# Exploit Author: Juan Sacco <juan.sacco@kpn.com> at KPN Red Team - http://www.kpn.com  
# Date and time of release: May, 9 2017 - 13:00PM 
# Found this and more exploits on my open source security project: http://www.exploitpack.com 
#
# MS17-010 - https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
# Tested on: Microsoft Windows Server 2008 x64 SP1 R2 Standard 
#
# Description: SMBv1 SrvOs2FeaToNt OOB is prone to a remote code execution
# vulnerability because the application fails to perform adequate
# boundary-checks on user-supplied input. Srv.sys process SrvOs2FeaListSizeToNt 
# and when the logic is not correct it leads to a cross-border copy. The vulnerability trigger point is as follows:
#
# Vulnerable code:
# unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)
# {
#   int v4; // edi@1
#   _BYTE *v5; // edi@1
#   unsigned int result; // eax@1
# 
#   v4 = a1 + 8;
#   *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;
#   *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);
#   *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);
#   _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));
#   v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);
#   *v5++ = 0;
#   _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD *)(a1 + 6));
#   result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC;
#   *(_DWORD *)a1 = result - a1;
#   return result;
# }
#
# Impact: An attacker could exploit this vulnerability to execute arbitrary code in the
# context of the application. Failed exploit attempts could result in a
# denial-of-service condition.
#
# Timeline:
# 04/05/2017 - Research started
# 04/05/2017 - First PoC using original code
# 05/05/2017 - Kernel debugging on Windows 2008
# 05/05/2017 - Exploit code first draft
# 06/05/2017 - Functional PoC
# 07/05/2017 - Added support for Zerosum0x0 shellcode
# 08/05/2017 - Code revisited and bugs fixed
# 09/05/2017 - First successful shell
# 09/05/2017 - Exploit tested in QA Laba
# 09/05/2017 - Exploit code final review
# 09/05/2017 - Publish
#
# Vendor homepage: http://www.microsoft.com
# This exploit is a port from the amazing work made by Risksense. Checkout the original project at: https://github.com/RiskSense-Ops/MS17-010
# Credits: @EquationGroup @ShadowBrokers @progmboy @zerosum0x0 @juansacco 
#
# How to run: python3 ms17010.py ipaddress
#
import sys
import socket
import time
import ast
import binascii
import os

def mod_replay():
    # Download attachment for more information

if __name__ == "__main__":
    print("[*] MS17-010 Exploit - SMBv1 SrvOs2FeaToNt OOB")
    print("[*] Exploit running.. Please wait")
    main(sys.argv[1])