Re: [Full-Disclosure] New Remote Windows Exploit (MS04-029)

From: Heikki Toivonen (heikki_at_osafoundation.org)
Date: 11/03/04

  • Next message: Shoshannah Forbes: "Re: [Full-Disclosure] Who wrote Sobig?"
    To: full-disclosure@lists.netsys.com
    Date: Wed, 03 Nov 2004 13:47:12 -0800
    
    
    

    The moderator/admin messed things up - I did not send this!

    Heikki Toivonen wrote:
    > /*
    > * Date: 2004/10/30
    > * Maxload load_max@yahoo.com
    > *
    > * Exploit for \"Vulnerability in RPC Runtime Library\"
    > * http://www.microsoft.com/technet/security/bulletin/MS04-029.mspx
    > *
    > * Tested Against:
    > * Windows 2000 (SP3 SP4)
    > * Windows XP (SP1 SP2)
    > * Windows NT4 (SP6a)
    > *
    > * EXPLOIT IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY AS A PROOF OF CONCEPT
    > * I TAKE NO RESPONSIBILITY FOR ANY USE OF THIS CODE.
    > *
    > *
    > * Instructions:
    > *
    > * [user@localhost] $ gcc -o maxload maxload.c
    > * [user@localhost] $ ./maxload
    > * *** MaxLoad (windows rpc exploit) v.1 ***
    > *
    > * For educational propose only!
    > * error: you must enter a valid ip
    > * usage:./maxload [IP-ADDRESS]
    > * e.g: ./maxload 192.168.1.23
    > *
    > *
    > * [user@localhost] $ ./maxload 192.168.1.2
    > * *** MaxLoad (windows rpc exploit) v.1 ***
    > * For educational propose only!
    > * Succes! Try connect to 192.168.1.2 port 31337
    > *
    > *
    > * [user@localhost] $ telnet 192.168.1.2 31337
    > * Connected to 192.168.1.2.
    > * Escape character is \'^]\'.
    > *
    > * Microsoft Windows XP [Version 5.1.2600]
    > * Copyright 1985-2001 Microsoft Corp.
    > *
    > * C:\\>
    > *
    > * Bang, here you go, administrative access..
    > *
    > */
    >
    > Do i need too say more :D
    >
    > https://fri-adgang.dk/?get=1056]maxload.c (source code)
    > https://fri-adgang.dk/?get=1055]maxload (linux static binary)
    >
    > -MaxLoad
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html

    -- 
       Heikki Toivonen
    
    

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html



  • Next message: Shoshannah Forbes: "Re: [Full-Disclosure] Who wrote Sobig?"

    Relevant Pages

    • Re: [Full-Disclosure] New MyDoom exploiting IFRAME
      ... microsoft are acting "responsibly", following "commonly accepted practice" ... they are masters of managing "responsibility" - just check their EULAs. ... > Full-Disclosure - We believe in it. ... > Charter: http://lists.netsys.com/full-disclosure-charter.html ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] New Remote Windows Exploit (MS04-029)
      ... Ahem, nice try. ... > * EXPLOIT IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY AS A PROOF OF CONCEPT ... > * I TAKE NO RESPONSIBILITY FOR ANY USE OF THIS CODE. ... Charter: http://lists.netsys.com/full-disclosure-charter.html ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] PoC to be released on 01/20/05
      ... On "Not One Damn Dime Day" those who oppose what is happening in our name in Iraq can speak up with a 24-hour national boycott of all forms of consumer spending. ... Remind the people in power that the war in Iraq is immoral and illegal; that they are responsible for starting it and that it is their responsibility to stop it. ... Full-Disclosure - We believe in it. ... Charter: http://lists.netsys.com/full-disclosure-charter.html ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] New Remote Windows Exploit (MS04-029)
      ... Something/somebody is messing things up - I did not send this! ... > * EXPLOIT IS PROVIDED FOR EDUCATIONAL PURPOSES ONLY AS A PROOF OF CONCEPT ... Full-Disclosure - We believe in it. ... Charter: http://lists.netsys.com/full-disclosure-charter.html ...
      (Full-Disclosure)