3

The recent WannaCry ransomware attack exploited a vulnerability in older Windows SMB code. The presumably reverse-engineered function that has been cited 1 as vulnerable is as follows:

unsigned int __fastcall SrvOs2FeaToNt(int a1, int a2)
# {
#   int v4; // edi@1
#   _BYTE *v5; // edi@1
#   unsigned int result; // eax@1
#
#   v4 = a1 + 8;
#   *(_BYTE *)(a1 + 4) = *(_BYTE *)a2;
#   *(_BYTE *)(a1 + 5) = *(_BYTE *)(a2 + 1);
#   *(_WORD *)(a1 + 6) = *(_WORD *)(a2 + 2);
#   _memmove((void *)(a1 + 8), (const void *)(a2 + 4), *(_BYTE *)(a2 + 1));
#   v5 = (_BYTE *)(*(_BYTE *)(a1 + 5) + v4);
#   *v5++ = 0;
#   _memmove(v5, (const void *)(a2 + 5 + *(_BYTE *)(a1 + 5)), *(_WORD*)(a1 + 6));
#   result = (unsigned int)&v5[*(_WORD *)(a1 + 6) + 3] & 0xFFFFFFFC;
#   *(_DWORD *)a1 = result - a1;
#   return result;
# }

While it looks like this function copies data from one place to another and we're told the application fails to perform adequate boundary-checks on user-supplied input can someone explain in detail what this function is supposed to do line by line and where it is flawed?

Improve this question
1

Please check these links,might help....

https://gist.github.com/worawit/bd04bad3cd231474763b873df081c09a https://zhuanlan.zhihu.com/p/26592431

Improve this answer
3
  • 2
    answers formed solely from links are likely to be deleted. Please include in your answer why you think that the information from these links would be helpful.
    – peter ferrie
    May 19 '17 at 16:15
  • I am not able to form a clear overall picture right now,but however these links helped me a bit...I am also in the process to find out.once i get it,i will for sure
    – Warm_up
    May 19 '17 at 16:52
  • Thanks for those links. The second one references blogs.360.cn/360safe/2017/04/17/nsa-eternalblue-smb which I think is more useful. Though the translation from Chinese is pretty garbled I think the problem is in code for a different function (SrvOs2FeaListSizeToNt) that gets called before the quoted function in my original question. Here a DWORD calculation is cast to a WORD. While that sounds unsafe I am still not sure how the EternalBlue exploit takes advantage of this.
    – julian
    May 23 '17 at 23:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.