Re: There is a script to detect ms010_061?

[Richard Miles <richard.k.miles () googlemail com>]

That's awesome. I'm pretty newbie, but if there is anything that I may
help. I'm sure other guys on the list with more experience may be able
to assist you too.

Great initiative.

Thanks

On Tue, Nov 9, 2010 at 2:23 PM, Drazen Popovic <Drazen.Popovic () fer hr> wrote:
> Hi all,
> long time no hear =)
>
> I'm working on it...as it turns out Metasploit offers a working exploit for
> these vuln
> so I'll base my work on that as I lack the reversing/IDA skillz for the time
> being.
>
> I'm trying to generate the client code for communicating with the vulnerable
> service (WinSpools)
> which then I will use to trigger the vulnerability and detect it.
>
> Regards,
> Dražen.
>
>
>
> -----Original Message-----
> From: nmap-dev-bounces () insecure org on behalf of Richard Miles
> Sent: Tue 11/9/2010 20:59
> To: Ron; nmap-dev () insecure org
> Subject: Re: There is a script to detect ms010_061?
>
> Too bad you know it and you can't write it. I believe it's a contract issue
> :(
>
> What's the problem in write the check for Nessus?
>
> Anyone is working on it?
>
> Thanks
>
> On Fri, Nov 5, 2010 at 8:51 AM, Ron <ron () skullsecurity net> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> > No, but it IS possible to check for ms10-061 remotely. Against Windows
> > 2000, XP, and 2003, it isn't an *incredibly* difficult check to write.
> > Against Vista and higher it's pretty tricky, but do-able.
> >
> > I can't personally write it, because I've worked on the check for Nessus,
> > but I encourage others to try! The kb lists the files that were changed:
> > http://support.microsoft.com/kb/2347290
> >
> > And the patchdiff2 tool is free and can be used with IDA to analyze the
> > differences between the patched/unpatched files.
> >
> > Good luck!
> >
> >
> > On Fri, 5 Nov 2010 08:37:03 -0500 Richard Miles
> > <richard.k.miles () googlemail com> wrote:
> > > Hi
> > >
> > > There is a script to detect  ms010_061? Like you do with
> > > smb-check-vulns...
> > >
> > > If not, should be a awesome improvement.
> > >
> > > Thanks
> > > _______________________________________________
> > > Sent through the nmap-dev mailing list
> > > http://cgi.insecure.org/mailman/listinfo/nmap-dev
> > > Archived at http://seclists.org/nmap-dev/
> > -----BEGIN PGP SIGNATURE-----
> > Version: GnuPG v2.0.16 (GNU/Linux)
> >
> > iEYEARECAAYFAkzUC9cACgkQ2t2zxlt4g/QPmACeLATJnK5LSzXrElsEGlfGPFjF
> > gW0An2Ko4dLP/YPfxc+AcLUukoUjXy1a
> > =LPFh
> > -----END PGP SIGNATURE-----
> > _______________________________________________
> > Sent through the nmap-dev mailing list
> > http://cgi.insecure.org/mailman/listinfo/nmap-dev
> > Archived at http://seclists.org/nmap-dev/
> _______________________________________________
> Sent through the nmap-dev mailing list
> http://cgi.insecure.org/mailman/listinfo/nmap-dev
> Archived at http://seclists.org/nmap-dev/
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/