full-disclosure - Re: Bad news on RPC DCOM vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1065835784.3f875d08e7da8@postoffice.tpg.com.au>
From: vosipov at tpg.com.au (V.O.)
Subject: Re: Bad news on RPC DCOM vulnerability

There is not much info there, the site basically goes on saying that somebody
("karlss0n") posted the exploit  http://www.securitylab.ru/_exploits/rpc2.c.txt
to their bbs, the exploit is not using fixed jump addresses, which makes it work
with several versions of Windows. 

Then somebody has tried it against a patched XP and it seems to be working. 
Currently this exploit can be used for a shell on an unpatched (ms03-039) XP
(they say you need to put a shellcode into file bshell2 and fix a couple of
offsets, the sample code is at http://www.securitylab.ru/_exploits/shell.asm.txt)

On a patched XP this sploit only produces a DoS.

the discussion is here -
http://forum.securitylab.ru/forum_posts.asp?TID=5642&PN=1&TPN=3 ,more
informative, they talk about using SEH.

P.S.  I am not associated with anybody from this site/posting in; I am simply
translating the site for those who cannot read Russian, because online
translators are shite :)

Quoting Bobby Brown <bbrown@...secadmin.com>:

> So I can "assume" no other information is posted, other than this site, to
> collaborate the RPC issue is not resolved or should we all try to translate
> this site using the helpful hints, which they are?
> 
> 
> BB
> 
> 
> -----Original Message-----
> From: full-disclosure-admin@...ts.netsys.com
> [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of petard
> Sent: Friday, October 10, 2003 4:40 PM
> To: Brown, Bobby (US - Hermitage)
> Cc: full-disclosure@...ts.netsys.com
> Subject: Re: [Full-Disclosure] Re: Bad news on RPC DCOM vulnerability
> 
> 
> On Fri, Oct 10, 2003 at 03:34:04PM -0400, Brown, Bobby (US - Hermitage)
> wrote:
> > For us that can not interpret the site, what more information can be
> > provided.
> > 
> > Bobby
> > 
> FYI, the site is in Russian. Here are the steps for enlightening yourself:
> 
> 1. Visit your favorite search engine.
> 2. Type the words "online translator russian" (without quotation marks) into
> the query field.
> 3. Visit one of the many free or paid translating services that are listed
> there.
> 4. Select your preferred language (English, I'd wager), enter the URL, and
> let
> the translator go to work.
> 5. Read the slightly stilted but informative result.
> 
> FWIW, entering that query into google and clicking "I'm feeling lucky" gives
> good
> results.
> 
> Good luck.
> 
> HTH,
> 
> petard
> 
> 
> --
> If your message really might be confidential, download my PGP key here:
> http://petard.freeshell.org/petard.asc
> and encrypt it. Otherwise, save bandwidth and lose the disclaimer.
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
> 
> 
>