123 lines
2.8 KiB
C
123 lines
2.8 KiB
C
/*
|
|
|
|
HTML manglizer
|
|
--------------
|
|
Copyright (C) 2004 by Michal Zalewski <lcamtuf@coredump.cx>
|
|
|
|
HTML manglizer library. Logs random seeds to error-log; find the last entry before
|
|
crash, then pass it to remangle.cgi to reproduce the problem.
|
|
|
|
*/
|
|
|
|
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <time.h>
|
|
|
|
#include "tags.h"
|
|
|
|
#define R(x) (rand() % (x))
|
|
|
|
#define MAXTCOUNT 100
|
|
#define MAXPCOUNT 20
|
|
#define MAXSTR2 80
|
|
|
|
void make_up_value(void) {
|
|
char c=R(2);
|
|
|
|
if (c) putchar('"');
|
|
|
|
switch (R(31)) {
|
|
|
|
case 0: printf("javascript:"); make_up_value(); break;
|
|
// case 1: printf("jar:"); make_up_value(); break;
|
|
case 2: printf("mk:"); make_up_value(); break;
|
|
case 3: printf("file:"); make_up_value(); break;
|
|
case 4: printf("http:"); make_up_value(); break;
|
|
case 5: printf("about:"); make_up_value(); break;
|
|
case 6: printf("_blank"); break;
|
|
case 7: printf("_self"); break;
|
|
case 8: printf("top"); break;
|
|
case 9: printf("left"); break;
|
|
case 10: putchar('&'); make_up_value(); putchar(';'); break;
|
|
case 11: make_up_value(); make_up_value(); break;
|
|
|
|
case 12 ... 20: {
|
|
int c = R(10) ? R(10) : (1 + R(MAXSTR2) * R(MAXSTR2));
|
|
char* x = malloc(c);
|
|
memset(x,R(256),c);
|
|
fwrite(x,c,1,stdout);
|
|
free(x);
|
|
break;
|
|
}
|
|
|
|
case 21: printf("%s","%n%n%n%n%n%n"); break;
|
|
case 22: putchar('#'); break;
|
|
case 23: putchar('*'); break;
|
|
default: if (R(2)) putchar('-'); printf("%d",rand()); break;
|
|
|
|
}
|
|
|
|
if (c) putchar('"');
|
|
|
|
}
|
|
|
|
|
|
void random_tag(void) {
|
|
int tn, tc;
|
|
|
|
do tn = R(MAXTAGS); while (!tags[tn][0]);
|
|
tc = R(MAXPCOUNT) + 1;
|
|
|
|
putchar('<');
|
|
|
|
switch (R(10)) {
|
|
case 0: putchar(R(256)); break;
|
|
case 1: putchar('/');
|
|
}
|
|
|
|
printf("%s", tags[tn][0]);
|
|
|
|
while (tc--) {
|
|
int pn;
|
|
switch (R(32)) {
|
|
case 0: putchar(R(256));
|
|
case 1: break;
|
|
default: putchar(' ');
|
|
}
|
|
do pn = R(MAXPARS-1) + 1; while (!tags[tn][pn]);
|
|
printf("%s", tags[tn][pn]);
|
|
switch (R(32)) {
|
|
case 0: putchar(R(256));
|
|
case 1: break;
|
|
default: putchar('=');
|
|
}
|
|
|
|
make_up_value();
|
|
|
|
}
|
|
|
|
putchar('>');
|
|
|
|
}
|
|
|
|
|
|
int main(int argc,char** argv) {
|
|
int tc,seed;
|
|
|
|
printf("Content-Type: text/html;charset=utf-8\nRefresh: 0;URL=mangle.cgi\n\n");
|
|
printf("<HTML><HEAD><META HTTP-EQUIV=\"Refresh\" content=\"0;URL=mangle.cgi\">\n");
|
|
printf("<script language=\"javascript\">setTimeout('window.location=\"mangle.cgi\"', 1000);</script>\n");
|
|
|
|
seed = (time(0) ^ (getpid() << 16));
|
|
fprintf(stderr,"[%u] Mangle attempt 0x%08x (%s) -- %s\n", (int)time(0), seed, getenv("HTTP_USER_AGENT"), getenv("REMOTE_ADDR"));
|
|
srand(seed);
|
|
|
|
tc = R(MAXTCOUNT) + 1;
|
|
while (tc--) random_tag();
|
|
fflush(0);
|
|
return 0;
|
|
}
|