RELEASE: SMB2 REMOTE EXPLOIT (VISTA SP1/SP2) + HACKTRO

["Piotr Bania" <bania.piotr () gmail com>]

Hello digital-cowboys,

Today i'm releasing ~1year old (almost) remote exploit for the MS09-050 SMB2
negotiation vulnerability. Since users had almost a year to patch up their
machines and some other remote exploits for this vulnerability are flying
over the internet for a long time already i have decided to release my own.

This exploit uses the trampoline technique that I described in my previous
blog post [1] and it is also a fantastic example of how not^H^H^H to write
exploits. Additionally, to make this one more miserable and yet still funky,
I have attached a brand new 3D HACKTRO (yay!). As always, greetings for all
of the hidden demosceners spending more time bouncing to cracktros than
original games.


Here comes the video capture of the pure-awesome hacktro (low-quality):
http://vimeo.com/14138182

And here is the list of mirrors where you can find exploit src + hacktro
bin:
http://www.piotrbania.com/all/smb2_exploit_mirrors.txt


Please note that some of the mirrors listed there may be dead soon because
we are expecting big liquor* shipment straight from Russia (*beep*). So be
sure you will get your copy before this transport arrives! Also make sure
you click on the ascii g00gle ads to support our cause. ODZYSKAMY POLMOS!

thank you and have a nice winter!
_o/


*   - alcohol-free ((:)
[1] -
http://blog.metasploit.com/2009/10/smb2-351-packets-from-trampoline.html





-- 
--------------------------------------------------------------------
Piotr Bania - <bania.piotr () gmail com> - 0xCD, 0x19
Fingerprint: 413E 51C7 912E 3D4E A62A  BFA4 1FF6 689F BE43 AC33
http://www.piotrbania.com  - Key ID: 0xBE43AC33
--------------------------------------------------------------------

               - "The more I learn about men, the more I love dogs."


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/