LSD hacker Broke Windows Server 2003

Hi guys/girls,

Do you still remember the famous LSD who won PITBULL challenge (Argus Hacking challenge)?.
Now they made a news broke in to Windows Server 2003
Check this out:

Quote:

---

The Last Stage of Delirium Research Group has discovered a critical security vulnerability in all recent versions of Microsoft operating systems. The vulnerability affects default installations of Windows NT 4.0, Windows 2000, Windows XP as well as Windows 2003 Server. The LSD Research Group was able to create proof of concept codes for this issue, which allowed for remote attack resulting in execution of any commands on vulnerable Windows systems with SYSTEM privileges (the highest level of access in Windows). The vulnerability is also exploitable in the case of Windows 2003 Server, regardless of the buffer overflow prevention mechanism it has been equipped with. >>

---

Check out their link http://www.lsd-pl.net/

Cheerrs


annya

Hehe was only a matter of time before someone did it and made it to the news. I am surprised it did not happen sooner :D

well M$ response awaited lets see how much they care abt their this product. they are marketing it with full vigour. So i think M$ will soon realse its patch soon. and the fact that a lot of websites are shifting over to M$ Win 2K3 ...lets hope this stops this trend.

Quote:

---

The existence of the vulnerability has been confirmed by Microsoft Corporation. This report is part of the coordinated release of information about this new threat. The appropriate security bulletin as well as fixes for all affected platforms are available for download from the Microsoft Security.

---

http://www.lsd-pl.net/special.html

This is a Microsoft product we're talking about here..... In the immortal words of Gomer Pyle "Surprise! Surprise! Surprise!"

We all had a feeling that RPC's would be the culprit of a major Windows flaw. Even though they are very helpful at times they always seem to be a vulnerability.

the way they got around the MS anti-overflow device worked in the lab under "certain conditions" which they arn't saying but their method works on all other unpatched nt based systems unconditionally

View and download patch from MS

http://www.microsoft.com/technet/tre...n/MS03-026.asp

Quote:

---

Originally posted here by MrZaiGA
View and download patch from MS

http://www.microsoft.com/technet/tre...n/MS03-026.asp

---

Yes MS have new patch but that patch is useless cause :

Quote:

---

patched XP Home.

Drag/Drop and other COM functions stop working, after a very visible
svchost.exe crash.

The hdmore loopback exploit is more friendly - it gave a nice DoS on all
RPC/COM services (no drag/drop) without crashing svchost. Of course,
this is only with the new return addresses that are not tied to any
specific servicepack..



Regards
Thor Larholm
PivX Solutions, LLC - Senior Security Researcher


-----Original Message-----
From: khan rohail [mailto:rohaikaz YAHOO COM]
Sent: Monday, July 28, 2003 8:34 AM
Subject: RPC DCOM still vulnerable even after applying patches


This is in reference to exploit code available here:
http://www.securiteam.com/exploits/5CP0N0KAKK.html
.......

We (Douglas Mclean/and I) have checked it against
windows 200 SP4 machines that "even if you apply the
patch kb823980", you can get DOS attacks as tcp port
135 service (loc-srv)gets crashed and we get this
error on the box against which the exploit is being
run:

"SVCHOST.exe has generated errors and will be closed
by Windows. You will need to restart the program. An
error log is being created".

You are not able to access Event log either and other
funny things are detected too.

--------
So, even if you apply the patch MS03-026 you still are vulnerable and
you can still get DOS attacks.

---

Check out the link http://www.securityfocus.com/archive...8/2003-08-03/2

Cheerss

I think I spend half my time patching systems at work. There are so many systems around including servers, it gets ridiculous how much I have to patch. Even with software to automate the patching it still wastes a lot of my time configuring the software to run the new patch and with so many notebooks I have to always worry that some user will not log in to the network and then will not get patched. Its just too much work just keeping up with all the patches released.

Pucker up people!

Widespread use of RPC DCOM Exploit

( I can't believe Windows ME has a redeeming value! )

Oh, and for Negative,
Exploitation of Microsoft RPC Vulnerabilities , the additional warning was apparently justified, even though he didn't review the previous threads first! :D

I'm new to all of this but can someone tell me what a buffer underrun is? And also how it works?

Buffer Under Run Occurs when the system cannot keep up a steady data stream to the CD recording software.

I think you meant Buffer overflow it is when data transferred to a buffer exceeds the storage capacity of the buffer and some of the data “overflows” into another buffer, one that the data was not intended to go into. Since buffers can only hold a specific amount of data, when that Limit has been reached the data has to flow somewhere else, it goes into another buffer, which can corrupt data that is already contained in that buffer :)

and how it works you send data with instructions to corrupt a system that are purposely written into a file in full knowledge that the data will overflow a buffer and release the instructions into the computer’s instructions. I may be wrong about that I am sure someone will correct me if I am

Buffer overflow happens on DoS attacks???

not all BOFs cause a DoS

Not all DoS is caused by a BOF

A BOF can cause a DoS