Piotr, who made kon-boot, finally decided to release the Vista smb2 Negotiate ProcessID Function Table Dereference exploit code he’s been sitting on since last fall.
Download: smb2_exploit_release.zip
It should spawn a shell on TARGET_IP on port 28876
Sample usage
————
> smb2_exploit.exe 192.167.0.5 45 0
> telnet 192.167.0.5 28876
http://en.wikipedia.org/wiki/Robin_Sage
Thomas Ryan tricked people into becoming friends with “Robin Sage”
We decided to find her real identity
We started by tracking down the image to
http://www.godsgirls.com/girls/katya/album and expanded our search from there…
Katharine Cole
San Fransico,CA
DOB: july 6 1989
http://www.myspace.com/teez_bunny_
http://en-gb.facebook.com/katharinecole
We even have her cell phone number but since she was probably an unwilling participant in this experiment we decided not to make that public. Just goes to show that you cant fool everyone. 🙂
The new version of SubSeven v2.3 was released. It takes fail to a whole new level. Upon first examination the files are packed with Aspack 2.12, which you can unpack using AspackDie, using a file like Bintext you can examine the strings inside Subseven.exe you will get some laughs at words spelled wrong
000E7260 004E7260 0 You Are Downloading a File plase wait till its finished 000E72A0 004E72A0 0 Sorry a fileserch is still in progress 000E73FC 004E73FC 0 E:\[!! Souce Code !!]\[Sub7 2009] [BetaIV]\IM.EXE
then you’ll see some stuff referring to nirsoft
0014C01C 0054C01C 0 NirSoft 0014C0EC 0054C0EC 0 MessenPass 0014C10A 0054C10A 0 LegalCopyright 0014C13E 0054C13E 0 2004 - 2009 Nir Sofer
Using ResourceHacker you can see that subseven contains 6 Nirsoft password recovery apps as resources inside the exe chromepass, iepv, pspv, PasswordFox, MessenPass, and Mail Passview.
Supposedly they claim Mobman, who coded the original Sub7 had passed on the sourcecode to them and they recoded it from the ground up , using someone else programs embedded into your program doesn’t qualify as “coding” , more like ripping, which FC (the wannabe coder) has been accused of in the past and seems to continue to do dragging down the subseven legacy.
The program itself unpacked is over 2mb showing FC still doesnt know how to optimize his Delphi code, another sign of being a pure ripper.10 years later and the newer one has the same tired features the original had , only shittier/buggier , hell even simple spyware has rootkit technology nowadays. I’m pretty sure mobman is sorry he ever gave them the greenlight to shit on his program.
Affects Windows NT/2K/XP/2K3/VISTA/2K8/7 32 bit only. 64 bit version of the Windows OS are not vulnerable due to the fact that 64 bit versions of Windows do not include the vulnerable feature (16 bit compatibility).
Windows Kernel Privilege Escalation (CVE-2010-0232)
Read more:mswinnt-pwn.txt
Download POC:KiTrap0D.zip
Screenshot: Here
Work around: Disable the NTVDM and WOWEXEC subsystems.