuration file -- these generally *are* bound to alias addresses +to offer several different address-based services from one machine. + +Using -e to start a remote backdoor shell is another obvious sort of thing, +easier than constructing a file for inetd to listen on "ingreslock" or +something, and you can access-control it against other people by specifying a +client host and port. Experience with this truly demonstrates how fragile the +barrier between being "logged in" or not really is, and is further expressed by +scripts/bsh. If you're already behind a firewall, it may be easier to make an +*outbound* connection and then run a shell; a small wrapper script can +periodically try connecting to a known place and port, you can later listen +there until the inbound connection arrives, and there's your shell. Running +a shell via UDP has several interesting features, although be aware that once +"connected", the UDP stub sockets tend to show up in "netstat" just like TCP +connections and may not be quite as subtle as you wanted. Packets may also be +lost, so use TCP if you need reliable connections. But since UDP is +connectionless, a hookup of this sort will stick around almost forever, even if +you ^C out of netcat or do a reboot on your side, and you only need to remember +the ports you used on both ends to reestablish. And outbound UDP-plus-exec +connection creates the connected socket and starts the program immediately. On +a listening UDP connection, the socket is created once a first packet is +received. In either case, though, such a "connection" has the interesting side +effect that only your client-side IP address and [chosen?] source port will +thereafter be able to talk to it. Instant access control! A non-local third +party would have to do ALL of the following to take over such a session: + + forge UDP with your source address [trivial to do; see below] + guess the port numbers of BOTH ends, or sniff the wire for them + arrange to block ICMP or UDP return traffic between it and your real + source, so the session doesn't die with a network write error. + +The companion program data/rservice.c is helpful in scripting up any sort of +r-service username or password guessing attack. The arguments to "rservice" +are simply the strings that get null-terminated and passed over an "rcmd"-style +connection, with the assumption that the client does not need a separate +standard-error port. Brute-force password banging is best done via "rexec" if +it is available since it is less likely to log failed attempts. Thus, doing +"rservice joe joespass pwd | nc target exec" should return joe's home dir if +the password is right, or "Permission denied." Plug in a dictionary and go to +town. If you're attacking rsh/rlogin, remember to be root and bind to a port +between 512 and 1023 on your end, and pipe in "rservice joe joe pwd" and such. + +Netcat can prevent inadvertently sending extra information over a telnet +connection. Use "nc -t" in place of telnet, and daemons that try to ask for +things like USER and TERM environment variables will get no useful answers, as +they otherwise would from a more recent telnet program. Some telnetds actually +try to collect this stuff and then plug the USER variable into "login" so that +the caller is then just asked for a password! This mechanism could cause a +login attempt as YOUR real username to be logged over there if you use a +Borman-based telnet instead of "nc -t". + +Got an unused network interface configured in your kernel [e.g. SLIP], or +support for alias addresses? Ifconfig one to be any address you like, and bind +to it with -s to enable all sorts of shenanigans with bogus source addresses. +The interface probably has to be UP before this works; some SLIP versions +need a far-end address before this is true. Hammering on UDP services is then +a no-brainer. What you can do to an unfiltered syslog daemon should be fairly +obvious; trimming the conf file can help protect against it. Many routers out +there still blindly believe what they receive via RIP and other routing +protocols. Although most UDP echo and chargen servers check if an incoming +packet was sent from *another* "internal" UDP server, there are many that still +do not, any two of which [or many, for that matter] could keep each other +entertained for hours at the expense of bandwidth. And you can always make +someone wonder why she's being probed by nsa.gov. + +Your TCP spoofing possibilities are mostly limited to destinations you can +source-route to while locally bound to your phony address. Many sites block +source-routed packets these days for precisely this reason. If your kernel +does oddball things when sending source-routed packets, try moving the pointer +around with -G. You may also have to fiddle with the routing on your own +machine before you start receiving packets back. Warning: some machines still +send out traffic using the source address of the outbound interface, regardless +of your binding, especially in the case of localhost. Check first. If you can +open a connection but then get no data back from it, the target host is +probably killing the IP options on its end [this is an option inside TCP +wrappers and several other packages], which happens after the 3-way handshake +is completed. If you send some data and observe the "send-q" side of "netstat" +for that connection increasing but never getting sent, that's another symptom. +Beware: if Sendmail 8.7.x detects a source-routed SMTP connection, it extracts +the hop list and sticks it in the Received: header! + +SYN bombing [sometimes called "hosing"] can disable many TCP servers, and if +you hit one often enough, you can keep it unreachable for days. As is true of +many other denial-of-service attacks, there is currently no defense against it +except maybe at the human level. Making kernel SOMAXCONN considerably larger +than the default and the half-open timeout smaller can help, and indeed some +people running large high-performance web servers have *had* to do that just to +handle normal traffic. Taking out mailers and web servers is sociopathic, but +on the other hand it is sometimes useful to be able to, say, disable a site's +identd daemon for a few minutes. If someone realizes what is going on, +backtracing will still be difficult since the packets have a phony source +address, but calls to enough ISP NOCs might eventually pinpoint the source. +It is also trivial for a clueful ISP to watch for or even block outgoing +packets with obviously fake source addresses, but as we know many of them are +not clueful or willing to get involved in such hassles. Besides, outbound +packets with an [otherwise unreachable] source address in one of their net +blocks would look fairly legitimate. + +Notes +===== + +A discussion of various caveats, subtleties, and the design of the innards. + +As of version 1.07 you can construct a single file containing command arguments +and then some data to transfer. Netcat is now smart enough to pick out the +first line and build the argument list, and send any remaining data across the +net to one or multiple ports. The first release of netcat had trouble with +this -- it called fgets() for the command line argument, which behind the +scenes does a large read() from standard input, perhaps 4096 bytes or so, and +feeds that out to the fgets() library routine. By the time netcat 1.00 started +directly read()ing stdin for more data, 4096 bytes of it were gone. It now +uses raw read() everywhere and does the right thing whether reading from files, +pipes, or ttys. If you use this for multiple-port connections, the single +block of data will now be a maximum of 8K minus the first line. Improvements +have been made to the logic in sending the saved chunk to each new port. Note +that any command-line arguments hidden using this mechanism could still be +extracted from a core dump. + +When netcat receives an inbound UDP connection, it creates a "connected socket" +back to the source of the connection so that it can also send out data using +normal write(). Using this mechanism instead of recvfrom/sendto has several +advantages -- the read/write select loop is simplified, and ICMP errors can in +effect be received by non-root users. However, it has the subtle side effect +that if further UDP packets arrive from the caller but from different source +ports, the listener will not receive them. UDP listen mode on a multihomed +machine may have similar quirks unless you specifically bind to one of its +addresses. It is not clear that kernel support for UDP connected sockets +and/or my understanding of it is entirely complete here, so experiment... + +You should be aware of some subtleties concerning UDP scanning. If -z is on, +netcat attempts to send a single null byte to the target port, twice, with a +small time in between. You can either use the -w timeout, or netcat will try +to make a "sideline" TCP connection to the target to introduce a small time +delay equal to the round-trip time between you and the target. Note that if +you have a -w timeout and -i timeout set, BOTH take effect and you wait twice +as long. The TCP connection is to a normally refused port to minimize traffic, +but if you notice a UDP fast-scan taking somewhat longer than it should, it +could be that the target is actually listening on the TCP port. Either way, +any ICMP port-unreachable messages from the target should have arrived in the +meantime. The second single-byte UDP probe is then sent. Under BSD kernels, +the ICMP error is delivered to the "connected socket" and the second write +returns an error, which tells netcat that there is NOT a UDP service there. +While Linux seems to be a fortunate exception, under many SYSV derived kernels +the ICMP is not delivered, and netcat starts reporting that *all* the ports are +"open" -- clearly wrong. [Some systems may not even *have* the "udp connected +socket" concept, and netcat in its current form will not work for UDP at all.] +If -z is specified and only one UDP port is probed, netcat's exit status +reflects whether the connection was "open" or "refused" as with TCP. + +It may also be that UDP packets are being blocked by filters with no ICMP error +returns, in which case everything will time out and return "open". This all +sounds backwards, but that's how UDP works. If you're not sure, try "echo +w00gumz | nc -u -w 2 target 7" to see if you can reach its UDP echo port at +all. You should have no trouble using a BSD-flavor system to scan for UDP +around your own network, although flooding a target with the high activity that +-z generates will cause it to occasionally drop packets and indicate false +"opens". A more "correct" way to do this is collect and analyze the ICMP +errors, as does SATAN's "udp_scan" backend, but then again there's no guarantee +that the ICMP gets back to you either. Udp_scan also does the zero-byte +probes but is excruciatingly careful to calculate its own round-trip timing +average and dynamically set its own response timeouts along with decoding any +ICMP received. Netcat uses a much sleazier method which is nonetheless quite +effective. Cisco routers are known to have a "dead time" in between ICMP +responses about unreachable UDP ports, so a fast scan of a cisco will show +almost everything "open". If you are looking for a specific UDP service, you +can construct a file containing the right bytes to trigger a response from the +other end and send that as standard input. Netcat will read up to 8K of the +file and send the same data to every UDP port given. Note that you must use a +timeout in this case [as would any other UDP client application] since the +two-write probe only happens if -z is specified. + +Many telnet servers insist on a specific set of option negotiations before +presenting a login banner. On a raw connection you will see this as small +amount of binary gook. My attempts to create fixed input bytes to make a +telnetd happy worked some places but failed against newer BSD-flavor ones, +possibly due to timing problems, but there are a couple of much better +workarounds. First, compile with -DTELNET and use -t if you just want to get +past the option negotiation and talk to something on a telnet port. You will +still see the binary gook -- in fact you'll see a lot more of it as the options +are responded to behind the scenes. The telnet responder does NOT update the +total byte count, or show up in the hex dump -- it just responds negatively to +any options read from the incoming data stream. If you want to use a normal +full-blown telnet to get to something but also want some of netcat's features +involved like settable ports or timeouts, construct a tiny "foo" script: + + #! /bin/sh + exec nc -otheroptions targethost 23 + +and then do + + nc -l -p someport -e foo localhost & + telnet localhost someport + +and your telnet should connect transparently through the exec'ed netcat to +the target, using whatever options you supplied in the "foo" script. Don't +use -t inside the script, or you'll wind up sending *two* option responses. + +I've observed inconsistent behavior under some Linuxes [perhaps just older +ones?] when binding in listen mode. Sometimes netcat binds only to "localhost" +if invoked with no address or port arguments, and sometimes it is unable to +bind to a specific address for listening if something else is already listening +on "any". The former problem can be worked around by specifying "-s 0.0.0.0", +which will do the right thing despite netcat claiming that it's listening on +[127.0.0.1]. This is a known problem -- for example, there's a mention of it +in the makefile for SOCKS. On the flip side, binding to localhost and sending +packets to some other machine doesn't work as you'd expect -- they go out with +the source address of the sending interface instead. The Linux kernel contains +a specific check to ensure that packets from 127.0.0.1 are never sent to the +wire; other kernels may contain similar code. Linux, of course, *still* +doesn't support source-routing, but they claim that it and many other network +improvements are at least breathing hard. + +There are several possible errors associated with making TCP connections, but +to specifically see anything other than "refused", one must wait the full +kernel-defined timeout for a connection to fail. Netcat's mechanism of +wrapping an alarm timer around the connect prevents the *real* network error +from being returned -- "errno" at that point indicates "interrupted system +call" since the connect attempt was interrupted. Some old 4.3 BSD kernels +would actually return things like "host unreachable" immediately if that was +the case, but most newer kernels seem to wait the full timeout and *then* pass +back the real error. Go figure. In this case, I'd argue that the old way was +better, despite those same kernels generally being the ones that tear down +*established* TCP connections when ICMP-bombed. + +Incoming socket options are passed to applications by the kernel in the +kernel's own internal format. The socket-options structure for source-routing +contains the "first-hop" IP address first, followed by the rest of the real +options list. The kernel uses this as is when sending reply packets -- the +structure is therefore designed to be more useful to the kernel than to humans, +but the hex dump of it that netcat produces is still useful to have. + +Kernels treat source-routing options somewhat oddly, but it sort of makes sense +once one understands what's going on internally. The options list of addresses +must contain hop1, hop2, ..., destination. When a source-routed packet is sent +by the kernel [at least BSD], the actual destination address becomes irrelevant +because it is replaced with "hop1", "hop1" is removed from the options list, +and all the other addresses in the list are shifted up to fill the hole. Thus +the outbound packet is sent from your chosen source address to the first +*gateway*, and the options list now contains hop2, ..., destination. During +all this address shuffling, the kernel does NOT change the pointer value, which +is why it is useful to be able to set the pointer yourself -- you can construct +some really bizarre return paths, and send your traffic fairly directly to the +target but around some larger loop on the way back. Some Sun kernels seem to +never flip the source-route around if it contains less than three hops, never +reset the pointer anyway, and tries to send the packet [with options containing +a "completed" source route!!] directly back to the source. This is way broken, +of course. [Maybe ipforwarding has to be on? I haven't had an opportunity to +beat on it thoroughly yet.] + +"Credits" section: The original idea for netcat fell out of a long-standing +desire and fruitless search for a tool resembling it and having the same +features. After reading some other network code and realizing just how many +cool things about sockets could be controlled by the calling user, I started +on the basics and the rest fell together pretty quickly. Some port-scanning +ideas were taken from Venema/Farmer's SATAN tool kit, and Pluvius' "pscan" +utility. Healthy amounts of BSD kernel source were perused in an attempt to +dope out socket options and source-route handling; additional help was obtained +from Dave Borman's telnet sources. The select loop is loosely based on fairly +well-known code from "rsh" and Richard Stevens' "sock" program [which itself is +sort of a "netcat" with more obscure features], with some more paranoid +sanity-checking thrown in to guard against the distinct likelihood that there +are subtleties about such things I still don't understand. I found the +argument-hiding method cleanly implemented in Barrett's "deslogin"; reading the +line as input allows greater versatility and is much less prone to cause +bizarre problems than the more common trick of overwriting the argv array. +After the first release, several people contributed portability fixes; they are +credited in generic.h and the Makefile. Lauren Burka inspired the ascii art +for this revised document. Dean Gaudet at Wired supplied a precursor to +the hex-dump code, and mudge@l0pht.com originally experimented with and +supplied code for the telnet-options responder. Outbound "-e " resulted +from a need to quietly bypass a firewall installation. Other suggestions and +patches have rolled in for which I am always grateful, but there are only 26 +hours per day and a discussion of feature creep near the end of this document. + +Netcat was written with the Russian railroad in mind -- conservatively built +and solid, but it *will* get you there. While the coding style is fairly +"tight", I have attempted to present it cleanly [keeping *my* lines under 80 +characters, dammit] and put in plenty of comments as to why certain things +are done. Items I know to be questionable are clearly marked with "XXX". +Source code was made to be modified, but determining where to start is +difficult with some of the tangles of spaghetti code that are out there. +Here are some of the major points I feel are worth mentioning about netcat's +internal design, whether or not you agree with my approach. + +Except for generic.h, which changes to adapt more platforms, netcat is a single +source file. This has the distinct advantage of only having to include headers +once and not having to re-declare all my functions in a billion different +places. I have attempted to contain all the gross who's-got-what-.h-file +things in one small dumping ground. Functions are placed "dependencies-first", +such that when the compiler runs into the calls later, it already knows the +type and arguments and won't complain. No function prototyping -- not even the +__P(()) crock -- is used, since it is more portable and a file of this size is +easy enough to check manually. Each function has a standard-format comment +ahead of it, which is easily found using the regexp " :$". I freely use gotos. +Loops and if-clauses are made as small and non-nested as possible, and the ends +of same *marked* for clarity [I wish everyone would do this!!]