Metasploit mailing list archives
Windows Server 2003 R2 (SP2) Target
From: metafan at intern0t.net (metafan at intern0t.net)
Date: Tue, 04 Nov 2008 12:17:57 -0500
Keep in mind that it can also be a defensive windows mechanism ;) I think it was yesterday i tried to hack our own server (for fun) to see if the exploit would work, the scanner said it was vulnerable so i thought well lets try (and yes i had permission).. Well then it didn't give a shell and i'm like hmmm, something sure isn't right, even though it shouldn't have been exploited anyways as we had updated it (i think).. I log onto the server and see that some M$ Defensive BS has blocked some "malicious code" from being executed in the memory of the process, i'm like O_O and wonder if M$ has finally found a way of blocking such malicious attacks.. (and no the server has absolutely no AV and FW on). ~ MaXe PS: Though that doesn't mean that the same applies to you, i'm just saying what happened to our server which is Win 2003 SP2 Enterprise. (hd moore -v ) The 2003 SP1/SP2 bypass is senstive to any changes in ntdll.dll, shell32.dll, and ws2help.dll. What are the MD5s of these files on your machine? It could be that R2 ships with slightly different binaries, or a post-SP2 windows update changed the binary. On Tuesday 04 November 2008, vibus at gmx.net wrote:
I've been unable to exploit my Windows 2003 server in using "Windows 2003 SP2 English (NX)". I even made a clean install in my VM with the same results. I double checked the SP (2) and the language (english).
_______________________________________________ http://spool.metasploit.com/mailman/listinfo/framework
Current thread:
- Windows Server 2003 R2 (SP2) Target vibus at gmx.net (Nov 04)
- DDOS on Site Wright, Gareth (Nov 04)
- Windows Server 2003 R2 (SP2) Target H D Moore (Nov 04)
- <Possible follow-ups>
- Windows Server 2003 R2 (SP2) Target metafan at intern0t.net (Nov 04)