NT password replacement program

Summary
Description:Micro$oft tried to obfuscate the NT password storage method, but it has been broken and this program allows you to reset any user's password. Administrator might be a good example.
Author:pnordahl@eunet.no
Compromise:Administrator, if you have physical access.
Vulnerable Systems:NT 4.0 (probably earlier) without service pack 3 syskey enabled.
Date:11 June 1997
Notes:A uuencoded of the source distribution is attached below. His web site also offers disk images.
Details

from http://home.eunet.no/~pnordahl/ntpasswd/ :

rgot your NT admin password?

Reinstall? Oh no.. But not any more.. 

The Offline Utility to Change NT Passwords



Overview

     This is a small utility to (re)set the password of any user that has a valid (local) account on your NT
     system, by modifying the crypted password in the registrys SAM file. 
     You do not need to know the old password to set a new one. 
     It works offline, that is, you have to shutdown your computer and boot off a floppydisk. The bootdisk
     includes stuff to access NTFS partitions and scripts to glue the whole thing together. 
     Note: It will not work on systems encrypted with SP3's syskey. 

Why?

NT stores it's user information including crypted versions of the passwords in a file called 'sam', usually found in
\winnt\system32\config. This file is a part of the registry, and thus in a somewhat undocumented binary format.
As far as I know, Microsoft provides no way of changing this if you cannot log in as someone with appropriate
privileges, except restoring the registry files from the rescuefloppy. 

     You don't forget passwords? 
     You never get boxes to admin when someone quits suddenly? 
     Your vendor delivers a preconfigured system to you, but never have "freak" accidents and lose the
     password they've set on it? 
     If so, what are you doing reading this?? Go read propaganda from your favourite software vendor instead. 



DISCLAIMER:

THIS SOFTWARE COMES WITH NO WARRANTY WHATSOEVER. THE AUTHOR IS NOT
RESPONSIBLE FOR ANY DAMAGE CAUSED BY THE (MIS)USE OF THIS SOFTWARE! 
It's VERY ALPHA yet, and relies heavily on undocumented structures and methods. You have been warned! 

--Fyodor note:  Now here is the uuencoded source distribution, you might have to cut and paste, since it may be transferred to html.