. + +Large structures and buffers are all malloc()ed up on the fly, slightly larger +than the size asked for and zeroed out. This reduces the chances of damage +from those "end of the buffer" fencepost errors or runaway pointers escaping +off the end. These things are permanent per run, so nothing needs to be freed +until the program exits. + +File descriptor zero is always expected to be standard input, even if it is +closed. If a new network descriptor winds up being zero, a different one is +asked for which will be nonzero, and fd zero is simply left kicking around +for the rest of the run. Why? Because everything else assumes that stdin is +always zero and "netfd" is always positive. This may seem silly, but it was a +lot easier to code. The new fd is obtained directly as a new socket, because +trying to simply dup() a new fd broke subsequent socket-style use of the new fd +under Solaris' stupid streams handling in the socket library. + +The catch-all message and error handlers are implemented with an ample list of +phoney arguments to get around various problems with varargs. Varargs seems +like deliberate obfuscation in the first place, and using it would also +require use of vfprintf() which not all platforms support. The trailing +sleep in bail() is to allow output to flush, which is sometimes needed if +netcat is already on the other end of a network connection. + +The reader may notice that the section that does DNS lookups seems much +gnarlier and more confusing than other parts. This is NOT MY FAULT. The +sockaddr and hostent abstractions are an abortion that forces the coder to +deal with it. Then again, a lot of BSD kernel code looks like similar +struct-pointer hell. I try to straighten it out somewhat by defining my own +HINF structure, containing names, ascii-format IP addresses, and binary IP +addresses. I fill this structure exactly once per host argument, and squirrel +everything safely away and handy for whatever wants to reference it later. + +Where many other network apps use the FIONBIO ioctl to set non-blocking I/O +on network sockets, netcat uses straightforward blocking I/O everywhere. +This makes everything very lock-step, relying on the network and filesystem +layers to feed in data when needed. Data read in is completely written out +before any more is fetched. This may not be quite the right thing to do under +some OSes that don't do timed select() right, but this remains to be seen. + +The hexdump routine is written to be as fast as possible, which is why it does +so much work itself instead of just sprintf()ing everything together. Each +dump line is built into a single buffer and atomically written out using the +lowest level I/O calls. Further improvements could undoubtedly be made by +using writev() and eliminating all sprintf()s, but it seems to fly right along +as is. If both exec-a-prog mode and a hexdump file is asked for, the hexdump +flag is deliberately turned off to avoid creating random zero-length files. +Files are opened in "truncate" mode; if you want "append" mode instead, change +the open flags in main(). + +main() may look a bit hairy, but that's only because it has to go down the +argv list and handle multiple ports, random mode, and exit status. Efforts +have been made to place a minimum of code inside the getopt() loop. Any real +work is sent off to functions in what is hopefully a straightforward way. + +Obligatory vendor-bash: If "nc" had become a standard utility years ago, +the commercial vendors would have likely packaged it setuid root and with +-DGAPING_SECURITY_HOLE turned on but not documented. It is hoped that netcat +will aid people in finding and fixing the no-brainer holes of this sort that +keep appearing, by allowing easier experimentation with the "bare metal" of +the network layer. + +It could be argued that netcat already has too many features. I have tried +to avoid "feature creep" by limiting netcat's base functionality only to those +things which are truly relevant to making network connections and the everyday +associated DNS lossage we're used to. Option switches already have slightly +overloaded functionality. Random port mode is sort of pushing it. The +hex-dump feature went in later because it *is* genuinely useful. The +telnet-responder code *almost* verges on the gratuitous, especially since it +mucks with the data stream, and is left as an optional piece. Many people have +asked for example "how 'bout adding encryption?" and my response is that such +things should be separate entities that could pipe their data *through* netcat +instead of having their own networking code. I am therefore not completely +enthusiastic about adding any more features to this thing, although you are +still free to send along any mods you think are useful. + +Nonetheless, at this point I think of netcat as my tcp/ip swiss army knife, +and the numerous companion programs and scripts to go with it as duct tape. +Duct tape of course has a light side and a dark side and binds the universe +together, and if I wrap enough of it around what I'm trying to accomplish, +it *will* work. Alternatively, if netcat is a large hammer, there are many +network protocols that are increasingly looking like nails by now... + +_H* 960320 v1.10 RELEASE -- happy spring! diff --git a/usr.bin/nc/data/Makefile b/usr.bin/nc/data/Makefile new file mode 100644 index 00000000000..65cf185358f --- /dev/null +++ b/usr.bin/nc/data/Makefile @@ -0,0 +1,10 @@ +all: data rservice xor + +data: data.c + cc -s -O -o data data.c +rservice: rservice.c + cc -s -O -o rservice rservice.c +xor: xor.c + cc -s -O -o xor xor.c +clean: + rm -f *.o data rservice xor diff --git a/usr.bin/nc/data/README b/usr.bin/nc/data/README new file mode 100644 index 00000000000..7e4b9fbf63c --- /dev/null +++ b/usr.bin/nc/data/README @@ -0,0 +1,9 @@ +For now, read the header comments inside each of these for documentation. +The programs are simple enough that they don't really need a Makefile any more +complex than the one given; ymmv. Data and xor may also be useful on DOS, +which is why there are hooks for it in the code. + +data.c a primitive atob / btoa byte generator +*.d example input to "data -g" +rservice.c a utility for scripting up rsh/rexec attacks +xor.c generic xor handler diff --git a/usr.bin/nc/data/data.c b/usr.bin/nc/data/data.c new file mode 100644 index 00000000000..56c167fd969 --- /dev/null +++ b/usr.bin/nc/data/data.c @@ -0,0 +1,274 @@ +/* primitive arbitrary-data frontend for netcat. 0.9 960226 + only handles one value per ascii line, but at least parses 0xNN too + an input line containing "%r" during "-g" generates a random byte + + todo: + make work on msloss jus' for kicks [workin' on it...] + + syntax: data -X [limit] + where X is one of + d: dump raw bytes to ascii format + g: generate raw bytes from ascii input + c: generate ??? of value -- NOTYET + r: generate all random bytes + and limit is how many bytes to generate or dump [unspecified = infinite] + + *Hobbit*, started 951004 or so and randomly screwed around with since */ + +#include + +#ifdef MSDOS /* for MSC only at the moment... */ +#include +#else /* MSDOS */ +#include +#define HAVE_RANDOM /* XXX: might have to change */ +#endif /* MSDOS */ + +static char buf_in [128]; +static char buf_raw [8192]; +static char surveysez[] = "survey sez... XXX\n"; + +/* fgetss : + wrapper for fgets, that yanks trailing newlines. Doing the work ourselves + instead of calling strchr/strlen/whatever */ +char * fgetss (buf, len, from) + char * buf; + size_t len; + FILE * from; +{ + register int x; + register char * p, * q; + p = fgets (buf, len, from); /* returns ptr to buf */ + if (! p) + return (NULL); + q = p; + for (x = 0; x < len; x++) { + *p = (*p & 0x7f); /* rip parity, just in case */ + switch (*p) { + case '\n': + case '\r': + case '\0': + *p = '\0'; + return (q); + } /* switch */ + p++; + } /* for */ +} /* fgetss */ + +/* randint: + swiped from rndb.c. Generates an INT, you have to mask down to char. */ +int randint() +{ + register int q; + register int x; + +#ifndef HAVE_RANDOM + q = rand(); +#else + q = random(); +#endif + x = ((q >> 8) & 0xff); /* perturb low byte using some higher bits */ + x = q ^ x; + return (x); +} + +main (argc, argv) + int argc; + char ** argv; +{ + register unsigned char * p; + register char * q; + register int x; + int bc = 0; + int limit = 0; /* num to gen, or 0 = infinite */ + register int xlimit; /* running limit */ + FILE * txt; /* line-by-line ascii file */ + int raw; /* raw bytes fd */ + int dumping = 0; /* cmd flags ... */ + int genning = 0; + int randing = 0; + + memset (buf_in, 0, sizeof (buf_in)); + memset (buf_raw, 0, sizeof (buf_raw)); + + xlimit = 1; /* doubles as "exit flag" */ + bc = 1; /* preload, assuming "dump" */ + x = getpid() + 687319; +/* if your library doesnt have srandom/random, use srand/rand. [from rnd.c] */ +#ifndef HAVE_RANDOM + srand (time(0) + x); +#else + srandom (time(0) + x); +#endif + +#ifdef O_BINARY +/* DOS stupidity */ +/* Aha: *here's* where that setmode() lib call conflict in ?BSD came from */ + x = setmode (0, O_BINARY); /* make stdin raw */ + if (x < 0) { + fprintf (stderr, "stdin binary setmode oops: %d\n", x); + exit (1); + } + x = setmode (1, O_BINARY); /* make stdout raw */ + if (x < 0) { + fprintf (stderr, "stdout binary setmode oops: %d\n", x); + exit (1); + } +#endif /* O_BINARY */ + + if (argv[1]) { + p = argv[1]; /* shit-simple single arg parser... */ + if (*p == '-') /* dash is optional, we'll deal */ + p++; + if (*p == 'd') + dumping++; + if (*p == 'g') + genning++; + if (*p == 'r') + randing++; + } /* if argv 1 */ + +/* optional second argument: limit # of bytes shoveled either way */ + if (argv[2]) { + x = atoi (argv[2]); + if (x) + limit = x; + else + goto wrong; + xlimit = limit; + } + +/* Since this prog would likely best be written in assmbler, I'm gonna + write it *like* assembler. So there. */ + + if (randing) + goto do_rand; + +nextbuf: /* loop sleaze */ + + if (dumping) { /* switch off to wherever */ + if (genning) + goto wrong; + goto do_dump; + } + if (genning) + goto do_gen; +wrong: + fprintf (stderr, surveysez); /* if both or neither */ + exit (1); + +do_gen: +/* here if genning -- original functionality */ + q = buf_raw; + bc = 0; +/* suck up lines until eof or buf_raw is full */ + while (1) { + p = fgetss (buf_in, 120, stdin); + if (! p) + break; /* EOF */ +/* super-primitive version first: one thingie per line */ + if (*p == '#') /* comment */ + continue; + if (*p == '\0') /* blank line */ + continue; + if (*p == '%') { /* escape char? */ + p++; + if (*p == 'r') { /* random byte */ + x = randint(); + goto stuff; + } /* %r */ + } /* if "%" escape */ + if (*p == '0') + if (*(p+1) == 'x') /* 0x?? */ + goto hex; + x = atoi (p); /* reg'lar decimal number */ + goto stuff; + +hex: +/* A 65 a 97 */ +/* xxx: use a conversion table for this or something. Since we ripped the + parity bit, we only need a preset array of 128 with downconversion factors + loaded in *once*. maybe look at scanf... */ + p++; p++; /* point at hex-chars */ + x = 0; + if ((*p > 96) && (*p < 123)) /* a-z */ + *p = (*p - 32); /* this is massively clumsy */ + if ((*p > 64) && (*p < 71)) /* A-F */ + x = (*p - 55); + if ((*p > 47) && (*p < 58)) /* digits */ + x = (*p - 48); + p++; + if (*p) /* another digit? */ + x = (x << 4); /* shift to hi half */ + if ((*p > 96) && (*p < 123)) /* a-z */ + *p = (*p - 32); + if ((*p > 64) && (*p < 71)) /* A-F */ + x = (x | (*p - 55)); /* lo half */ + if ((*p > 47) && (*p < 58)) /* digits */ + x = (x | (*p - 48)); + +/* fall thru */ +stuff: /* cvt to byte and add to buffer */ + *q = (x & 0xff); + q++; + bc++; + if (limit) { + xlimit--; + if (xlimit == 0) /* max num reached */ + break; + } /* limit */ + if (bc >= sizeof (buf_raw)) /* buffer full */ + break; + } /* while 1 */ + +/* now in theory we have our buffer formed; shovel it out */ + x = write (1, buf_raw, bc); + if (x <= 0) { + fprintf (stderr, "write oops: %d\n", x); + exit (1); + } + if (xlimit && p) + goto nextbuf; /* go get some more */ + exit (0); + +do_dump: +/* here if dumping raw stuff into an ascii file */ +/* gad, this is *so* much simpler! can we say "don't rewrite printf"? */ + x = read (0, buf_raw, 8192); + if (x <= 0) + exit (0); + q = buf_raw; + for ( ; x > 0; x--) { + p = q; + printf ("%-3.3d # 0x%-2.2x # ", *p, *p); + if ((*p > 31) && (*p < 127)) + printf ("%c %d\n", *p, bc); + else + printf (". %d\n", bc); + q++; + bc++; + if (limit) { + xlimit--; + if (xlimit == 0) { + fflush (stdout); + exit (0); + } + } /* limit */ + } /* for */ + goto nextbuf; + +do_rand: +/* here if generating all-random bytes. Stays in this loop */ + p = buf_raw; + while (1) { + *p = (randint() & 0xff); + write (1, p, 1); /* makes very slow! */ + if (limit) { + xlimit--; + if (xlimit == 0) + break; + } + } /* while */ + exit (0); + +} /* main */ diff --git a/usr.bin/nc/data/dns-any.d b/usr.bin/nc/data/dns-any.d new file mode 100644 index 00000000000..77b014cf703 --- /dev/null +++ b/usr.bin/nc/data/dns-any.d @@ -0,0 +1,36 @@ +# dns "any for ." query, to udp 53 +# if tcp: precede with 2 bytes of len: +# 0 +# 17 +# you should get at least *one* record back out + +# HEADER: +0 # query id = 2 +2 + +1 # flags/opcodes = query, dorecurse +0 + +0 # qdcount, i.e. nqueries: 1 +1 + +0 # ancount: answers, 0 +0 + +0 # nscount: 0 +0 + +0 # addl records: 0 +0 + +# end of fixed header + +0 # name-len: 0 for ".", lenbyte plus name-bytes otherwise + +0 # type: any, 255 +0xff + +0 # class: IN +1 + +# i think that's it.. diff --git a/usr.bin/nc/data/nfs-0.d b/usr.bin/nc/data/nfs-0.d new file mode 100644 index 00000000000..03609382270 --- /dev/null +++ b/usr.bin/nc/data/nfs-0.d @@ -0,0 +1,59 @@ +# UDP NFS null-proc call; finds active NFS listeners on port 2049. +# If you get *something* back, there's an NFS server there. + +000 # XID: 4 trash bytes +001 +002 +003 + +000 # CALL: 0 +000 +000 +000 + +000 # RPC version: 2 +000 +000 +002 + +000 # nfs: 100003 +001 +0x86 +0xa3 + +000 # version: 1 +000 +000 +001 + +000 # procedure number: 0 +000 +000 +000 + +000 # port: junk +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # extra auth trash? probably not needed +000 +000 +000 + +# that's it! diff --git a/usr.bin/nc/data/pm.d b/usr.bin/nc/data/pm.d new file mode 100644 index 00000000000..fe327693a9e --- /dev/null +++ b/usr.bin/nc/data/pm.d @@ -0,0 +1,8 @@ +# obligatory duplicate of dr delete's Livingston portmaster crash, aka +# telnet break. Fire into its telnet listener. An *old* bug by now, but +# consider the small window one might obtain from a slightly out-of-rev PM +# used as a firewall, that starts routing IP traffic BEFORE its filter sets +# are fully loaded... + +255 # 0xff # . 1 +243 # 0xf3 # . 