对Windows 2000中wkssvc.dll中某个函数的分析

by envymask

文件名： wkssvc.dll
语言：简体中文
文件版本：5.0.2195.6862
最后修改时间：2003-10-23

RPC接口
UUID：6bffd098-a112-3610-9833-46c3f87e345a
Opnum:：0x16
Function Name：NetrUnjoinDomain2
远程可以通过管道wkssvc调用，匿名帐号就行

说明：这是一个具有潜在漏洞的函数，为什么说具有潜在漏洞呢？因为我没有找到方法触发，这个过程要重现，首先要控制目标机器的DNS服务器A，添加某个域名的Service Type查询目录，然后指向一个受控制的IP B，把这个Service Type解析到B IP，然后在B机器上伪造一个LDAP服务器，负责返回查询结果，也就是返回后面那个DomainControllerName的关键。根据我的测试，我最大只能在LDAP数据包将Hostname字段增加到0xff，而且Windows在调用DsGetDcNameW后，只处理Hostname字段小于64字节的数据包，大于或等于64字节的不处理，这儿又卡住了。如果哪位牛Man能够构造这种Long Hostname的数据包，而且能让Windows处理，就能触发这个溢出。
由于是今年9月份的时候分析的这个dll，很多细节都不记得了，只能想起来这么些。

远程调用方法：
先建立Null Session的SMB连接，然后调用下面的API
NetJoinDomain(L"////目标IP",
L"某个域名",NULL,NULL,NULL,NETSETUP_DOMAIN_JOIN_IF_JOINED);

函数调用过程：
NetrUnjoinDomain2 -> sub_7672068E -> sub_7671EDB6 -> sub_76721D5B


Codz:


调用详细过程:
NetrUnjoinDomain2：

.text:7671CE58                 push    ebp
.text:7671CE59                 mov     ebp, esp
.text:7671CE5B                 push    ecx
.text:7671CE5C                 push    ecx
.text:7671CE5D                 push    esi
.text:7671CE5E                 push    edi
.text:7671CE5F                 xor     edi, edi
.text:7671CE61                 xor     esi, esi
.text:7671CE63                 cmp     [ebp+arg_8], edi ; arg_8不能为0
.text:7671CE66                 mov     [ebp+var_4], edi
.text:7671CE69                 mov     [ebp+var_8], edi
.text:7671CE6C                 jnz     short loc_7671CE71 ; 必跳
.text:7671CE6E                 push    57h
.text:7671CE70                 pop     esi
.text:7671CE71
.text:7671CE71 loc_7671CE71:                           ; CODE XREF: sub_7671CE58+14j
.text:7671CE71                 cmp     esi, edi
.text:7671CE73                 jnz     short loc_7671CECC ; 不跳
.text:7671CE75                 lea     eax, [ebp+var_8]
.text:7671CE78                 push    eax
.text:7671CE79                 push    [ebp+arg_14]
.text:7671CE7C                 push    [ebp+arg_0]
.text:7671CE7F                 call    sub_7671CD18    ; 返回值要为0
.text:7671CE84                 mov     esi, eax
.text:7671CE86                 cmp     esi, edi
.text:7671CE88                 jnz     short loc_7671CECC ; 不跳
.text:7671CE8A                 lea     eax, [ebp+var_4]
.text:7671CE8D                 push    eax
.text:7671CE8E                 call    sub_7671DFA6    ; 调用GetComputerName
.text:7671CE93                 mov     esi, eax        ; 返回值要为0
.text:7671CE95                 cmp     esi, edi
.text:7671CE97                 jnz     short loc_7671CECC ; 不跳
.text:7671CE99                 mov     eax, [ebp+var_4]
.text:7671CE9C                 cmp     esi, edi
.text:7671CE9E                 mov     [ebp+arg_4], eax
.text:7671CEA1                 jnz     short loc_7671CECC ; 不跳
.text:7671CEA3                 call    sub_76718EA7    ; 返回值要为0
.text:7671CEA8                 mov     esi, eax
.text:7671CEAA                 cmp     esi, edi        ;
.text:7671CEAC                 jnz     short loc_7671CECC ; 不跳
.text:7671CEAE                 push    [ebp+arg_18]
.text:7671CEB1                 push    [ebp+var_8]
.text:7671CEB4                 push    [ebp+arg_10]
.text:7671CEB7                 push    [ebp+arg_C]
.text:7671CEBA                 push    [ebp+arg_8]
.text:7671CEBD                 push    [ebp+arg_4]
.text:7671CEC0                 call    sub_7672068E    ; 进入才能溢出
...
...
...


