MS08-067 Authentication against NTLMv2

[one.miguel at gmail.com (Juan Miguel Paredes)]

The problem is like you stated.  A secure configuration would not have
either accessible by anonymous users.  On workstations on a domain,
the BROWSER service may even be turned off completely.  Lastly, in my
testing of baselined systems, there is also "buffer overflow"
detection that thwarts attempts (McAfee in my case).  It definitely
works as long as either the BROWSER or SRVSVC named pipe is enabled
and accessible by anonymous users (and the BO detection is turned
off).

On Mon, Nov 10, 2008 at 5:18 PM, Ron <ron at skullsecurity.net> wrote:

> There are two ways to test this, either through "BROWSER" or "SRVSVC".
> Metasploit uses "BROWSER" by default (and, in my testing, it works on
> more systems by default), but you can change it with the SMBPIPE
> variable ("set SMBPIPE SRVSVC"). If you get the same problem for both
> BROWSER and SRVSVC, then you're probably out of luck testing this
> anonymously.