exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Microsoft RRAS Service RASMAN Registry Overflow

Posted Nov 26, 2009

Authored by H D Moore, Pusscat | Site metasploit.com

This Metasploit module exploits a registry-based stack overflow in the Windows Routing and Remote Access Service. Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well. A valid username and password is required to exploit this flaw on Windows 2000. When attacking XP SP1, the SMBPIPE option needs to be set to 'SRVSVC'. Exploiting this flaw involves two distinct steps - creating the registry key and then triggering an overwrite based on a read of this key. Once the key is created, it cannot be recreated. This means that for any given system, you only get one chance to exploit this flaw. Picking the wrong target will require a manual removal of the following registry key before you can try again: HKEY_USERS\\\\.DEFAULT\\\\Software\\\\Microsoft\\\\RAS Phonebook

tags | exploit, remote, overflow, registry

systems | windows

advisories | CVE-2006-2370

SHA-256 | 23ee569235c3874d89c2c84da0e57b5ca0d9fd9d118297399485cee1eebf336b

Download | Favorite | View

Related Files

No related files