Work at SourceForge, help us to make it a better place! We have an immediate need for a Support Technician in our San Francisco or Denver office.

Close

#129 9.1.0.1 TOO EASY DOS ATTACK

9.1.0.1
open
nobody
None
1
2013-09-13
2013-08-30
J-Unit
No

Attacking Machine - Windows XP Home SP3 (32 bit) - Pentium 4 2.8GHZ, 2G RAM

M.I.T.M. Machine - Windows XP Pro SP3 (32 bit) - Pentium 4 2.6GHZ, 3G RAM

Vulnerable Machine - Nas4Free 9.1.0.1 Full (32 bit) - AMD Athlon X64 3200+ (2GHZ), 2G Ram

Environment - Domain, User is a Domain Admin


Step 1. use Psexec to get a remote shell on the machine that will be doing xcopy.(MITM)
example: "psexec \MachineName -s -u DomainName\UserName -p Password cmd.exe"
now you will have your remote shell

Step 2. use xcopy to copy a file from NAS4Free Server, to MITM Machine.
example: "xcopy "\nas.ser.ver.ip\NAS Share\Movie.wmv" C:\TEMP\NewMovie.wmv /Y"

This Will Result in xcopy asking you if your copying a File or a Directory, don't answer.

Step 3. Break. CTRL+C. Server is Crashed Instantly and needs to be unplugged and rebooted. It will just sit there constantly beeping, Frozen and unusable until it is.

it works every time.

Discussion

  • J-Unit
    J-Unit
    2013-08-30

    sorry for the typos. should of read \\machinename, \\nas.ser.ver.ip

     
    Last edit: J-Unit 2013-08-30
  • Alex Lin
    Alex Lin
    2013-09-01

    Hi J-Unit,

    Thank you for reporting this.

    I do not have Windows XP 32 bit. I am using the following setup but cannot replicate your issue :
    - psexec v1.98 (in System Internal Suite - 1 Aug 2013)
    - Attacking machine - Windows 7 64 bit (updated up till the last update)
    - MITM Machine - Windows 7 64 bit (updated up till the last update)
    - NAS4Free 9.1.0.1 r820

    Although the console issuing commands do hang but all 3 machines are still live. (You may notice the file copy still complete even though I tried to cancel it )
    I do notice the difference between my test and yours :-
    my xcopy did NOT prompt me if I copy a file or directory.

    Can you please provide more information for further investigation :-
    1. Which NAS4Free revision are you using ? (You can find that information from console or WebGUI under System information -> Version )
    2. Your Samba settings ( a screenshot on Services|CIFS/SMB|Settings )
    3. Your Windows XP update/patching status

     
    Attachments
  • J-Unit
    J-Unit
    2013-09-04

    The reasons you did not get the screen that asks for a file or directory is because you didn't try renaming your file in xcopy. xcopy "\\asdfasdf\software\applications\linux\centosxxxx.iso" D:\MUST_TYPE_NEW_NAME_HERE.ANY /Y (and if must_type_new_name_here.any allready exists, it also will not ask you). and the XP SP3 machines I'm using are fully updated and patched. i will test with windows 7 x64 when i get the chance. Also I'm using the same psexec as you(1.98) and my version of NAS4Free is 9.1.0.1 - Sandstorm (revision 847).
    I've included 2 scenarios of launching psexec with slightly differently with same result. Also I've Included a screenshot of the command windows after i use ctrl+c.

     
    Last edit: J-Unit 2013-09-04
  • Alexey
    Alexey
    2013-09-05

    You use Authentication anonymous for samba.
    Try to crash server with Local User Auth

     
  • zoon01
    zoon01
    2013-09-13

    I agree with Alexey.

    Try todo with Authentication set as Local User