Windows 7/Server 2008 R2 SMB client infinite loop
There are very few exploits available for Windows 7 and Windows Server 2008. The SMB client infinite loop is one such vulnerability that causes a system crash. This vulnerability will not provide any session or shell connectivity, but it is worth discussing. We will deal with the DLL injection flaw in Windows 7 in the Understanding the Windows DLL injection flaws recipe.
The SMB client in the kernel in Microsoft Windows Server 2008 R2 and Windows 7 allows remote SMB servers and man-in-the-middle attackers to cause a denial of service (infinite loop and system hang) via SMBv1 or SMBv2 response packet. The packet contains an incorrect length value in a NetBIOS header or an additional length field at the end of this response packet. This incorrect header value is the main reason for the vulnerability.
Getting ready
Metasploit contains an auxiliary module auxiliary/dos/windows/smb/ms10_006_negotiate_response_loop which can be used to exploit the...
