RE: DCOM RPC exploit (dcom.c)

["Tom H" <tom () scriptsupport co uk>]

I used nmap to scan a random /16 for systems with port 135 open,
I fed the results of systems with that port open into enum  (enum -S $ip)
and grepped for a "SharedDocs" share, which indicates  XP box.
Then I ran the win32 binary I compiled from from the c code posted to this list
against that list of ips.
I assumed that most XP boxes would be SP1.
I got 6 command prompts.
I then ran the same binary looking for Xp with Sp0.
I got 156 command prompts.




_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html