2 diff --git a/usr.bin/nc/data/pmap-dump.d b/usr.bin/nc/data/pmap-dump.d new file mode 100644 index 00000000000..bc6b63277df --- /dev/null +++ b/usr.bin/nc/data/pmap-dump.d @@ -0,0 +1,60 @@ +# portmap dump request: like "rpcinfo -p" but via UDP instead +# send to UDP 111 and hope it's not a logging portmapper! +# split into longwords, since rpc apparently only deals with them + +001 # 0x01 # . # XID: 4 trash bytes +002 # 0x02 # . +003 # 0x03 # . +004 # 0x04 # . + +000 # 0x00 # . # MSG: int 0=call, 1=reply +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # pmap call body: rpc version=2 +000 # 0x00 # . +000 # 0x00 # . +002 # 0x02 # . + +000 # 0x00 # . # pmap call body: prog=PMAP, 100000 +001 # 0x01 # . +134 # 0x86 # . +160 # 0xa0 # . + +000 # 0x00 # . # pmap call body: progversion=2 +000 # 0x00 # . +000 # 0x00 # . +002 # 0x02 # . + +000 # 0x00 # . # pmap call body: proc=DUMP, 4 +000 # 0x00 # . +000 # 0x00 # . +004 # 0x04 # . + +# with AUTH_NONE, there are 4 zero integers [16 bytes] here + +000 # 0x00 # . # auth junk: cb_cred: auth_unix = 1; NONE = 0 +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +# The reply you get back contains your XID, int 1 if "accepted", and +# a whole mess of gobbledygook containing program numbers, versions, +# and ports that rpcinfo knows how to decode. For the moment, you get +# to wade through it yourself... diff --git a/usr.bin/nc/data/pmap-mnt.d b/usr.bin/nc/data/pmap-mnt.d new file mode 100644 index 00000000000..00588ba41f7 --- /dev/null +++ b/usr.bin/nc/data/pmap-mnt.d @@ -0,0 +1,78 @@ +# portmap request for mountd [or whatever; see where prog=MOUNT] +# send to UDP 111 and hope it's not a logging portmapper! +# split into longwords, since rpc apparently only deals with them + +001 # 0x01 # . # XID: 4 trash bytes +002 # 0x02 # . +003 # 0x03 # . +004 # 0x04 # . + +000 # 0x00 # . # MSG: int 0=call, 1=reply +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # pmap call body: rpc version=2 +000 # 0x00 # . +000 # 0x00 # . +002 # 0x02 # . + +000 # 0x00 # . # pmap call body: prog=PMAP, 100000 +001 # 0x01 # . +134 # 0x86 # . +160 # 0xa0 # . + +000 # 0x00 # . # pmap call body: progversion=2 +000 # 0x00 # . +000 # 0x00 # . +002 # 0x02 # . + +000 # 0x00 # . # pmap call body: proc=GETPORT, 3 +000 # 0x00 # . +000 # 0x00 # . +003 # 0x03 # . + +# with AUTH_NONE, there are 4 zero integers [16 bytes] here + +000 # 0x00 # . # auth junk: cb_cred: auth_unix = 1; NONE = 0 +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # auth junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +000 # 0x00 # . # prog=MOUNT, 100005 +001 # 0x01 # . +134 # 0x86 # . +165 # 0xa5 # . + +000 # 0x00 # . # progversion=1 +000 # 0x00 # . +000 # 0x00 # . +001 # 0x01 # . + +000 # 0x00 # . # protocol=udp, 17 +000 # 0x00 # . +000 # 0x00 # . +017 # 0x11 # . + +000 # 0x00 # . # proc num = junk +000 # 0x00 # . +000 # 0x00 # . +000 # 0x00 # . + +# The reply you get back contains your XID, int 1 if "accepted", and +# mountd's port number at the end or 0 if not registered. diff --git a/usr.bin/nc/data/rip.d b/usr.bin/nc/data/rip.d new file mode 100644 index 00000000000..da505e21430 --- /dev/null +++ b/usr.bin/nc/data/rip.d @@ -0,0 +1,52 @@ +# struct netinfo { +# struct sockaddr rip_dst; /* destination net/host */ +# int rip_metric; /* cost of route */ +# }; +# struct rip { +# u_char rip_cmd; /* request/response */ +# u_char rip_vers; /* protocol version # */ +# u_char rip_res1[2]; /* pad to 32-bit boundary */ +# union { +# struct netinfo ru_nets[1]; /* variable length... */ +# char ru_tracefile[1]; /* ditto ... */ +# } ripun; +#define rip_nets ripun.ru_nets +#define rip_tracefile ripun.ru_tracefile +#define RIPCMD_REQUEST 1 /* want info */ +#define RIPCMD_RESPONSE 2 /* responding to request */ +#define RIPCMD_TRACEON 3 /* turn tracing on */ +#define RIPCMD_TRACEOFF 4 /* turn it off */ +#define HOPCNT_INFINITY 16 /* per Xerox NS */ +#define MAXPACKETSIZE 512 /* max broadcast size */ + +### RIP packet redux +### UDP send FROM clued-rtr/520 to target/520 +2 # RIPCMD_RESPONSE +1 # version +0 # padding +0 + +# sockaddr-plus-metric structs begin, as many as necessary... +0 # len +2 # AF_INET +0 # port +0 +# addr bytes: +X +Y +Z +Q +0 # filler, out to 16 bytes [sizeof (sockaddr)] ... +0 +0 +0 +0 +0 +0 +0 +0 # metric: net-order integer +0 +0 +1 + +## that's it diff --git a/usr.bin/nc/data/rservice.c b/usr.bin/nc/data/rservice.c new file mode 100644 index 00000000000..1085d9cb789 --- /dev/null +++ b/usr.bin/nc/data/rservice.c @@ -0,0 +1,68 @@ +/* generate ^@string1^@string2^@cmd^@ input to netcat, for scripting up + rsh/rexec attacks. Needs to be a prog because shells strip out nulls. + + args: + locuser remuser [cmd] + remuser passwd [cmd] + + cmd defaults to "pwd". + + ... whatever. _H*/ + +#include + +/* change if you like; "id" is a good one for figuring out if you won too */ +static char cmd[] = "pwd"; + +static char buf [256]; + +main(argc, argv) + int argc; + char * argv[]; +{ + register int x; + register int y; + char * p; + char * q; + + p = buf; + memset (buf, 0, 256); + + p++; /* first null */ + y = 1; + + if (! argv[1]) + goto wrong; + x = strlen (argv[1]); + memcpy (p, argv[1], x); /* first arg plus another null */ + x++; + p += x; + y += x; + + if (! argv[2]) + goto wrong; + x = strlen (argv[2]); + memcpy (p, argv[2], x); /* second arg plus null */ + x++; + p += x; + y += x; + + q = cmd; + if (argv[3]) + q = argv[3]; + x = strlen (q); /* not checked -- bfd */ + memcpy (p, q, x); /* the command, plus final null */ + x++; + p += x; + y += x; + + memcpy (p, "\n", 1); /* and a newline, so it goes */ + y++; + + write (1, buf, y); /* zot! */ + exit (0); + +wrong: + fprintf (stderr, "wrong! needs 2 or more args.\n"); + exit (1); +} diff --git a/usr.bin/nc/data/showmount.d b/usr.bin/nc/data/showmount.d new file mode 100644 index 00000000000..499794bc8a5 --- /dev/null +++ b/usr.bin/nc/data/showmount.d @@ -0,0 +1,63 @@ +# UDP mountd call. Use as input to find mount daemons and avoid portmap. +# Useful proc numbers are 2, 5, and 6. +# UDP-scan around between 600-800 to find most mount daemons. +# Using this with "2", plugged into "nc -u -v -w 2 victim X-Y" will +# directly scan *and* dump the current exports when mountd is hit. +# combine stdout *and* stderr thru "strings" or something to clean it up + +000 # XID: 4 trash bytes +001 +002 +003 + +000 # CALL: 0 +000 +000 +000 + +000 # RPC version: 2 +000 +000 +002 + +000 # mount: 100005 +001 +0x86 +0xa5 + +000 # mount version: 1 +000 +000 +001 + +000 # procedure number -- put what you need here: +000 # 2 = dump [showmount -e] +000 # 5 = exportlist [showmount -a] +xxx # "sed s/xxx/$1/ | data -g | nc ..." or some such... + +000 # port: junk +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # auth trash +000 +000 +000 + +000 # extra auth trash? probably not needed +000 +000 +000 + +# that's it! diff --git a/usr.bin/nc/data/xor.c b/usr.bin/nc/data/xor.c new file mode 100644 index 00000000000..9feead0cbac --- /dev/null +++ b/usr.bin/nc/data/xor.c @@ -0,0 +1,92 @@ +/* Generic xor handler. + + With no args, xors stdin against 0xFF to stdout. A single argument is a + file to read xor-bytes out of. Any zero in the xor-bytes array is treated + as the end; if you need to xor against a string that *includes* zeros, + you're on your own. + + The indirect file can be generated easily with data.c. + + Written because there are so many lame schemes for "masking" plaintext + passwords and the like floating around, and it's handy to just run an + obscure binary-format configuration file through this and look for strings. + + *Hobbit*, 960208 */ + +#include +#include + +char buf[8192]; +char bytes[256]; +char * py; + +/* do the xor, in place. Uses global ptr "py" to maintain "bytes" state */ +xorb (buf, len) + char * buf; + int len; +{ + register int x; + register char * pb; + + pb = buf; + x = len; + while (x > 0) { + *pb = (*pb ^ *py); + pb++; + py++; + if (! *py) + py = bytes; + x--; + } +} /* xorb */ + +/* blah */ +main (argc, argv) + int argc; + char ** argv; +{ + register int x = 0; + register int y; + +/* manually preload; xor-with-0xFF is all too common */ + memset (bytes, 0, sizeof (bytes)); + bytes[0] = 0xff; + +/* if file named in any arg, reload from that */ +#ifdef O_BINARY /* DOS shit... */ + x = setmode (0, O_BINARY); /* make stdin raw */ + if (x < 0) { + fprintf (stderr, "stdin binary setmode oops: %d\n", x); + exit (1); + } + x = setmode (1, O_BINARY); /* make stdout raw */ + if (x < 0) { + fprintf (stderr, "stdout binary setmode oops: %d\n", x); + exit (1); + } +#endif /* O_BINARY */ + + if (argv[1]) +#ifdef O_BINARY + x = open (argv[1], O_RDONLY | O_BINARY); +#else + x = open (argv[1], O_RDONLY); +#endif + if (x > 0) { + read (x, bytes, 250); /* nothin' fancy here */ + close (x); + } + py = bytes; + x = 1; + while (x > 0) { + x = read (0, buf, sizeof (buf)); + if (x <= 0) + break; + xorb (buf, x); + y = write (1, buf, x); + if (y <= 0) + exit (1); + } + exit (0); +} + diff --git a/usr.bin/nc/generic.h b/usr.bin/nc/generic.h new file mode 100644 index 00000000000..b3dd5f5dc64 --- /dev/null +++ b/usr.bin/nc/generic.h @@ -0,0 +1,377 @@ +/* generic.h -- anything you don't #undef at the end remains in effect. + The ONLY things that go in here are generic indicator flags; it's up + to your programs to declare and call things based on those flags. + + You should only need to make changes via a minimal system-specific section + at the end of this file. To build a new section, rip through this and + check everything it mentions on your platform, and #undef that which needs + it. If you generate a system-specific section you didn't find in here, + please mail me a copy so I can update the "master". + + I realize I'm probably inventing another pseudo-standard here, but + goddamnit, everybody ELSE has already, and I can't include all of their + hairball schemes too. HAVE_xx conforms to the gnu/autoconf usage and + seems to be the most common format. In fact, I dug a lot of these out + of autoconf and tried to common them all together using "stupidh" to + collect data from platforms. + + In disgust... _H* 940910, 941115, 950511. Pseudo-version: 1.3 + + Updated 951104 with many patches from netcat feedback, and properly + closed a lot of slop in open-ended comments: version 1.4 + 960217 + nextstep: version 1.5 +*/ + +#ifndef GENERIC_H /* only run through this once */ +#define GENERIC_H + +/* =============================== */ +/* System calls, lib routines, etc */ +/* =============================== */ + +/* How does your system declare malloc, void or char? Usually void, but go + ask the SunOS people why they had to be different... */ +#define VOID_MALLOC + +/* notably from fwtk/firewall.h: posix locking? */ +#define HAVE_FLOCK /* otherwise it's lockf() */ + +/* if you don't have setsid(), you might have setpgrp(). */ +#define HAVE_SETSID + +/* random() is generally considered better than rand() */ +#define HAVE_RANDOM + +/* the srand48/lrand48/etc family is s'posedly even better */ +#define HAVE_RAND48 +/* bmc@telebase and others have suggested these macros if a box *does* have + rand48. Will consider for later if we're doing something that really + requires stronger random numbers, but netcat and such certainly doesn't. +#define srandom(seed) srand48((long) seed) +#define random() lrand48() */ + +/* if your machine doesn't have lstat(), it should have stat() [dos...] */ +#define HAVE_LSTAT + +/* different kinds of term ioctls. How to recognize them, very roughly: + sysv/POSIX_ME_HARDER: termio[s].h, struct termio[s], tty.c_*[] + bsd/old stuff: sgtty.h, ioctl(TIOCSETP), sgttyb.sg_*, tchars.t_* */ +#define HAVE_TERMIOS + +/* dbm vs ndbm */ +#define HAVE_NDBM + +/* extended utmp/wtmp stuff. MOST machines still do NOT have this SV-ism */ +#define UTMPX + +/* some systems have nice() which takes *relative* values... [resource.h] */ +#define HAVE_SETPRIORITY + +/* a sysvism, I think, but ... */ +#define HAVE_SYSINFO + +/* ============= */ +/* Include files */ +/* ============= */ + +/* Presence of these can be determined via a script that sniffs them + out if you aren't sure. See "stupidh"... */ + +/* stdlib comes with most modern compilers, but ya never know */ +#define HAVE_STDLIB_H + +/* not on a DOS box! */ +#define HAVE_UNISTD_H + +/* stdarg is a weird one */ +#define HAVE_STDARG_H + +/* dir.h or maybe ndir.h otherwise. */ +#define HAVE_DIRENT_H + +/* string or strings */ +#define HAVE_STRINGS_H + +/* if you don't have lastlog.h, what you want might be in login.h */ +#define HAVE_LASTLOG_H + +/* predefines for _PATH_various */ +#define HAVE_PATHS_H + +/* some SV-flavors break select stuff out separately */ +#define HAVE_SELECT_H + +/* assorted others */ +#define HAVE_PARAM_H /* in sys/ */ +#define HAVE_SYSMACROS_H /* in sys/ */ +#define HAVE_TTYENT_H /* securetty et al */ + +/* ==================== */ + +/* Still maybe have to do something about the following, if it's even + worth it. I just grepped a lot of these out of various code, without + looking them up yet: + +#define HAVE_EINPROGRESS +#define HAVE_F_SETOWN +HAVE_FILIO_H ... fionbio, fiosetown, etc... will need for hairier + select loops. +#define HAVE_SETENV ... now *there's* a hairy one; **environ is portable +#define BIG_ENDIAN/little_endian ... *please* try to avoid this stupidity + and LSBFIRST/MSBFIRST +#define HAVE_GETUSERSHELL ... you could always pull it out of getpwent() +#define HAVE_SETE[UG]ID ... lib or syscall, it varies on diff platforms +#define HAVE_STRCHR ... should actually be handled by string/strings +#define HAVE_PSTAT +#define HAVE_ST_BLKSIZE ... a stat() thing? +#define HAVE_IP_TOS +#define HAVE_STRFTIME ... screw this, we'll just INCLUDE one for lame + old boxes that don't have it [sunos 3.x, early 4.x?] +#define HAVE_VFPRINTF +#define HAVE_SHADOW_PASSWD ... in its multitudinous schemes?? ... how + about sumpin' like #define SHADOW_PASSWD_TYPE ... could get grody. + ... looks like sysv /etc/shadow, getspent() family is common. +#define SIG* ... what a swamp, punt for now; should all be in signal.h +#define HAVE_STRCSPN ... see larry wall's comment in the fwtk regex code +#define ULTRIX_AUTH ... bwahaha. +#define HAVE_YP or NIS or whatever you wanna call it this week +randomness about VARARGS?? +--- later stuff to be considered --- +#define UINT4 ... u-int on alpha/osf, i.e. __alpha/__osf__, ulong elsewhere? + dont name it that, though, it'll conflict with extant .h files like md5 +randomness about machine/endian.h, machine/inline.h -- bsdi, net/2 +randomness about _PATH_WTMP vs WTMP_FILE and where they even live!! +#define HAVE_SYS_ERRLIST ... whether it's in stdio.h or not [bsd 4.4] +--- still more stuff +#define HAVE_SETENV +#define _PATH_UTMP vs UTMP_FILE, a la deslogind?! +#define HAVE_DAEMON +#define HAVE_INETADDR [vixie bind?] +lseek: SEEK_SET vs L_SET and associated lossage [epi-notes, old 386Mach] +bsdi: ioctl_compat.h ? +--- takin' some ifdefs from CNS krb: +F_GETOWN/F_SETOWN +CRAY: long = 8 bytes, etc [class with alpha?] +CGETENT +SIGINFO +SIGTSTP SIGTTOU SIGWINCH +SPX? +SYSV_TERMIO -- covered elsewhere, I hope +TIOCEXT TIOCFLUSH TIOC[GS]WINSIZ +NEWINIT: something about init cleaning up dead login processes [telnet?] +PARENT_DOES_UTMP, too [telnet] +VDISCARD +VEOL/VEOL2/VLNEXT VREPRINT -- termios stuff?, and related... +STREAMSPTY/STREAMSPTYEM +AF_INET/AF_UNSPEC, PF_* +ECHOCTL/ECHOKE +F_ULOCK [?!] +setpgrp/getpgrp() ONEARG business.. +HAVE_ALLOCA +HAVE_GETUTENT +HAVE_SYS_SELECT_H [irix!] +HAVE_DIRENT [old 386mach has *direct.h*!] +HAVE_SIGSET +HAVE_VFORK_H and HAVE_VFORK +HAVE_VHANGUP +HAVE_VSPRINTF +HAVE_IPTOS_* +HAVE_STRCASECMP, STRNCASECMP +HAVE_SYS_FCNTL_H +HAVE_SYS_TIME_H +HAVE_UTIMES +NOTTYENT [?] +HAVE_FCHMOD +HAVE_GETUSERSHELL +HAVE_SIGCONTEXT [stack hair, very machine-specific] +YYLINENO? +POSIX_SIGNALS +POSIX_TERMIOS +SETPROCTITLE -- breaks some places, like fbsd sendmail +SIG* -- actual signal names? some are missing +SIOCGIFCONF +SO_BROADCAST +SHMEM [krb tickets] +VARARGS, or HAVE_VARARGS +CBAUD +... and B300, B9600, etc etc +HAVE_BZERO vs memset/memcpy +HAVE_SETVBUF +HAVE_STRDUP +HAVE_GETENV +HAVE_STRSAVE +HAVE_STBLKSIZE [stat?] +HAVE_STREAM_H -- in sys/, ref sendmail 8.7 for IP_SRCROUTE +FCHMOD +INITGROUPS -- most machines seem to *have* +SETREUID +SNPRINTF +SETPGRP semantics bsd vs. sys5 style + +There's also the issue about WHERE various .h files live, sys/ or otherwise. +There's a BIG swamp lurking where network code of any sort lives. +*/ + +/* ======================== */ +/* System-specific sections */ +/* ======================== */ + +/* By turning OFF various bits of the above, you can customize for + a given platform. Yes, we're ignoring the stock compiler predefines + and using our own plugged in via the Makefile. */ + +/* DOS boxes, with MSC; you may need to adapt to a different compiler. */ +/* looks like later ones *do* have dirent.h, for example */ +#ifdef MSDOS +#undef HAVE_FLOCK +#undef HAVE_RANDOM +#undef HAVE_LSTAT +#undef HAVE_TERMIOS +#undef UTMPX +#undef HAVE_SYSINFO +#undef HAVE_UNISTD_H +#undef HAVE_DIRENT_H /* unless you have the k00l little wrapper from L5!! */ +#undef HAVE_STRINGS_H +#undef HAVE_LASTLOG_H +#undef HAVE_PATHS_H +#undef HAVE_PARAM_H +#undef HAVE_SYSMACROS_H +#undef HAVE_SELECT_H +#undef HAVE_TTYENT_H +#endif /* MSDOS */ + +/* buglix 4.x; dunno about 3.x on down. should be bsd4.2 */ +#ifdef ULTRIX +#undef UTMPX +#undef HAVE_PATHS_H +#undef HAVE_SYSMACROS_H +#undef HAVE_SELECT_H +#endif /* buglix */ + +/* some of this might still be broken on older sunoses */ +#ifdef SUNOS +#undef VOID_MALLOC +#undef UTMPX +#undef HAVE_PATHS_H +#undef HAVE_SELECT_H +#endif /* sunos */ + +/* "contact your vendor for a fix" */ +#ifdef SOLARIS +/* has UTMPX */ +#undef HAVE_RANDOM +#undef HAVE_SETPRIORITY +#undef HAVE_STRINGS_H /* this is genuinely the case, go figure */ +#undef HAVE_PATHS_H +#undef HAVE_SELECT_H +#undef HAVE_TTYENT_H +#endif /* SOLARIS */ + +/* whatever aix variant MIT had at the time; 3.2.x?? */ +#ifdef AIX +#undef UTMPX +#undef HAVE_LASTLOG_H +#define HAVE_LOGIN_H /* "special", in the educational sense */ +#endif /* aix */ + +/* linux, which is trying as desperately as the gnu folks can to be + POSIXLY_CORRECT. I think I'm gonna hurl... */ +#ifdef LINUX +#undef UTMPX +#undef HAVE_SYSINFO +#undef HAVE_SELECT_H +#undef HAVE_TTYENT_H +#endif /* linux */ + +/* irix 5.x; may not be correct for earlier ones */ +#ifdef IRIX +/* wow, does irix really have everything?! */ +#endif /* irix */ + +/* osf on alphas */ +#ifdef OSF +#undef UTMPX +#undef HAVE_SELECT_H +#endif /* osf */ + +/* they's some FUCKED UP paths in this one! */ +#ifdef FREEBSD +#undef UTMPX +#undef HAVE_SYSINFO +#undef HAVE_LASTLOG_H +#undef HAVE_SYSMACROS_H +#undef HAVE_SELECT_H /* actually a lie, but only for kernel */ +#endif /* freebsd */ + +/* Originally from the sidewinder site, of all places, but subsequently + checked further under a more normal bsdi 2.0 */ +#ifdef BSDI +#undef UTMPX +#undef HAVE_LASTLOG_H +#undef HAVE_SYSMACROS_H +/* and their malloc.h was in sys/ ?! */ +#undef HAVE_SELECT_H +#endif /* bsdi */ + +/* netbsd/44lite, jives with amiga-netbsd from cactus */ +#ifdef NETBSD +#undef UTMPX +#undef HAVE_SYSINFO +#undef HAVE_LASTLOG_H +#undef HAVE_SELECT_H +#endif /* netbsd */ + +/* Hpux 9.0x, from BBN and various patches sent in */ +#ifdef HPUX +#undef HAVE_RANDOM /* but *does* have ?rand48 -- need to consider.. */ +#undef HAVE_UTMPX +#undef HAVE_LASTLOG_H /* has utmp/wtmp/btmp nonsense, and pututline() */ +#undef HAVE_PATHS_H +#undef HAVE_SELECT_H +#undef HAVE_TTYENT_H +#endif /* hockeypux */ + +/* Unixware [a loose definition of "unix", to be sure], 1.1.2 [at least] + from Brian Clapper. He wasn't sure about 2.0... */ +#ifdef UNIXWARE +/* has UTMPX */ +#undef HAVE_SETPRIORITY +/* NOTE: UnixWare does provide the BSD stuff, in "/usr/ucbinclude" (headers) + and "/usr/ucblib" (libraries). However, I've run into problems linking + stuff out of that version of the C library, when objects are also coming + out of the "regular" C library. My advice: Avoid the BSD compatibility + stuff wherever possible. Brian Clapper */ +#undef HAVE_STRINGS_H +#undef HAVE_PATHS_H +#undef HAVE_TTYENT_H +#endif /* UNIXWARE */ + +/* A/UX 3.1.x from darieb@sandia.gov */ +#ifdef AUX +#undef HAVE_RANDOM +#undef HAVE_SELECT_H /* xxx: untested */ +#endif /* a/ux */ + +/* NeXTSTEP 3.2 motorola mudge@l0pht.com xxx should also work with + white hardware and Sparc/HPPA. Should work with 3.3 too as it's + 4.3 / 4.4 bsd wrapped around mach */ +#ifdef NEXT +#undef UTMPX +#undef HAVE_SELECT_X +#endif /* NeXTSTEP 3.2 motorola */ + +/* Make some "generic" assumptions if all else fails */ +#ifdef GENERIC +#undef HAVE_FLOCK +#if defined(SYSV) && (SYSV < 4) /* TW leftover: old SV doesnt have symlinks */ +#undef HAVE_LSTAT +#endif /* old SYSV */ +#undef HAVE_TERMIOS +#undef UTMPX +#undef HAVE_PATHS_H +#undef HAVE_SELECT_H +#endif /* generic */ + +/* ================ */ +#endif /* GENERIC_H */ + diff --git a/usr.bin/nc/nc.1 b/usr.bin/nc/nc.1 new file mode 100644 index 00000000000..cffb9f637b5 --- /dev/null +++ b/usr.bin/nc/nc.1 @@ -0,0 +1,213 @@ +.\" $OpenBSD: nc.1,v 1.1 1996/09/05 08:55:32 deraadt Exp $ +.