currently, there is a working DoS proof of concept (POC) in the file downloads section. I have found the source for it, but I would now like to create it so the exploit works. So far, this is the plan.

1) When the buffer overflow occurs, and I fill bshell2 with only A's, the address that could not be read is not 0x6161616161, which is what it should be.

2) To fix this, we must change the code inside the program that creates the new user, which will not be hard. For testing, we can replace it with A's, and see if we can find the buffer. After we find out the exact amount of A's it takes to create the DoS, we can insert shell, and get our exploit running again. Basically, you find out what is the smallest amount that can be passed, and subtract one more A so we don't overflow the buffer. Then you add 3 more A's to get the full 32 bits, and get to where the code can be executed. Correct me if I'm wrong, it's about 3:00 AM here.

3) After we get this, inserting the shellcode is childs play. There is just one problem. I can't get the program to compile. I've gotten it down to 2 errors, but that is it (in MS VC++). I've also tried gcc for windows, and I didn't get anything. If someone can rework this code so that it compiles, I will create the exploit so that it is up to date. Since most ISP's now block port 135 by default, the exploit will now be sent to port 445, which is another port that DCOM listens on. I've already made this change, but I need help finding the errors. I've tried compiling with .c and .cpp, none of the above have helped. Here's the code.

add
#pragma comment(lib,"ws2_32")

and fix the line :
if (buf[i+32]!=win2kvuln)

to :
if (buf[i+32]!=*win2kvuln)


by the way this is rpc.cpp


and again it does not work

P.S : y was i unable to upload any attahcment!!!! i would have posted the whole code!!

it worked ! You rock, i'm going to edit the shell now.

So... "what", is this supposed to be the end-all be-all of RPC exploits then?

Wasn't this original exploit (and all the reworkings there-after) flawed. I remember trying perhaps 5-6 versions, which often didn't compile, and if they compiled they didn't work. The only way they worked was DoS. However, I remember testing it on a machine on my network and discovering that one of the exploits (can't remember which one) crashed the svchost.exe on the machine.


But as well as changing the code I believe the shellcode (and a universal ret value/position) will need doing too?