Microsoft Windows Server Service Remote Code Execution Vulnerability (921883)

# Copyright (C) 2011 Greenbone Networks GmbH
# Some text descriptions might be excerpted from (a) referenced
# source(s), and are Copyright (C) by the respective right holder(s).
#
# SPDX-License-Identifier: GPL-2.0-or-later
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

if(description)
{
  script_oid("1.3.6.1.4.1.25623.1.0.902782");
  script_version("2022-04-28T13:38:57+0000");
  script_cve_id("CVE-2006-3439");
  script_tag(name:"cvss_base", value:"10.0");
  script_tag(name:"cvss_base_vector", value:"AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_tag(name:"creation_date", value:"2011-12-30 11:26:07 +0530 (Fri, 30 Dec 2011)");
  script_tag(name:"last_modification", value:"2022-04-28 13:38:57 +0000 (Thu, 28 Apr 2022)");
  script_name("Microsoft Windows Server Service Remote Code Execution Vulnerability (921883)");
  script_category(ACT_ATTACK);
  script_copyright("Copyright (C) 2011 Greenbone Networks GmbH");
  script_family("Windows : Microsoft Bulletins");
  script_dependencies("os_detection.nasl");
  script_require_ports(139, 445);
  script_mandatory_keys("Host/runs_windows");

  script_xref(name:"URL", value:"http://securitytracker.com/id?1016667");
  script_xref(name:"URL", value:"http://www.securityfocus.com/bid/19409");
  script_xref(name:"URL", value:"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-040");

  script_tag(name:"impact", value:"Successful exploitation could allow remote code execution by sending a
  specially crafted RPC request and can take complete control of an affected system.");

  script_tag(name:"affected", value:"- Microsoft Windows XP Service Pack 2 and prior

  - Microsoft Windows 2K3 Service Pack 1 and prior

  - Microsoft Windows 2000 Service Pack 4 and prior");

  script_tag(name:"insight", value:"The flaw is due to a boundary error in the 'CanonicalizePathName()'
  function in netapi32.dll and can be exploited to cause a stack-based buffer
  overflow via a malicious NetrpPathCanonicalize RPC request with an overly
  long path name to the Server Service.");

  script_tag(name:"solution", value:"The vendor has released updates. Please see the references for more information.");

  script_tag(name:"summary", value:"This host is missing important security update according to
  Microsoft Bulletin MS06-040.");

  script_tag(name:"qod_type", value:"remote_app");
  script_tag(name:"solution_type", value:"VendorFix");
  exit(0);
}

include("smb_nt.inc");

name = kb_smb_name();
port = kb_smb_transport();

soc = open_sock_tcp( port );
if( ! soc ) exit( 0 );

## SMB Negotiate Protocol Request
smb_neg_req = raw_string(0x00, 0x00, 0x00, 0x85, 0xff, 0x53, 0x4d, 0x42,
                         0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x62, 0x00, 0x02,
                         0x50, 0x43, 0x20, 0x4e, 0x45, 0x54, 0x57, 0x4f,
                         0x52, 0x4b, 0x20, 0x50, 0x52, 0x4f, 0x47, 0x52,
                         0x41, 0x4d, 0x20, 0x31, 0x2e, 0x30, 0x00, 0x02,
                         0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x31, 0x2e,
                         0x30, 0x00, 0x02, 0x57, 0x69, 0x6e, 0x64, 0x6f,
                         0x77, 0x73, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x57,
                         0x6f, 0x72, 0x6b, 0x67, 0x72, 0x6f, 0x75, 0x70,
                         0x73, 0x20, 0x33, 0x2e, 0x31, 0x61, 0x00, 0x02,
                         0x4c, 0x4d, 0x31, 0x2e, 0x32, 0x58, 0x30, 0x30,
                         0x32, 0x00, 0x02, 0x4c, 0x41, 0x4e, 0x4d, 0x41,
                         0x4e, 0x32, 0x2e, 0x31, 0x00, 0x02, 0x4e, 0x54,
                         0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32,
                         0x00);

send( socket:soc, data:smb_neg_req );

## SMB Negotiate Protocol Response
smb_neg_resp = smb_recv( socket:soc );
if( ! smb_neg_resp ) {
  close( soc );
  exit( 0 );
}

## SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
smb_sess_req = raw_string(0x00, 0x00, 0x00, 0xec, 0xff, 0x53, 0x4d, 0x42,
                          0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                          0x00, 0x00, 0x42, 0x53, 0x52, 0x53, 0x50, 0x59,
                          0x4c, 0x20, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
                          0x00, 0x00, 0x40, 0x00, 0x0c, 0xff, 0x00, 0x00,
                          0x00, 0x00, 0x44, 0x01, 0x00, 0x01, 0x00, 0x00,
                          0x00, 0x00, 0x00, 0x4a, 0x00, 0x00, 0x00, 0x00,
                          0x00, 0xdc, 0x02, 0x00, 0x80, 0xb1, 0x00, 0x60,
                          0x48, 0x06, 0x06, 0x2b, 0x06, 0x01, 0x05, 0x05,
                          0x02, 0xa0, 0x3e, 0x30, 0x3c, 0xa0, 0x0e, 0x30,
                          0x0c, 0x06, 0x0a, 0x2b, 0x06, 0x01, 0x04, 0x01,
                          0x82, 0x37, 0x02, 0x02, 0x0a, 0xa2, 0x2a, 0x04,
                          0x28, 0x4e, 0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50,
                          0x00, 0x01, 0x00, 0x00, 0x00, 0x05, 0x82, 0x08,
                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                          0x00, 0x05, 0x01, 0x28, 0x0a, 0x00, 0x00, 0x00,
                          0x0f, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
                          0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00,
                          0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
                          0x32, 0x00, 0x20, 0x00, 0x53, 0x00, 0x65, 0x00,
                          0x72, 0x00, 0x76, 0x00, 0x69, 0x00, 0x63, 0x00,
                          0x65, 0x00, 0x20, 0x00, 0x50, 0x00, 0x61, 0x00,
                          0x63, 0x00, 0x6b, 0x00, 0x20, 0x00, 0x32, 0x00,
                          0x20, 0x00, 0x32, 0x00, 0x36, 0x00, 0x30, 0x00,
                          0x30, 0x00, 0x00, 0x00, 0x57, 0x00, 0x69, 0x00,
                          0x6e, 0x00, 0x64, 0x00, 0x6f, 0x00, 0x77, 0x00,
                          0x73, 0x00, 0x20, 0x00, 0x32, 0x00, 0x30, 0x00,
                          0x30, 0x00, 0x32, 0x00, 0x20, 0x00, 0x35, 0x00,
                          0x2e, 0x00, 0x31, 0x00, 0x00, 0x00, 0x00, 0x00);

send( socket:soc, data:smb_sess_req );

## SMB Session Setup AndX Response, NTLMSSP_CHALLENGE,
## Error: STATUS_MORE_PROCESSING_REQUIRED
smb_sess_resp = smb_recv( socket:soc );
if( ! smb_sess_resp ) {
  close( soc );
  exit( 0 );
}

##Extract UID from Session Setup AndX Response
if( smb_sess_resp && strlen( smb_sess_resp ) > 33 ) {
  uid_low = ord( smb_sess_resp[32] );
  uid_high = ord( smb_sess_resp[33] );
  uid = uid_high * 256;
  uid += uid_low;
} else {
  exit( 0 );
}

## SMB Session Setup AndX Request, NTLMSSP_AUTH, User: \
smb_sess_andx_req = raw_string(0x00, 0x00, 0x01, 0x02, 0xff, 0x53, 0x4d, 0x42,
                               0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                               0x00, 0x00, 0x42, 0x53, 0x52, 0x53, 0x50, 0x59,
                               0x4c, 0x20, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6)
                               + raw_string( uid_low, uid_high ) +
                               raw_string( 0x80, 0x00, 0x0c, 0xff, 0x00, 0x00,
                               0x00, 0x00, 0x44, 0x01, 0x00, 0x00, 0x00, 0x00,
                               0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x00,
                               0x00, 0xdc, 0x02, 0x00, 0x80, 0xc7, 0x00, 0xa1,
                               0x5f, 0x30, 0x5d, 0xa2, 0x5b, 0x04, 0x59, 0x4e,
                               0x54, 0x4c, 0x4d, 0x53, 0x53, 0x50, 0x00, 0x03,
                               0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x48,
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x49,
                               0x00, 0x00, 0x00, 0x10, 0x00, 0x10, 0x00, 0x49,
                               0x00, 0x00, 0x00, 0x05, 0x02, 0x08, 0x00, 0x01,
                               0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x0f, 0x00,
                               0x77, 0x24, 0xb3, 0x5b, 0xd0, 0xee, 0x67, 0x99,
                               0xa6, 0x5b, 0x68, 0xa4, 0x4f, 0x0e, 0xeb, 0x56,
                               0x57, 0x00, 0x69, 0x00, 0x6e, 0x00, 0x64, 0x00,
                               0x6f, 0x00, 0x77, 0x00, 0x73, 0x00, 0x20, 0x00,
                               0x32, 0x00, 0x30, 0x00, 0x30, 0x00, 0x32, 0x00,
                               0x20, 0x00, 0x53, 0x00, 0x65, 0x00, 0x72, 0x00,
                               0x76, 0x00, 0x69, 0x00, 0x63, 0x00, 0x65, 0x00,
                               0x20, 0x00, 0x50, 0x00, 0x61, 0x00, 0x63, 0x00,
                               0x6b, 0x00, 0x20, 0x00, 0x32, 0x00, 0x20, 0x00,
                               0x32, 0x00, 0x36, 0x00, 0x30, 0x00, 0x30, 0x00,
                               0x00, 0x00, 0x57, 0x00, 0x69, 0x00, 0x6e, 0x00,
                               0x64, 0x00, 0x6f, 0x00, 0x77, 0x00, 0x73, 0x00,
                               0x20, 0x00, 0x32, 0x00, 0x30, 0x00, 0x30, 0x00,
                               0x32, 0x00, 0x20, 0x00, 0x35, 0x00, 0x2e, 0x00,
                               0x31, 0x00, 0x00, 0x00, 0x00, 0x00);

