mailing list archives
Re: SQL Server 2K SP0 magically protected
From: "Joshua J. Drake" <jdrake () metasploit com>
Date: Fri, 18 Jun 2010 16:09:15 -0500
On Fri, Jun 18, 2010 at 09:39:10PM +0200, Emma Schreber wrote:
I want to use the ms02_039_slammer exploit. So I set up a SQL Server 2000 SP0 straight from the old red MSDN CD.
SQL Server 2000 SP0 Developer on XP
The exploit didn't work. Neither did ms02_056_hello.
I fully expected to have to change a return address or something but it didn't even crash.
No crash, no log entry, nothing. Attached to the process: no exception.
So I installed
SQL Server 2000 SP0 Enterprise on W2K Server.
Again no crash, nothing. Both exploits.
I verified in wireshark that the servers received the data.
I don't think the MSDN CD from about 2002 is patched against this.
The exact version number is 8.0.194, so it should be perfectly vulnerable.
Didn't this exploit use to be very reliable?
Did I dream the whole slammer thing?
There was a repackage of SP0 due to the slammer worm. The only
difference is one file (which I forget at the moment). You might be
using this version...
The ms09_004 exploit might work, although it requires auth...
Hope this helps,
Joshua J. Drake