module

MS07-029 Microsoft DNS RPC Service extractQuotedChar() Overflow (SMB)

Try Surface Command
Back to search
Disclosed
Apr 12, 2007
Created
May 30, 2018

Description

This module exploits a stack buffer overflow in the RPC interface
of the Microsoft DNS service. The vulnerability is triggered
when a long zone name parameter is supplied that contains
escaped octal strings. This module is capable of bypassing NX/DEP
protection on Windows 2003 SP1/SP2. This module exploits the
RPC service using the \DNSSERVER pipe available via SMB. This
pipe requires a valid user account to access, so the SMBUSER
and SMBPASS options must be specified.

Authors

hdm [email protected]
Unknown
bcoles [email protected]

Platform

Windows

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/windows/smb/ms07_029_msdns_zonename
    msf exploit(ms07_029_msdns_zonename) > show targets
        ...targets...
    msf exploit(ms07_029_msdns_zonename) > set TARGET < target-id >
    msf exploit(ms07_029_msdns_zonename) > show options
        ...show and set options...
    msf exploit(ms07_029_msdns_zonename) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.