[Full-Disclosure] Finding Win2k SP3 with a single packet

From: 0xcd0x80@hush.com
Date: 09/10/02


From: 0xcd0x80@hush.com (0xcd0x80@hush.com)
Date: Mon,  9 Sep 2002 15:08:56 -0700

Just a quick post to highlight something I noticed, you may well need
this the next time a really tasty sploit in IIS comes out.

When deciding which offset to use when you want to mess about on the stack or the heap you need to know the Service Pack in use. So how can you tell that in as few a number of packets as possible. Well if you need to tell whether SP3 has been installed on Win2k you can try this.

I'll assume that you have determined the server is Win 2K by seeing the
web banner is IIS 5.0. So if you send a single SYN packet to port 80, or
any other open port you can find and have a look at the result.

First example Win 2K with SP2 or below:

 hping -S -p 139 10.0.0.3
HPING 10.0.0.3 (eth1 10.0.0.3): S set, 40 headers + 0 data bytes
len=46 ip=10.0.0.3 flags=SA DF seq=0 ttl=128 id=65060 win=16616 rtt=0.7
ms

Then we try on a freshly installed SP3 machine:
 hping -S -p 139 10.0.0.4
HPING 10.0.0.4 (eth1 10.0.0.4): S set, 40 headers + 0 data bytes
len=46 ip=10.0.0.4 flags=SA DF seq=0 ttl=128 id=24532 win=64240 rtt=0.7
ms

As we can see SP3 has a TCP windowsize of 64240 and before that had
16616.

(My warning from before was because Win XP also has win=64240)

So with a single packet we can tell the difference between SP3 and
below. I know its simple and not fool proof but it might just get you
those system privs that you were after.

I admit that I'm pretty lame so I haven't got a nice 0day to put the
theory into practice with. However, if you do know about one let me know
some details and I will do some experimentation.

This is just a stop gap solution, give Fyodor a little time and I'm sure
nmap will build this OS fingerprinting in as it does everything else you
might want it to.

greetz, they know who they are, do you?
b,m,b,e,g,s,u

Get your free encrypted email at https://www.hushmail.com



Relevant Pages

  • Re: adsutil.vbs missing after installing XP SP3
    ... I have local copies of the XP Pro/SP2 install kit, and the SP3 install kit, on the C: ... I turn on IIS as part of building the baseline image for my software developers. ... ServerComment for Web server number 1, ...
    (microsoft.public.windowsxp.general)
  • Re: IIS5 and Windows2000 SP3
    ... the .net framework and IIS and SP3. ... > "The Simple Mail Transport Protocol service hung on ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS5 and Windows2000 SP3
    ... > Unfortunately rolling back from sp3 to sp2 hasn't completely solved the ... > is to set the IIS, www publishing, smtp and ftp services to Manual. ... then I manually start the other services after bootup. ... > to sp3 I can't afford the time just yet. ...
    (microsoft.public.inetserver.iis.security)
  • Re: IIS5 and Windows2000 SP3
    ... Unfortunately rolling back from sp3 to sp2 hasn't completely solved the ... as the services still hang on bootup. ... is to set the IIS, www publishing, smtp and ftp services to Manual. ... then I manually start the other services after bootup. ...
    (microsoft.public.inetserver.iis.security)
  • Re: Remote Desktop Connection
    ... Also if you're going to use the web interface, you'll need to open port 80 ... and make sure IIS is running. ... Prev by Date: ...
    (microsoft.public.windowsxp.help_and_support)