对Windows 2000中wkssvc.dll中某个函数的分析

by envymask

文件名： wkssvc.dll
语言：简体中文
文件版本：5.0.2195.6862
最后修改时间：2003-10-23

RPC接口
UUID：6bffd098-a112-3610-9833-46c3f87e345a
Opnum:：0x16
Function Name：NetrUnjoinDomain2
远程可以通过管道wkssvc调用，匿名帐号就行

说明：这是一个具有潜在漏洞的函数，为什么说具有潜在漏洞呢？因为我没有找到方法触发，这个过程要重现，首先要控制目标机器的DNS服务器A，添加某个域名的Service Type查询目录，然后指向一个受控制的IP B，把这个Service Type解析到B IP，然后在B机器上伪造一个LDAP服务器，负责返回查询结果，也就是返回后面那个DomainControllerName的关键。根据我的测试，我最大只能在LDAP数据包将Hostname字段增加到0xff，而且Windows在调用DsGetDcNameW后，只处理Hostname字段小于64字节的数据包，大于或等于64字节的不处理，这儿又卡住了。如果哪位牛Man能够构造这种Long Hostname的数据包，而且能让Windows处理，就能触发这个溢出。
由于是今年9月份的时候分析的这个dll，很多细节都不记得了，只能想起来这么些。

远程调用方法：
先建立Null Session的SMB连接，然后调用下面的API
NetJoinDomain(L"////目标IP",
L"某个域名",NULL,NULL,NULL,NETSETUP_DOMAIN_JOIN_IF_JOINED);

函数调用过程：
NetrUnjoinDomain2 -> sub_7672068E -> sub_7671EDB6 -> sub_76721D5B


Codz:

调用详细过程: NetrUnjoinDomain2： .text:7671CE58                 push    ebp .text:7671CE59                 mov     ebp, esp .text:7671CE5B                 push    ecx .text:7671CE5C                 push    ecx .text:7671CE5D                 push    esi .text:7671CE5E                 push    edi .text:7671CE5F                 xor     edi, edi .text:7671CE61                 xor     esi, esi .text:7671CE63                 cmp     [ebp+arg_8], edi ; arg_8不能为0 .text:7671CE66                 mov     [ebp+var_4], edi .text:7671CE69                 mov     [ebp+var_8], edi .text:7671CE6C                 jnz     short loc_7671CE71 ; 必跳 .text:7671CE6E                 push    57h .text:7671CE70                 pop     esi .text:7671CE71 .text:7671CE71 loc_7671CE71:                           ; CODE XREF: sub_7671CE58+14j .text:7671CE71                 cmp     esi, edi .text:7671CE73                 jnz     short loc_7671CECC ; 不跳 .text:7671CE75                 lea     eax, [ebp+var_8] .text:7671CE78                 push    eax .text:7671CE79                 push    [ebp+arg_14] .text:7671CE7C                 push    [ebp+arg_0] .text:7671CE7F                 call    sub_7671CD18    ; 返回值要为0 .text:7671CE84                 mov     esi, eax .text:7671CE86                 cmp     esi, edi .text:7671CE88                 jnz     short loc_7671CECC ; 不跳 .text:7671CE8A                 lea     eax, [ebp+var_4] .text:7671CE8D                 push    eax .text:7671CE8E                 call    sub_7671DFA6    ; 调用GetComputerName .text:7671CE93                 mov     esi, eax        ; 返回值要为0 .text:7671CE95                 cmp     esi, edi .text:7671CE97                 jnz     short loc_7671CECC ; 不跳 .text:7671CE99                 mov     eax, [ebp+var_4] .text:7671CE9C                 cmp     esi, edi .text:7671CE9E                 mov     [ebp+arg_4], eax .text:7671CEA1                 jnz     short loc_7671CECC ; 不跳 .text:7671CEA3                 call    sub_76718EA7    ; 返回值要为0 .text:7671CEA8                 mov     esi, eax .text:7671CEAA                 cmp     esi, edi        ; .text:7671CEAC                 jnz     short loc_7671CECC ; 不跳 .text:7671CEAE                 push    [ebp+arg_18] .text:7671CEB1                 push    [ebp+var_8] .text:7671CEB4                 push    [ebp+arg_10] .text:7671CEB7                 push    [ebp+arg_C] .text:7671CEBA                 push    [ebp+arg_8] .text:7671CEBD                 push    [ebp+arg_4] .text:7671CEC0                 call    sub_7672068E    ; 进入才能溢出 ... ... ... sub_7672068E: .text:7672068E                 push    ebp .text:7672068F                 mov     ebp, esp .text:76720691                 push    ecx .text:76720692                 push    ebx .text:76720693                 push    esi .text:76720694                 xor     esi, esi .text:76720696                 and     [ebp+var_4], esi .text:76720699                 call    sub_76723855 .text:7672069E                 push    offset aNetpdodomainjo ; "NetpDoDomainJoin/n" .text:767206A3                 call    sub_767238B6 .text:767206A8                 cmp     [ebp+arg_4], esi .text:767206AB                 pop     ecx .text:767206AC                 jnz     short loc_767206B1 ; 必跳 .text:767206AE                 push    57h .text:767206B0                 pop     esi .text:767206B1 .text:767206B1 loc_767206B1:                           ; CODE XREF: sub_7672068E+1Ej .text:767206B1                 test    esi, esi .text:767206B3                 jnz     short loc_7672072F ; 不跳 .text:767206B5                 cmp     [ebp+arg_0], esi .text:767206B8                 jnz     short loc_767206CF .text:767206BA                 lea     eax, [ebp+var_4] .text:767206BD                 push    eax .text:767206BE                 call    sub_767207F7    ; 返回值要为0 .text:767206C3                 mov     esi, eax .text:767206C5                 test    esi, esi .text:767206C7                 jnz     short loc_7672072F ; 不跳 .text:767206C9                 mov     eax, [ebp+var_4] .text:767206CC                 mov     [ebp+arg_0], eax .text:767206CF .text:767206CF loc_767206CF:                           ; CODE XREF: sub_7672068E+2Aj .text:767206CF                 test    esi, esi .text:767206D1                 jnz     short loc_7672072F ; 不跳 .text:767206D3                 mov     ebx, [ebp+arg_14] ; arg_14要为1 .text:767206D6                 push    [ebp+arg_0] .text:767206D9                 test    bl, 1           ; bl要为1 .text:767206DC                 jz      short loc_76720717 ; 不跳 .text:767206DE                 call    sub_7671EC9B .text:767206E3                 mov     esi, eax .text:767206E5                 cmp     esi, 0A83h .text:767206EB                 jnz     short loc_767206FC .text:767206ED                 test    ebx, 80000000h .text:767206F3                 jnz     short loc_767206FA .text:767206F5                 test    bl, 20h .text:767206F8                 jz      short loc_767206FC .text:767206FA .text:767206FA loc_767206FA:                           ; CODE XREF: sub_7672068E+65j .text:767206FA                 xor     esi, esi .text:767206FC .text:767206FC loc_767206FC:                           ; CODE XREF: sub_7672068E+5Dj .text:767206FC                                         ; sub_7672068E+6Aj .text:767206FC                 test    esi, esi .text:767206FE                 jnz     short loc_7672072F ; 不跳 .text:76720700                 push    ebx .text:76720701                 push    [ebp+arg_10] .text:76720704                 push    [ebp+arg_C] .text:76720707                 push    [ebp+arg_8] .text:7672070A                 push    [ebp+arg_4] .text:7672070D                 push    [ebp+arg_0] .text:76720710                 call    sub_7671EDB6    ; 进入才能溢出 ... ... ... sub_7671EDB6: ... ... ... .text:7671EEF7                 lea     eax, [ebp+var_20] .text:7671EEFA                 push    eax .text:7671EEFB                 push    [ebp+var_C] .text:7671EEFE                 call    ds:RtlRunDecodeUnicodeString .text:7671EF04                 push    3 .text:7671EF06                 push    [ebp+var_1C] .text:7671EF09                 push    [ebp+arg_C] .text:7671EF0C                 push    [ebp+var_28] .text:7671EF0F                 push    [ebp+arg_0] .text:7671EF12                 call    sub_767202DC    ; 返回值要是2554h或0 .text:7671EF17                 mov     edi, eax .text:7671EF19                 lea     eax, [ebp+var_20] .text:7671EF1C                 push    eax .text:7671EF1D                 lea     eax, [ebp+var_C] .text:7671EF20                 push    eax .text:7671EF21                 call    ds:RtlRunEncodeUnicodeString .text:7671EF27                 cmp     edi, esi        ; ESI = 2554h .text:7671EF29                 jnz     short loc_7671EF2D ; 此处不跳 .text:7671EF2B                 xor     edi, edi .text:7671EF2D .text:7671EF2D loc_7671EF2D:                           ; CODE XREF: sub_7671EDB6+173j .text:7671EF2D                 cmp     edi, ebx        ; ebx = 0 .text:7671EF2F                 jnz     loc_7671F677    ; 此处不跳，上面edi 应该为 0 .text:7671EF35                 cmp     [ebp+var_38], ebx .text:7671EF38                 jnz     short loc_7671EF59 ; 此处跳 .text:7671EF3A                 lea     eax, [ebp+var_8] .text:7671EF3D                 push    eax .text:7671EF3E                 lea     eax, [ebp+var_4] .text:7671EF41                 push    eax .text:7671EF42                 lea     eax, [ebp+var_48] .text:7671EF45                 push    eax .text:7671EF46                 push    1020h .text:7671EF4B                 push    [ebp+arg_0] .text:7671EF4E                 push    [ebp+var_28] .text:7671EF51                 push    ebx .text:7671EF52                 call    sub_7671FEEA    ; 调用DsGetDcNameW或DsGetDcNameWithAccountW函数 .text:7671EF52                                         ; 并将返回的DomainControllerName Copy到NetApiBufferAllocate .text:7671EF52                                         ; 申请的内存，再把内存地址赋值给var_4 .text:7671EF57                 mov     edi, eax        ; 返回值要为0 .text:7671EF59 .text:7671EF59 loc_7671EF59:                           ; CODE XREF: sub_7671EDB6+182j .text:7671EF59                 cmp     edi, ebx        ; ebx = 0 .text:7671EF5B                 jnz     loc_7671F677    ; 此处不跳 .text:7671EF61                 lea     eax, [ebp+var_20] .text:7671EF64                 push    eax .text:7671EF65                 push    [ebp+var_C] .text:7671EF68                 call    ds:RtlRunDecodeUnicodeString .text:7671EF6E                 push    [ebp+var_44] .text:7671EF71                 push    [ebp+var_1C] .text:7671EF74                 push    [ebp+arg_C] .text:7671EF77                 push    [ebp+var_4]     ; DomainControllerName .text:7671EF7A                 call    sub_76721D5B    ; 进入有溢出函数 sub_76721D5B: .text:76721D5B                 push    ebp .text:76721D5C                 mov     ebp, esp .text:76721D5E                 sub     esp, 2D0h .text:76721D64                 push    ebx .text:76721D65                 push    esi .text:76721D66                 push    edi .text:76721D67                 mov     edi, [ebp+arg_0] ; arg_0超长就溢出 .text:76721D6A                 xor     esi, esi .text:76721D6C                 xor     ebx, ebx .text:76721D6E                 cmp     word ptr [edi], 5Ch .text:76721D72                 lea     eax, [ebp+var_2D0] .text:76721D78                 mov     [ebp+var_4], esi .text:76721D7B                 jz      short loc_76721D97 .text:76721D7D                 lea     eax, [ebp+var_2D0] .text:76721D83                 push    offset asc_76711A14 ; wchar_t * .text:76721D88                 push    eax             ; wchar_t * .text:76721D89                 call    ds:wcscpy .text:76721D8F                 pop     ecx .text:76721D90                 lea     eax, [ebp+var_2CC] .text:76721D96                 pop     ecx .text:76721D97 .text:76721D97 loc_76721D97:                           ; CODE XREF: sub_76721D5B+20j .text:76721D97                 test    [ebp+arg_C], 20h .text:76721D9B                 jz      short loc_76721DA0 ; arg_0 .text:76721D9D                 push    2 .text:76721D9F                 pop     ebx .text:76721DA0 .text:76721DA0 loc_76721DA0:                           ; CODE XREF: sub_76721D5B+40j .text:76721DA0                 push    edi             ; arg_0 .text:76721DA1                 push    offset aWsIpc   ; "%ws/IPC$" .text:76721DA6                 push    eax             ; 局部变量 .text:76721DA7                 call    ds:swprintf     ; 溢出