send( socket:soc, data:smb_sess_andx_req );

## SMB Session Setup AndX Response
smb_sess_andx_resp = smb_recv( socket:soc );
if( ! smb_sess_andx_resp ) {
  close( soc );
  exit( 0 );
}

## SMB Tree Connect AndX Request, Path: \\xxx.xxx.xxx.xxx\IPC$
smb_tree_resp = smb_tconx( soc:soc, name:name, uid:uid, share:"IPC$" );
if( ! smb_tree_resp ) {
  close( soc );
  exit( 0 );
}

## NT Create AndX Request, FID: 0x4000, Path: \browser
nt_creat_req = raw_string(0x00, 0x00, 0x00, 0x66, 0xff, 0x53, 0x4d, 0x42,
                          0xa2, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                          0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                          0x00, 0x08, 0x00, 0x01, 0x18, 0xff, 0x00, 0x00,
                          0x00, 0x00, 0x10, 0x00, 0x16, 0x00, 0x00, 0x00,
                          0x00, 0x00, 0x00, 0x00, 0x9f, 0x01, 0x12, 0x00,
                          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                          0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,
                          0x01, 0x00, 0x00, 0x00, 0x40, 0x00, 0x40, 0x00,
                          0x02, 0x00, 0x00, 0x00, 0x03, 0x13, 0x00, 0x00,
                          0x5c, 0x00, 0x62, 0x00, 0x72, 0x00, 0x6f, 0x00,
                          0x77, 0x00, 0x73, 0x00, 0x65, 0x00, 0x72, 0x00,
                          0x00, 0x00);

send( socket:soc, data:nt_creat_req );
nt_creat_resp = smb_recv( socket:soc );
if( ! nt_creat_resp ) {
  close( soc );
  exit( 0 );
}

## DCERPC Bind: call_id: 0 SRVSVC V3.0
dcerpc_bind_req = raw_string(0x00, 0x00, 0x00, 0x88, 0xff, 0x53, 0x4d, 0x42,
                             0x2f, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                             0x00, 0x08, 0x40, 0x01, 0x0e, 0xff, 0x00, 0x00,
                             0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0xff,
                             0xff, 0xff, 0xff, 0x08, 0x00, 0x48, 0x00, 0x00,
                             0x00, 0x48, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00,
                             0x00, 0x49, 0x00, 0x00, 0x05, 0x00, 0x0b, 0x03,
                             0x10, 0x00, 0x00, 0x00, 0x48, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0xb8, 0x10, 0xb8, 0x10,
                             0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x01, 0x00, 0xc8, 0x4f, 0x32, 0x4b,
                             0x70, 0x16, 0xd3, 0x01, 0x12, 0x78, 0x5a, 0x47,
                             0xbf, 0x6e, 0xe1, 0x88, 0x03, 0x00, 0x00, 0x00,
                             0x04, 0x5d, 0x88, 0x8a, 0xeb, 0x1c, 0xc9, 0x11,
                             0x9f, 0xe8, 0x08, 0x00, 0x2b, 0x10, 0x48, 0x60,
                             0x02, 0x00, 0x00, 0x00);

send( socket:soc, data:dcerpc_bind_req );
dcerpc_bind_resp = smb_recv( socket:soc );
if( ! dcerpc_bind_resp ) {
  close( soc );
  exit( 0 );
}

## Read AndX Request, FID: 0x4000
read_andx_req = raw_string(0x00, 0x00, 0x00, 0x3c, 0xff, 0x53, 0x4d, 0x42,
                           0x2e, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                           0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                           0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                           0x00, 0x08, 0x80, 0x01, 0x0c, 0xff, 0x00, 0x00,
                           0x00, 0x00, 0x40, 0x00, 0x00, 0x00, 0x00, 0x00,
                           0x04, 0x00, 0x04, 0xff, 0xff, 0xff, 0xff, 0x00,
                           0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);

send( socket:soc, data:read_andx_req );
read_andx_resp = smb_recv( socket:soc );
if( ! read_andx_resp ) {
  close( soc );
  exit( 0 );
}