\" +.\" Copyright (c) 1996 David Sacerdote +.\" All rights reserved. +.\" +.\" Redistribution and use in source and binary forms, with or without +.\" modification, are permitted provided that the following conditions +.\" are met: +.\" 1. Redistributions of source code must retain the above copyright +.\" notice, this list of conditions and the following disclaimer. +.\" 2. Redistributions in binary form must reproduce the above copyright +.\" notice, this list of conditions and the following disclaimer in the +.\" documentation and/or other materials provided with the distribution. +.\" 3. The name of the author may not be used to endorse or promote products +.\" derived from this software without specific prior written permission +.\" +.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR +.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES +.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. +.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, +.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT +.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF +.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +.\" +.Dd August 1, 1996 +.Dt nc 1 +.Sh NAME +.Os +.Nm nc +.Nd +Arbitrary tcp and udp connections and listens. +.Pp +.Nm nc +.Op Fl e Ar command +.Op Fl g Ar intermediates +.Op Fl G Ar hopcount +.Op Fl i Ar interval +.Op Fl lnrtuvz +.Op Fl o Ar filename +.Op Fl p Ar source port +.Op Fl s Ar ip address +.Op Fl w Ar timeout +.Op Ar hostname +.Op Ar port[s...] +.Pp +.Sh DESCRIPTION +The +.Nm nc +(or +.Nm netcat ) +utility is used for just about anything under the sun +involving TCP or UDP. It can open tcp connections, send udp packets, +listen on arbitrary tcp and udp ports, do port scanning, and source +routing. Unlike +.Xr telnet 1 , +.Nm nc +scripts nicely, and separates error messages onto standard error instead +of sending them to standard output, as +.Xr telnet 1 +does with some. +.Pp +Destination ports can be single integers, names as listed in +.Xr /etc/services 5 , +or ranges. Ranges are in the form nn-mm, and several separate ports and/or +ranges may be specified on the command line. +.Pp +Common uses include: +.Bl -bullet +.It +simple tcp proxies +.It +shell\-script based http clients and servers +.It +network daemon testing +.It +source routing based connectivity testing +.It +and much, much more +.El +.Pp +The options are as follows: +.Bl -tag -width Ds +.It Fl e Ar command +Execute the specified command, using data from the network for stdin, +and sending stdout and stderr to the network. This option is only present if +.Nm nc +was compiled with the GAPING_SECURITY_HOLE compile time option, since it +allows users to make arbitrary programs available to anyone on the network. +.It Fl g Ar intermediate-host +Specifies a hop along a loose source routed path. Can be used more than +once to build a chain of hop points. +.It Fl G Ar pointer +Positions the "hop counter" within the list of machines in the path of +a source routed packet. Must be a multiple of 4. +.It Fl i Ar seconds +Specifies a delay time interval between lines of text sent and received. +Also causes a delay time between connections to multiple ports. +.It Fl l +Is used to specify that +.Nm nc +should listen for an incoming connection, rather than initiate a +connection to a remote host. Any hostname/ip address and port arguments +restrict the source of inbound connections to only that address and +source port. +.It Fl n +Do not do DNS lookups on any of the specified addresses or hostnames, or +names of port numbers from /etc/services. +.It Fl o Ar filename +Create a hexadecimal log of data transferred in the specified file. +Each line begins with < or >. < means "from the net" and > means +"to the net." +.It Fl p Ar port +Specifies the source port +.Nm nc +should use, subject to privilege restrictions and availability. +.It Fl r +Specified that source and/or destination ports should be chosen semi-randomly +instead of sequentially within a range or in the order that the +system assigns. +.It Fl s Ar hostname/ip-address +Specifies the ip of the interface which is used to send the packets. +On some platforms, this can be used for udp spoofing by using ifconfig +to bring up a dummy interface with the desired source ip address. +.It Fl t +Causes +.Nm nc +to send RFC854 DON'T and WON'T responses to RFC854 DO +and WILL requests. This makes it possible to use +.Nm nc +to script telnet sessions. The presence of this option can be +enabled or disabled as a compile-time option. +.It Fl u +Use UDP instead of TCP. +On most platforms, +.Nm nc +will behave as if a connection is established until it receives an +ICMP packet indicating that there is no program listening to what it +sends. +.It Fl v +Verbose. Cause +.Nm nc +to display connection information. Using \-v +more than once will cause +.Nm nc +to become even more verbose. +.It Fl w Ar timeout +Specifies the number of seconds +.Nm nc +should wait before deciding that +an attempt to establish a connection is hopeless. +Also used to specify how long to wait for more network data after standard +input closes. +.It Fl z +Specifies that +.Nm nc +should just scan for listening +daemons, without sending any data to them. Diagnostic messages about refused +connections will not be +displayed unless \-v is specified twice. +.Sh EXAMPLES +.Pp +.Bl -tag -width x +.It Li "nc" +Wait for the user to type what would normally be command-line +arguments in at stdin. +.It Li "nc example.host 42" +Open a TCP connection to port 42 of example.host. If the connection +fails, do not display any error messages, but simply exit. +.It Li "nc -p 31337 example.host 42" +Open a TCP connection to port 42 of example.host, and use port 31337 +as the source port. +.It Li "nc -w 5 example.host 42" +Open a tcp connection to port 42 of example.host, and time out after +five seconds while attempting to connect. +.It Li "nc -u example.host 53" +Send any data from stdin +to UDP port 53 of example.host, and display any data returned. +.It Li "nc -s 10.1.2.3 example.host 42" +Open a tcp connection to port 42 of example.host using 10.1.2.3 as the +ip for the local end of the connection. +.It Li "nc -v example.host 42" +Open a tcp connection to port 42 of example.host, displaying some +diagnostic messages on stderr. +.It Li "nc -v -v example.host 42" +Open a tcp connection to port 42 of example.host, displaying all +diagnostic messages on stderr. +.It Li "nc -v -z example.host 20-30" +Attempt to open tcp connections to ports 20 through 30 of +example.host, and report which ones +.Nm nc +was able to connect to. +.It Li "nc -v -u -z -w 3 example.host 20-30" +Send udp packets to ports 20-30 of example.host, and report which ones +did not respond with an ICMP packet after three seconds. +.It Li "nc -l -p 3000" +Listen on TCP port 3000, and once there is a connection, send stdin to +the remote host, and send data from the remote host to stdout. +.It Li "echo foobar | nc example.host 1000" +Connect to port 1000 of example.host, send the string "foobar" +followed by a newline, and move data from port 1000 of example.host to +stdout until example.host closes the connection. +.El +.Sh SEE ALSO +.Xr telnet 1 , +.Xr cat 1 , +and the +.Nm netcat +.Pa README +.Sh AUTHOR +*Hobbit* [hobbit@avian.org] diff --git a/usr.bin/nc/netcat.blurb b/usr.bin/nc/netcat.blurb new file mode 100644 index 00000000000..2c540ad9dcc --- /dev/null +++ b/usr.bin/nc/netcat.blurb @@ -0,0 +1,61 @@ +Netcat 1.10 is an updated release of Netcat, a simple Unix utility which reads +and writes data across network connections using TCP or UDP protocol. It is +designed to be a reliable "back-end" tool that can be used directly or easily +driven by other programs and scripts. At the same time it is a feature-rich +network debugging and exploration tool, since it can create almost any kind of +connection you would need and has several interesting built-in capabilities. + +Some of netcat's major features are: + + Outbound or inbound connections, TCP or UDP, to or from any ports + Full DNS forward/reverse checking, with appropriate warnings + Ability to use any local source port + Ability to use any locally-configured network source address + Built-in port-scanning capabilities, with randomizer + Built-in loose source-routing capability + Can read command line arguments from standard input + Slow-send mode, one line every N seconds + Hex dump of transmitted and received data + Optional ability to let another program service established connections + Optional telnet-options responder + +A very short list of potential uses: + + Script backends + Scanning ports and inventorying services, automated probes + Backup handlers + File transfers + Server testing, simulation, debugging, and hijacking + Firewall testing + Proxy gatewaying + Network performance testing + Address spoofing tests + Protecting X servers + 1001 other uses you'll likely come up with + +Changes between the 1.00 release and this release: + + Better portability -- updated generic.h and Makefile [thanx folks!] + Indication of local-end interface address on inbound connections + That's *Dave* Borman's telnet, not Paul Borman... + Better indication of DNS errors + Total byte counts printed if -v -v is used + A bunch of front-end driver companion programs and scripts + Better handling of stdin arguments-plus-data + Hex-dump feature + Telnet responder + Program exec works inbound or outbound now + +Netcat and the associated package is a product of Avian Research, and is freely +available in full source form with no restrictions save an obligation to give +credit where due. Get it via anonymous FTP at avian.org:/src/hacks/nc110.tgz +which is a gzipped tar file and not to be confused with its version 1.00 +precursor, nc100.tgz. Other distribution formats can be accomodated upon +request. Netcat is also mirrored at the following [faster] sites: + + zippy.telcom.arizona.edu:/pub/mirrors/avian.org/hacks/nc110.tgz + ftp.sterling.com:/mirrors/avian.org/src/hacks/nc110.tgz + coast.cs.purdue.edu:/pub/tools/unix/netcat/nc110.tgz + ftp.rge.com:/pub/security/coast/mirrors/avian.org/netcat/nc110.tgz + +_H* 960320 diff --git a/usr.bin/nc/netcat.c b/usr.bin/nc/netcat.c new file mode 100644 index 00000000000..5ceb4f1d2fd --- /dev/null +++ b/usr.bin/nc/netcat.c @@ -0,0 +1,1668 @@ +/* Netcat 1.10 RELEASE 960320 + + A damn useful little "backend" utility begun 950915 or thereabouts, + as *Hobbit*'s first real stab at some sockets programming. Something that + should have and indeed may have existed ten years ago, but never became a + standard Unix utility. IMHO, "nc" could take its place right next to cat, + cp, rm, mv, dd, ls, and all those other cryptic and Unix-like things. + + Read the README for the whole story, doc, applications, etc. + + Layout: + conditional includes: + includes: + handy defines: + globals: + malloced globals: + cmd-flag globals: + support routines: + readwrite select loop: + main: + + bluesky: + parse ranges of IP address as well as ports, perhaps + RAW mode! + backend progs to grab a pty and look like a real telnetd?! + backend progs to do various encryption modes??!?! +*/ + +#include "generic.h" /* same as with L5, skey, etc */ + +/* conditional includes -- a very messy section which you may have to dink + for your own architecture [and please send diffs...]: */ +/* #undef _POSIX_SOURCE /* might need this for something? */ +#define HAVE_BIND /* ASSUMPTION -- seems to work everywhere! */ +#define HAVE_HELP /* undefine if you dont want the help text */ +/* #define ANAL /* if you want case-sensitive DNS matching */ + +#ifdef HAVE_STDLIB_H +#include +#else +#include +#endif +#ifdef HAVE_SELECT_H /* random SV variants need this */ +#include +#endif + +/* have to do this *before* including types.h. xxx: Linux still has it wrong */ +#ifdef FD_SETSIZE /* should be in types.h, butcha never know. */ +#undef FD_SETSIZE /* if we ever need more than 16 active */ +#endif /* fd's, something is horribly wrong! */ +#define FD_SETSIZE 16 /* <-- this'll give us a long anyways, wtf */ +#include /* *now* do it. Sigh, this is broken */ + +#ifdef HAVE_RANDOM /* aficionados of ?rand48() should realize */ +#define SRAND srandom /* that this doesn't need *strong* random */ +#define RAND random /* numbers just to mix up port numbers!! */ +#else +#define SRAND srand +#define RAND rand +#endif /* HAVE_RANDOM */ + +/* includes: */ +#include /* timeval, time_t */ +#include /* jmp_buf et al */ +#include /* basics, SO_ and AF_ defs, sockaddr, ... */ +#include /* sockaddr_in, htons, in_addr */ +#include /* misc crud that netinet/ip.h references */ +#include /* IPOPT_LSRR, header stuff */ +#include /* hostent, gethostby*, getservby* */ +#include /* inet_ntoa */ +#include +#include /* strcpy, strchr, yadda yadda */ +#include +#include +#include /* O_WRONLY et al */ + +/* handy stuff: */ +#define SA struct sockaddr /* socket overgeneralization braindeath */ +#define SAI struct sockaddr_in /* ... whoever came up with this model */ +#define IA struct in_addr /* ... should be taken out and shot, */ + /* ... not that TLI is any better. sigh.. */ +#define SLEAZE_PORT 31337 /* for UDP-scan RTT trick, change if ya want */ +#define USHORT unsigned short /* use these for options an' stuff */ +#define BIGSIZ 8192 /* big buffers */ + +#ifndef INADDR_NONE +#define INADDR_NONE 0xffffffff +#endif +#ifdef MAXHOSTNAMELEN +#undef MAXHOSTNAMELEN /* might be too small on aix, so fix it */ +#endif +#define MAXHOSTNAMELEN 256 + +struct host_poop { + char name[MAXHOSTNAMELEN]; /* dns name */ + char addrs[8][24]; /* ascii-format IP addresses */ + struct in_addr iaddrs[8]; /* real addresses: in_addr.s_addr: ulong */ +}; +#define HINF struct host_poop + +struct port_poop { + char name [64]; /* name in /etc/services */ + char anum [8]; /* ascii-format number */ + USHORT num; /* real host-order number */ +}; +#define PINF struct port_poop + +/* globals: */ +jmp_buf jbuf; /* timer crud */ +int jval = 0; /* timer crud */ +int netfd = -1; +int ofd = 0; /* hexdump output fd */ +static char unknown[] = "(UNKNOWN)"; +static char p_tcp[] = "tcp"; /* for getservby* */ +static char p_udp[] = "udp"; +#ifdef HAVE_BIND +extern int h_errno; +/* stolen almost wholesale from bsd herror.c */ +static char * h_errs[] = { + "Error 0", /* but we *don't* use this */ + "Unknown host", /* 1 HOST_NOT_FOUND */ + "Host name lookup failure", /* 2 TRY_AGAIN */ + "Unknown server error", /* 3 NO_RECOVERY */ + "No address associated with name", /* 4 NO_ADDRESS */ +}; +#else +int h_errno; /* just so we *do* have it available */ +#endif /* HAVE_BIND */ +int gatesidx = 0; /* LSRR hop count */ +int gatesptr = 4; /* initial LSRR pointer, settable */ +USHORT Single = 1; /* zero if scanning */ +unsigned int insaved = 0; /* stdin-buffer size for multi-mode */ +unsigned int wrote_out = 0; /* total stdout bytes */ +unsigned int wrote_net = 0; /* total net bytes */ +static char wrote_txt[] = " sent %d, rcvd %d"; +static char hexnibs[20] = "0123456789abcdef "; + +/* will malloc up the following globals: */ +struct timeval * timer1 = NULL; +struct timeval * timer2 = NULL; +SAI * lclend = NULL; /* sockaddr_in structs */ +SAI * remend = NULL; +HINF ** gates = NULL; /* LSRR hop hostpoop */ +char * optbuf = NULL; /* LSRR or sockopts */ +char * bigbuf_in; /* data buffers */ +char * bigbuf_net; +fd_set * ding1; /* for select loop */ +fd_set * ding2; +PINF * portpoop = NULL; /* for getportpoop / getservby* */ +unsigned char * stage = NULL; /* hexdump line buffer */ + +/* global cmd flags: */ +USHORT o_alla = 0; +unsigned int o_interval = 0; +USHORT o_listen = 0; +USHORT o_nflag = 0; +USHORT o_wfile = 0; +USHORT o_random = 0; +USHORT o_udpmode = 0; +USHORT o_verbose = 0; +unsigned int o_wait = 0; +USHORT o_zero = 0; +/* o_tn in optional section */ + +/* Debug macro: squirt whatever message and sleep a bit so we can see it go + by. need to call like Debug ((stuff)) [with no ; ] so macro args match! + Beware: writes to stdOUT... */ +#ifdef DEBUG +#define Debug(x) printf x; printf ("\n"); fflush (stdout); sleep (1); +#else +#define Debug(x) /* nil... */ +#endif + + +/* support routines -- the bulk of this thing. Placed in such an order that + we don't have to forward-declare anything: */ + +/* holler : + fake varargs -- need to do this way because we wind up calling through + more levels of indirection than vanilla varargs can handle, and not all + machines have vfprintf/vsyslog/whatever! 