IIS XPLOIT MS01-033 v2
(c) Vecna 2001

This tool is a on-demand IIS exploiter, using the exploit MS01-033 against IIS
servers running in w2k, as the worm CodeRed and sucessors. It can run any
win32 PE file in the remote machine, regardless its size, unlike previous
versions of this tool.

This tool also have a automatic attack mode, where it listen for connections
in port 80 trying to use this exploit, and send back our exploit. Machines
scanning for exploitable machines generally mean a already compromissed
machine by CodeRed or similar, and thus, a working target for the exploit.
When running in this mode, the tool dont use the GUI, but a console window
showing the log of connections and its actions.

Another switch make the tool drop a binary image useable, after encrypted and
signed, as a plugin for Hybris virus.

The exploit code, when get control in the IIS server, connect back to the
exploit sender, download, save to disk(to TEMP directory) and execute the
win32 PE file. The exploit code has 742 bytes.

When running as a plugin inside Hybris virus, a thread is created to scan, at
first, IPs similar  to the current one, and after some time, full random IPs.

This tool can be used to spread any virus in win32 PE format to machines that
are already infected by CodeRed and similars. Use XPLOIT2.EXE -L MYVIRUS.EXE,
with MYVIRUS.EXE being a small do-nothing infected program. All machines
scanning your one will be infected.

Compile with MASM.
