Segurança Os nukes voltaram... bemvindos a 1999.

Xeon3D

Xeon3D

1st Folding then Sex
Full Disclosure: Windows Vista/7 : SMB2.0 NEGOTIATE PROTOCOL REQUEST Remote B.S.O.D.


* Release date: September 7th, 2009
* Discovered by: Laurent Gaffi
* Severity: Medium/High I.

II. BACKGROUND

Windows vista and newer Windows comes with a new SMB version named SMB2. See:
http://en.wikipedia.org/wiki/Windows_Vista_networking_technologies#Server_Message_Block_2.0 for more details.

III. DESCRIPTION

SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality.
The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and it's used
to identify the SMB dialect that will be used for futher communication.

IV. PROOF OF CONCEPT

...

V. BUSINESS IMPACT

An attacker can remotely crash without no user interaction, any Vista/Windows 7 machine with SMB enable.
Windows Xp, 2k, are NOT affected as they dont have this driver.

VI. SYSTEMS AFFECTED

Windows Vista/7 All (64b/32b|SP1/SP2 fully updated) and possibly Win Server 2008
as it use the same SMB2.0 driver (not tested).

VII. SOLUTION

Vendor contacted, but no patch available for the moment. Close SMB feature and ports, until a patch is provided.
Clicar para expandir...

Parece que a Microsoft quer voltar aos velhos tempos do Windows 95.
(saudades...)
Já estou mesmo a ver, sistemas topo de gama, windows 7 instalado e pum... BSOD.

Fonte: Insecure.org

(Nota: não pus link directo para a fonte, devido ao facto de conter um PoC, se um moderador assim o entender fácilmente encontra o artigo).
 
Hmmm... Vou testar o PoC
A ver se o meu desktop da o 1º bluescreen


EDIT: ou estou a fazer alguma coisa errada.... ou nem o meu laptop nem o desktop sofrem deste problema :D
 
Última edição:
PJTuga disse:
Hmmm... Vou testar o PoC
A ver se o meu desktop da o 1º bluescreen


EDIT: ou estou a fazer alguma coisa errada.... ou nem o meu laptop nem o desktop sofrem deste problema :D
Clicar para expandir...

Provavelmente vai te dar erro a correr... digo eu. Por acaso nem me lembrei de experimentar a correr com o localhost.
 
eu testei o exploit em python
fiz copy-paste mas tive de corrigir uns erros minimos... testei com localhost e com o outro pc da rede...
os dados sao enviados. nao ocorre nenhum erro de execução. mas também nao acontece nada ao pc

mas ja vi varios blogs com printscreens do sistema a correr em maquinas virtuais e dar BSOD
________________

Nunca tinha ouvido falar disto no Windows 95, (nessa altura nao fazia a ideia do que eram falhas no sistema xD)
Mas como é possivel a M$ cometer o mesmo erro 2 vezes :S ?
 
Atenção que esse exploit também dá para execução remota de código e takeover das máquinas.

http://www.theregister.co.uk/2009/09/09/microsoft_windows_security_bug/
Microsoft has promised to patch a serious flaw in newer versions of its Windows operating system after hackers released exploit code that allows them to take complete control of the underlying machines.

The flaw, which affects various versions of Windows Vista, 2008, and the release candidate version of Windows 7, resides in the implementation of a network file sharing technology known as SMB, or server message block. The bug, which fails to adequately parse network negotiation requests, was previously believed only to generate a debilitating blue screen of death, but on Tuesday, Microsoft confirmed in some cases it could also be used to remotely execute malicious code on vulnerable machines.
Clicar para expandir...
 
Acho que não vão conseguir aplicar isto à versão RTM:

Microsoft has issued a formal security advisory in response to the latest flaw discovered within its Windows operating systems, shedding a bit of light on the issue. According to CNET, Microsoft believes that the flaw will not cause any problems for Windows 7 users, and instead only for those on Windows Vista and Windows 2008 (not Server 2008 R2, though).

The advisory, found here, stated the following: Microsoft is investigating new public reports of a possible vulnerability in Microsoft Server Message Block (SMB) implementation. We are not aware of attacks that try to use the reported vulnerabilities or of customer impact at this time.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) to provide information that they can use to provide broader protections to customers.

However, whilst the report has Windows 7 (both x86 and x64) listed under 'Non-affected Software', be warned: if you're using the release candidate version of the operating system, you're still at risk. If you're running the RTM, you can sleep easy. Microsoft said that once they've fully investigated the flaw, they will include the fix in the monthly patch cycle, or perhaps release it out of that schedule, depending on how necessary it becomes. Keep in mind that Windows XP and 2000 are both safe from the flaw.
Clicar para expandir...
Fonte: http://www.neowin.net/news/software/09/09/09/microsoft-windows-7-is-not-affected-by-zero-day-flaw

Ao que parece apenas afecta o Vista e versões do 7 anteriores à RTM (possivelmente as mesmo coladas à RTM poderão também já não ter problemas mas a RC tem).
 
Esta história ainda está longe de acabar... e agora ainda ficou pior... ai ai ai

SMB2 remote exploit released
Last week Guy posted a diary (http://isc.sans.org/diary.html?storyid=7093) about a 0-day vulnerability in SMB2 on Windows Vista and Server 2008 operating systems. Back then the exploit only crashed affected systems.

This is already bad enough; however, it just got worse. Yesterday a well known security company added a module for their exploitation product. The module contains the remote exploit for this vulnerability – in other words, any user running this tool can get full access to affected machines.

If the exploit is stable enough, it can _very easily_ be used in a worm, so it can potentially be devastating.
So, if you are running a Windows Vista or Server 2008 machine (Windows 7 RTM is not affected, RC *is*), be sure you apply one of workarounds listed by Microsoft (they are not perfect, but they can help), available here:

* Run a host based firewall which will block access to ports 139 and 445. Please note that the builtin firewall in Windows Vista will automatically block this traffic if your location is set to Public. In other words, if you connect to a wireless network at Starbucks and set this you will be fine, but if you are inside your organization you are probably vulnerable, unless your administrators went one step further and used group policies to properly configure your firewall.
* Disable SMB2. This has some performance impacts, but it's nothing one can't live without until the patch is out. However, it requires modifying the registry.

We will keep an eye on the development and will update the diary as necessary.
Clicar para expandir...

Mais:
White hats release exploit for critical Windows vuln
The progress of ethical researchers in exploiting the bug is important because it’s an indication of how other, less scrupulous hackers are likely faring. It shows that the bug, which affects newer operating systems built under a program designed to prevent such security flaws, is far from being a mere theoretical risk to the millions of people who use the products. Rather, it means attackers can use the internet to take over vulnerable machines located half-way around the globe.
Clicar para expandir...

Patch? É já a seguir... :dormir2: azarito :|

Remote Exploit Video Demo
 
Última edição:
escrevi o exploit em C (com base no PoC) e testei no meu PC com vista x64 SP2. com firewall aberta na porta 445, e com file sharing ligado: não funcionou.

inclusivé no blog de quem o descobriu há varias pessoas que tb dizem que nos PCs deles não funcionou.

anyway, para quem está preocupado basta desligar file sharing e bloquear a porta 445 até sair um patch e pronto.
 
Inicie sessão ou registe-se para poder participar.
Back
Topo