6 params oughta be enough. */ +void holler (str, p1, p2, p3, p4, p5, p6) + char * str; + char * p1, * p2, * p3, * p4, * p5, * p6; +{ + if (o_verbose) { + fprintf (stderr, str, p1, p2, p3, p4, p5, p6); +#ifdef HAVE_BIND + if (h_errno) { /* if host-lookup variety of error ... */ + if (h_errno > 4) /* oh no you don't, either */ + fprintf (stderr, "preposterous h_errno: %d", h_errno); + else + fprintf (stderr, h_errs[h_errno]); /* handle it here */ + h_errno = 0; /* and reset for next call */ + } +#endif + if (errno) { /* this gives funny-looking messages, but */ + perror (" "); /* it's more portable than sys_errlist[]... */ + } else /* xxx: do something better? */ + fprintf (stderr, "\n"); + fflush (stderr); + } +} /* holler */ + +/* bail : + error-exit handler, callable from anywhere */ +void bail (str, p1, p2, p3, p4, p5, p6) + char * str; + char * p1, * p2, * p3, * p4, * p5, * p6; +{ + o_verbose = 1; + holler (str, p1, p2, p3, p4, p5, p6); + close (netfd); + sleep (1); + exit (1); +} /* bail */ + +/* catch : + no-brainer interrupt handler */ +void catch () +{ + errno = 0; + if (o_verbose > 1) /* normally we don't care */ + bail (wrote_txt, wrote_net, wrote_out); + bail (" punt!"); +} + +/* timeout and other signal handling cruft */ +void tmtravel () +{ + signal (SIGALRM, SIG_IGN); + alarm (0); + if (jval == 0) + bail ("spurious timer interrupt!"); + longjmp (jbuf, jval); +} + +/* arm : + set the timer. Zero secs arg means unarm */ +void arm (num, secs) + unsigned int num; + unsigned int secs; +{ + if (secs == 0) { /* reset */ + signal (SIGALRM, SIG_IGN); + alarm (0); + jval = 0; + } else { /* set */ + signal (SIGALRM, tmtravel); + alarm (secs); + jval = num; + } /* if secs */ +} /* arm */ + +/* Hmalloc : + malloc up what I want, rounded up to *4, and pre-zeroed. Either succeeds + or bails out on its own, so that callers don't have to worry about it. */ +char * Hmalloc (size) + unsigned int size; +{ + unsigned int s = (size + 4) & 0xfffffffc; /* 4GB?! */ + char * p = malloc (s); + if (p != NULL) + memset (p, 0, s); + else + bail ("Hmalloc %d failed", s); + return (p); +} /* Hmalloc */ + +/* findline : + find the next newline in a buffer; return inclusive size of that "line", + or the entire buffer size, so the caller knows how much to then write(). + Not distinguishing \n vs \r\n for the nonce; it just works as is... */ +unsigned int findline (buf, siz) + char * buf; + unsigned int siz; +{ + register char * p; + register int x; + if (! buf) /* various sanity checks... */ + return (0); + if (siz > BIGSIZ) + return (0); + x = siz; + for (p = buf; x > 0; x--) { + if (*p == '\n') { + x = (int) (p - buf); + x++; /* 'sokay if it points just past the end! */ +Debug (("findline returning %d", x)) + return (x); + } + p++; + } /* for */ +Debug (("findline returning whole thing: %d", siz)) + return (siz); +} /* findline */ + +/* comparehosts : + cross-check the host_poop we have so far against new gethostby*() info, + and holler about mismatches. Perhaps gratuitous, but it can't hurt to + point out when someone's DNS is fukt. Returns 1 if mismatch, in case + someone else wants to do something about it. */ +int comparehosts (poop, hp) + HINF * poop; + struct hostent * hp; +{ + errno = 0; + h_errno = 0; +/* The DNS spec is officially case-insensitive, but for those times when you + *really* wanna see any and all discrepancies, by all means define this. */ +#ifdef ANAL + if (strcmp (poop->name, hp->h_name) != 0) { /* case-sensitive */ +#else + if (strcasecmp (poop->name, hp->h_name) != 0) { /* normal */ +#endif + holler ("DNS fwd/rev mismatch: %s != %s", poop->name, hp->h_name); + return (1); + } + return (0); +/* ... do we need to do anything over and above that?? */ +} /* comparehosts */ + +/* gethostpoop : + resolve a host 8 ways from sunday; return a new host_poop struct with its + info. The argument can be a name or [ascii] IP address; it will try its + damndest to deal with it. "numeric" governs whether we do any DNS at all, + and we also check o_verbose for what's appropriate work to do. */ +HINF * gethostpoop (name, numeric) + char * name; + USHORT numeric; +{ + struct hostent * hostent; + struct in_addr iaddr; + register HINF * poop = NULL; + register int x; + +/* I really want to strangle the twit who dreamed up all these sockaddr and + hostent abstractions, and then forced them all to be incompatible with + each other so you *HAVE* to do all this ridiculous casting back and forth. + If that wasn't bad enough, all the doc insists on referring to local ports + and addresses as "names", which makes NO sense down at the bare metal. + + What an absolutely horrid paradigm, and to think of all the people who + have been wasting significant amounts of time fighting with this stupid + deliberate obfuscation over the last 10 years... then again, I like + languages wherein a pointer is a pointer, what you put there is your own + business, the compiler stays out of your face, and sheep are nervous. + Maybe that's why my C code reads like assembler half the time... */ + +/* If we want to see all the DNS stuff, do the following hair -- + if inet_addr, do reverse and forward with any warnings; otherwise try + to do forward and reverse with any warnings. In other words, as long + as we're here, do a complete DNS check on these clowns. Yes, it slows + things down a bit for a first run, but once it's cached, who cares? */ + + errno = 0; + h_errno = 0; + if (name) + poop = (HINF *) Hmalloc (sizeof (HINF)); + if (! poop) + bail ("gethostpoop fuxored"); + strcpy (poop->name, unknown); /* preload it */ +/* see wzv:workarounds.c for dg/ux return-a-struct inet_addr lossage */ + iaddr.s_addr = inet_addr (name); + + if (iaddr.s_addr == INADDR_NONE) { /* here's the great split: names... */ + if (numeric) + bail ("Can't parse %s as an IP address", name); + hostent = gethostbyname (name); + if (! hostent) +/* failure to look up a name is fatal, since we can't do anything with it */ + bail ("%s: forward host lookup failed: ", name); + strncpy (poop->name, hostent->h_name, MAXHOSTNAMELEN - 2); + for (x = 0; hostent->h_addr_list[x] && (x < 8); x++) { + memcpy (&poop->iaddrs[x], hostent->h_addr_list[x], sizeof (IA)); + strncpy (poop->addrs[x], inet_ntoa (poop->iaddrs[x]), + sizeof (poop->addrs[0])); + } /* for x -> addrs, part A */ + if (! o_verbose) /* if we didn't want to see the */ + return (poop); /* inverse stuff, we're done. */ +/* do inverse lookups in separate loop based on our collected forward addrs, + since gethostby* tends to crap into the same buffer over and over */ + for (x = 0; poop->iaddrs[x].s_addr && (x < 8); x++) { + hostent = gethostbyaddr ((char *)&poop->iaddrs[x], + sizeof (IA), AF_INET); + if ((! hostent) || (! hostent-> h_name)) + holler ("Warning: inverse host lookup failed for %s: ", + poop->addrs[x]); + else + (void) comparehosts (poop, hostent); + } /* for x -> addrs, part B */ + + } else { /* not INADDR_NONE: numeric addresses... */ + memcpy (poop->iaddrs, &iaddr, sizeof (IA)); + strncpy (poop->addrs[0], inet_ntoa (iaddr), sizeof (poop->addrs)); + if (numeric) /* if numeric-only, we're done */ + return (poop); + if (! o_verbose) /* likewise if we don't want */ + return (poop); /* the full DNS hair */ + hostent = gethostbyaddr ((char *) &iaddr, sizeof (IA), AF_INET); +/* numeric or not, failure to look up a PTR is *not* considered fatal */ + if (! hostent) + holler ("%s: inverse host lookup failed: ", name); + else { + strncpy (poop->name, hostent->h_name, MAXHOSTNAMELEN - 2); + hostent = gethostbyname (poop->name); + if ((! hostent) || (! hostent->h_addr_list[0])) + holler ("Warning: forward host lookup failed for %s: ", + poop->name); + else + (void) comparehosts (poop, hostent); + } /* if hostent */ + } /* INADDR_NONE Great Split */ + +/* whatever-all went down previously, we should now have a host_poop struct + with at least one IP address in it. */ + h_errno = 0; + return (poop); +} /* gethostpoop */ + +/* getportpoop : + Same general idea as gethostpoop -- look up a port in /etc/services, fill + in global port_poop, but return the actual port *number*. Pass ONE of: + pstring to resolve stuff like "23" or "exec"; + pnum to reverse-resolve something that's already a number. + If o_nflag is on, fill in what we can but skip the getservby??? stuff. + Might as well have consistent behavior here, and it *is* faster. */ +USHORT getportpoop (pstring, pnum) + char * pstring; + unsigned int pnum; +{ + struct servent * servent; + register int x; + register int y; + char * whichp = p_tcp; + if (o_udpmode) + whichp = p_udp; + portpoop->name[0] = '?'; /* fast preload */ + portpoop->name[1] = '\0'; + +/* case 1: reverse-lookup of a number; placed first since this case is much + more frequent if we're scanning */ + if (pnum) { + if (pstring) /* one or the other, pleeze */ + return (0); + x = pnum; + if (o_nflag) /* go faster, skip getservbyblah */ + goto gp_finish; + y = htons (x); /* gotta do this -- see Fig.1 below */ + servent = getservbyport (y, whichp); + if (servent) { + y = ntohs (servent->s_port); + if (x != y) /* "never happen" */ + holler ("Warning: port-bynum mismatch, %d != %d", x, y); + strncpy (portpoop->name, servent->s_name, sizeof (portpoop->name)); + } /* if servent */ + goto gp_finish; + } /* if pnum */ + +/* case 2: resolve a string, but we still give preference to numbers instead + of trying to resolve conflicts. None of the entries in *my* extensive + /etc/services begins with a digit, so this should "always work" unless + you're at 3com and have some company-internal services defined... */ + if (pstring) { + if (pnum) /* one or the other, pleeze */ + return (0); + x = atoi (pstring); + if (x) + return (getportpoop (NULL, x)); /* recurse for numeric-string-arg */ + if (o_nflag) /* can't use names! */ + return (0); + servent = getservbyname (pstring, whichp); + if (servent) { + strncpy (portpoop->name, servent->s_name, sizeof (portpoop->name)); + x = ntohs (servent->s_port); + goto gp_finish; + } /* if servent */ + } /* if pstring */ + + return (0); /* catches any problems so far */ + +/* Obligatory netdb.h-inspired rant: servent.s_port is supposed to be an int. + Despite this, we still have to treat it as a short when copying it around. + Not only that, but we have to convert it *back* into net order for + getservbyport to work. Manpages generally aren't clear on all this, but + there are plenty of examples in which it is just quietly done. More BSD + lossage... since everything getserv* ever deals with is local to our own + host, why bother with all this network-order/host-order crap at all?! + That should be saved for when we want to actually plug the port[s] into + some real network calls -- and guess what, we have to *re*-convert at that + point as well. Fuckheads. */ + +gp_finish: +/* Fall here whether or not we have a valid servent at this point, with + x containing our [host-order and therefore useful, dammit] port number */ + sprintf (portpoop->anum, "%d", x); /* always load any numeric specs! */ + portpoop->num = (x & 0xffff); /* ushort, remember... */ + return (portpoop->num); +} /* getportpoop */ + +/* nextport : + Come up with the next port to try, be it random or whatever. "block" is + a ptr to randports array, whose bytes [so far] carry these meanings: + 0 ignore + 1 to be tested + 2 tested [which is set as we find them here] + returns a USHORT random port, or 0 if all the t-b-t ones are used up. */ +USHORT nextport (block) + char * block; +{ + register unsigned int x; + register unsigned int y; + + y = 70000; /* high safety count for rnd-tries */ + while (y > 0) { + x = (RAND() & 0xffff); + if (block[x] == 1) { /* try to find a not-done one... */ + block[x] = 2; + break; + } + x = 0; /* bummer. */ + y--; + } /* while y */ + if (x) + return (x); + + y = 65535; /* no random one, try linear downsearch */ + while (y > 0) { /* if they're all used, we *must* be sure! */ + if (block[y] == 1) { + block[y] = 2; + break; + } + y--; + } /* while y */ + if (y) + return (y); /* at least one left */ + + return (0); /* no more left! */ +} /* nextport */ + +/* loadports : + set "to be tested" indications in BLOCK, from LO to HI. Almost too small + to be a separate routine, but makes main() a little cleaner... */ +void loadports (block, lo, hi) + char * block; + USHORT lo; + USHORT hi; +{ + USHORT x; + + if (! block) + bail ("loadports: no block?!"); + if ((! lo) || (! hi)) + bail ("loadports: bogus values %d, %d", lo, hi); + x = hi; + while (lo <= x) { + block[x] = 1; + x--; + } +} /* loadports */ + +#ifdef GAPING_SECURITY_HOLE +char * pr00gie = NULL; /* global ptr to -e arg */ + +/* doexec : + fiddle all the file descriptors around, and hand off to another prog. Sort + of like a one-off "poor man's inetd". This is the only section of code + that would be security-critical, which is why it's ifdefed out by default. + Use at your own hairy risk; if you leave shells lying around behind open + listening ports you deserve to lose!! */ +doexec (fd) + int fd; +{ + register char * p; + + dup2 (fd, 0); /* the precise order of fiddlage */ + close (fd); /* is apparently crucial; this is */ + dup2 (0, 1); /* swiped directly out of "inetd". */ + dup2 (0, 2); + p = strrchr (pr00gie, '/'); /* shorter argv[0] */ + if (p) + p++; + else + p = pr00gie; +Debug (("gonna exec %s as %s...", pr00gie, p)) + execl (pr00gie, p, NULL); + bail ("exec %s failed", pr00gie); /* this gets sent out. Hmm... */ +} /* doexec */ +#endif /* GAPING_SECURITY_HOLE */ + +/* doconnect : + do all the socket stuff, and return an fd for one of + an open outbound TCP connection + a UDP stub-socket thingie + with appropriate socket options set up if we wanted source-routing, or + an unconnected TCP or UDP socket to listen on. + Examines various global o_blah flags to figure out what-all to do. */ +int doconnect (rad, rp, lad, lp) + IA * rad; + USHORT rp; + IA * lad; + USHORT lp; +{ + register int nnetfd; + register int rr; + int x, y; + errno = 0; + +/* grab a socket; set opts */ +newskt: + if (o_udpmode) + nnetfd = socket (AF_INET, SOCK_DGRAM, IPPROTO_UDP); + else + nnetfd = socket (AF_INET, SOCK_STREAM, IPPROTO_TCP); + if (nnetfd < 0) + bail ("Can't get socket"); + if (nnetfd == 0) /* if stdin was closed this might *be* 0, */ + goto newskt; /* so grab another. See text for why... */ + x = 1; + rr = setsockopt (nnetfd, SOL_SOCKET, SO_REUSEADDR, &x, sizeof (x)); + if (rr == -1) + holler ("nnetfd reuseaddr failed"); /* ??? */ +#ifdef SO_REUSEPORT /* doesnt exist everywhere... */ + rr = setsockopt (nnetfd, SOL_SOCKET, SO_REUSEPORT, &x, sizeof (x)); + if (rr == -1) + holler ("nnetfd reuseport failed"); /* ??? */ +#endif +#if 0 +/* If you want to screw with RCVBUF/SNDBUF, do it here. Liudvikas Bukys at + Rochester sent this example, which would involve YET MORE options and is + just archived here in case you want to mess with it. o_xxxbuf are global + integers set in main() getopt loop, and check for rr == 0 afterward. */ + rr = setsockopt(nnetfd, SOL_SOCKET, SO_RCVBUF, &o_rcvbuf, sizeof o_rcvbuf); + rr = setsockopt(nnetfd, SOL_SOCKET, SO_SNDBUF, &o_sndbuf, sizeof o_sndbuf); +#endif + + /* fill in all the right sockaddr crud */ + lclend->sin_family = AF_INET; + +/* fill in all the right sockaddr crud */ + lclend->sin_family = AF_INET; + remend->sin_family = AF_INET; + +/* if lad/lp, do appropriate binding */ + if (lad) + memcpy (&lclend->sin_addr.s_addr, lad, sizeof (IA)); + if (lp) + lclend->sin_port = htons (lp); + rr = 0; + if (lad || lp) { + x = (int) lp; +/* try a few times for the local bind, a la ftp-data-port... */ + for (y = 4; y > 0; y--) { + rr = bind (nnetfd, (SA *)lclend, sizeof (SA)); + if (rr == 0) + break; + if (errno != EADDRINUSE) + break; + else { + holler ("retrying local %s:%d", inet_ntoa (lclend->sin_addr), lp); + sleep (2); + errno = 0; /* clear from sleep */ + } /* if EADDRINUSE */ + } /* for y counter */ + } /* if lad or lp */ + if (rr) + bail ("Can't grab %s:%d with bind", + inet_ntoa(lclend->sin_addr), lp); + + if (o_listen) + return (nnetfd); /* thanks, that's all for today */ + + memcpy (&remend->sin_addr.s_addr, rad, sizeof (IA)); + remend->sin_port = htons (rp); + +/* rough format of LSRR option and explanation of weirdness. +Option comes after IP-hdr dest addr in packet, padded to *4, and ihl > 5. +IHL is multiples of 4, i.e. real len = ip_hl << 2. + type 131 1 ; 0x83: copied, option class 0, number 3 + len 1 ; of *whole* option! + pointer 1 ; nxt-hop-addr; 1-relative, not 0-relative + addrlist... var ; 4 bytes per hop-addr + pad-to-32 var ; ones, i.e. "NOP" + +If we want to route A -> B via hops C and D, we must add C, D, *and* B to the +options list. Why? Because when we hand the kernel A -> B with list C, D, B +the "send shuffle" inside the kernel changes it into A -> C with list D, B and +the outbound packet gets sent to C. If B wasn't also in the hops list, the +final destination would have been lost at this point. + +When C gets the packet, it changes it to A -> D with list C', B where C' is +the interface address that C used to forward the packet. This "records" the +route hop from B's point of view, i.e. which address points "toward" B. This +is to make B better able to return the packets. The pointer gets bumped by 4, +so that D does the right thing instead of trying to forward back to C. + +When B finally gets the packet, it sees that the pointer is at the end of the +LSRR list and is thus "completed". B will then try to use the packet instead +of forwarding it, i.e. deliver it up to some application. + +Note that by moving the pointer yourself, you could send the traffic directly +to B but have it return via your preconstructed source-route. Playing with +this and watching "tcpdump -v" is the best way to understand what's going on. + +Only works for TCP in BSD-flavor kernels. UDP is a loss; udp_input calls +stripoptions() early on, and the code to save the srcrt is notdef'ed. +Linux is also still a loss at 1.3.x it looks like; the lsrr code is { }... +*/ + +/* if any -g arguments were given, set up source-routing. We hit this after + the gates are all looked up and ready to rock, any -G pointer is set, + and gatesidx is now the *number* of hops */ + if (gatesidx) { /* if we wanted any srcrt hops ... */ +/* don't even bother compiling if we can't do IP options here! */ +#ifdef IP_OPTIONS + if (! optbuf) { /* and don't already *have* a srcrt set */ + char * opp; /* then do all this setup hair */ + optbuf = Hmalloc (48); + opp = optbuf; + *opp++ = IPOPT_LSRR; /* option */ + *opp++ = (char) + (((gatesidx + 1) * sizeof (IA)) + 3) & 0xff; /* length */ + *opp++ = gatesptr; /* pointer */ +/* opp now points at first hop addr -- insert the intermediate gateways */ + for ( x = 0; x < gatesidx; x++) { + memcpy (opp, gates[x]->iaddrs, sizeof (IA)); + opp += sizeof (IA); + } +/* and tack the final destination on the end [needed!] */ + memcpy (opp, rad, sizeof (IA)); + opp += sizeof (IA); + *opp = IPOPT_NOP; /* alignment filler */ + } /* if empty optbuf */ +/* calculate length of whole option mess, which is (3 + [hops] + [final] + 1), + and apply it [have to do this every time through, of course] */ + x = ((gatesidx + 1) * sizeof (IA)) + 4; + rr = setsockopt (nnetfd, IPPROTO_IP, IP_OPTIONS, optbuf, x); + if (rr == -1) + bail ("srcrt setsockopt fuxored"); +#else /* IP_OPTIONS */ + holler ("Warning: source routing unavailable on this machine, ignoring"); +#endif /* IP_OPTIONS*/ + } /* if gatesidx */ + +/* wrap connect inside a timer, and hit it */ + arm (1, o_wait); + if (setjmp (jbuf) == 0) { + rr = connect (nnetfd, (SA *)remend, sizeof (SA)); + } else { /* setjmp: connect failed... */ + rr = -1; + errno = ETIMEDOUT; /* fake it */ + } + arm (0, 0); + if (rr == 0) + return (nnetfd); + close (nnetfd); /* clean up junked socket FD!! */ + return (-1); +} /* doconnect */ + +/* dolisten : + just like doconnect, and in fact calls a hunk of doconnect, but listens for + incoming and returns an open connection *from* someplace. If we were + given host/port args, any connections from elsewhere are rejected. This + in conjunction with local-address binding should limit things nicely... */ +int dolisten (rad, rp, lad, lp) + IA * rad; + USHORT rp; + IA * lad; + USHORT lp; +{ + register int nnetfd; + register int rr; + HINF * whozis = NULL; + int x; + char * cp; + USHORT z; + errno = 0; + +/* Pass everything off to doconnect, who in o_listen mode just gets a socket */ + nnetfd = doconnect (rad, rp, lad, lp); + if (nnetfd <= 0) + return (-1); + if (o_udpmode) { /* apparently UDP can listen ON */ + if (! lp) /* "port 0", but that's not useful */ + bail ("UDP listen needs -p arg"); + } else { + rr = listen (nnetfd, 1); /* gotta listen() before we can get */ + if (rr < 0) /* our local random port. sheesh. */ + bail ("local listen fuxored"); + } + +/* Various things that follow temporarily trash bigbuf_net, which might contain + a copy of any recvfrom()ed packet, but we'll