full-disclosure - RELEASE: SMB2 REMOTE EXPLOIT (VISTA SP1/SP2) + HACKTRO

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 17 Aug 2010 18:26:40 +0200
From: "Piotr Bania" <bania.piotr@...il.com>
To: <full-disclosure@...ts.grok.org.uk>
Subject: RELEASE: SMB2 REMOTE EXPLOIT (VISTA SP1/SP2) +
	HACKTRO

Hello digital-cowboys,

Today i'm releasing ~1year old (almost) remote exploit for the MS09-050 SMB2
negotiation vulnerability. Since users had almost a year to patch up their
machines and some other remote exploits for this vulnerability are flying
over the internet for a long time already i have decided to release my own.

This exploit uses the trampoline technique that I described in my previous
blog post [1] and it is also a fantastic example of how not^H^H^H to write
exploits. Additionally, to make this one more miserable and yet still funky,
I have attached a brand new 3D HACKTRO (yay!). As always, greetings for all
of the hidden demosceners spending more time bouncing to cracktros than
original games.

Here comes the video capture of the pure-awesome hacktro (low-quality):
http://vimeo.com/14138182

And here is the list of mirrors where you can find exploit src + hacktro
bin:
http://www.piotrbania.com/all/smb2_exploit_mirrors.txt

Please note that some of the mirrors listed there may be dead soon because
we are expecting big liquor* shipment straight from Russia (*beep*). So be
sure you will get your copy before this transport arrives! Also make sure
you click on the ascii g00gle ads to support our cause. ODZYSKAMY POLMOS!

thank you and have a nice winter!
_o/

*   - alcohol-free ((:)
[1] -
http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html

-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr@...il.com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

               - "The more I learn about men, the more I love dogs."

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/