Rapid7 Vulnerability & Exploit Database

Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS

Back to Search

Microsoft Windows DNSAPI.dll LLMNR Buffer Underrun DoS

Disclosed
04/12/2011
Created
05/30/2018

Description

This module exploits a buffer underrun vulnerability in Microsoft's DNSAPI.dll as distributed with Windows Vista and later without KB2509553. By sending a specially crafted LLMNR query, containing a leading '.' character, an attacker can trigger stack exhaustion or potentially cause stack memory corruption. Although this vulnerability may lead to code execution, it has not been proven to be possible at the time of this writing. NOTE: In some circumstances, a '.' may be found before the top of the stack is reached. In these cases, this module may not be able to cause a crash.

Author(s)

  • jduck <jduck@metasploit.com>

Development

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':

msf > use auxiliary/dos/windows/llmnr/ms11_030_dnsapi
msf auxiliary(ms11_030_dnsapi) > show actions
    ...actions...
msf auxiliary(ms11_030_dnsapi) > set ACTION < action-name >
msf auxiliary(ms11_030_dnsapi) > show options
    ...show and set options...
msf auxiliary(ms11_030_dnsapi) > run

Metasploit

Penetration testing software for offensive security teams.
Key Features
Free Metasploit Pro Trial View All Features

Time is precious, so I don’t want to do something manually that I can automate. Leveraging the Metasploit Framework when automating any task keeps us from having to re-create the wheel as we can use the existing libraries and focus our efforts where it matters.

– Jim O’Gorman | President, Offensive Security

;