begin 600 chntpw-970611.tar.gz.uue
M'XL(`%_"GC,``^Q;:UO;R)+.5_PK.LY)D$$8WX`,EV2-+8)WP.;8)I=E>'R$
M+&,MLN25Y!AG)O]]W^J++K8A<_:9G/VPRR1!ZJZJKJY[=6NLL1=-Y[LO?N8/
MJY4.2B7V@I6KU?T]_&:L7*OQW_*GQ-A^M7:P5ROMUPXP6]JK5%^PO9_*E?R9
MA9$9,/9BZHU_`&<'X;^"H7_MCR7T?VD^V"/'M7_*&N52:?\Y_>\=['']5\NE
M:OF@C-E*I5IZP4H_A9NEG__C^G^5>\64\MG(#U@TMEEG-'(=SV;M/KLRPW#N
M!T-F#)W(#W*OZ#_6&)O>O<W&=F"SR&=3W_$B>B!DS[:']I!=-FOL#6L:/>8Z
M=X$9.':(]^*8T4HA:/1LF[7:O7[]XH(O//%!S/%&?A%+`.^JWC\_*19W@3X$
MPF53#N1RC<;)O67E&F<7]0^]$[;383NM(O[^39-H!?XB,`JYW$7KM'>23$J*
M19/%,+N388W^6D4_ES-=]W!#^$4N)WX?,O&[:.4V_J8U&@6@BN6QE"\G8QBV
MTVQ>G:2Y:5[2NUP,N,01&/O?5OZ+V/\5ZS]EC>?]?Z]T4*G)^%\]J)1JY/_5
M<NW__?]?\;.[E6-;*<N-?3_C^.PZ<EPG6G!'152H%O?*\.9:L<1Z]4LV-"/S
MS@SM(M&BOPU_N@B<^W'$-*O`RK_\<L"N["BR@0R2YMC=.3?O;8_#GP6V[2[8
MT`FCP+F;@9)+<8"%_BRP;(8%[QS/#,3:GN]9_F1B!Y9CNFPZ"Z9^"%=6ZU[C
MA6G@_R%D<R<:%W@`ZO4NV`4/0@MVMV!&X%CLBS_S[IEFFXM_FSA$L^A_*YJS
M`E$Q/1&^`G\6010A(75[]7B5*S.(F#\"AQ,[!M)Y[`HF9N3X'B?A#&TS9!&"
MJ\=&@3\AU.E\.)M,B>"_(W9.%JSNND[H<TG0?(](AM%L-*)M/-AL&OB17\1&
MB`)$WPA,ZX'C^YX9(0RS3X[[X'B)#*Y<+`LB"*\4CAN=JR^M]@<6!W@>9X=V
M9#INR'R/JU^IBT*T%=C0N*#'"?;/6Y!AYZS_J=XU&)ZONIV/K:;19*=?V)71
M[QM=UNYTF_7SBYWS^@>CS?Y1[P%N<Y/5VTVB4&]_8<;GJZ[1Z[%.E[4NKRY:
M0`>];KW=;QD]'9F@<7'=!*,Z.[WN@UZ?7;0N6WV`]3LZ>#"(T"HFZYRQ2Z/;
M.,=K_;1UT>I_H5796:O?IN7.L%Z=7=6[_5;C^J+>95?7W:M.CU.C[31;O<9%
MO75I-(L,3&!A9GPT8.*]<TI,6)?5K_OGH((_C4Z[WVV!OTZWQTX-<%@_O>"D
M^#+89;/5-1I]VD[RU("LP-R%SGI71J-%#\9G`SNI=[_HDFS/^/LU@#!)U)KU
M2\BQQ[0?2`6*:%QWC4OB%W+H79_V^JW^==]@'SJ=9H](@7S/Z'YL-8S>$;OH
M]+C`KGN&CD7Z=;X\J$!:F,;SZ76OQ>76:D.MW>NK?JO3YDYQWOD$P8#9.K";
M7,:=-M\S9-3I?B&Z)`^N`IU].C<PWB61<JG5218]2*_1)VHI2*P*>?93FV5M
MX\-%"X;4,&BV0X0^M7I&`1IK]0B@)5;^5/_"]WC-MT^Z`F_B,66R.M<H:YVQ
M>O-CBYB7P+"#7DO:3.>,N]]UXUQ*7WKD+LOE7B%`N+.AS8[#:.C`&]^EAQ;A
M;K28(@BM#".S1-G1D>5%;G9HYB'P#6DLMPM?&]OP71,>ROV='!@1#`4+'/.R
MR:9P?@1.!!MR[[AN>\.Z1KUY:8#=%.7A,D^3X3!POMK![KWKWYGN\B2O@#@C
M\6A>AI\\"B'?"R,D"B1+D`@1Y&YNV0G+R]I'CL&8C)TR^^6@M%\NZSSZJ\#/
M>,C/'^5R5"R.CE3UCUUW9@A+)F(^[49GLW"&&FR!".YYT2XD&=F3:F47'(R<
M^]W0G-`^_=%H$+'P&W@H'1&1,Y*$1H'W#N'3#@HL=+[9!,J9WL+HT?)Z`I)@
MB*>A$R#%*7K]8(8\-%(P8A*0.:XHL@0/(7\ZB_@@W]-DP0<TL>`TF$PC78AL
M"YEM1"DBPL*/KNT5<K_G&,57AA"/X9&6?QWF=8Y3.%)3HWL["C6.*]"VRSI?
M.0&AR1ND3DQRP,).^9;O00$$=C0+/"T-`NSO?!>=*7+3&X"80VYKW)K`C<^0
M?!G2_T,BH=Q7WQDR'Q@$)?<X\LR)W`H?L(/@[@;UWBU?'FO.+"@)?L!"DC]G
