Windows Server 2003 R2 (SP2) Target

[metafan at intern0t.net (metafan at intern0t.net)]

Keep in mind that it can also be a defensive windows mechanism ;)
I think it was yesterday i tried to hack our own server (for fun)
to see if the exploit would work, the scanner said it was vulnerable
so i thought well lets try (and yes i had permission)..

Well then it didn't give a shell and i'm like hmmm, something sure
isn't right, even though it shouldn't have been exploited anyways
as we had updated it (i think).. 

I log onto the server and see that some M$ Defensive BS has blocked
some "malicious code" from being executed in the memory of the process,
i'm like O_O and wonder if M$ has finally found a way of blocking such
malicious attacks.. (and no the server has absolutely no AV and FW on).


~ MaXe

PS: Though that doesn't mean that the same applies to you, i'm just
saying what happened to our server which is Win 2003 SP2 Enterprise.

(hd moore -v )
The 2003 SP1/SP2 bypass is senstive to any changes in ntdll.dll, 
shell32.dll, and ws2help.dll. What are the MD5s of these files on your 
machine? It could be that R2 ships with slightly different binaries, or a 
post-SP2 windows update changed the binary.


On Tuesday 04 November 2008, vibus at gmx.net wrote:
> I've been unable to exploit my Windows 2003 server in using "Windows
> 2003 SP2 English (NX)". I even made a clean install in my VM with the
> same results. I double checked the SP (2) and the language (english).


_______________________________________________
http://spool.metasploit.com/mailman/listinfo/framework