Metasploit modules that can be used to exploit Microsoft » Windows 2000

Order by Disclosure Date Module Name Module Type
  • MS10-026 Microsoft MPEG Layer-3 Audio Stack Based Overflow
    Disclosure Date: 2010-04-13
    First seen: 2020-04-26
    exploit/windows/browser/ms10_026_avi_nsamplespersec
    This module exploits a buffer overflow in l3codecx.ax while processing a AVI files with MPEG Layer-3 audio contents. The overflow only allows to overwrite with 0's so the three least significant bytes of EIP saved on stack are overwritten and shellcode is mapped using the .NET DLL memory technique pioneered by Alexander Sotirov and Mark Dowd. Please note on IE 8 targets, your malicious URL must be a trusted site in order to load the .Net control. Authors: - Yamata Li - Shahin Ramezany <shahin@abysssec.com> - juan vazquez <juan.vazquez@metasploit.com> - Jordi Sanchez <jsanchez@0x01000000.org>
  • Windows Media Services ConnectFunnel Stack Buffer Overflow
    Disclosure Date: 2010-04-13
    First seen: 2020-04-26
    exploit/windows/mmsp/ms10_025_wmss_connect_funnel
    This module exploits a stack buffer overflow in the Windows Media Unicast Service version 4.1.0.3930 (NUMS.exe). By sending a specially crafted FunnelConnect request, an attacker can execute arbitrary code under the "NetShowServices" user account. Windows Media Services 4.1 ships with Windows 2000 Server, but is not installed by default. NOTE: This service does NOT restart automatically. Successful, as well as unsuccessful exploitation attempts will kill the service which prevents additional attempts. Authors: - jduck <jduck@metasploit.com>
  • MS10-018 Microsoft Internet Explorer DHTML Behaviors Use After Free
    Disclosure Date: 2010-03-09
    First seen: 2020-04-26
    exploit/windows/browser/ms10_018_ie_behaviors
    This module exploits a use-after-free vulnerability within the DHTML behaviors functionality of Microsoft Internet Explorer versions 6 and 7. This bug was discovered being used in-the-wild and was previously known as the "iepeers" vulnerability. The name comes from Microsoft's suggested workaround to block access to the iepeers.dll file. According to Nico Waisman, "The bug itself is when trying to persist an object using the setAttribute, which end up calling VariantChangeTypeEx with both the source and the destination being the same variant. So if you send as a variant an IDISPATCH the algorithm will try to do a VariantClear of the destination before using it. This will end up on a call to PlainRelease which deref the reference and clean the object." NOTE: Internet Explorer 8 and Internet Explorer 5 are not affected. Authors: - unknown - Trancer <mtrancer@gmail.com> - Nanika - jduck <jduck@metasploit.com>
  • MS10-018 Microsoft Internet Explorer Tabular Data Control ActiveX Memory Corruption
    Disclosure Date: 2010-03-09
    First seen: 2020-04-26
    exploit/windows/browser/ms10_018_ie_tabular_activex
    This module exploits a memory corruption vulnerability in the Internet Explorer Tabular Data ActiveX Control. Microsoft reports that version 5.01 and 6 of Internet Explorer are vulnerable. By specifying a long value as the "DataURL" parameter to this control, it is possible to write a NUL byte outside the bounds of an array. By targeting control flow data on the stack, an attacker can execute arbitrary code. Authors: - Unknown - jduck <jduck@metasploit.com>
  • MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution
    Disclosure Date: 2010-02-26
    First seen: 2020-04-26
    exploit/windows/browser/ms10_022_ie_vbscript_winhlp32
    This module exploits a code execution vulnerability that occurs when a user presses F1 on MessageBox originated from VBscript within a web page. When the user hits F1, the MessageBox help functionality will attempt to load and use a HLP file from an SMB or WebDAV (if the WebDAV redirector is enabled) server. This particular version of the exploit implements a WebDAV server that will serve HLP file as well as a payload EXE. During testing warnings about the payload EXE being unsigned were witnessed. A future version of this module might use other methods that do not create such a warning. Authors: - Maurycy Prodeus - jduck <jduck@metasploit.com>
  • Windows SYSTEM Escalation via KiTrap0D
    Disclosure Date: 2010-01-19
    First seen: 2020-04-26
