Description
This module exploits an overflow in the Windows Routing and Remote Access Service (RRAS) to execute code as SYSTEM.
The RRAS DCERPC endpoint is accessible to unauthenticated users via SMBv1 browser named pipe on Windows Server 2003 and Windows XP hosts; however, this module targets Windows Server 2003 only.
Since the service is hosted inside svchost.exe, a failed exploit attempt can cause other system services to fail as well.
The module has been successfully tested on:
Windows Server 2003 SP0 (x86); Windows Server 2003 SP1 (x86); Windows Server 2003 SP2 (x86); and Windows Server 2003 R2 SP2 (x86).
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use exploit/windows/smb/smb/rras_erraticgophermsf undefined(rras_erraticgopher) > show actions ...actions...msf undefined(rras_erraticgopher) > set ACTION < action-name >msf undefined(rras_erraticgopher) > show options ...show and set options...msf undefined(rras_erraticgopher) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub