<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>RE: Re: Bad news on RPC DCOM vulnerability</TITLE>
<META http-equiv=Content-Type content="text/html; charset=iso-8859-1">
<META content="MSHTML 6.00.2800.1152" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV><FONT face=Arial size=2>
<P>This code doesn't work without shellcode. The simple version of a "battle"
shellcode can be found here:</P>
<P><A
href="http://www.SecurityLab.ru/_exploits/bshell2">http://www.SecurityLab.ru/_exploits/bshell2</A>
(add user 'a' with pass 'a' in administrator group)</P>
<P>You can change this shellcode as you need.</P>
<P>On system with MS03-39 installed, this code only crash systems, because
nature of new vulnerability is not known.</P>
<P>See more: <A
href="http://www.securitylab.ru/40757.html">http://www.securitylab.ru/40757.html</A></P>
<P> </P></FONT></DIV>
<BLOCKQUOTE dir=ltr
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=sigpizbguy@hotpop.com href="mailto:sigpizbguy@hotpop.com">Mike
Gordon</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=full-disclosure@lists.netsys.com
href="mailto:full-disclosure@lists.netsys.com">full-disclosure@lists.netsys.com</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Monday, October 13, 2003 1:41
AM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Full-Disclosure] RE: Re: Bad
news on RPC DCOM vulnerability</DIV>
<DIV><BR></DIV><!-- Converted from text/rtf format -->
<P><FONT face=Arial size=2>A compiled version is found at</FONT> <A
href="http://www.SecurityLab.ru/_exploits/rpc3.zip"><U><FONT
face="Times New Roman"
color=#0000ff>http://www.SecurityLab.ru/_exploits/rpc3.zip</FONT></U></A><FONT
face="Times New Roman"> </FONT><BR><FONT face=Arial size=2>But it seems to
only crash systems.</FONT> </P>
<P><FONT face=Arial size=2>Does any one have a clean complile of the "better
code" from </FONT><A
href="http://www.cyberphreak.ch/sploitz/MS03-039.txt"><U><FONT face=Arial
color=#0000ff
size=2>http://www.cyberphreak.ch/sploitz/MS03-039.txt</FONT></U></A>
</P></BLOCKQUOTE></BODY></HTML>