## Packet type: 12 (Bind_ack) @ offset 66 - 1 byte
## Auth Length: 00 @ Offset 74 - 2 bytes
## Call ID : 00 @ Offset 76 - 4 bytes

if( strlen( read_andx_resp ) > 79 &&
    ! ( ord( read_andx_resp[66] ) == 12 && ord( read_andx_resp[74] ) == 00 &&
    ord( read_andx_resp[75] ) == 00 && ord( read_andx_resp[76] ) == 00 &&
    ord( read_andx_resp[77] ) == 00 && ord( read_andx_resp[78] ) == 00 &&
    ord( read_andx_resp[79] ) == 00 ) ) {
  close( soc );
  exit( 0 );
}

## NetPathCanonicalize request
netpath_can_req = raw_string(0x00, 0x00, 0x00, 0xb8, 0xff, 0x53, 0x4d, 0x42,
                             0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                             0x00, 0x08, 0xc0, 0x01, 0x10, 0x00, 0x00, 0x64,
                             0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x00, 0x54, 0x00, 0x64, 0x00, 0x54, 0x00, 0x02,
                             0x00, 0x26, 0x00, 0x00, 0x40, 0x75, 0x00, 0x00,
                             0x5c, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00,
                             0x45, 0x00, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
                             0x64, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                             0x4c, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x00,
                             0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
                             0x6d, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
                             0x07, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                             0x07, 0x00, 0x00, 0x00, 0x4f, 0x00, 0x70, 0x00,
                             0x65, 0x00, 0x6e, 0x00, 0x56, 0x41, 0x53, 0x00,
                             0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                             0x00, 0x00, 0x00, 0x00);

send( socket:soc, data:netpath_can_req );
netpath_can_resp = smb_recv( socket:soc );
if( ! netpath_can_resp ) {
  close( soc );
  exit( 0 );
}

## SRVSVC NetPathCanonicalize request
netpath_req = raw_string(0x00, 0x00, 0x00, 0xac, 0xff, 0x53, 0x4d, 0x42,
                         0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                         0x00, 0x08, 0x00, 0x02, 0x10, 0x00, 0x00, 0x58,
                         0x00, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x00, 0x54, 0x00, 0x58, 0x00, 0x54, 0x00, 0x02,
                         0x00, 0x26, 0x00, 0x00, 0x40, 0x69, 0x00, 0x00,
                         0x5c, 0x00, 0x50, 0x00, 0x49, 0x00, 0x50, 0x00,
                         0x45, 0x00, 0x5c, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x05, 0x00, 0x00, 0x03, 0x10, 0x00, 0x00, 0x00,
                         0x58, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
                         0x40, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1f, 0x00,
                         0x00, 0x00, 0x02, 0x00, 0x02, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,
                         0x6d, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,
                         0x00, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
                         0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                         0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00);

send( socket:soc, data:netpath_req );
netpath_resp = smb_recv( socket:soc );
if( ! netpath_resp ) {
  close( soc );
  exit( 0 );
}

## SMB Tree Disconnect Request
smb_tree_dis_req = raw_string(0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42,
                              0x71, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                              0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                              0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0xc5, 0xa6,
                              0x00, 0x08, 0x40, 0x02, 0x00, 0x00, 0x00);

send( socket:soc, data:smb_tree_dis_req );
smb_tree_dis_resp = smb_recv( socket:soc );
if( ! smb_tree_dis_resp ) {
  close( soc );
  exit( 0 );
}

## SMB Logoff AndX Request
smb_logoff_req = raw_string(0x00, 0x00, 0x00, 0x27, 0xff, 0x53, 0x4d, 0x42,
                            0x74, 0x00, 0x00, 0x00, 0x00, 0x18, 0x03, 0xc8,
                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
                            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc5, 0xa6,
                            0x00, 0x08, 0x80, 0x02, 0x02, 0xff, 0x00, 0x00,
                            0x00, 0x00, 0x00);

send( socket:soc, data:smb_logoff_req );
smb_logoff_resp = smb_recv( socket:soc );
if( ! smb_logoff_resp ) {
  close( soc );
  exit( 0 );
}

close( soc );

## After applying the patch these fields will filled with '00'
if( strlen( netpath_resp ) > 98 &&
    ord( netpath_resp[88] ) == 79 && ord( netpath_resp[90] ) == 112 &&
    ord( netpath_resp[92] ) == 101 && ord( netpath_resp[94] ) == 110 &&
    ord( netpath_resp[96] ) == 86 && ord( netpath_resp[97] ) == 65  &&
    ord( netpath_can_resp[98] ) == 83 ) {
  security_message( port:port );
  exit( 0 );
}

exit( 99 );