bugtraq - Re: MS05_039 Exploitation (different languages)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <1125009927.8303.18.camel__14495.4720199623$1125095637$gmane$org@localhost>
Date: Fri, 26 Aug 2005 00:45:27 +0200
From: Fabrice MOURRON <fmourron@...probe.com>
To: Roman Medina-Heigl Hernandez <roman@...labs.com>
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: MS05_039 Exploitation (different languages)

Hi Roman,

I assure you that the address is also different for the French language.
With the similar review with ollydbg, the base address for me is
0x76740000. I've attached the resulting exploit and Metasploit's module
for french's system.

Regards,

-- 
Fabrice MOURRON ----- Consultant en sécurité des systèmes d'information
fmourron@...probe.com ------[ ExaProbe ]------ http://www.exaprobe.com/

PGP KeyID: 20D22266
FingerPrint: 767E CB52 94D3 7AEF DD21  BD2F 4D5C 6E6D 20D2 2266


Le jeudi 25 août 2005 à 18:36 +0200, Roman Medina-Heigl Hernandez a
écrit :
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hi,
> 
> I tested existing exploits for PnP bug on my W2k SP4 machine (Spanish)
> and they didn't work ("services" process is crashing but I got no
> shell). So I did a quick review with Olly and I realized that
> umpnpmgr.dll is being loaded at a different base address. In Spanish
> systems this base address is 0x76770000 but current exploits are
> assumming (I guess) 0x767a0000. Then I did a quick hack to HOD's exploit
> and it worked perfectly. I also modified Metasploit's module and
> included a target for Spanish systems. I've attached resulting exploits
> (they are trivial, though).
> 
> Is it usual that Windows DLLs have different base address across same
> Windows/SP versions (but different languages)?
> 
> 
> - --
> 
> Cheers,
> - -Roman
> 
> PGP Fingerprint:
> 09BB EFCD 21ED 4E79 25FB  29E1 E47F 8A7D EAD5 6742
> [Key ID: 0xEAD56742. Available at KeyServ]
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.0 (MingW32)
> 
> iD8DBQFDDfOr5H+KferVZ0IRAiZKAKDJ0A1RT+iyFcJipN3k56YEmzctqACePS5e
> aUJNlnMEsftew1Yn993iGJY=
> =XE3r
> -----END PGP SIGNATURE-----


Download attachment "ms05_039_pnp_french.pm" of type "application/x-perl" (8091 bytes)

View attachment "HOD-ms05039-pnp-expl-french.c" of type "text/x-csrc" (14543 bytes)