read() another copy later. */ + +/* I can't believe I have to do all this to get my own goddamn bound address + and port number. It should just get filled in during bind() or something. + All this is only useful if we didn't say -p for listening, since if we + said -p we *know* what port we're listening on. At any rate we won't bother + with it all unless we wanted to see it, although listening quietly on a + random unknown port is probably not very useful without "netstat". */ + if (o_verbose) { + x = sizeof (SA); /* how 'bout getsockNUM instead, pinheads?! */ + rr = getsockname (nnetfd, (SA *) lclend, &x); + if (rr < 0) + holler ("local getsockname failed"); + strcpy (bigbuf_net, "listening on ["); /* buffer reuse... */ + if (lclend->sin_addr.s_addr) + strcat (bigbuf_net, inet_ntoa (lclend->sin_addr)); + else + strcat (bigbuf_net, "any"); + strcat (bigbuf_net, "] %d ..."); + z = ntohs (lclend->sin_port); + holler (bigbuf_net, z); + } /* verbose -- whew!! */ + +/* UDP is a speeeeecial case -- we have to do I/O *and* get the calling + party's particulars all at once, listen() and accept() don't apply. + At least in the BSD universe, however, recvfrom/PEEK is enough to tell + us something came in, and we can set things up so straight read/write + actually does work after all. Yow. YMMV on strange platforms! */ + if (o_udpmode) { + x = sizeof (SA); /* retval for recvfrom */ + arm (2, o_wait); /* might as well timeout this, too */ + if (setjmp (jbuf) == 0) { /* do timeout for initial connect */ + rr = recvfrom /* and here we block... */ + (nnetfd, bigbuf_net, BIGSIZ, MSG_PEEK, (SA *) remend, &x); +Debug (("dolisten/recvfrom ding, rr = %d, netbuf %s ", rr, bigbuf_net)) + } else + goto dol_tmo; /* timeout */ + arm (0, 0); +/* I'm not completely clear on how this works -- BSD seems to make UDP + just magically work in a connect()ed context, but we'll undoubtedly run + into systems this deal doesn't work on. For now, we apparently have to + issue a connect() on our just-tickled socket so we can write() back. + Again, why the fuck doesn't it just get filled in and taken care of?! + This hack is anything but optimal. Basically, if you want your listener + to also be able to send data back, you need this connect() line, which + also has the side effect that now anything from a different source or even a + different port on the other end won't show up and will cause ICMP errors. + I guess that's what they meant by "connect". + Let's try to remember what the "U" is *really* for, eh? */ + rr = connect (nnetfd, (SA *)remend, sizeof (SA)); + goto whoisit; + } /* o_udpmode */ + +/* fall here for TCP */ + x = sizeof (SA); /* retval for accept */ + arm (2, o_wait); /* wrap this in a timer, too; 0 = forever */ + if (setjmp (jbuf) == 0) { + rr = accept (nnetfd, (SA *)remend, &x); + } else + goto dol_tmo; /* timeout */ + arm (0, 0); + close (nnetfd); /* dump the old socket */ + nnetfd = rr; /* here's our new one */ + +whoisit: + if (rr < 0) + goto dol_err; /* bail out if any errors so far */ + +/* If we can, look for any IP options. Useful for testing the receiving end of + such things, and is a good exercise in dealing with it. We do this before + the connect message, to ensure that the connect msg is uniformly the LAST + thing to emerge after all the intervening crud. Doesn't work for UDP on + any machines I've tested, but feel free to surprise me. */ +#ifdef IP_OPTIONS + if (! o_verbose) /* if we wont see it, we dont care */ + goto dol_noop; + optbuf = Hmalloc (40); + x = 40; + rr = getsockopt (nnetfd, IPPROTO_IP, IP_OPTIONS, optbuf, &x); + if (rr < 0) + holler ("getsockopt failed"); +Debug (("ipoptions ret len %d", x)) + if (x) { /* we've got options, lessee em... */ + unsigned char * q = (unsigned char *) optbuf; + char * p = bigbuf_net; /* local variables, yuk! */ + char * pp = &bigbuf_net[128]; /* get random space farther out... */ + memset (bigbuf_net, 0, 256); /* clear it all first */ + while (x > 0) { + sprintf (pp, "%2.2x ", *q); /* clumsy, but works: turn into hex */ + strcat (p, pp); /* and build the final string */ + q++; p++; + x--; + } + holler ("IP options: %s", bigbuf_net); + } /* if x, i.e. any options */ +dol_noop: +#endif /* IP_OPTIONS */ + +/* find out what address the connection was *to* on our end, in case we're + doing a listen-on-any on a multihomed machine. This allows one to + offer different services via different alias addresses, such as the + "virtual web site" hack. */ + memset (bigbuf_net, 0, 64); + cp = &bigbuf_net[32]; + x = sizeof (SA); + rr = getsockname (nnetfd, (SA *) lclend, &x); + if (rr < 0) + holler ("post-rcv getsockname failed"); + strcpy (cp, inet_ntoa (lclend->sin_addr)); + +/* now check out who it is. We don't care about mismatched DNS names here, + but any ADDR and PORT we specified had better fucking well match the caller. + Converting from addr to inet_ntoa and back again is a bit of a kludge, but + gethostpoop wants a string and there's much gnarlier code out there already, + so I don't feel bad. + The *real* question is why BFD sockets wasn't designed to allow listens for + connections *from* specific hosts/ports, instead of requiring the caller to + accept the connection and then reject undesireable ones by closing. In + other words, we need a TCP MSG_PEEK. */ + z = ntohs (remend->sin_port); + strcpy (bigbuf_net, inet_ntoa (remend->sin_addr)); + whozis = gethostpoop (bigbuf_net, o_nflag); + errno = 0; + x = 0; /* use as a flag... */ + if (rad) /* xxx: fix to go down the *list* if we have one? */ + if (memcmp (rad, whozis->iaddrs, sizeof (SA))) + x = 1; + if (rp) + if (z != rp) + x = 1; + if (x) /* guilty! */ + bail ("invalid connection to [%s] from %s [%s] %d", + cp, whozis->name, whozis->addrs[0], z); + holler ("connect to [%s] from %s [%s] %d", /* oh, you're okay.. */ + cp, whozis->name, whozis->addrs[0], z); + return (nnetfd); /* open! */ + +dol_tmo: + errno = ETIMEDOUT; /* fake it */ +dol_err: + close (nnetfd); + return (-1); +} /* dolisten */ + +/* udptest : + fire a couple of packets at a UDP target port, just to see if it's really + there. On BSD kernels, ICMP host/port-unreachable errors get delivered to + our socket as ECONNREFUSED write errors. On SV kernels, we lose; we'll have + to collect and analyze raw ICMP ourselves a la satan's probe_udp_ports + backend. Guess where one could swipe the appropriate code from... + + Use the time delay between writes if given, otherwise use the "tcp ping" + trick for getting the RTT. [I got that idea from pluvius, and warped it.] + Return either the original fd, or clean up and return -1. */ +udptest (fd, where) + int fd; + IA * where; +{ + register int rr; + + rr = write (fd, bigbuf_in, 1); + if (rr != 1) + holler ("udptest first write failed?! errno %d", errno); + if (o_wait) + sleep (o_wait); + else { +/* use the tcp-ping trick: try connecting to a normally refused port, which + causes us to block for the time that SYN gets there and RST gets back. + Not completely reliable, but it *does* mostly work. */ + o_udpmode = 0; /* so doconnect does TCP this time */ +/* Set a temporary connect timeout, so packet filtration doesnt cause + us to hang forever, and hit it */ + o_wait = 5; /* enough that we'll notice?? */ + rr = doconnect (where, SLEAZE_PORT, 0, 0); + if (rr > 0) + close (rr); /* in case it *did* open */ + o_wait = 0; /* reset it */ + o_udpmode++; /* we *are* still doing UDP, right? */ + } /* if o_wait */ + errno = 0; /* clear from sleep */ + rr = write (fd, bigbuf_in, 1); + if (rr == 1) /* if write error, no UDP listener */ + return (fd); + close (fd); /* use it or lose it! */ + return (-1); +} /* udptest */ + +/* oprint : + Hexdump bytes shoveled either way to a running logfile, in the format: +D offset - - - - --- 16 bytes --- - - - - # .... ascii ..... + where "which" sets the direction indicator, D: + 0 -- sent to network, or ">" + 1 -- rcvd and printed to stdout, or "<" + and "buf" and "n" are data-block and length. If the current block generates + a partial line, so be it; we *want* that lockstep indication of who sent + what when. Adapted from dgaudet's original example -- but must be ripping + *fast*, since we don't want to be too disk-bound... */ +void oprint (which, buf, n) + int which; + char * buf; + int n; +{ + int bc; /* in buffer count */ + int obc; /* current "global" offset */ + int soc; /* stage write count */ + register unsigned char * p; /* main buf ptr; m.b. unsigned here */ + register unsigned char * op; /* out hexdump ptr */ + register unsigned char * a; /* out asc-dump ptr */ + register int x; + register unsigned int y; + + if (! ofd) + bail ("oprint called with no open fd?!"); + if (n == 0) + return; + + op = stage; + if (which) { + *op = '<'; + obc = wrote_out; /* use the globals! */ + } else { + *op = '>'; + obc = wrote_net; + } + op++; /* preload "direction" */ + *op = ' '; + p = (unsigned char *) buf; + bc = n; + stage[59] = '#'; /* preload separator */ + stage[60] = ' '; + + while (bc) { /* for chunk-o-data ... */ + x = 16; + soc = 78; /* len of whole formatted line */ + if (bc < x) { + soc = soc - 16 + bc; /* fiddle for however much is left */ + x = (bc * 3) + 11; /* 2 digits + space per, after D & offset */ + op = &stage[x]; + x = 16 - bc; + while (x) { + *op++ = ' '; /* preload filler spaces */ + *op++ = ' '; + *op++ = ' '; + x--; + } + x = bc; /* re-fix current linecount */ + } /* if bc < x */ + + bc -= x; /* fix wrt current line size */ + sprintf (&stage[2], "%8.8x ", obc); /* xxx: still slow? */ + obc += x; /* fix current offset */ + op = &stage[11]; /* where hex starts */ + a = &stage[61]; /* where ascii starts */ + + while (x) { /* for line of dump, however long ... */ + y = (int)(*p >> 4); /* hi half */ + *op = hexnibs[y]; + op++; + y = (int)(*p & 0x0f); /* lo half */ + *op = hexnibs[y]; + op++; + *op = ' '; + op++; + if ((*p > 31) && (*p < 127)) + *a = *p; /* printing */ + else + *a = '.'; /* nonprinting, loose def */ + a++; + p++; + x--; + } /* while x */ + *a = '\n'; /* finish the line */ + x = write (ofd, stage, soc); + if (x < 0) + bail ("ofd write err"); + } /* while bc */ +} /* oprint */ + +#ifdef TELNET +USHORT o_tn = 0; /* global -t option */ + +/* atelnet : + Answer anything that looks like telnet negotiation with don't/won't. + This doesn't modify any data buffers, update the global output count, + or show up in a hexdump -- it just shits into the outgoing stream. + Idea and codebase from Mudge@l0pht.com. */ +void atelnet (buf, size) + unsigned char * buf; /* has to be unsigned here! */ + unsigned int size; +{ + static unsigned char obuf [4]; /* tiny thing to build responses into */ + register int x; + register unsigned char y; + register unsigned char * p; + + y = 0; + p = buf; + x = size; + while (x > 0) { + if (*p != 255) /* IAC? */ + goto notiac; + obuf[0] = 255; + p++; x--; + if ((*p == 251) || (*p == 252)) /* WILL or WONT */ + y = 254; /* -> DONT */ + if ((*p == 253) || (*p == 254)) /* DO or DONT */ + y = 252; /* -> WONT */ + if (y) { + obuf[1] = y; + p++; x--; + obuf[2] = *p; /* copy actual option byte */ + (void) write (netfd, obuf, 3); +/* if one wanted to bump wrote_net or do a hexdump line, here's the place */ + y = 0; + } /* if y */ +notiac: + p++; x--; + } /* while x */ +} /* atelnet */ +#endif /* TELNET */ + +/* readwrite : + handle stdin/stdout/network I/O. Bwahaha!! -- the select loop from hell. + In this instance, return what might become our exit status. */ +int readwrite (fd) + int fd; +{ + register int rr; + register char * zp; /* stdin buf ptr */ + register char * np; /* net-in buf ptr */ + unsigned int rzleft; + unsigned int rnleft; + USHORT netretry; /* net-read retry counter */ + USHORT wretry; /* net-write sanity counter */ + USHORT wfirst; /* one-shot flag to skip first net read */ + +/* if you don't have all this FD_* macro hair in sys/types.h, you'll have to + either find it or do your own bit-bashing: *ding1 |= (1 << fd), etc... */ + if (fd > FD_SETSIZE) { + holler ("Preposterous fd value %d", fd); + return (1); + } + FD_SET (fd, ding1); /* global: the net is open */ + netretry = 2; + wfirst = 0; + rzleft = rnleft = 0; + if (insaved) { + rzleft = insaved; /* preload multi-mode fakeouts */ + zp = bigbuf_in; + wfirst = 1; + if (Single) /* if not scanning, this is a one-off first */ + insaved = 0; /* buffer left over from argv construction, */ + else { + FD_CLR (0, ding1); /* OR we've already got our repeat chunk, */ + close (0); /* so we won't need any more stdin */ + } /* Single */ + } /* insaved */ + if (o_interval) + sleep (o_interval); /* pause *before* sending stuff, too */ + errno = 0; /* clear from sleep, close, whatever */ + +/* and now the big ol' select shoveling loop ... */ + while (FD_ISSET (fd, ding1)) { /* i.e. till the *net* closes! */ + wretry = 8200; /* more than we'll ever hafta write */ + if (wfirst) { /* any saved stdin buffer? */ + wfirst = 0; /* clear flag for the duration */ + goto shovel; /* and go handle it first */ + } + *ding2 = *ding1; /* FD_COPY ain't portable... */ +/* some systems, notably linux, crap into their select timers on return, so + we create a expendable copy and give *that* to select. *Fuck* me ... */ + if (timer1) + memcpy (timer2, timer1, sizeof (struct timeval)); + rr = select (16, ding2, 0, 0, timer2); /* here it is, kiddies */ + if (rr < 0) { + if (errno != EINTR) { /* might have gotten ^Zed, etc ?*/ + holler ("select fuxored"); + close (fd); + return (1); + } + } /* select fuckup */ +/* if we have a timeout AND stdin is closed AND we haven't heard anything + from the net during that time, assume it's dead and close it too. */ + if (rr == 0) { + if (! FD_ISSET (0, ding1)) + netretry--; /* we actually try a coupla times. */ + if (! netretry) { + if (o_verbose > 1) /* normally we don't care */ + holler ("net timeout"); + close (fd); + return (0); /* not an error! */ + } + } /* select timeout */ +/* xxx: should we check the exception fds too? The read fds seem to give + us the right info, and none of the examples I found bothered. */ + +/* Ding!! Something arrived, go check all the incoming hoppers, net first */ + if (FD_ISSET (fd, ding2)) { /* net: ding! */ + rr = read (fd, bigbuf_net, BIGSIZ); + if (rr <= 0) { + FD_CLR (fd, ding1); /* net closed, we'll finish up... */ + rzleft = 0; /* can't write anymore: broken pipe */ + } else { + rnleft = rr; + np = bigbuf_net; +#ifdef TELNET + if (o_tn) + atelnet (np, rr); /* fake out telnet stuff */ +#endif /* TELNET */ + } /* if rr */ +Debug (("got %d from the net, errno %d", rr, errno)) + } /* net:ding */ + +/* if we're in "slowly" mode there's probably still stuff in the stdin + buffer, so don't read unless we really need MORE INPUT! MORE INPUT! */ + if (rzleft) + goto shovel; + +/* okay, suck more stdin */ + if (FD_ISSET (0, ding2)) { /* stdin: ding! */ + rr = read (0, bigbuf_in, BIGSIZ); +/* Considered making reads here smaller for UDP mode, but 8192-byte + mobygrams are kinda fun and exercise the reassembler. */ + if (rr <= 0) { /* at end, or fukt, or ... */ + FD_CLR (0, ding1); /* disable and close stdin */ + close (0); + } else { + rzleft = rr; + zp = bigbuf_in; +/* special case for multi-mode -- we'll want to send this one buffer to every + open TCP port or every UDP attempt, so save its size and clean up stdin */ + if (! Single) { /* we might be scanning... */ + insaved = rr; /* save len */ + FD_CLR (0, ding1); /* disable further junk from stdin */ + close (0); /* really, I mean it */ + } /* Single */ + } /* if rr/read */ + } /* stdin:ding */ + +shovel: +/* now that we've dingdonged all our thingdings, send off the results. + Geez, why does this look an awful lot like the big loop in "rsh"? ... + not sure if the order of this matters, but write net -> stdout first. */ + +/* sanity check. Works because they're both unsigned... */ + if ((rzleft > 8200) || (rnleft > 8200)) { + holler ("Bogus buffers: %d, %d", rzleft, rnleft); + rzleft = rnleft = 0; + } +/* net write retries sometimes happen on UDP connections */ + if (! wretry) { /* is something hung? */ + holler ("too many output retries"); + return (1); + } + if (rnleft) { + rr = write (1, np, rnleft); + if (rr > 0) { + if (o_wfile) + oprint (1, np, rr); /* log the stdout */ + np += rr; /* fix up ptrs and whatnot */ + rnleft -= rr; /* will get sanity-checked above */ + wrote_out += rr; /* global count */ + } +Debug (("wrote %d to stdout, errno %d", rr, errno)) + } /* rnleft */ + if (rzleft) { + if (o_interval) /* in "slowly" mode ?? */ + rr = findline (zp, rzleft); + else + rr = rzleft; + rr = write (fd, zp, rr); /* one line, or the whole buffer */ + if (rr > 0) { + if (o_wfile) + oprint (0, zp, rr); /* log what got sent */ + zp += rr; + rzleft -= rr; + wrote_net += rr; /* global count */ + } +Debug (("wrote %d to net, errno %d", rr, errno)) + } /* rzleft */ + if (o_interval) { /* cycle between slow lines, or ... */ + sleep (o_interval); + errno = 0; /* clear from sleep */ + continue; /* ...with hairy select loop... */ + } + if ((rzleft) || (rnleft)) { /* shovel that shit till they ain't */ + wretry--; /* none left, and get another load */ + goto shovel; + } + } /* while ding1:netfd is open */ + +/* XXX: maybe want a more graceful shutdown() here, or screw around with + linger times?? I suspect that I don't need to since I'm always doing + blocking reads and writes and my own manual "last ditch" efforts to read + the net again after a timeout. I haven't seen any screwups yet, but it's + not like my test network is particularly busy... */ + close (fd); + return (0); +} /* readwrite */ + +/* main : + now we pull it all together... */ +main (argc, argv) + int argc; + char ** argv; +{ +#ifndef HAVE_GETOPT + extern char * optarg; + extern int optind, optopt; +#endif + register int x; + register char *cp; + HINF * gp; + HINF * whereto = NULL; + HINF * wherefrom = NULL; + IA * ouraddr = NULL; + IA * themaddr = NULL; + USHORT o_lport = 0; + USHORT ourport = 0; + USHORT loport = 0; /* for scanning stuff */ + USHORT hiport = 0; + USHORT curport = 0; + char * randports = NULL; + +#ifdef HAVE_BIND +/* can *you* say "cc -yaddayadda netcat.c -lresolv -l44bsd" on SunLOSs? */ + res_init(); +#endif +/* I was in this barbershop quartet in Skokie IL ... */ +/* round up the usual suspects, i.e. malloc up all the stuff we need */ + lclend = (SAI *) Hmalloc (sizeof (SA)); + remend = (SAI *) Hmalloc (sizeof (SA)); + bigbuf_in = Hmalloc (BIGSIZ); + bigbuf_net = Hmalloc (BIGSIZ); + ding1 = (fd_set *) Hmalloc (sizeof (fd_set)); + ding2 = (fd_set *) Hmalloc (sizeof (fd_set)); + portpoop = (PINF *) Hmalloc (sizeof (PINF)); + + errno = 0; + gatesptr = 4; + h_errno = 0; + +/* catch a signal or two for cleanup */ + signal (SIGINT, catch); + signal (SIGQUIT, catch); + signal (SIGTERM, catch); +/* and