Thanks for the above link.
Link above is no longer valid, so you can find it here:
http://packetstormsecurity.org/paper...al_Attacks.pdf
This link I came across is very detailed:
https://www.moonloop.org/bin/view/Mo...Red6cUaILIXVGw
I've gone through the whitepapers and have updated winlockpwn with SP3 and Vista Firewire exploits. I'm in the process of testing it, but I left my firewire cables at home, so it wont be until tomorrow.
In the meantime, please reference both links and see if I implemented it correctly:
Code:
{"name":"WinXP SP3 msv1_0.dll technique",
"notes":"Patches the call which decides if an account requires password authentication. Page Offset signature changed from SP2.",
"phase":[{
"sig":"8BFF558BEC83EC50A1",
"pageoffset":[0x81B],
"patch":"B001",
"patchoffset":0xa5}]
},
{"name":"Windows Vista msv1_0.dll technique",
"notes":"Patches the call which decides if an account requires password authentication. Signature and offsets changed with Vista.",
"phase":[{
"sig":"8BFF558BEC81EC88000000A1A4",
"pageoffset":[0x76A],
"patch":"B001",
"patchoffset":0xBD}]
},
You'll notice that in the second whitepage linked in my post, they claim the Vista exploit wouldnt work, but the first link gives a different memory address which claimed to be successful! If you can take the first linked page and locate the signature and offset, that would be helpful!
William
Originally Posted by williamc
