[C++] Fetch string from a text file in webserver

[katsumi]

How do i Fetch a string from a text file in webserver..
wat exactly i am planning to do is make a server sided MD5 check
wat actually the program need to do
read the MD5 hash from the text file in webserver
For ex:- www.mysite.com/md5string.txt
and assign the string to a variable

Any ideas?

heres wat it looks like

hash = "mysite.com/md5string.txt";
fileMD5 = md5->getHashFromFile("MyApp.exe");
if( hash != fileMD5)
{
MessageBox( 0, "File Edited", "Virus", MB_OK );
}

[MentaL]

[katsumi]

bumppppp

[s-p-n]

You need to get the hash file into a string, otherwise you're just checking if the URL provided is not the hash; rather than the contents of the file inside the URL.

My C++ is terrible,

http://www.cplusplus.com/reference/c.../cstdio/fgets/

Edit: This is me trying:

FILE * pFile;
char hash [100];

pFile = fopen ("http://www.mysite.com/md5string.txt", "r"); //Or "md5string.txt"
if (pFile == NULL) perror ("Error opening file");
else {
    fgets (hash, 100 , pFile);
    fputs (hash);
    fclose (pFile);
    
    fileMD5 = md5->getHashFromFile("MyApp.exe");
    
    if( hash != fileMD5)
    {
        MessageBox( 0, "File Edited", "Virus", MB_OK );
    }
}
return 0; 

Lol, idk..

[jMerliN]

You need to get the hash file into a string, otherwise you're just checking if the URL provided is not the hash; rather than the contents of the file inside the URL.

My C++ is terrible,

http://www.cplusplus.com/reference/c.../cstdio/fgets/

Edit: This is me trying:

FILE * pFile;
char hash [100];

pFile = fopen ("http://www.mysite.com/md5string.txt", "r"); //Or "md5string.txt"
if (pFile == NULL) perror ("Error opening file");
else {
    fgets (hash, 100 , pFile);
    fputs (hash);
    fclose (pFile);
    
    fileMD5 = md5->getHashFromFile("MyApp.exe");
    
    if( hash != fileMD5)
    {
        MessageBox( 0, "File Edited", "Virus", MB_OK );
    }
}
return 0; 

Lol, idk..

I'm quite sure fopen doesn't work on URIs :\.

Also, oddly enough, fgets and fputs are also incredibly insecure. (Instant exploit w/ unlimited shellcode and maybe stack corruption if you're lucky ftw).


You'll need to create a socket, connect to the web server, send a GET request, read the response, then parse what you want out of it. It's just that simple (tutorials everywhere for it).

[katsumi]

thank you s-p-n but i believe that wont work :(

@ jMerliN any tuts on making sockets?

Edit _
i found some stuff googling is it related to what i am looking for ?
http://www.codeguru.com/forum/archiv.../t-290504.html

[ExploitR]

Use the api function URLDownloadToFile( but since it is a common virus technique you will have to encrypt the api function call.
The call is :

HRESULT URLDownloadToFile(      
    LPUNKNOWN pCaller,
    LPCTSTR szURL,
    LPCTSTR szFileName,
    DWORD dwReserved,
    LPBINDSTATUSCALLBACK lpfnCB
);

HRESULT hr = URLDownloadToFile ( NULL, "mysite.com/md5file.txt", "C:\\md5file.txt", 0, NULL );
FILE* f;
f = fopen("C:\\md5file.txt");
char* buffer[];
size_t result;
long lSize = ftell(f);
result = fread (buffer,1,lSize,f);
if(buffer != md5string)
{
    //throw error
}

And the header is <urlmon.h>

[katsumi]

Use the api function URLDownloadToFile( but since it is a common virus technique you will have to encrypt the api function call.
The call is :

HRESULT URLDownloadToFile(      
    LPUNKNOWN pCaller,
    LPCTSTR szURL,
    LPCTSTR szFileName,
    DWORD dwReserved,
    LPBINDSTATUSCALLBACK lpfnCB
);

HRESULT hr = URLDownloadToFile ( NULL, "mysite.com/md5file.txt", "C:\\md5file.txt", 0, NULL );
FILE* f;
f = fopen("C:\\md5file.txt");
char* buffer[];
size_t result;
long lSize = ftell(f);
result = fread (buffer,1,lSize,f);
if(buffer != md5string)
{
    //throw error
}

And the header is <urlmon.h>

ty i hope that should work, ill test later and update you with this.

[s-p-n]

I'm quite sure fopen doesn't work on URIs :\.

Also, oddly enough, fgets and fputs are also incredibly insecure. (Instant exploit w/ unlimited shellcode and maybe stack corruption if you're lucky ftw).


You'll need to create a socket, connect to the web server, send a GET request, read the response, then parse what you want out of it. It's just that simple (tutorials everywhere for it).

Wow, lol. That's Karma for ya.

It wouldn't be just as bad [fgets/fputs/puts] if the URI had been local would it? Or are the functions themselves insecure?

[jMerliN]

Wow, lol. That's Karma for ya.

It wouldn't be just as bad [fgets/fputs/puts] if the URI had been local would it? Or are the functions themselves insecure?

It's mainly fgets, it's generally quite insecure unless you're really careful with your use. Lazy programmers are likely to not properly count how much data is left in a buffer and if they don't, a buffer overflow happens. If the buffer is on the stack, you can overwrite the EIP and construct a 0day attack. If it's not, you might be able to fuzz it up a bit and get something nice, worst case you can make a 0day or DOS the system to hell. It just comes down to how carefully someone thinks through their code.

[ThePhailure772]

How do i Fetch a string from a text file in webserver..
wat exactly i am planning to do is make a server sided MD5 check
wat actually the program need to do
read the MD5 hash from the text file in webserver
For ex:- www.mysite.com/md5string.txt
and assign the string to a variable

Any ideas?

heres wat it looks like

hash = "mysite.com/md5string.txt";
fileMD5 = md5->getHashFromFile("MyApp.exe");
if( hash != fileMD5)
{
MessageBox( 0, "File Edited", "Virus", MB_OK );
}

Why do it such a horrible way? Grab the MD5, send it to the server and have the server check it. Also, you don't need to use a windows API function to download a file, just use send and recv with this string:
"GET /md5string.txt HTTP/1.1\r\n\r\nHost: mysite.com\r\n\r\n"
then just call recieve and loop till completion.