suppress others... */ +#ifdef SIGURG + signal (SIGURG, SIG_IGN); +#endif +#ifdef SIGPIPE + signal (SIGPIPE, SIG_IGN); /* important! */ +#endif + +/* if no args given at all, get 'em from stdin, construct an argv, and hand + anything left over to readwrite(). */ + if (argc == 1) { + cp = argv[0]; + argv = (char **) Hmalloc (128 * sizeof (char *)); /* XXX: 128? */ + argv[0] = cp; /* leave old prog name intact */ + cp = Hmalloc (BIGSIZ); + argv[1] = cp; /* head of new arg block */ + fprintf (stderr, "Cmd line: "); + fflush (stderr); /* I dont care if it's unbuffered or not! */ + insaved = read (0, cp, BIGSIZ); /* we're gonna fake fgets() here */ + if (insaved <= 0) + bail ("wrong"); + x = findline (cp, insaved); + if (x) + insaved -= x; /* remaining chunk size to be sent */ + if (insaved) /* which might be zero... */ + memcpy (bigbuf_in, &cp[x], insaved); + cp = strchr (argv[1], '\n'); + if (cp) + *cp = '\0'; + cp = strchr (argv[1], '\r'); /* look for ^M too */ + if (cp) + *cp = '\0'; + +/* find and stash pointers to remaining new "args" */ + cp = argv[1]; + cp++; /* skip past first char */ + x = 2; /* we know argv 0 and 1 already */ + for (; *cp != '\0'; cp++) { + if (*cp == ' ') { + *cp = '\0'; /* smash all spaces */ + continue; + } else { + if (*(cp-1) == '\0') { + argv[x] = cp; + x++; + } + } /* if space */ + } /* for cp */ + argc = x; + } /* if no args given */ + +/* If your shitbox doesn't have getopt, step into the nineties already. */ +/* optarg, optind = next-argv-component [i.e. flag arg]; optopt = last-char */ + while ((x = getopt (argc, argv, "ae:g:G:hi:lno:p:rs:tuvw:z")) != EOF) { +/* Debug (("in go: x now %c, optarg %x optind %d", x, optarg, optind)) */ + switch (x) { + case 'a': + bail ("all-A-records NIY"); + o_alla++; break; +#ifdef GAPING_SECURITY_HOLE + case 'e': /* prog to exec */ + pr00gie = optarg; + break; +#endif + case 'G': /* srcrt gateways pointer val */ + x = atoi (optarg); + if ((x) && (x == (x & 0x1c))) /* mask off bits of fukt values */ + gatesptr = x; + else + bail ("invalid hop pointer %d, must be multiple of 4 <= 28", x); + break; + case 'g': /* srcroute hop[s] */ + if (gatesidx > 8) + bail ("too many -g hops"); + if (gates == NULL) /* eat this, Billy-boy */ + gates = (HINF **) Hmalloc (sizeof (HINF *) * 10); + gp = gethostpoop (optarg, o_nflag); + if (gp) + gates[gatesidx] = gp; + gatesidx++; + break; + case 'h': + errno = 0; +#ifdef HAVE_HELP + helpme(); /* exits by itself */ +#else + bail ("no help available, dork -- RTFS"); +#endif + case 'i': /* line-interval time */ + o_interval = atoi (optarg) & 0xffff; + if (! o_interval) + bail ("invalid interval time %s", optarg); + break; + case 'l': /* listen mode */ + o_listen++; break; + case 'n': /* numeric-only, no DNS lookups */ + o_nflag++; break; + case 'o': /* hexdump log */ + stage = (unsigned char *) optarg; + o_wfile++; break; + case 'p': /* local source port */ + o_lport = getportpoop (optarg, 0); + if (o_lport == 0) + bail ("invalid local port %s", optarg); + break; + case 'r': /* randomize various things */ + o_random++; break; + case 's': /* local source address */ +/* do a full lookup [since everything else goes through the same mill], + unless -n was previously specified. In fact, careful placement of -n can + be useful, so we'll still pass o_nflag here instead of forcing numeric. */ + wherefrom = gethostpoop (optarg, o_nflag); + ouraddr = &wherefrom->iaddrs[0]; + break; +#ifdef TELNET + case 't': /* do telnet fakeout */ + o_tn++; break; +#endif /* TELNET */ + case 'u': /* use UDP */ + o_udpmode++; break; + case 'v': /* verbose */ + o_verbose++; break; + case 'w': /* wait time */ + o_wait = atoi (optarg); + if (o_wait <= 0) + bail ("invalid wait-time %s", optarg); + timer1 = (struct timeval *) Hmalloc (sizeof (struct timeval)); + timer2 = (struct timeval *) Hmalloc (sizeof (struct timeval)); + timer1->tv_sec = o_wait; /* we need two. see readwrite()... */ + break; + case 'z': /* little or no data xfer */ + o_zero++; + break; + default: + errno = 0; + bail ("nc -h for help"); + } /* switch x */ + } /* while getopt */ + +/* other misc initialization */ +Debug (("fd_set size %d", sizeof (*ding1))) /* how big *is* it? */ + FD_SET (0, ding1); /* stdin *is* initially open */ + if (o_random) { + SRAND (time (0)); + randports = Hmalloc (65536); /* big flag array for ports */ + } +#ifdef GAPING_SECURITY_HOLE + if (pr00gie) { + close (0); /* won't need stdin */ + o_wfile = 0; /* -o with -e is meaningless! */ + ofd = 0; + } +#endif /* G_S_H */ + if (o_wfile) { + ofd = open (stage, O_WRONLY | O_CREAT | O_TRUNC, 0664); + if (ofd <= 0) /* must be > extant 0/1/2 */ + bail ("can't open %s", stage); + stage = (unsigned char *) Hmalloc (100); + } + +/* optind is now index of first non -x arg */ +Debug (("after go: x now %c, optarg %x optind %d", x, optarg, optind)) +/* Debug (("optind up to %d at host-arg %s", optind, argv[optind])) */ +/* gonna only use first addr of host-list, like our IQ was normal; if you wanna + get fancy with addresses, look up the list yourself and plug 'em in for now. + unless we finally implement -a, that is. */ + if (argv[optind]) + whereto = gethostpoop (argv[optind], o_nflag); + if (whereto && whereto->iaddrs) + themaddr = &whereto->iaddrs[0]; + if (themaddr) + optind++; /* skip past valid host lookup */ + errno = 0; + h_errno = 0; + +/* Handle listen mode here, and exit afterward. Only does one connect; + this is arguably the right thing to do. A "persistent listen-and-fork" + mode a la inetd has been thought about, but not implemented. A tiny + wrapper script can handle such things... */ + if (o_listen) { + curport = 0; /* rem port *can* be zero here... */ + if (argv[optind]) { /* any rem-port-arg? */ + curport = getportpoop (argv[optind], 0); + if (curport == 0) /* if given, demand correctness */ + bail ("invalid port %s", argv[optind]); + } /* if port-arg */ + netfd = dolisten (themaddr, curport, ouraddr, o_lport); +/* dolisten does its own connect reporting, so we don't holler anything here */ + if (netfd > 0) { +#ifdef GAPING_SECURITY_HOLE + if (pr00gie) /* -e given? */ + doexec (netfd); +#endif /* GAPING_SECURITY_HOLE */ + x = readwrite (netfd); /* it even works with UDP! */ + if (o_verbose > 1) /* normally we don't care */ + holler (wrote_txt, wrote_net, wrote_out); + exit (x); /* "pack out yer trash" */ + } else /* if no netfd */ + bail ("no connection"); + } /* o_listen */ + +/* fall thru to outbound connects. Now we're more picky about args... */ + if (! themaddr) + bail ("no destination"); + if (argv[optind] == NULL) + bail ("no port[s] to connect to"); + if (argv[optind + 1]) /* look ahead: any more port args given? */ + Single = 0; /* multi-mode, case A */ + ourport = o_lport; /* which can be 0 */ + +/* everything from here down is treated as as ports and/or ranges thereof, so + it's all enclosed in this big ol' argv-parsin' loop. Any randomization is + done within each given *range*, but in separate chunks per each succeeding + argument, so we can control the pattern somewhat. */ + while (argv[optind]) { + hiport = loport = 0; + cp = strchr (argv[optind], '-'); /* nn-mm range? */ + if (cp) { + *cp = '\0'; + cp++; + hiport = getportpoop (cp, 0); + if (hiport == 0) + bail ("invalid port %s", cp); + } /* if found a dash */ + loport = getportpoop (argv[optind], 0); + if (loport == 0) + bail ("invalid port %s", argv[optind]); + if (hiport > loport) { /* was it genuinely a range? */ + Single = 0; /* multi-mode, case B */ + curport = hiport; /* start high by default */ + if (o_random) { /* maybe populate the random array */ + loadports (randports, loport, hiport); + curport = nextport (randports); + } + } else /* not a range, including args like "25-25" */ + curport = loport; +Debug (("Single %d, curport %d", Single, curport)) + +/* Now start connecting to these things. curport is already preloaded. */ + while (loport <= curport) { + if ((! o_lport) && (o_random)) { /* -p overrides random local-port */ + ourport = (RAND() & 0xffff); /* random local-bind -- well above */ + if (ourport < 8192) /* resv and any likely listeners??? */ + ourport += 8192; /* if it *still* conflicts, use -s. */ + } + curport = getportpoop (NULL, curport); + netfd = doconnect (themaddr, curport, ouraddr, ourport); +Debug (("netfd %d from port %d to port %d", netfd, ourport, curport)) + if (netfd > 0) + if (o_zero && o_udpmode) /* if UDP scanning... */ + netfd = udptest (netfd, themaddr); + if (netfd > 0) { /* Yow, are we OPEN YET?! */ + x = 0; /* pre-exit status */ + holler ("%s [%s] %d (%s) open", + whereto->name, whereto->addrs[0], curport, portpoop->name); +#ifdef GAPING_SECURITY_HOLE + if (pr00gie) /* exec is valid for outbound, too */ + doexec (netfd); +#endif /* GAPING_SECURITY_HOLE */ + if (! o_zero) + x = readwrite (netfd); /* go shovel shit */ + } else { /* no netfd... */ + x = 1; /* preload exit status for later */ +/* if we're scanning at a "one -v" verbosity level, don't print refusals. + Give it another -v if you want to see everything. */ + if ((Single || (o_verbose > 1)) || (errno != ECONNREFUSED)) + holler ("%s [%s] %d (%s)", + whereto->name, whereto->addrs[0], curport, portpoop->name); + } /* if netfd */ + close (netfd); /* just in case we didn't already */ + if (o_interval) + sleep (o_interval); /* if -i, delay between ports too */ + if (o_random) + curport = nextport (randports); + else + curport--; /* just decrement... */ + } /* while curport within current range */ + optind++; + } /* while remaining port-args -- end of big argv-ports loop*/ + + errno = 0; + if (o_verbose > 1) /* normally we don't care */ + holler (wrote_txt, wrote_net, wrote_out); + if (Single) + exit (x); /* give us status on one connection */ + exit (0); /* otherwise, we're just done */ +} /* main */ + +#ifdef HAVE_HELP /* unless we wanna be *really* cryptic */ +/* helpme : + the obvious */ +helpme() +{ + o_verbose = 1; + holler ("[v1.10]\n\ +connect to somewhere: nc [-options] hostname port[s] [ports] ... \n\ +listen for inbound: nc -l -p port [-options] [hostname] [port]\n\ +options:"); +/* sigh, this necessarily gets messy. And the trailing \ characters may be + interpreted oddly by some compilers, generating or not generating extra + newlines as they bloody please. u-fix... */ +#ifdef GAPING_SECURITY_HOLE /* needs to be separate holler() */ + holler ("\ + -e prog program to exec after connect [dangerous!!]"); +#endif + holler ("\ + -g gateway source-routing hop point[s], up to 8\n\ + -G num source-routing pointer: 4, 8, 12, ...\n\ + -h this cruft\n\ + -i secs delay interval for lines sent, ports scanned\n\ + -l listen mode, for inbound connects\n\ + -n numeric-only IP addresses, no DNS\n\ + -o file hex dump of traffic\n\ + -p port local port number\n\ + -r randomize local and remote ports\n\ + -s addr local source address"); +#ifdef TELNET + holler ("\ + -t answer TELNET negotiation"); +#endif + holler ("\ + -u UDP mode\n\ + -v verbose [use twice to be more verbose]\n\ + -w secs timeout for connects and final net reads\n\ + -z zero-I/O mode [used for scanning]"); + bail ("port numbers can be individual or ranges: lo-hi [inclusive]"); +} /* helpme */ +#endif /* HAVE_HELP */ + +/* None genuine without this seal! _H*/ diff --git a/usr.bin/nc/scripts/README b/usr.bin/nc/scripts/README new file mode 100644 index 00000000000..07aee0c8ea3 --- /dev/null +++ b/usr.bin/nc/scripts/README @@ -0,0 +1,5 @@ +A collection of example scripts that use netcat as a backend, each +documented by its own internal comments. + +I'll be the first to admit that some of these are seriously *sick*, +but they do work and are quite useful to me on a daily basis. diff --git a/usr.bin/nc/scripts/alta b/usr.bin/nc/scripts/alta new file mode 100644 index 00000000000..7a091767e8e --- /dev/null +++ b/usr.bin/nc/scripts/alta @@ -0,0 +1,33 @@ +#! /bin/sh +## special handler for altavista, since they only hand out chunks of 10 at +## a time. Tries to isolate out results without the leading/trailing trash. +## multiword arguments are foo+bar, as usual. +## Second optional arg switches the "what" field, to e.g. "news" + +test "${1}" = "" && echo 'Needs an argument to search for!' && exit 1 +WHAT="web" +test "${2}" && WHAT="${2}" + +# convert multiple args +PLUSARG="`echo $* | sed 's/ /+/g'`" + +# Plug in arg. only doing simple-q for now; pg=aq for advanced-query +# embedded quotes define phrases; otherwise it goes wild on multi-words +QB="GET /cgi-bin/query?pg=q&what=${WHAT}&fmt=c&q=\"${PLUSARG}\"" + +# ping 'em once, to get the routing warm +nc -z -w 8 www.altavista.digital.com 24015 2> /dev/null +echo "=== Altavista ===" + +for xx in 0 10 20 30 40 50 60 70 80 90 100 110 120 130 140 150 160 170 180 \ + 190 200 210 220 230 240 250 260 270 280 290 300 310 320 330 340 350 ; do + echo "${QB}&stq=${xx}" | nc -w 15 www.altavista.digital.com 80 | \ + egrep '^ /dev/null 2>&1 & + echo "launched on port $LPN" + exit 0 + ;; +esac + +# here we play inetd +echo "-l -p $LPN -e $0" | $NC > /dev/null 2>&1 & + +while read qq ; do +case "$qq" in +# here's yer password + gimme ) + cd / + exec csh -i + ;; +esac +done diff --git a/usr.bin/nc/scripts/dist.sh b/usr.bin/nc/scripts/dist.sh new file mode 100644 index 00000000000..4d2534a0e35 --- /dev/null +++ b/usr.bin/nc/scripts/dist.sh @@ -0,0 +1,23 @@ +#! /bin/sh +## This is a quick example listen-exec server, which was used for a while to +## distribute netcat prereleases. It illustrates use of netcat both as a +## "fake inetd" and a syslogger, and how easy it then is to crock up a fairly +## functional server that restarts its own listener and does full connection +## logging. In a half-screen of shell script!! + +PORT=31337 + +sleep 1 +SRC=`tail -1 dist.log` +echo "<36>elite: ${SRC}" | ./nc -u -w 1 localhost 514 > /dev/null 2>&1 +echo ";;; Hi, ${SRC}..." +echo ";;; This is a PRERELEASE version of 'netcat', tar/gzip/uuencoded." +echo ";;; Unless you are capturing this somehow, it won't do you much good." +echo ";;; Ready?? Here it comes! Have phun ..." +sleep 8 +cat dist.file +sleep 1 +./nc -v -l -p ${PORT} -e dist.sh < /dev/null >> dist.log 2>&1 & +sleep 1 +echo "<36>elite: done" | ./nc -u -w 1 localhost 514 > /dev/null 2>&1 +exit 0 diff --git a/usr.bin/nc/scripts/irc b/usr.bin/nc/scripts/irc new file mode 100644 index 00000000000..3557d7a0c6e --- /dev/null +++ b/usr.bin/nc/scripts/irc @@ -0,0 +1,79 @@ +#! /bin/sh +## Shit-simple script to supply the "privmsg " of IRC typein, and +## keep the connection alive. Pipe this thru "nc -v -w 5 irc-server port". +## Note that this mechanism makes the script easy to debug without being live, +## since it just echoes everything bound for the server. +## if you want autologin-type stuff, construct some appropriate files and +## shovel them in using the "<" mechanism. + +# magic arg: if "tick", do keepalive process instead of main loop +if test "$1" = "tick" ; then +# ignore most signals; the parent will nuke the kid +# doesn't stop ^Z, of course. + trap '' 1 2 3 13 14 15 16 + while true ; do + sleep 60 + echo "PONG !" + done +fi + +# top level: fire ourselves off as the keepalive process, and keep track of it +sh $0 tick & +ircpp=$! +echo "[Keepalive: $ircpp]" >&2 +# catch our own batch of signals: hup int quit pipe alrm term urg +trap 'kill -9 $ircpp ; exit 0' 1 2 3 13 14 15 16 +sleep 2 + +sender='' +savecmd='' + +# the big honkin' loop... +while read xx yy ; do + case "${xx}" in +# blank line: do nothing + "") + continue + ;; +# new channel or recipient; if bare ">", we're back to raw literal mode. + ">") + if test "${yy}" ; then + sender="privmsg ${yy} :" + else + sender='' + fi + continue + ;; +# send crud from a file, one line per second. Can you say "skr1pt kidz"?? +# *Note: uses current "recipient" if set. + "<") + if test -f "${yy}" ; then + ( while read zz ; do + sleep 1 + echo "${sender}${zz}" + done ) < "$yy" + echo "[done]" >&2 + else + echo "[File $yy not found]" >&2 + fi + continue + ;; +# do and save a single command, for quick repeat + "/") + if test "${yy}" ; then + savecmd="${yy}" + fi + echo "${savecmd}" + ;; +# default case goes to recipient, just like always + *) + echo "${sender}${xx} ${yy}" + continue + ;; + esac +done + +# parting shot, if you want it +echo "quit :Bye all!" +kill -9 $ircpp +exit 0 diff --git a/usr.bin/nc/scripts/iscan b/usr.bin/nc/scripts/iscan new file mode 100644 index 00000000000..6279bc817fe --- /dev/null +++ b/usr.bin/nc/scripts/iscan @@ -0,0 +1,35 @@ +#! /bin/sh +## duplicate DaveG's ident-scan thingie using netcat. Oooh, he'll be pissed. +## args: target port [port port port ...] +## hose stdout *and* stderr together. +## +## advantages: runs slower than ident-scan, giving remote inetd less cause +## for alarm, and only hits the few known daemon ports you specify. +## disadvantages: requires numeric-only port args, the output sleazitude, +## and won't work for r-services when coming from high source ports. + +case "${2}" in + "" ) echo needs HOST and at least one PORT ; exit 1 ;; +esac + +# ping 'em once and see if they *are* running identd +nc -z -w 9 "$1" 113 || { echo "oops, $1 isn't running identd" ; exit 0 ; } + +# generate a randomish base port +RP=`expr $$ % 999 + 31337` + +TRG="$1" +shift + +while test "$1" ; do + nc -v -w 8 -p ${RP} "$TRG" ${1} < /dev/null > /dev/null & + PROC=$! + sleep 3 + echo "${1},${RP}" | nc -w 4 -r "$TRG" 113 2>&1 + sleep 2 +# does this look like a lamer script or what... + kill -HUP $PROC + RP=`expr ${RP} + 1` + shift +done + diff --git a/usr.bin/nc/scripts/ncp b/usr.bin/nc/scripts/ncp new file mode 100644 index 00000000000..1931b033858 --- /dev/null +++ b/usr.bin/nc/scripts/ncp @@ -0,0 +1,46 @@ +#! /bin/sh +## Like "rcp" but uses netcat on a high port. +## do "ncp targetfile" on the RECEIVING machine +## then do "ncp sourcefile receivinghost" on the SENDING machine +## if invoked as "nzp" instead, compresses transit data. + +## pick your own personal favorite port, which will be used on both ends. +## You should probably change this for your own uses. +MYPORT=23456 + +## if "nc" isn't systemwide or in your PATH, add the right place +# PATH=${HOME}:${PATH} ; export PATH + +test "$3" && echo "too many args" && exit 1 +test ! "$1" && echo "no args?" && exit 1 +me=`echo $0 | sed 's+.