/**** Hollow Chocolate Bunnies From hell ---------------------------------- presenting refspoof.c - A HTTP referer spoofer written by softxor Refspoof is acting like a proxy server and is able to spoof your HTTP referer and user-agent. This comes in handy to bypass certain authentication mechanisms or user-agent limitations for some download managers. Port shouldn't be world accessable, might not be very secure. Start with ./refspoof -h to get help. compile with: gcc -o refspoof refspoof.c Contact: [+] Web: http://bunnies.phpnet.us/ [+] Mail: insertnamehere@ NOSPAM gmx.de [+] Irc: irc.milw0rm.com #hcbfh NOTE: Hollow chocolate bunnies from hell, the new upcoming security group of your trust, is still searching for new members. Join us in irc at irc.milw0rm.com #hcbfh and msg softxor or apply by email. Membership comes with free 0day midget porn. ****/ #include #include #include #include #include #include #include #include #include #include #include #include #include //how many pending connections? #define BACKLOG 50 #define VERSION "1.0" int verbose = 0; int listen_port = 8080; char *referer = "www.google.de"; char *user_agent = "Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8) Gecko/20051111 Firefox/1.5"; void usage(char *cmd) { fprintf(stderr, "Usage: %s \n" "Options:\n" "-r \tsets the HTTP referer (without http:// in front)\n" "-u \tsets the User-agent\n" "-v\t\tshows version\n" "-V\t\tsets verbose mode\n" "-p \tsets listening port\n" "-h\t\tshows this help\n" "Example: %s -r http://foo.net -u Mozilla1.0 -p 3029\n",cmd, cmd); } void send_error_page(int sockfd, char *message) { char error_header[] = "HTTP/1.1 200 OK\n" "Date: Mon, 23 May 2005 22:38:34 GMT\n" "Content-Length: 39\n" "Server: refspoof\n" "Connection: close\n" "Content-Type: text/html; charset=UTF-8\n\n"; char error_message[1024]; sprintf(error_message, "%s%s\n", error_header, message); write(sockfd, error_message, strlen(error_message)); } void connect_target(int sockfd_in, char *get_request, char *domain) { char recvbuffer[90000]; int sockfd; struct sockaddr_in srv; struct hostent *host; int x; if (strstr(domain, "about") != NULL) { send_error_page(sockfd_in, "refspoof " VERSION "
\nby softxor
\nhttp://softxor.ifastnet.net
\n"); _exit(1); } domain[strlen(domain) - 1] = '\0'; if((host = gethostbyname(domain)) == NULL) { send_error_page(sockfd_in, "Unable to find host. Maybe misspelled?"); fprintf(stderr, "ERROR: Unknown host %s\n", domain); _exit(1); } srv.sin_family = AF_INET; srv.sin_port = htons(80); srv.sin_addr = *(struct in_addr*) host->h_addr; if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) { fprintf(stderr, "ERROR: Cannot start socket()!\n"); exit(1); } if(connect(sockfd,(struct sockaddr*)&srv, sizeof(srv)) < 0) { fprintf(stderr, "ERROR: Could not connect to %s!\n", domain); send_error_page(sockfd_in, "Unable to connect to host."); close(sockfd); _exit(1); } if(write(sockfd, get_request, strlen(get_request)) < 0) { fprintf(stderr, "ERROR: Not able to get remote data.\n"); send_error_page(sockfd_in, "Not able to get remote data."); _exit(1); } bzero(&recvbuffer, sizeof(recvbuffer)); while (x = read(sockfd, recvbuffer, sizeof(recvbuffer))) {; if (verbose) printf("RECIEVING DATA: %s\n\n", recvbuffer); fflush(stdout); if (write(sockfd_in, recvbuffer, x) < 0) { fprintf(stderr, "ERROR: Not able to pipe datastream to client.\n"); _exit(1); } bzero(&recvbuffer, sizeof(recvbuffer)); } close(sockfd); } void relay_connection(int sockfd_in) { char recvbuffer[1024]; char *tmp; int i; char get_path[128]; char get_domain[128]; char get_request[1024]; if (recv(sockfd_in, recvbuffer, sizeof(recvbuffer), 0) < 0) _exit(1); if (strlen(recvbuffer) < 15) { send_error_page(sockfd_in, "Malformed GET request."); fprintf(stderr, "ERROR: Malformed GET request (%s%s)", get_domain, get_path); _exit(1); } tmp = strchr(recvbuffer + 12, '/'); for (i = 0; tmp[i] != ' '; ++i) { if (i >= 127) { tmp[128] = '\0'; send_error_page(sockfd_in, "Too long path defined."); fprintf(stderr, "ERROR: Too long path in GET REQUEST (%s)\n", tmp); _exit(1); } get_path[i] = tmp[i]; } get_path[i] = '\0'; if (verbose) { printf("PATH %s\n",get_path); fflush(stdout); } tmp = strstr(recvbuffer, "Host:"); tmp += 6; for (i = 0; tmp[i] != '\n'; ++i) { if (i >= 127) { tmp[128] = '\0'; send_error_page(sockfd_in, "Too long path defined."); fprintf(stderr, "ERROR: Too long path in GET REQUEST (%s)\n", tmp); _exit(1); } get_domain[i] = tmp[i]; } get_domain[i] = '\0'; if (verbose) { printf("DOMAIN %s\n",get_domain); fflush(stdout); } sprintf(get_request, "GET %s HTTP/1.0\nHost: %s\nReferer: http://%s\nUser-Agent: %s\n\n", get_path, get_domain, referer, user_agent); connect_target(sockfd_in, get_request, get_domain); } int main(int argc, char **argv) { int sockfd_listen, sockfd_n; struct sockaddr_in my_addr; int yes = 1; struct sockaddr_in their_addr; socklen_t sin_size; int c; extern char *optarg; while((c = getopt(argc, argv, "u:r:vVp:hH")) != -1) { switch(c) { case 'u': user_agent = malloc(strlen(optarg) + 1); strcpy(user_agent, optarg); break; case 'r': referer = malloc(strlen(optarg) + 1); strcpy(referer, optarg); break; case 'v': printf("refspoof version " VERSION " by softxor\n"); exit(0); case 'V': verbose = 1; break; case 'p': listen_port = atoi(optarg); break; case 'h': case 'H': default: usage(argv[0]); exit(0); break; } } printf("Starting proxy server on port %i.\n", listen_port); printf("Using 'http://%s' as referer\n", referer); printf("User agent is '%s'\n", user_agent); fflush(stdout); sockfd_listen = socket(AF_INET, SOCK_STREAM, 0); setsockopt(sockfd_listen, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)); my_addr.sin_family = AF_INET; my_addr.sin_port = htons(listen_port); my_addr.sin_addr.s_addr = INADDR_ANY; memset(&(my_addr.sin_zero), '\0', 8); bind(sockfd_listen, (struct sockaddr *)&my_addr, sizeof(struct sockaddr)); listen(sockfd_listen, BACKLOG); while(1) { sin_size = sizeof(struct sockaddr_in); if ((sockfd_n = accept(sockfd_listen, (struct sockaddr *)&their_addr, &sin_size)) == -1) { fprintf(stderr, "ERROR: Unable to accept connections.\n"); continue; } fprintf(stdout, "SERVER: got connection from %s\n",inet_ntoa(their_addr.sin_addr)); if (!fork()) { close(sockfd_listen); relay_connection(sockfd_n); close(sockfd_n); _exit(EXIT_SUCCESS); } close(sockfd_n); } exit(EXIT_SUCCESS); }