sub_7672068E:

.text:7672068E                 push    ebp
.text:7672068F                 mov     ebp, esp
.text:76720691                 push    ecx
.text:76720692                 push    ebx
.text:76720693                 push    esi
.text:76720694                 xor     esi, esi
.text:76720696                 and     [ebp+var_4], esi
.text:76720699                 call    sub_76723855
.text:7672069E                 push    offset aNetpdodomainjo ; "NetpDoDomainJoin/n"
.text:767206A3                 call    sub_767238B6
.text:767206A8                 cmp     [ebp+arg_4], esi
.text:767206AB                 pop     ecx
.text:767206AC                 jnz     short loc_767206B1 ; 必跳
.text:767206AE                 push    57h
.text:767206B0                 pop     esi
.text:767206B1
.text:767206B1 loc_767206B1:                           ; CODE XREF: sub_7672068E+1Ej
.text:767206B1                 test    esi, esi
.text:767206B3                 jnz     short loc_7672072F ; 不跳
.text:767206B5                 cmp     [ebp+arg_0], esi
.text:767206B8                 jnz     short loc_767206CF
.text:767206BA                 lea     eax, [ebp+var_4]
.text:767206BD                 push    eax
.text:767206BE                 call    sub_767207F7    ; 返回值要为0
.text:767206C3                 mov     esi, eax
.text:767206C5                 test    esi, esi
.text:767206C7                 jnz     short loc_7672072F ; 不跳
.text:767206C9                 mov     eax, [ebp+var_4]
.text:767206CC                 mov     [ebp+arg_0], eax
.text:767206CF
.text:767206CF loc_767206CF:                           ; CODE XREF: sub_7672068E+2Aj
.text:767206CF                 test    esi, esi
.text:767206D1                 jnz     short loc_7672072F ; 不跳
.text:767206D3                 mov     ebx, [ebp+arg_14] ; arg_14要为1
.text:767206D6                 push    [ebp+arg_0]
.text:767206D9                 test    bl, 1           ; bl要为1
.text:767206DC                 jz      short loc_76720717 ; 不跳
.text:767206DE                 call    sub_7671EC9B
.text:767206E3                 mov     esi, eax
.text:767206E5                 cmp     esi, 0A83h
.text:767206EB                 jnz     short loc_767206FC
.text:767206ED                 test    ebx, 80000000h
.text:767206F3                 jnz     short loc_767206FA
.text:767206F5                 test    bl, 20h
.text:767206F8                 jz      short loc_767206FC
.text:767206FA
.text:767206FA loc_767206FA:                           ; CODE XREF: sub_7672068E+65j
.text:767206FA                 xor     esi, esi
.text:767206FC
.text:767206FC loc_767206FC:                           ; CODE XREF: sub_7672068E+5Dj
.text:767206FC                                         ; sub_7672068E+6Aj
.text:767206FC                 test    esi, esi
.text:767206FE                 jnz     short loc_7672072F ; 不跳
.text:76720700                 push    ebx
.text:76720701                 push    [ebp+arg_10]
.text:76720704                 push    [ebp+arg_C]
.text:76720707                 push    [ebp+arg_8]
.text:7672070A                 push    [ebp+arg_4]
.text:7672070D                 push    [ebp+arg_0]
.text:76720710                 call    sub_7671EDB6    ; 进入才能溢出
...
...
...