    exploit/windows/local/ms10_015_kitrap0d
    This module will create a new session with SYSTEM privileges via the KiTrap0D exploit by Tavis Ormandy. If the session in use is already elevated then the exploit will not run. The module relies on kitrap0d.x86.dll, and is not supported on x64 editions of Windows. Authors: - Tavis Ormandy - HD Moore - Pusscat - OJ Reeves
  • Microsoft Windows EOT Font Table Directory Integer Overflow
    Disclosure Date: 2009-11-10
    First seen: 2020-04-26
    auxiliary/dos/windows/browser/ms09_065_eot_integer
    This module exploits an integer overflow flaw in the Microsoft Windows Embedded OpenType font parsing code located in win32k.sys. Since the kernel itself parses embedded web fonts, it is possible to trigger a BSoD from a normal web page when viewed with Internet Explorer. Authors: - hdm <x@hdm.io>
  • MS08-067 Microsoft Server Service Relative Path Stack Corruption
    Disclosure Date: 2008-10-28
    First seen: 2020-04-26
    exploit/windows/smb/ms08_067_netapi
    This module exploits a parsing flaw in the path canonicalization code of NetAPI32.dll through the Server Service. This module is capable of bypassing NX on some operating systems and service packs. The correct target must be used to prevent the Server Service (along with a dozen others in the same process) from crashing. Windows XP targets seem to handle multiple successful exploitation events, but 2003 targets will often crash or hang on subsequent attempts. This is just the first version of this module, full support for NX bypass on 2003, along with other platforms, is still in development. Authors: - hdm <x@hdm.io> - Brett Moore <brett.moore@insomniasec.com> - frank2 <frank2@dc949.org> - jduck <jduck@metasploit.com>
  • Windows Media Encoder 9 wmex.dll ActiveX Buffer Overflow
    Disclosure Date: 2008-09-09
    First seen: 2020-04-26
    exploit/windows/browser/ms08_053_mediaencoder
    This module exploits a stack buffer overflow in Windows Media Encoder 9. When sending an overly long string to the GetDetailsString() method of wmex.dll an attacker may be able to execute arbitrary code. Authors: - MC <mc@metasploit.com>
  • MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (TCP)
    Disclosure Date: 2007-04-12
    First seen: 2020-04-26
    exploit/windows/dcerpc/ms07_029_msdns_zonename
    This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. Authors: - hdm <x@hdm.io> - Unknown - bcoles <bcoles@gmail.com>
  • MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)
    Disclosure Date: 2007-04-12
    First seen: 2020-04-26
    exploit/windows/smb/ms07_029_msdns_zonename
    This module exploits a stack buffer overflow in the RPC interface of the Microsoft DNS service. The vulnerability is triggered when a long zone name parameter is supplied that contains escaped octal strings. This module is capable of bypassing NX/DEP protection on Windows 2003 SP1/SP2. This module exploits the RPC service using the \DNSSERVER pipe available via SMB. This pipe requires a valid user account to access, so the SMBUSER and SMBPASS options must be specified. Authors: - hdm <x@hdm.io> - Unknown - bcoles <bcoles@gmail.com>
  • Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
    Disclosure Date: 2007-03-28
    First seen: 2020-04-26
    exploit/windows/email/ms07_017_ani_loadimage_chunksize
    This module exploits a buffer overflow vulnerability in the LoadAniIcon() function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee. Authors: - hdm <x@hdm.io> - skape <mmiller@hick.org>
  • Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (HTTP)
    Disclosure Date: 2007-03-28
    First seen: 2020-04-26
    exploit/windows/browser/ms07_017_ani_loadimage_chunksize
    This module exploits a buffer overflow vulnerability in the LoadAniIcon() function in USER32.dll. The flaw can be triggered through Internet Explorer 6 and 7 by using the CURSOR style sheet directive to load a malicious .ANI file. The module can also exploit Mozilla Firefox by using a UNC path in a moz-icon URL and serving the .ANI file over WebDAV. The vulnerable code in USER32.dll will catch any exceptions that occur while the invalid cursor is loaded, causing the exploit to silently fail when the wrong target has been chosen. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee. Authors: - hdm <x@hdm.io> - skape <mmiller@hick.org> - Solar Eclipse <solareclipse@phreedom.org>
