Messenger Service DoS

The folks at LSD have come out with a “proof of concept” code that will cause the victim computer to re-boot if they are running the messenger service...as if ads weren't bad enough. While most of us have disabled this service a long time ago there will be many who have not.

From the remarks:

/*

DoS Proof of Concept for MS03-043 - exploitation shouldn't be too hard.
Launching it one or two times against the target should make the
machine reboot. Tested against a Win2K SP4.

"The vulnerability results because the Messenger Service does not
properly validate the length of a message before passing it to the allocated
buffer" according to MS bulletin. Digging into it a bit more, we find that when
a character 0x14 in encountered in the 'body' part of the message, it is
replaced by a CR+LF. The buffer allocated for this operation is twice the size
of the string, which is the way to go, but is then copied to a buffer which
was only allocated 11CAh bytes. Thanks to that, we can bypass the length checks
and overflow the fixed size buffer.

Credits go to LSD :)

*/

huh... a while back I tried to overflow the buffer too...

guess I wasn't doing it right! LoL

thanks for the heads up. (though people should not even have this service running... we killed it a long time ago)

Nice post...


For those n00bs that aren't sure on how to disable this spawn of satan--

1. Open Control Panel
2. Double-click Administrative Tools.
3. Double-click Services.
4. Double-click Messenger.
5. In the Startup type list, click Disabled.
6. Click Stop, and then click OK.

Thanx Conf1rm3d_K1ll , for the steps to disable the service (Iwas wondering how should i do it).

:)

Do point me elsewhere if this has already been covered, but what does the messenger service actually do? If it is disabled, apart from not dying a slow and painful death, what else will not happen on my computer? Is it purely for MS/internet messages? Will it cause any issues across the corporate network?

I just want to check before I recommend that we get this disabled corporately. I don't like looking totally stupid.

Schrodinger the messanger sevice is used to send pop-ups to another machine
try it by going into dos and typing

Code:

---

net send compname then this will be msg displayed

---

a little box like an error msg will pop-up on the computer whos name you specified - the name can be that comps name on network or an ip addy

heh could you not DoS someone by simply putting

Code:

---

:LOOP
@echo off
net send 127.0.0.1 is this annoying yet?
GOTO LOOP

---

in a .bat file and leaving it running - :rofl:

v_Ln

valhallen - thank you. That is what I thought it might be. Given our users ability to ignore VERY IMPORTANT AND URGENT messages, I think I could leave that running for a week before some people complained. And then it would be that their keyboard wasn't working ( missing keystrokes ).

All I have to do now is convince people that it isn't worth having running. We mainly use this for telling people that email is down - so maybe we will have to keep email running instead.

Schrodinger i wouldn't woryy about it in a corporate environment behind a firewall. fws block these messages from the internet.

OFFTOPIC:

Quote:

---

heh could you not DoS someone by simply putting

<code>
:LOOP
@echo off
net send 127.0.0.1 is this annoying yet?
GOTO LOOP
</code>

in a .bat file and leaving it running -

---

I know someone who did this on their high school network. They were an assistant (and very immature). They had the login script copy it to everyone startup folders, along with copying it to a "hidden" folder and adding an entry to the .reg to start it at boot. (these machines were not secured by any means... default installs of 2k and the admins gave the assistants admin access... DUH!)

Instead of hitting one machine, he sent the message to the whole domain (on purpose)... but every single box was doing it! Every computer monitor filled with messages from different machines. Nobody knew what was going on... everyone was rebooting, etc. problem still happening. He was just sitting there laughing his a$$ off! Everyone knew he had something to do with it.

Needless to say... he is no longer an assistant and got suspended from school.
Though.. he said given the chance, he'd do it again, just to see the admins faces again!

Some people will never grow up... :rolleyes:

Thanks for both how to disable it and the actual information itself. I'm gonna try that on my own network, pretty funny if it kills the family computer ;) Do you consider it a large vulnerability? Like if my home computer has messanger running. Could I message myself 'net send <my IP> 0x14 0x14 0x14 0x14 0x14' will that crash my computer?

Tedob1 wrote:

Quote:

---

Schrodinger i wouldn't woryy about it in a corporate environment behind a firewall. fws block these messages from the internet.

---

I disagree with this assessment: all it's gonna take is a new virus that infects just ONE machine on your LAN and it could spread to all other machines. Yes, the firewall will (and does) block any direct attempts from the Internet but you are still exposed inside due to user carelessness (re.; clicking or opening up attachment from unknown sender...that doesn't happen does it?! ;) ).

This service for the most part is useless and many agree should be disabled. The only use that we have seen in our corporate environment is print messages: after a document has printed a message gets sent to their workstations stating it has printed.

We are developing a VB script which we will run, as a domain administrator, and remotely across the network stop and disable the Messenger service. Further, we're incorporating the disabling of this service in our standard build.

If anyone is interested in this script PM me and I'll send it to you when it's done (we expect to be done with it in next day or so). :cool:

Quote:

---

Originally posted here by Tedob1
Schrodinger i wouldn't woryy about it in a corporate environment behind a firewall. fws block these messages from the internet.

---

You have more faith in our firewall than I do. :rolleyes:

I thought there was a feeling that relying on border security was dangerous, because securing the border rigorously is impossible. We have serious concerns about laptops, which we know are taken home, and connected to personal internet connections - probably completely unprotected. We suspect our last infection came in this way.

phishphreek - you know this is so tempting. Just for the sheer hell of it. When I am starting a few days away. :lildevil:

you can use the name of a user currenlty logged in instead if ip or comp name.

you can also disable it by typing at the dos prompt: net stop messenger

Quote:

---

you know this is so tempting. Just for the sheer hell of it. When I am starting a few days away

---

Use the ISS scanner utility: it puts a nasty popup on users screen telling them to patch. It's located at http://www.iss.net/support/product_utilities/ms03-043

Have fun!