Vulnerability Details : CVE-1999-0504

Products affected by CVE-1999-0504

Metasploit modules for CVE-1999-0504

• Microsoft Windows Authenticated User Code Execution

  Disclosure Date: 1999-01-01

  First seen: 2020-04-26

  exploit/windows/smb/psexec

  This module uses a valid administrator username and password (or password hash) to execute an arbitrary payload. This module is similar to the "psexec" utility provided by SysInternals. This module is now able to clean up after itself. The service created by this t

  More information

• Microsoft Windows Authenticated Powershell Command Execution

  Disclosure Date: 1999-01-01

  First seen: 2020-04-26

  exploit/windows/smb/psexec_psh

  exploit/windows/smb/psexec_psh This module uses a valid administrator username and password to execute a powershell payload using a similar technique to the "psexec" utility provided by SysInternals. The payload is encoded in base64 and executed from the commandline using

  More information

• Windows Management Instrumentation (WMI) Remote Command Execution

  Disclosure Date: 1999-01-01

  First seen: 2020-04-26

  exploit/windows/local/wmi

  This module executes powershell on the remote host using the current user credentials or those supplied. Instead of using PSEXEC over TCP port 445 we use the WMIC command to start a Remote Procedure Call on TCP port 135 and an ephemeral port. Set ReverseListe

  More information

• Microsoft Windows Authenticated Logged In Users Enumeration

  First seen: 2020-04-26

  auxiliary/scanner/smb/psexec_loggedin_users

  This module uses a valid administrator username and password to enumerate users currently logged in, using a similar technique than the "psexec" utility provided by SysInternals. It uses reg.exe to query the HKU base registry key. Authors: - Royce Davis @R3dy__ <r

  More information

• Powershell Remoting Remote Command Execution

  Disclosure Date: 1999-01-01

  First seen: 2020-04-26

  exploit/windows/local/powershell_remoting

  This module uses Powershell Remoting (TCP 47001) to inject payloads on target machines. If RHOSTS are specified, it will try to resolve the IPs to hostnames, otherwise use a HOSTFILE to supply a list of known hostnames. Authors: - Ben Campbell <eat_meatb

  More information

• Microsoft Windows Authenticated Administration Utility

  First seen: 2020-04-26

  auxiliary/admin/smb/psexec_command

  auxiliary/admin/smb/psexec_command This module uses a valid administrator username and password to execute an arbitrary command on one or more hosts, using a similar technique than the "psexec" utility provided by SysInternals. Daisy chaining commands with '&' does not wor

  More information

• PsExec via Current User Token

  Disclosure Date: 1999-01-01

  First seen: 2020-04-26

  exploit/windows/local/current_user_psexec

  This module uploads an executable file to the victim system, creates a share containing that executable, creates a remote service on each target system using a UNC path to that file, and finally starts the service(s). The result is similar to psexe

  More information

CVSS scores for CVE-1999-0504

References for CVE-1999-0504