  • Windows ANI LoadAniIcon() Chunk Size Stack Buffer Overflow (SMTP)
    Disclosure Date: 2007-03-28
    First seen: 2020-04-26
    exploit/windows/email/ms07_017_ani_loadimage_chunksize
    This module exploits a buffer overflow vulnerability in the LoadAniIcon() function of USER32.dll. The flaw is triggered through Outlook Express by using the CURSOR style sheet directive to load a malicious .ANI file. This vulnerability was discovered by Alexander Sotirov of Determina and was rediscovered, in the wild, by McAfee. Authors: - hdm <x@hdm.io> - skape <mmiller@hick.org>
  • MS06-070 Microsoft Workstation Service NetpManageIPCConnect Overflow
    Disclosure Date: 2006-11-14
    First seen: 2020-04-26
    exploit/windows/smb/ms06_070_wkssvc
    This module exploits a stack buffer overflow in the NetApi32 NetpManageIPCConnect function using the Workstation service in Windows 2000 SP4 and Windows XP SP2. In order to exploit this vulnerability, you must specify the name of a valid Windows DOMAIN. It may be possible to satisfy this condition by using a custom DNS and LDAP setup, however that method is not covered here. Although Windows XP SP2 is vulnerable, Microsoft reports that Administrator credentials are required to reach the vulnerable code. Windows XP SP1 only requires valid user credentials. Also, testing shows that a machine already joined to a domain is not exploitable. Authors: - jduck <jduck@metasploit.com>
  • MS06-066 Microsoft Services nwapi32.dll Module Exploit
    Disclosure Date: 2006-11-14
    First seen: 2020-04-26
    exploit/windows/smb/ms06_066_nwapi
    This module exploits a stack buffer overflow in the svchost service when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. Authors: - pusscat <pusscat@metasploit.com>
  • MS06-066 Microsoft Services nwwks.dll Module Exploit
    Disclosure Date: 2006-11-14
    First seen: 2020-04-26
    exploit/windows/smb/ms06_066_nwwks
    This module exploits a stack buffer overflow in the svchost service, when the netware client service is running. This specific vulnerability is in the nwapi32.dll module. Authors: - pusscat <pusscat@metasploit.com>
  • MS06-040 Microsoft Server Service NetpwPathCanonicalize Overflow
    Disclosure Date: 2006-08-08
    First seen: 2020-04-26
    exploit/windows/smb/ms06_040_netapi
    This module exploits a stack buffer overflow in the NetApi32 CanonicalizePathName() function using the NetpwPathCanonicalize RPC call in the Server Service. It is likely that other RPC calls could be used to exploit this service. This exploit will result in a denial of service on Windows XP SP2 or Windows 2003 SP1. A failed exploit attempt will likely result in a complete reboot on Windows 2000 and the termination of all SMB-related services on Windows XP. The default target for this exploit should succeed on Windows NT 4.0, Windows 2000 SP0-SP4+, Windows XP SP0-SP1 and Windows 2003 SP0. Authors: - hdm <x@hdm.io>
  • Microsoft SRV.SYS Mailslot Write Corruption
    Disclosure Date: 2006-07-11
    First seen: 2020-04-26
    auxiliary/dos/windows/smb/ms06_035_mailslot
    This module triggers a kernel pool corruption bug in SRV.SYS. Each call to the mailslot write function results in a two byte return value being written into the response packet. The code which creates this packet fails to consider these two bytes in the allocation routine, resulting in a slow corruption of the kernel memory pool. These two bytes are almost always set to "\xff\xff" (a short integer with value of -1). Authors: - hdm <x@hdm.io>
  • MS06-025 Microsoft RRAS Service Overflow
    Disclosure Date: 2006-06-13
    First seen: 2020-04-26
    exploit/windows/smb/ms06_025_rras
    This module exploits a stack buffer overflow in the Windows Routing and Remote Access Service. Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well. A valid username and password is required to exploit this flaw on Windows 2000. When attacking XP SP1, the SMBPIPE option needs to be set to 'SRVSVC'. Authors: - Nicolas Pouvesle <nicolas.pouvesle@gmail.com> - hdm <x@hdm.io>
50 metasploit modules found
1 2 3
Please note: Metasploit modules are only matched by CVE numbers. Visit metasploit web site for more details
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close