Re: Adding "dangerous" checks?

[Ron <ron () skullsecurity net>]

Brandon Enright wrote:
> Coming from an organization that was scrambling for a network check of
> MS08-067 last week, we were more happy to get one that had about equal
> chance of working or crashing the service.  That's what "intrusive" is
> all about.
>
> As for technical hurdles, I'm not sure what funky things can be sent to
> RPC/netapi32.dll/NetprPathCanonicalize to check for the vulnerability
> but assuming there is some semi-reliable payload to do it,
> DEP/NX/ASLR/Localization/winver are likely all working against the
> check.
>
> Are we talking about a English Windows XP SP2/SP3 check only?  Is there
> some creative way to help factor out all the variations so that the
> check works more broadly?
>
> Brandon


I don't know what the ratio of crashing:working is, but I tried on my 
own vulnerable server twice and got one crash/one working result. So 50% 
by my highly skewed results.

The check itself doesn't (shouldn't) crash anything or run arbitrary 
code. It sends it invalid input that returns a different result on the 
old and new versions. On the original, it returns an error code, and on 
the patched, it returns successfully. That's what I got out of it.

If I'm right, it should work on every Windows system, independent of 
language. The only issue is the potential crashing (50% give or take).

Ron

_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://SecLists.Org