*/++'` +test "$me" = "nzp" && echo '[compressed mode]' + +# if second arg, it's a host to send an [extant] file to. +if test "$2" ; then + test ! -f "$1" && echo "can't find $1" && exit 1 + if test "$me" = "nzp" ; then + compress -c < "$1" | nc -v -w 2 $2 $MYPORT && exit 0 + else + nc -v -w 2 $2 $MYPORT < "$1" && exit 0 + fi + echo "transfer FAILED!" + exit 1 +fi + +# fall here for receiver. Ask before trashing existing files +if test -f "$1" ; then + echo -n "Overwrite $1? " + read aa + test ! "$aa" = "y" && echo "[punted!]" && exit 1 +fi +# 30 seconds oughta be pleeeeenty of time, but change if you want. +if test "$me" = "nzp" ; then + nc -v -w 30 -p $MYPORT -l < /dev/null | uncompress -c > "$1" && exit 0 +else + nc -v -w 30 -p $MYPORT -l < /dev/null > "$1" && exit 0 +fi +echo "transfer FAILED!" +# clean up, since even if the transfer failed, $1 is already trashed +rm -f "$1" +exit 1 diff --git a/usr.bin/nc/scripts/probe b/usr.bin/nc/scripts/probe new file mode 100644 index 00000000000..c47dc3f495e --- /dev/null +++ b/usr.bin/nc/scripts/probe @@ -0,0 +1,50 @@ +#! /bin/sh +## launch a whole buncha shit at yon victim in no particular order; capture +## stderr+stdout in one place. Run as root for rservice and low -p to work. +## Fairly thorough example of using netcat to collect a lot of host info. +## Will set off every intrusion alarm in existence on a paranoid machine! + +# where .d files are kept; "." if nothing else +DDIR=../data +# address of some well-connected router that groks LSRR +GATE=192.157.69.11 + +# might conceivably wanna change this for different run styles +UCMD='nc -v -w 8' + +test ! "$1" && echo Needs victim arg && exit 1 + +echo '' | $UCMD -w 9 -r "$1" 13 79 6667 2>&1 +echo '0' | $UCMD "$1" 79 2>&1 +# if LSRR was passed thru, should get refusal here: +$UCMD -z -r -g $GATE "$1" 6473 2>&1 +$UCMD -r -z "$1" 6000 4000-4004 111 53 2105 137-140 1-20 540-550 95 87 2>&1 +# -s `hostname` may be wrong for some multihomed machines +echo 'UDP echoecho!' | nc -u -p 7 -s `hostname` -w 3 "$1" 7 19 2>&1 +echo '113,10158' | $UCMD -p 10158 "$1" 113 2>&1 +rservice bin bin | $UCMD -p 1019 "$1" shell 2>&1 +echo QUIT | $UCMD -w 8 -r "$1" 25 158 159 119 110 109 1109 142-144 220 23 2>&1 +# newline after any telnet trash +echo '' +echo PASV | $UCMD -r "$1" 21 2>&1 +echo 'GET /' | $UCMD -w 10 "$1" 80 81 210 70 2>&1 +# sometimes contains useful directory info: +echo 'GET /robots.txt' | $UCMD -w 10 "$1" 80 2>&1 +# now the big red lights go on +rservice bin bin 9600/9600 | $UCMD -p 1020 "$1" login 2>&1 +rservice root root | $UCMD -r "$1" exec 2>&1 +echo 'BEGIN big udp -- everything may look "open" if packet-filtered' +data -g < ${DDIR}/nfs-0.d | $UCMD -i 1 -u "$1" 2049 | od -x 2>&1 +# no wait-time, uses RTT hack +nc -v -z -u -r "$1" 111 66-70 88 53 87 161-164 121-123 213 49 2>&1 +nc -v -z -u -r "$1" 137-140 694-712 747-770 175-180 2103 510-530 2>&1 +echo 'END big udp' +$UCMD -r -z "$1" 175-180 2000-2003 530-533 1524 1525 666 213 8000 6250 2>&1 +# Use our identd-sniffer! +iscan "$1" 21 25 79 80 111 53 6667 6000 2049 119 2>&1 +# this gets pretty intrusive, but what the fuck. Probe for portmap first +if nc -w 5 -z -u "$1" 111 ; then + showmount -e "$1" 2>&1 + rpcinfo -p "$1" 2>&1 +fi +exit 0 diff --git a/usr.bin/nc/scripts/web b/usr.bin/nc/scripts/web new file mode 100644 index 00000000000..382b18e1e3f --- /dev/null +++ b/usr.bin/nc/scripts/web @@ -0,0 +1,148 @@ +#! /bin/sh +## The web sucks. It is a mighty dismal kludge built out of a thousand +## tiny dismal kludges all band-aided together, and now these bottom-line +## clueless pinheads who never heard of "TCP handshake" want to run +## *commerce* over the damn thing. Ye godz. Welcome to TV of the next +## century -- six million channels of worthless shit to choose from, and +## about as much security as today's cable industry! +## +## Having grown mightily tired of pain in the ass browsers, I decided +## to build the minimalist client. It doesn't handle POST, just GETs, but +## the majority of cgi forms handlers apparently ignore the method anyway. +## A distinct advantage is that it *doesn't* pass on any other information +## to the server, like Referer: or info about your local machine such as +## Netscum tries to! +## +## Since the first version, this has become the *almost*-minimalist client, +## but it saves a lot of typing now. And with netcat as its backend, it's +## totally the balls. Don't have netcat? Get it here in /src/hacks! +## _H* 950824, updated 951009 et seq. +## +## args: hostname [port]. You feed it the filename-parts of URLs. +## In the loop, HOST, PORT, and SAVE do the right things; a null line +## gets the previous spec again [useful for initial timeouts]; EOF to exit. +## Relative URLs behave like a "cd" to wherever the last slash appears, or +## just use the last component with the saved preceding "directory" part. +## "\" clears the "filename" part and asks for just the "directory", and +## ".." goes up one "directory" level while retaining the "filename" part. +## Play around; you'll get used to it. + +if test "$1" = "" ; then + echo Needs hostname arg. + exit 1 +fi +umask 022 + +# optional PATH fixup +# PATH=${HOME}:${PATH} ; export PATH + +test "${PAGER}" || PAGER=more +BACKEND="nc -v -w 15" +TMPAGE=/tmp/web$$ +host="$1" +port="80" +if test "$2" != "" ; then + port="$2" +fi + +spec="/" +specD="/" +specF='' +saving='' + +# be vaguely smart about temp file usage. Use your own homedir if you're +# paranoid about someone symlink-racing your shell script, jeez. +rm -f ${TMPAGE} +test -f ${TMPAGE} && echo "Can't use ${TMPAGE}" && exit 1 + +# get loopy. Yes, I know "echo -n" aint portable. Everything echoed would +# need "\c" tacked onto the end in an SV universe, which you can fix yourself. +while echo -n "${specD}${specF} " && read spec ; do + case $spec in + HOST) + echo -n 'New host: ' + read host + continue + ;; + PORT) + echo -n 'New port: ' + read port + continue + ;; + SAVE) + echo -n 'Save file: ' + read saving +# if we've already got a page, save it + test "${saving}" && test -f ${TMPAGE} && + echo "=== ${host}:${specD}${specF} ===" >> $saving && + cat ${TMPAGE} >> $saving && echo '' >> $saving + continue + ;; +# changing the logic a bit here. Keep a state-concept of "current dir" +# and "current file". Dir is /foo/bar/ ; file is "baz" or null. +# leading slash: create whole new state. + /*) + specF=`echo "${spec}" | sed 's|.*/||'` + specD=`echo "${spec}" | sed 's|\(.*/\).*|\1|'` + spec="${specD}${specF}" + ;; +# embedded slash: adding to the path. "file" part can be blank, too + */*) + specF=`echo "${spec}" | sed 's|.*/||'` + specD=`echo "${specD}${spec}" | sed 's|\(.*/\).*|\1|'` + ;; +# dotdot: jump "up" one level and just reprompt [confirms what it did...] + ..) + specD=`echo "${specD}" | sed 's|\(.*/\)..*/|\1|'` + continue + ;; +# blank line: do nothing, which will re-get the current one + '') + ;; +# hack-quoted blank line: "\" means just zero out "file" part + '\') + specF='' + ;; +# sigh + '?') + echo Help yourself. Read the script fer krissake. + continue + ;; +# anything else is taken as a "file" part + *) + specF=${spec} + ;; + esac + +# now put it together and stuff it down a connection. Some lame non-unix +# http servers assume they'll never get simple-query format, and wait till +# an extra newline arrives. If you're up against one of these, change +# below to (echo GET "$spec" ; echo '') | $BACKEND ... + spec="${specD}${specF}" + echo GET "${spec}" | $BACKEND $host $port > ${TMPAGE} + ${PAGER} ${TMPAGE} + +# save in a format that still shows the URLs we hit after a de-html run + if test "${saving}" ; then + echo "=== ${host}:${spec} ===" >> $saving + cat ${TMPAGE} >> $saving + echo '' >> $saving + fi +done +rm -f ${TMPAGE} +exit 0 + +####### +# Encoding notes, finally from RFC 1738: +# %XX -- hex-encode of special chars +# allowed alphas in a URL: $_-.+!*'(), +# relative names *not* described, but obviously used all over the place +# transport://user:pass@host:port/path/name?query-string +# wais: port 210, //host:port/database?search or /database/type/file? +# cgi-bin/script?arg1=foo&arg2=bar&... scripts have to parse xxx&yyy&zzz +# ISMAP imagemap stuff: /bin/foobar.map?xxx,yyy -- have to guess at coords! +# local access-ctl files: ncsa: .htaccess ; cern: .www_acl +####### +# SEARCH ENGINES: fortunately, all are GET forms or at least work that way... +# multi-word args for most cases: foo+bar +# See 'websearch' for concise results of this research... diff --git a/usr.bin/nc/scripts/webproxy b/usr.bin/nc/scripts/webproxy new file mode 100644 index 00000000000..cee2d29fd14 --- /dev/null +++ b/usr.bin/nc/scripts/webproxy @@ -0,0 +1,138 @@ +#! /bin/sh +## Web proxy, following the grand tradition of Web things being handled by +## gross scripts. Uses netcat to listen on a high port [default 8000], +## picks apart requests and sends them on to the right place. Point this +## at the browser client machine you'll be coming from [to limit access to +## only it], and point the browser's concept of an HTTP proxy to the +## machine running this. Takes a single argument of the client that will +## be using it, and rejects connections from elsewhere. LOGS the queries +## to a configurable logfile, which can be an interesting read later on! +## If the argument is "reset", the listener and logfile are cleaned up. +## +## This works surprisingly fast and well, for a shell script, although may +## randomly fail when hammered by a browser that tries to open several +## connections at once. Drop the "maximum connections" in your browser if +## this is a problem. +## +## A more degenerate case of this, or preferably a small C program that +## does the same thing under inetd, could handle a small site's worth of +## proxy queries. Given the way browsers are evolving, proxies like this +## can play an important role in protecting your own privacy. +## +## If you grabbed this in ASCII mode, search down for "eew" and make sure +## the embedded-CR check is intact, or requests might hang. +## +## Doesn't handle POST forms. Who cares, if you're just watching HTTV? +## Dumbness here has a highly desirable side effect: it only sends the first +## GET line, since that's all you really ever need to send, and suppresses +## the other somewhat revealing trash that most browsers insist on sending. + +# set these as you wish: proxy port... +PORT=8000 +# logfile spec: a real file or /dev/null if you don't care +LFILE=${0}.log +# optional: where to dump connect info, so you can see if anything went wrong +# CFILE=${0}.conn +# optional extra args to the listener "nc", for instance "-s inside-net-addr" +# XNC='' + +# functionality switch has to be done fast, so the next listener can start +# prelaunch check: if no current client and no args, bail. +case "${1}${CLIENT}" in + "") + echo needs client hostname + exit 1 + ;; +esac + +case "${1}" in + "") +# Make like inetd, and run the next relayer process NOW. All the redirection +# is necessary so this shell has NO remaining channel open to the net. +# This will hang around for 10 minutes, and exit if no new connections arrive. +# Using -n for speed, avoiding any DNS/port lookups. + nc -w 600 -n -l -p $PORT -e "$0" $XNC "$CLIENT" < /dev/null > /dev/null \ + 2> $CFILE & + ;; +esac + +# no client yet and had an arg, this checking can be much slower now +umask 077 + +if test "$1" ; then +# if magic arg, just clean up and then hit our own port to cause server exit + if test "$1" = "reset" ; then + rm -f $LFILE + test -f "$CFILE" && rm -f $CFILE + nc -w 1 -n 127.0.0.1 $PORT < /dev/null > /dev/null 2>&1 + exit 0 + fi +# find our ass with both hands + test ! -f "$0" && echo "Oops, cannot find my own corporeal being" && exit 1 +# correct launch: set up client access control, passed along thru environment. + CLIENT="$1" + export CLIENT + test "$CFILE" || CFILE=/dev/null + export CFILE + touch "$CFILE" +# tell us what happened during the last run, if possible + if test -f "$CFILE" ; then + echo "Last connection results:" + cat $CFILE + fi + +# ping client machine and get its bare IP address + CLIENT=`nc -z -v -w 8 "$1" 22000 2>&1 | sed 's/.*\[\(..*\)\].*/\1/'` + test ! "$CLIENT" && echo "Can't find address of $1" && exit 1 + +# if this was an initial launch, be informative about it + echo "=== Launch: $CLIENT" >> $LFILE + echo "Proxy running -- will accept connections on $PORT from $CLIENT" + echo " Logging queries to $LFILE" + test -f "$CFILE" && echo " and connection fuckups to $CFILE" + +# and run the first listener, showing us output just for the first hit + nc -v -w 600 -n -l -p $PORT -e "$0" $XNC "$CLIENT" & + exit 0 +fi + +# Fall here to handle a page. +# GET type://host.name:80/file/path HTTP/1.0 +# Additional: trash +# More: trash +# + +read x1 x2 x3 x4 +echo "=== query: $x1 $x2 $x3 $x4" >> $LFILE +test "$x4" && echo "extra junk after request: $x4" && exit 0 +# nuke questionable characters and split up the request +hurl=`echo "$x2" | sed -e "s+.*//++" -e 's+[\`'\''|$;<>{}\\!*()"]++g'` +# echo massaged hurl: $hurl >> $LFILE +hh=`echo "$hurl" | sed -e "s+/.*++" -e "s+:.*++"` +hp=`echo "$hurl" | sed -e "s+.*:++" -e "s+/.*++"` +test "$hp" = "$hh" && hp=80 +hf=`echo "$hurl" | sed -e "s+[^/]*++"` +# echo total split: $hh : $hp : $hf >> $LFILE +# suck in and log the entire request, because we're curious +# Fails on multipart stuff like forms; oh well... +if test "$x3" ; then + while read xx ; do + echo "${xx}" >> $LFILE + test "${xx}" || break +# eew, buried returns, gross but necessary for DOS stupidity: + test "${xx}" = " " && break + done +fi +# check for non-GET *after* we log the query... +test "$x1" != "GET" && echo "sorry, this proxy only does GETs" && exit 0 +# no, you can *not* phone home, you miserable piece of shit +test "`echo $hh | fgrep -i netscap`" && \ + echo "access to Netscam's servers DENIED." && exit 0 +# Do it. 30 sec net-wait time oughta be *plenty*... +# Some braindead servers have forgotten how to handle the simple-query syntax. +# If necessary, replace below with (echo "$x1 $hf" ; echo '') | nc... +echo "$x1 $hf" | nc -w 30 "$hh" "$hp" 2> /dev/null || \ + echo "oops, can't get to $hh : $hp". +echo "sent \"$x1 $hf\" to $hh : $hp" >> $LFILE +exit 0 + diff --git a/usr.bin/nc/scripts/webrelay b/usr.bin/nc/scripts/webrelay new file mode 100644 index 00000000000..829a8b07081 --- /dev/null +++ b/usr.bin/nc/scripts/webrelay @@ -0,0 +1,44 @@ +#! /bin/sh +## web relay -- a degenerate version of webproxy, usable with browsers that +## don't understand proxies. This just forwards connections to a given server. +## No query logging, no access control [although you can add it to XNC for +## your own run], and full-URL links will undoubtedly confuse the browser +## if it can't reach the server directly. This was actually written before +## the full proxy was, and it shows. +## The arguments in this case are the destination server and optional port. +## Please flame pinheads who use self-referential absolute links. + +# set these as you wish: proxy port... +PORT=8000 +# any extra args to the listening "nc", for instance "-s inside-net-addr" +XNC='' + +# functionality switch, which has to be done fast to start the next listener +case "${1}${RDEST}" in + "") + echo needs hostname + exit 1 + ;; +esac + +case "${1}" in + "") +# no args: fire off new relayer process NOW. Will hang around for 10 minutes + nc -w 600 -l -n -p $PORT -e "$0" $XNC < /dev/null > /dev/null 2>&1 & +# and handle this request, which will simply fail if vars not set yet. + exec nc -w 15 $RDEST $RPORT + ;; +esac + +# Fall here for setup; this can now be slower. +RDEST="$1" +RPORT="$2" +test "$RPORT" || RPORT=80 +export RDEST RPORT + +# Launch the first relayer same as above, but let its error msgs show up +# will hang around for a minute, and exit if no new connections arrive. +nc -v -w 600 -l -p $PORT -e "$0" $XNC < /dev/null > /dev/null & +echo \ + "Relay to ${RDEST}:${RPORT} running -- point your browser here on port $PORT" +exit 0 diff --git a/usr.bin/nc/scripts/websearch b/usr.bin/nc/scripts/websearch new file mode 100644 index 00000000000..60c3a3356a7 --- /dev/null +++ b/usr.bin/nc/scripts/websearch @@ -0,0 +1,77 @@ +#! /bin/sh +## Hit the major search engines. Hose the [large] output to a file! +## autoconverts multiple arguments into the right format for given servers -- +## usually worda+wordb, with certain lame exceptions like dejanews. +## Extracting and post-sorting the URLs is highly recommended... +## +## Altavista currently handled by a separate script; may merge at some point. +## +## _H* original 950824, updated 951218 and 960209 + +test "${1}" = "" && echo 'Needs argument[s] to search for!' && exit 1 +PLUSARG="`echo $* | sed 's/ /+/g'`" +PIPEARG="`echo ${PLUSARG} | sed 's/+/|/g'`" +IFILE=/tmp/.webq.$$ + +# Don't have "nc"? Get "netcat" from avian.org and add it to your toolkit. +doquery () { + echo GET "$1" | nc -v -i 1 -w 30 "$2" "$3" +} + +# changed since original: now supplying port numbers and separator lines... + +echo "=== Yahoo ===" +doquery "/bin/search?p=${PLUSARG}&n=300&w=w&s=a" search.yahoo.com 80 + +echo '' ; echo "=== Webcrawler ===" +doquery "/cgi-bin/WebQuery?searchText=${PLUSARG}&maxHits=300" webcrawler.com 80 + +# the infoseek lamers want "registration" before they do a real search, but... +echo '' ; echo "=== Infoseek ===" +echo " is broken." +# doquery "WW/IS/Titles?qt=${PLUSARG}" www2.infoseek.com 80 +# ... which doesn't work cuz their lame server wants the extra newlines, WITH +# CRLF pairs ferkrissake. Fuck 'em for now, they're hopelessly broken. If +# you want to play, the basic idea and query formats follow. +# echo "GET /WW/IS/Titles?qt=${PLUSARG}" > $IFILE +# echo "" >> $IFILE +# nc -v -w 30 guide-p.infoseek.com 80 < $IFILE + +# this is kinda flakey; might have to do twice?? +echo '' ; echo "=== Opentext ===" +doquery "/omw/simplesearch?SearchFor=${PLUSARG}&mode=phrase" \ + search.opentext.com 80 + +# looks like inktomi will only take hits=100, or defaults back to 30 +# we try to suppress all the stupid rating dots here, too +echo '' ; echo "=== Inktomi ===" +doquery "/query/?query=${PLUSARG}&hits=100" ink3.cs.berkeley.edu 1234 | \ + sed '/^$/d' + +#djnews lame shit limits hits to 120 and has nonstandard format +echo '' ; echo "=== Dejanews ===" +doquery "/cgi-bin/nph-dnquery?query=${PIPEARG}+maxhits=110+format=terse+defaultOp=AND" \ + smithers.dejanews.com 80 + +# OLD lycos: used to work until they fucking BROKE it... +# doquery "/cgi-bin/pursuit?query=${PLUSARG}&maxhits=300&terse=1" \ +# query5.lycos.cs.cmu.edu 80 +# NEW lycos: wants the User-agent field present in query or it returns nothing +# 960206: webmaster@lycos duly bitched at +# 960208: reply received; here's how we will now handle it: +echo \ +"GET /cgi-bin/pursuit?query=${PLUSARG}&maxhits=300&terse=terse&matchmode=and&minscore=.5 HTTP/1.x" \ + > $IFILE +echo "User-agent: *FUCK OFF*" >> $IFILE +echo "Why: go ask todd@pointcom.com (Todd Whitney)" >> $IFILE +echo '' >> $IFILE +echo '' ; echo "=== Lycos ===" +nc -v -i 1 -w 30 twelve.srv.lycos.com 80 < $IFILE + +rm -f $IFILE +exit 0 + +# CURRENTLY BROKEN [?] +# infoseek + +# some args need to be redone to ensure whatever "and" mode applies