Re: RPC DCOM exploit

As an FYI:

I've recently been testing dcom.c for pen testing on my network and the Windows 2000 SP3 and SP4 boxes that I was able to penetrate did not reboot after exiting from the shell. I was using the dcom.c that H D Moore released (Based on Flasksky's code) via a cygwin environment. Therefore, not having the system reboot, in my mind, is not a sign that an exploit did not take place.

Now, there could be a matrix of different patch levels that could cause the system to reboot or not reboot. Who knows why we're getting different results...

Is anyone else on the list seeing that at least some of their target systems are not rebooting after executing this code?

       -Barry

morning_wood wrote:

>could be... but .. they are two seperate issues,

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek