Microsoft IIS 5.0 SSL Remote buffer overflow Exploit (MS04-011)

http://www.k-otik.com/exploits/04212004.THCIISSLame.c.php

Compiled version here:

http://www.thc.org/download.php?t=e&f=THCIISSLame.zip

Anyone tried it ?

I try a few IP:

you should scan 4 pcs which have iis 5.0 installed and are running on SSL

you have got a scanner 4 us?

sounds very intresting!

did somone know how to patchthe hole ?

should I do a portscan on p443 and than bannerscan the results on p80?

works great

tested @ some pc's no shell @ all going further for more mabey i get some

and thx for the Exploit

Is this what we want?

195.*.*.*
Responds with ICMP unreachable: No
TCP ports: 80


TCP 80:
[HTTP/1.1 200 OK Server: Microsoft-IIS/5.0 Content-Location: http://10.41.2.20/Default.htm Date: Wed, 21 Apr 2004 14:47:12 GMT Content-Type: text/html Accept-]

I build a auto one and steal trying to get a shell / nothing..

thanks for the sploit

Exploit works perfectly, IIS 5 on Win2k Server W/SSL

S'pose it would make sense to recompile the sploit with the remote shell port as a command line option, since most firewalls aren't going to allow an inbound connection on port 31337. Maybe I'll do that tonight.

yea tru, that would be cool if you could do that.

yeh also a nice batch autohacker would be nice ,
thanks for the exploit

yeah good sploit ;]

[*] connecting the target
[*] Exploit send successfully ! Sleeping a while ....
[*] Trying to get a shell

Microsoft Windows 2000 [Version 5.00.2195]
© Copyright 1985-2000 Microsoft Corp.

C:\WINNT\system32>

got about 50 shells by now. the sploit is nice

sl.exe -bhpt 80,443 -f scan.txt -o vulnerable.txt

thats what u use to get results with port 80 and 443 open

are yall using the compilied or .c sploit?

.exe I think

LoL

anyone figured out how 2 secure the hacked boxes?

close port 443
firewall.exe 443

but isnt port 443 required to be open for ssl? i dont think this is a good idea ^^

dont publish this exploit to everybody

every leet scrip kiddie use it for his "ownage..." think about it

this thread is a really "how to hack iis 5 ssl remote exploit" thread...

Anyone just crashing alot of machines with this sploit? Try nmapin them out again and check things out... Oh and yes Scriptys are using it for 0wnage.. But its avaliable EVERYWHERE if the can type gcc sploit.c -o 0wnage then they are gonna useit anyway, and in anthor thread there are auto hackers galore... Why complain and make a usless post?

This is hardly the first spot in the world to post the exploit, it wasn't written by GSO.

This'll be a good motivator to get admins off their asses and patch.


Ooops, hearing reports from the field that the MS04-011 patch required is causing probs on a lot of systems... Slow Boot, BSOD, 100% utes eeeeek.


Thanks for the nice choice M$....

1) Apply patch = broken server

2) Don't apply patch = owned server


bah... doesn't matter anyhow, TCP RST DoS against all those BGP routers will be here soon and no one will be on the internet to even give a sheeeeeeeeiiiit.

Lol and Micro$oft slowly collapses upon itsself, down with the internet micro$oft must survive..

here is a scanner for the MS04-011 vu

EDITED...program been posted but not original link...edited the Downloads section lsass thread to reflect Foundstone link

cheers

but i thought this vuln has nothing to do with the other LSASS one.

well the exploit works but not for me, can't code so have to wait on connect back version

Some peeps said that they are working on an autohacker. but that's already included in the sploit right?

Some peeps said that they are working on an autohacker. but that's already included in the sploit right?


/EDIT
Sorry for this double post something went wront with my inet connection could someone please delete this?

al there auto hackers are just really bats anyone can make them

looks like a good exploit, but i can`t really find lots of servers

this was the one which vnet576 has edited!

http://www.thc.org/download.php?t=e&f=THCIISSLame.c

...

When i compiled with Dev C++ it gave 1 error i couldn't understand:

Very good Exploit guys