<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Binary Abstractions &#187; Exploits</title>
	<atom:link href="http://www.binaryabstractions.com/category/exploits/feed/" rel="self" type="application/rss+xml" />
	<link>http://www.binaryabstractions.com</link>
	<description>Research and Other Diatribes</description>
	<lastBuildDate>Thu, 04 Nov 2010 22:25:28 +0000</lastBuildDate>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
	<generator>http://wordpress.org/?v=</generator>
		<item>
		<title>Windows 7 and Server 2008 R2 SMB DoS</title>
		<link>http://www.binaryabstractions.com/2009/11/16/windows-7-and-server-2008-r2-smb-dos/</link>
		<comments>http://www.binaryabstractions.com/2009/11/16/windows-7-and-server-2008-r2-smb-dos/#comments</comments>
		<pubDate>Mon, 16 Nov 2009 13:54:00 +0000</pubDate>
		<dc:creator>SigmaApex</dc:creator>
				<category><![CDATA[Exploits]]></category>

		<guid isPermaLink="false">http://www.binaryabstractions.org/2009/11/16/windows-7-and-server-2008-r2-smb-dos/</guid>
		<description><![CDATA[Last week Laurent Gaffie posted a POC for a Windows 7 (beta through RC) and Windows Server 2008 R2 SMB denial of service.  He provided a POC in a Python payload harness to setup the listener and deliver the SMB packet. The code works fresh from the box however, pay attention to Python’s preference for [...]]]></description>
			<content:encoded><![CDATA[<p>Last week <a href="http://g-laurent.blogspot.com/2009/11/windows-7-server-2008r2-remote-kernel.html" target="_blank">Laurent Gaffie</a> posted a POC for a Windows 7 (beta through RC) and Windows Server 2008 R2 SMB denial of service.  He provided a POC in a Python payload harness to setup the listener and deliver the SMB packet.</p>
<p>The code works fresh from the box however, pay attention to Python’s preference for tabs:</p>
<div id="codeSnippetWrapper">
<pre id="codeSnippet" style="border-style: none; margin: 0em; padding: 0px; overflow: visible; text-align: left; line-height: 12pt; background-color: #f4f4f4; width: 100%; font-family: 'Courier New',courier,monospace; direction: ltr; color: black; font-size: 8pt;"><span style="color: #0000ff;">class</span> SMB2(SocketServer.BaseRequestHandler):
 <span style="color: #0000ff;">def</span> handle(self):
   <span style="color: #0000ff;">print</span> <span style="color: #006080;">"Who:"</span>, self.client_address
 <span style="color: #0000ff;">  print</span> <span style="color: #006080;">"THANKS SDL"
</span>   input = self.request.recv(1024)
   self.request.send(packet)
   self.request.<span style="color: #0000ff;">close</span>()

launch = SocketServer.TCPServer((<span style="color: #006080;">''</span>, 445),SMB2)
launch.serve_forever()</pre>
</div>
<p><!-- .csharpcode, .csharpcode pre { 	font-size: small; 	color: black; 	font-family: consolas, "Courier New", courier, monospace; 	background-color: #ffffff; 	/*white-space: pre;*/ } .csharpcode pre { margin: 0em; } .csharpcode .rem { color: #008000; } .csharpcode .kwrd { color: #0000ff; } .csharpcode .str { color: #006080; } .csharpcode .op { color: #0000c0; } .csharpcode .preproc { color: #cc6633; } .csharpcode .asp { background-color: #ffff00; } .csharpcode .html { color: #800000; } .csharpcode .attr { color: #ff0000; } .csharpcode .alt  { 	background-color: #f4f4f4; 	width: 100%; 	margin: 0em; } .csharpcode .lnum { color: #606060; } --></p>
<p>There really is nothing special that is required to make this work.  Executing the Python script will open a socket listening on TCP/445.  When the target attempts to access SMB services on the attacker, the target will hang.</p>
<p>I was not able to produce a BSOD and in some test cases the target was recovered once the SMB session was terminated.  NOTE: any SMB session connection will do, however as Laurent pointed out the ‘dir’ method is the easiest.</p>
<p>Just for grins, I captured the errant packet as it flew across the wire.  This is the encoded back from Laurent’s source in PCAP format decoded in Wireshark.</p>
<p><a href="http://www.binaryabstractions.org/wp-content/uploads/2009/11/smbWin7DoScapture.jpg"><img style="display: inline; border: 0px;" title="smb-Win7-DoS capture" src="http://www.binaryabstractions.org/wp-content/uploads/2009/11/smbWin7DoScapture_thumb.jpg" border="0" alt="smb-Win7-DoS capture" width="514" height="429" /></a></p>
<p>Why do we care?  How many organizations or even home users block egress SMB ?  Not many I’m certain.</p>
]]></content:encoded>
			<wfw:commentRss>http://www.binaryabstractions.com/2009/11/16/windows-7-and-server-2008-r2-smb-dos/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>

