ms10-070_check.py

#!/usr/bin/env python
#
# PoC for checking if MS10-070 patch is applied by providing a .NET
# application ScriptResource or WebResource resource handler's 'd' block
#
# Credits go to:
#
# * Juliano Rizzo - for the amazing research and hints about the remote
# passive check
# <http://twitter.com/julianor/status/26419702099>
#
# * Brian Holyfield - for his tool to exploit Padding Oracle attacks in a
# generic and easy way
# <https://www.gdssecurity.com/l/t/d.php?k=PadBuster>
#
# * Giorgio Fedon - for initial Perl version of this check
# <http://blog.mindedsecurity.com/2010/09/investigating-net-padding-oracle.html>
#
# * Alejo Murillo Moya - for testing and ideas
#
#
# Copyright (c) 2010 Bernardo Damele A. G. <[email protected]>
#
#
# Example of unpatched system:
#
# * /WebResource.axd?d=kHoDoPikaYfoTe1m9Ol5iQ2
# * /ScriptResource.axd?d=2nYOzoKtRvjs-g53K3r7VKmEXeQl_XMNY8nDEwcgwGVcS5Z8b9GanbNdzIgg493kfB_oInMb2DtFFEy5e-ajqdwMbg1F96l10
#
# Examples of patched system:
#
# * /WebResource.axd?d=VHYaLecZ91Zjq-_4mV3ftpYrTteh9kHzk9zwLyjpAZAOjWL3nbx1SmIeGdHJwBu_koMj8ZGAqrtxCJkW0
# * /ScriptResource.axd?d=Gcb5Zt1XkIPHAYC3l5vZ4QidrZMKISjkqnMQRQDqRD88oxkWIL1kNBQThGrDJBbaKqPd9AyT-jF1EhM-rame5NXv7RLQRhtlz-xfoQlHXf_pjgiBJW7ntGxhegohUeNFlo9x8_RMU6ocDmwwK6dfIRDFbX01

import sys

def base64decode(string):
    return string.decode("base64")

def hexdecode(string):
    string = string.lower()

    if string.startswith("0x"):
        string = string[2:]

    return string.decode("hex")

def hexencode(string):
    return string.encode("hex")

def dotNetUrlTokenDecode(string):
    """
Ported from padbuster v0.3 by Brian Holyfield:

sub web64Decode {
my ($input, $net) = @_;
# net: 0=No Padding Number, 1=Padding (NetUrlToken)
$input =~ s/\-/\+/g;
$input =~ s/\_/\//g;
if ($net == 1)
{
my $count = chop($input);
$input = $input.("=" x int($count));
}
return decode_base64($input);
}
"""

    string = string.replace("-", "+").replace("_", "/")
    count = string[-1]

    if count.isdigit():
        string = string[:-1] + ("=" * int(count))

    return base64decode(string)

def usage():
    print """
Use:

./ms10-070_check.py <encrypted_d_block>

Note:

Encrypted 'd' block MUST be from ScriptResource.axd or WebResource.axd.
Parse the application response body to find a valid one.

Examples:

With ScriptResource.axd 'd' block:
$ ./ms10-070_check.py 2nYOzoKtRvjs-g53K3r7VKmEXeQl_XMNY8nDEwcgwGVcS5Z8b9GanbNdzIgg493kfB_oInMb2DtFFEy5e-ajqdwMbg1F96l10
Your application is VULNERABLE, patch against MS10-070

With WebResource.axd 'd' block:
./ms10-070_check.py VHYaLecZ91Zjq-_4mV3ftpYrTteh9kHzk9zwLyjpAZAOjWL3nbx1SmIeGdHJwBu_koMj8ZGAqrtxCJkW0
Your application is NOT vulnerable
"""

def main():
    if len(sys.argv) < 2:
        usage()
        sys.exit(1)

    if (len(dotNetUrlTokenDecode(sys.argv[1])) % 8) == 0:
        print "Your application is VULNERABLE, patch against MS10-070"
    else:
        print "Your application is NOT vulnerable"

if __name__ == '__main__':
    main()