just released by ISS team .... :

scanmsgr.exe .......

... I hope to see an exploit soon, I need it to show to my manager so he will approve deployement of the patch on SUS.

wow thanks alot sounds great
im really expecting to see that exploit soon
great job!

Hi!

BigTHX 4 Scantool.
Ich hope to get the Exploit later too *g*

DaMan

Thanks for sharing m8...nice tool

THX for sharing the tool

thanks 4 sharing this...

I allways get a window error ... I'm on W2K

---edit

i change the file to c:\ and it works.

This scanner will popup a msg window warning about this vuln in the scaned ip, maybe there is another scanner that son't popup that window, or puting some parameter, i'll see

--- edit

solved

write a ini file with:

ping=true
target=[start IP]-[end IP]

save the file and do a "scanmsgr.exe config=inifile.ini"

now the scanned ip don't see any popup

I just checked mine and disabling the messenger service stops it but unpatched it gives a popup on the remote users desktop. Not a good thing when scanning your internal networks. I had 4 users call me and i only scanned a range of 10 machines. Is there a way of removing the popup part of the scan tool?

Nice Scanner M8..hopefully exploit soon

How to save the results to a file?

scanmsgr config=scann.ini > scann.txt doesnt work ... scann.txt remains empty ...

Figured it out thanks anyways

I programmed a little batch

pls people,
don't use this scanner...

it uses net send to tell people their system is hackable, and where they could download the patch....

so if you're a hacker, don't use this scanner,
if you're a security consultant, you can use this scanner to notify your costumers...
but remember... it is illegal to scan people that aren't affiliated with you.

hmm well, it's still nice to test home network thnx anyway

Grtz

that ping=true is handy should looked before scanning my users on the network boss told me off as it concerned the users LOL

You could use the option "ping=true" , it will send a silent Messenger "ping" instead of a popup message.
However, the ping technique only works on port 135, it doesn't work on the additional port range.

port 135 is blocked at most ISP's, but for internal network pen-testing it should be fine.

the RPC service uses this port, so all rpc vuln needs this port to work, if your isp blocks this port than they don't work!
it seems that the messengers service uses another random port. the difference between the messanger and the other rpc services is that the messangers uses UDP instead of TCP. the most isp block only TCP...

great thx 4 sharing dude

how about just (filtered) hexing the netsend msg from the exe file, ever thought of that

ok, so what do I do if I find a hackable host? take a note and hope that perhaps the exploit will be released before people have patched their machines? whats the point?

hifil0wlife, most exploit patches come out before the exploits themselves
That doesn' t mean we don' t use the exploits...

hi folkz,

Try this scann0r, no message with warning in this one....

thanks for this man, definately going to check it out.

no point of using this intill we achurly know a exploit is being made..but thx for the scanner m8..

thanks for the scanner...

i was wondering..is there anyway to make it work and save results to a *txt file

ps-
i tried scan target=ip-ip >>results.txt
and
scan target=ip-ip >log.txt


But nothing seems to work...




Thanks PPL

thnks dude i hope also to see the new exploit....soon.

Trust me it un hackable unless you do it thro udp and this board is ment for you can be 1337 h@x0rs it ment to protecting you networks damn this board has been giong down with leechers and newbiews but come on this is a "How to Hack for you Warez Stros" board is it becuase all of the leechers we dont get anymore good tools

Ducky ... the results will be saved after the scann is done .. or just use my little batch

nice one there

but to bad the isp's blocks tha shit

Nice one mate

Also heres a quick batch for scanning Multiple ranges

Thanx to tribalgoa for posting it and thanx to everyone else who posted the cool little batches to make things easier.