1
Hacking and Security / Re: Undetectable Hacking.
« on: January 20, 2014, 10:57:14 pm »
Thanks! I agree the metasploit unleashed page is highly mediocre, and does not provide much explanation on what is going on.
One thing i have been struggling with is how the MS08_067 module establishes it's connections to the target machine. From what I could deduce (probably incorrect) is that the module establishes a tcp connection through calling the connect() function in the TCP mixin, and then establishes an SMB connection through smb_login(). I know the SMB connection will use a TCP connection, but is it using the TCP connection established? I have found no documentation on how this is done.
Later this piece of code comes up
Thanks.
Edit: Added code for MS08_67 module
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms08_067_netapi.rb
One thing i have been struggling with is how the MS08_067 module establishes it's connections to the target machine. From what I could deduce (probably incorrect) is that the module establishes a tcp connection through calling the connect() function in the TCP mixin, and then establishes an SMB connection through smb_login(). I know the SMB connection will use a TCP connection, but is it using the TCP connection established? I have found no documentation on how this is done.
Later this piece of code comes up
Code: [Select]
handle = dcerpc_handle( '4b324fc8-1670-01d3-1278-5a47bf6ee188', '3.0', 'ncacn_np', ["\\#{datastore['SMBPIPE']}"] )
I know the exploit works by sending a malformed RPC packet to the server service process that can be identified by the 4b32.. code, and that the protocol used is ncacn_np Which i think is a form of Named Pipes over RPC? I am completely baffled by how the connections all link in the end as the use of mixins abstracts what is going on. And there isn't much documentation floating around on how connections can be established in metasploit. If you guys have any info or know where i can get some on a deeper level, i'd be very grateful as it's had be stumped for a while.Thanks.
Edit: Added code for MS08_67 module
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms08_067_netapi.rb