Re: SQL Server 2K SP0 magically protected

["Joshua J. Drake" <jdrake () metasploit com>]

On Fri, Jun 18, 2010 at 09:39:10PM +0200, Emma Schreber wrote:
> I want to use the ms02_039_slammer exploit. So I set up a SQL Server 2000 SP0 straight from the old red MSDN CD.
>
>
> SQL Server 2000 SP0 Developer on XP
>
>
> The exploit didn't work. Neither did ms02_056_hello. 
> I fully expected to have to change a return address or something but it didn't even crash.
>
> No crash, no log entry, nothing. Attached to the process: no exception.
> So I installed
>
> SQL Server 2000 SP0 Enterprise on W2K Server.
>
> Again no crash, nothing. Both exploits.
> I verified in wireshark that the servers received the data.
>
> I don't think the MSDN CD from about 2002 is patched against this.
> The exact version number is 8.0.194, so it should be perfectly vulnerable.
>
>
> Didn't this exploit use to be very reliable?
> Did I dream the whole slammer thing?

There was a repackage of SP0 due to the slammer worm. The only
difference is one file (which I forget at the moment).  You might be
using this version... 

The ms09_004 exploit might work, although it requires auth...

Hope this helps,

-- 
Joshua J. Drake

Attachment: _bin
Description:

_______________________________________________
https://mail.metasploit.com/mailman/listinfo/framework