sub_7671EDB6:
...
...
...
.text:7671EEF7                 lea     eax, [ebp+var_20]
.text:7671EEFA                 push    eax
.text:7671EEFB                 push    [ebp+var_C]
.text:7671EEFE                 call    ds:RtlRunDecodeUnicodeString
.text:7671EF04                 push    3
.text:7671EF06                 push    [ebp+var_1C]
.text:7671EF09                 push    [ebp+arg_C]
.text:7671EF0C                 push    [ebp+var_28]
.text:7671EF0F                 push    [ebp+arg_0]
.text:7671EF12                 call    sub_767202DC    ; 返回值要是2554h或0
.text:7671EF17                 mov     edi, eax
.text:7671EF19                 lea     eax, [ebp+var_20]
.text:7671EF1C                 push    eax
.text:7671EF1D                 lea     eax, [ebp+var_C]
.text:7671EF20                 push    eax
.text:7671EF21                 call    ds:RtlRunEncodeUnicodeString
.text:7671EF27                 cmp     edi, esi        ; ESI = 2554h
.text:7671EF29                 jnz     short loc_7671EF2D ; 此处不跳
.text:7671EF2B                 xor     edi, edi
.text:7671EF2D
.text:7671EF2D loc_7671EF2D:                           ; CODE XREF: sub_7671EDB6+173j
.text:7671EF2D                 cmp     edi, ebx        ; ebx = 0
.text:7671EF2F                 jnz     loc_7671F677    ; 此处不跳，上面edi 应该为 0
.text:7671EF35                 cmp     [ebp+var_38], ebx
.text:7671EF38                 jnz     short loc_7671EF59 ; 此处跳
.text:7671EF3A                 lea     eax, [ebp+var_8]
.text:7671EF3D                 push    eax
.text:7671EF3E                 lea     eax, [ebp+var_4]
.text:7671EF41                 push    eax
.text:7671EF42                 lea     eax, [ebp+var_48]
.text:7671EF45                 push    eax
.text:7671EF46                 push    1020h
.text:7671EF4B                 push    [ebp+arg_0]
.text:7671EF4E                 push    [ebp+var_28]
.text:7671EF51                 push    ebx
.text:7671EF52                 call    sub_7671FEEA    ; 调用DsGetDcNameW或DsGetDcNameWithAccountW函数
.text:7671EF52                                         ; 并将返回的DomainControllerName Copy到NetApiBufferAllocate
.text:7671EF52                                         ; 申请的内存，再把内存地址赋值给var_4
.text:7671EF57                 mov     edi, eax        ; 返回值要为0
.text:7671EF59
.text:7671EF59 loc_7671EF59:                           ; CODE XREF: sub_7671EDB6+182j
.text:7671EF59                 cmp     edi, ebx        ; ebx = 0
.text:7671EF5B                 jnz     loc_7671F677    ; 此处不跳
.text:7671EF61                 lea     eax, [ebp+var_20]
.text:7671EF64                 push    eax
.text:7671EF65                 push    [ebp+var_C]
.text:7671EF68                 call    ds:RtlRunDecodeUnicodeString
.text:7671EF6E                 push    [ebp+var_44]
.text:7671EF71                 push    [ebp+var_1C]
.text:7671EF74                 push    [ebp+arg_C]
.text:7671EF77                 push    [ebp+var_4]     ; DomainControllerName
.text:7671EF7A                 call    sub_76721D5B    ; 进入有溢出函数

sub_76721D5B:

.text:76721D5B                 push    ebp
.text:76721D5C                 mov     ebp, esp
.text:76721D5E                 sub     esp, 2D0h
.text:76721D64                 push    ebx
.text:76721D65                 push    esi
.text:76721D66                 push    edi
.text:76721D67                 mov     edi, [ebp+arg_0] ; arg_0超长就溢出
.text:76721D6A                 xor     esi, esi
.text:76721D6C                 xor     ebx, ebx
.text:76721D6E                 cmp     word ptr [edi], 5Ch
.text:76721D72                 lea     eax, [ebp+var_2D0]
.text:76721D78                 mov     [ebp+var_4], esi
.text:76721D7B                 jz      short loc_76721D97
.text:76721D7D                 lea     eax, [ebp+var_2D0]
.text:76721D83                 push    offset asc_76711A14 ; wchar_t *
.text:76721D88                 push    eax             ; wchar_t *
.text:76721D89                 call    ds:wcscpy
.text:76721D8F                 pop     ecx
.text:76721D90                 lea     eax, [ebp+var_2CC]
.text:76721D96                 pop     ecx
.text:76721D97
.text:76721D97 loc_76721D97:                           ; CODE XREF: sub_76721D5B+20j
.text:76721D97                 test    [ebp+arg_C], 20h
.text:76721D9B                 jz      short loc_76721DA0 ; arg_0
.text:76721D9D                 push    2
.text:76721D9F                 pop     ebx
.text:76721DA0
.text:76721DA0 loc_76721DA0:                           ; CODE XREF: sub_76721D5B+40j
.text:76721DA0                 push    edi             ; arg_0
.text:76721DA1                 push    offset aWsIpc   ; "%ws/IPC$"
.text:76721DA6                 push    eax             ; 局部变量
.text:76721DA7                 call    ds:swprintf     ; 溢出