Windows SMB2 client side crash exploit
=== EDIT - this exploit appears to be exactly the same one of one which was already found and fixed notified by Laurent Gaffié, i did not know this but his blog post can be found here thanks for the guy who anonymously commented to notify us about this. ==
While coding my SMB server to further expose cool tricks with MySQL injections i walked against a very nice bug in the SMB2 protocol which can make the box on the other side crash instantly while trying to connect to you.
Here is an overview of how it the exploit took place:
Victim: Negotiate protocol request and hoping for getting a negotiate protocol response back. You: Netbios session service packet with message type set to "session message" (0x00) and length field set to 0x000001 (means the rest of the packet should be 1 byte). You: Close connection FIN, ACK Victim: ACK back and it crashes
The exploit code can be found here.
I tried this out of a Windows 7 build 7600 but when later trying with a fully updated Windows 7 machine of a friend it didn't worked unfortunately.
Windows Vista and Windows server 2008 are untested since i don't have any of those here but i suppose they are vulnerable too.
Still it's a cool trick to have in your pocket i think and i suppose it's patched some updates ago (or his firewall blocked me and it still works).
You may have noticed i was talking about SMB, MySQL injections and cool tricks, well the way i found it was like this:
I have XAMPP running on the Windows 7 box and coded a tiny vulnerable PHP/MySQL program which allows me to do MySQL injections, as told in an earlier post i am working on remote ways of exploiting the SMB client with which MySQL will try to connect to your box and that i am working on ways of speeding up blind SQL injections and black box injections, the way i found this exploit was like this:
http://server/index.php?id=1 AND load_file("\\\\homebrew_smb_server\\filename")
The server will then try to connect over SMB to my home brew SMB server and die if you have the exploit running on that box.
There will come more posts from me out on this out of band MySQL injection exploitation subject and a program which already for me has proven to be a much faster way of exploiting MySQL injections in general will be published soon on this blog.
Hello, I am Jelmer born in 1991 and I live in Holland. I met Fredrik and Mathias through the internet. You can contact me via email jelmerdehen [ at ] hotmail [d0t] com Or you can chat with me in the IRC.