peju Posted May 20, 2018 Share Posted May 20, 2018 Hi, how can I analyse an exploit? For example https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/smb/ms04_007_killbill.rb This is working on MS IIS, this smb exploit generates a token with a lot of hex values. How can I reconstruct why it is like this. I installed immunity debugger in my xp vm, but there is no process for iis to attach. Best regards Quote Link to comment Share on other sites More sharing options...
Bigbiz Posted May 22, 2018 Share Posted May 22, 2018 Couldnt you locate where the exploit is located on machine then vi into it.? Quote Link to comment Share on other sites More sharing options...
peju Posted May 23, 2018 Author Share Posted May 23, 2018 Shure, but I mean, why is the token constructed like this on line 187-248 from the link. Maybe I can follow the stack, heap changes with a debugger? Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.