full-disclosure - New Remote Windows Exploit (MS04-029)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <418951E0.8020008@osafoundation.org>
From: heikki at osafoundation.org (Heikki Toivonen)
Subject: New Remote Windows Exploit (MS04-029)

The moderator/admin messed things up - I did not send this!

Heikki Toivonen wrote:
> /*
>  *  Date: 2004/10/30
>  *  Maxload load_max@...oo.com
>  *
>  *  Exploit for \"Vulnerability in RPC Runtime Library\"
>  *  http://www.microsoft.com/technet/security/bulletin/MS04-029.mspx
>  *
>  *  Tested Against:
>  *  Windows 2000 (SP3 SP4)
>  *  Windows XP (SP1 SP2)
>  *  Windows NT4 (SP6a)
>  *
>  *  EXPLOIT IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY AS A PROOF OF CONCEPT
>  *  I TAKE NO RESPONSIBILITY FOR ANY USE OF THIS CODE.
>  *
>  *
>  *  Instructions:
>  *
>  *  [user@...alhost] $ gcc -o maxload maxload.c
>  *  [user@...alhost] $ ./maxload
>  *  *** MaxLoad (windows rpc exploit) v.1 ***
>  *
>  *  For educational propose only!
>  *  error: you must enter a valid ip
>  *  usage:./maxload [IP-ADDRESS]
>  *  e.g: ./maxload 192.168.1.23
>  *
>  *
>  *  [user@...alhost] $ ./maxload 192.168.1.2
>  *  *** MaxLoad (windows rpc exploit) v.1 ***
>  *  For educational propose only!
>  *  Succes! Try connect to 192.168.1.2 port 31337
>  *
>  *
>  *  [user@...alhost] $ telnet 192.168.1.2 31337
>  *  Connected to 192.168.1.2.
>  *  Escape character is \'^]\'.
>  *
>  *  Microsoft Windows XP [Version 5.1.2600]
>  *  ? Copyright 1985-2001 Microsoft Corp.
>  *
>  *  C:\\>
>  *
>  * Bang, here you go, administrative access..
>  *
>  */
> 
> Do i need too say more :D
> 
> https://fri-adgang.dk/?get=1056]maxload.c (source code)
> https://fri-adgang.dk/?get=1055]maxload (linux static binary)
> 
> -MaxLoad
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html


-- 
   Heikki Toivonen

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 249 bytes
Desc: OpenPGP digital signature
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20041103/22fce5ed/signature.bin