In The Name Of Allah
Al-Salam Alekum ![[Image: SMBleed.png]](https://1.bp.blogspot.com/-gQeSEiBVy9M/XuLnYKNF8KI/AAAAAAAAJQo/MC44T2xEM6Q-wYWBtysoa6SgezlsNx4rACLcBGAsYHQ/s1600/SMBleed.png)
Windows SMB again came back with a nice remote gift for whom care about it xD
Quote:Well, this whole vulnerability deals with SMB messages, and these messages primarily include fields like the number of bytes to address and flags, and thus it accompanied by a variable-length buffer. By crafting this, the messages become quite easy, so this is a perfect tool for exposition.
But there are some variable that contains uninitialized data, and therefore, we put different addition to the compression function that is based on our POC on Microsoft’s WindowsProtocolTestSuites repository.
By adding this will not be sufficient, as POC needs different credentials and a writable share, that are easily accessible in many situations. Still, the bug refers to every sought of the message so that it can get utilized remotely for any authentication.
More importantly, the memory that has leaked is generally related to the earlier allocation in the NonPagedPoolNx pool, as we can manage the allocation size, which implies that the leaked data may come into our control to some extent.
The Soruce
Wa Salam Alekum
* Thankful to Allah *
Kurdy
