[28713] in bugtraq
locator exploit
daemon@ATHENA.MIT.EDU (Dave Aitel)
Sat Feb 1 13:32:45 2003
Date: Sat, 1 Feb 2003 13:17:37 -0500
From: Dave Aitel <dave@immunitysec.com>
To: bugtraq@securityfocus.com
Message-Id: <20030201131737.0fe1ea7a.dave@immunitysec.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
So after writing the RPC locator exploit, I noticed that the service
is not actually vulnerable until it has been initialized
properly. Does anyone have any more information on how often and when
this service is intialized (as opposed to simply started)?
Here is tethereal output illustrating an uninitialized locator service:
192.168.1.101 -> 192.168.1.100 DCERPC Bind: call_id: 5 UUID:
e33c0cc4-0482-101a-bc0c-02608c6ba218 ver 1.0
192.168.1.100 -> 192.168.1.101 DCERPC Bind_ack: call_id: 5 Provider
rejection, reason: Abstract syntax not supported
In my testing environment this is the state of the locator service
until a local user binds to it to begin a lookup.
Other than this, the RPC Locator Service exploit is available as a
CANVAS module. (http://www.immunitysec.com/CANVAS/)
-dave
