ShadowBrokers opublikowało exploity NSA na Windowsy od NT do 2012

[Hektor^ 1]

Kilka godzin temu grupa ShadowBrokers opublikowała zestaw narzędzi NSA do łamania systemów Windows.
Narzędzia są banalnie proste w użyciu. Przez weekend każde dziecko będzie mogło włamać się na serwery od Windows 2000 do Windows 2012.
Podatne są również systemy od Windows XP do 8.1.

Windows 10 i Windows Server 2016 póki co wydają się bezpieczne.


Co ciekawe NSA wiedziało o tym od co najmniej stycznia kiedy ta sama grupa próbowała sprzedać te narzędzia. Microsoft twierdzi, że nie został o tym poinformowany.
Obecnie ponad 3.5 miliona serwerów na świecie jest podatnych na ataki.



Piszą już o tym większe serwisy technologiczne.

Opis exploitów:
 

Exploit directory, every exploits comes with an xml describing options and targets:

    EASYBEE : exploit for MDaemon WorldClient (Web interface for MDaemon email server) and MDaemon WebAdmin (remote administration tool for MDaemon servers)
    EASYPI : exploit for Lotus CC:Mail for windows NT/2000/XP/2003
    ECLIPSEDWING : exploit for MS08-67 (remote code execution in Windows RPC) for Windows 2000/XP/2003
    EDUCATEDSCHOLAR : exploit for MS09-050 (remote code execution in SMBv2) on Windows Vista and 2008.
    EMERALDTHREAD : remote code execution through SMB or NBT on Windows XP / 2003. No information on the exploit, 0day?
    EMPHASISMINE : exploit in Lotus Domino through IMAP, maybe 0day (xml file)
    ENGLISHMANSDENTIST : apparently local code execution on Outlook by email (according to @GossiTheDog/ it could be through Outlook rules but I have not found anything confirming it). Possible 0-day. It is interesting to see that the exploit is language dependent and that only English/German/Korea and Chinese are proposed.
    ERRATICGOPHER : remote code execution through RPC in XP and 2003, possible 0 day. (xml)
    ESKIMOROLL : Kerberos exploit targeting 2000/2003/2008 servers, MS14-068 according to @gentilkiwi, dated back in 2011…
    ESTEEMAUDIT : remote code execution in RDP targeting XP and 2003, potential 0day, according to @GossiTheDog it exploits SmartCard authentication
    ETERNALROMANCE : this one is the big one, 0day remote code execution on Windows XP/2003/Vista/2008 using SMB (h/t @hackerfantastic)
    ETERNALSYNERGY : remote code execution in SMB targeting Windows 8 and 2012, potential 0day. According to @hackerfantastic and nex the exploit is not working on Windows 10 (does not mean it is not vulnerable)
    EWOKFRENZY : remote code execution pre-auth on Lotus Domino version 6.5.4 and 7.0.2 through IMAP, potential 0day (it seems to be old versions, last one is 9.0.1)
    EXPLODINGCAN : remote code execution on IIS6 on Windows 2003 through PROPFIND bug, CVE-2017-7269. Exploited in the wild in July/August 2016. Public exploit already available, thanks @GossiTheDog
    ZIPPYBEER : only python exploit, it seems to be an authenticated remote code execution in SMB, no information on the versions vulnerable, potential 0day

Źródło: https://www.randhome.io/blog/2017/04/14/shadowbrokers-easter-gift/