exploit/windows/smb/ms08_067_netapi not working at latest MSF revision

[stiofang]

Hi All,

I was pen testing with autopwn on an XP SP3 VM these passed few days and exploit/windows/smb/ms08_067_netap got me a meterpreter session every single time!

However when I msfupdate'd, this exploit no longer works? I haven't patched the VM's I was testing so all I can think of it's the latest revision of the framework b0rk this one?

Let me know!

Thanks,

S.

Yes this is definitely the case! Revision 9472 (The latest as of 10th June 2010) breaks this exploit. I downloaded the vmware image and loaded it up in VMWARE Server 2 and performed autopwn -p -t -e -r on my XP SP3 VM - I got a session straight away with this exploit.

Then I typed msfupdate and tried to pwn the same XP VM and I got no sessions.....

What's the story???

[g3ksan]

One thing I noticed when using this exploit, is that once you use it on a box, you will have to restart the popped box in order to run the exploit again. It is very weird. We had a bunch of people working on a Windows box in a MSF breakout session, we only had one Windows VM running.

It works on the current revision, which is 9478.

[edit] after talking to the guy that was in charge with the VMs that night, he had too restore the snapshot for some reason. I'm not exactly sure why that was.

[stiofang]

I have updated to revision 9496 and this still isn't working.

On the otherhand, I have booted up the VM version of BT4 available for download and it's metasploit definitions are about 160 days old.

It works every time with this version.

Who to we report this to, to get it fixed?

Should this be moved to bugs?

[lupin]

Who to we report this to, to get it fixed?

The Metasploit Developers most likely, as long as you can confirm this is not BackTrack specific.

Should this be moved to bugs?

Not unless it's a BackTrack specific issue.

[Archangel-Amael]

On the otherhand, I have booted up the VM version of BT4 available for download and it's metasploit definitions are about 160 days old.

That is pretty relevant of irrelevant depending on how you look at things. Yes the definitions for metasploit as well as some other tools are old or even maybe outdated, however that is why there are update commands that one can use.

[Krytical]

I think he means it is strange that it works with the old metasploit definitions and not the new ones, I don't think he was complaining about the old definitions...

[stiofang]

Yes I was saying that the old definitions work but the new ones don't for this particular exploit!