M&#*X]Z,,CQ"SQK01QHB^1E3USJ#;_-0M%-@)2OQR@?%%B*B4%RVEYU5]SO$*
MAXR$R)DZDN!3P/D!AX['[$<GTLKB]7N\_HCXU$;Z&V*UP'ZT(H=^9L6\`,@_
MO2H7$1DP+5@,HP$9[%':)&A7Z*5>D\.3,9^PUS-V\[KT>/N;)U;5PV_X`Z*$
M!C(`D:HI3.!$OJ6%W[;W:V)5VN9+OKG?EWA5FQ(X5-P(Q?^`>Z%',A_(C:R4
MLR)7HLEC5GIZ,6YMA/S,*HK02TCI6T)J)"4$9P!1/1^3.@2)J6U%)#5$@D5$
MP9((J+<B.S<NKEZ2_"`ZS#RQ=EH-7?(/_Z$())K.B?W#?SX%3B3*+.DG=U2=
MR4:8\Q0[SIQ`N>?0J_09\H6YFW4#%Z']`>(LZ3W#^'70,_H%$B-;E>.((&DU
M:F%X1<J7U*C*X\NA:D259S\G7_H[=Z%$CK!&BYA\5HD<3QH,\2+JS#^SK)+N
M)^08F_3##5MJB?0S=_&GD)$.Y^8Y0T#1TND>LHY'^4,11HE.'"H3>"F)JVT^
MQ:#EHKG01@D'BF.>:OCL4&?P&-;Y]:6PC=@RK@B4(>(R;S:Y@V5@_;']R-=/
MC`(CT\!3"0.6.O-"YYY<7N8L8;^2%!D-/3I'&>ND`!0*)DGSFB-2F`-)`0D/
MV]LI]2FD4N61Y76^P(USF]JY@E`;XHGBW'YL4N-"F\4:)BJ15`^TG"2P+6IS
MY+;&<>KC=JH>_6DZ<5AQ;A@ZHY'NQ#*?C[E-"Q,_YG@I5Y"_"(?B*$WNB&64
M9LEJ^/0[5MXO*,CR_E&60B*7O<^'$`RG(</J&L$2F5BR&VFI?@:REE%C84LC
M$6QSDMM.(3:Z[\O$)570!W^"NJ(,L,2=?L"-A9FE-8_23%IYZ$`D-2K0W@/A
MD&T6-U<8RYJ"&!.*V(Y%^%V9R`>DJ@!->6B;@356?;&.@("2C,PD&CMHN7EG
MKUYL!#M5?1'<P/$&8%L:SGQL1K'QIRPH%3P3.^$R.6*QG7R3SVGC?\X]-LA0
MMK2TT"CI;&G$!6F-W2&_/"R+B+`<*E'(/Y-:2QB/@I/#I;CN^F!'O,/Z@`Z)
M%_H3&VWYHHCZWPFA&VK[[\P[Q##7G^_8WM!!HQ\BKSDCQWJO)(;B<$`ZE,'"
M#`)SP4@X&V)!IFE\[*9T^Z;T.$+:WXZ'RK?'QV\+?+B$Z+Z=V]@`HVJV@EEX
MBYQ>`U`%0*66```D"19_GSG(@E2)BZ+YNMUJ=)J&R%3#(C-#RW&2:&&-;7,Z
M0!]4X1,J&`:6JIW1R"@[2)7-4N$N'+M$OW9.*HFF.0ZY`<@HE='0]C;,(K!@
MOY5$/0JX].0.!,?@'UQ:_M!>9I[/5S#Y9YA?8GQG9XGM[6W).)A=&2^)D/1=
M&M)_V('/TQL=GL&AB+9K>A.8RY0.\)"?4(IX;#9%WK;,T*8NEXJ3$".N@P@U
M5>=\M%OJ9IR(?)0?[<>[G*#3'!#=Z5PU-VI_[B23G];[I7,B/:Z\)QW.G2#K
MQ#U`%BAQ2P45^7P#VE2D*KYW<<[HH?&,D(\.>&IGP@=X!P,1O!6#$!Y[L!?\
M1)#Y0]HSBI8%=?AJ@Q#?(/('@-*64C!F]*4A0'$OXY@@/@CAB*`[$'0U&K+N
M4$<_H`I'Y%4Y>P.(\$6>J`(\O'M7/A*#O&73-#$,IRJ5"\?'R%9_,#Y6!FBE
M(&$K"6R9PU8!NQ?#5@!;5;#5!+;"80\`6XMAJX"M*=A:`EOEL&>`K<:P-<#N
M*=B]!+9&L&6"K<2P>X#=5[#[">P>P58)MAS#[@/V0,$>*.'L$^3!&89CTW".
MWQZI6,V!N65HXHDH`OA[;F.-/K(*(>VE3.ALYEG\R!8F8TES(@?IMII)(1\@
M/@QM*UA,([*DC.4X0VDYY<1T7!^^B)DERP$?Q.[;6VX^V;D0FR<;"86%+)40
M&HBA42\]GIW1/D-I,4M`!/7NW=M"!K+R-"051&G0ZM.@"/894&XMQ"M_VQ-O
M9?&V+]XJ8C^)9X6Z$,`_*?[0QL3PQ_*O_`7RWWA2`>O%L%8-R[IZ1@-O_[0"
MEG7U5RB`WX[8'I>KSH/P1;U]66\GTC5@U#+HH3F1&2U^0N(1,9\<#'0'(=+A
M<(9Z_2$\DL/2[\3"/'FE&'K0%?E"S-DK9S2T1VPPH(NATUYS,)"4R*L)Z8T`
MU1^HZ7G%2TAL1<*'P\&`V,^B9"-`%A_%U>A)`K9U-Y`"6B:B9]\A"QW;UDFF
M`Z/=Z'ZYZB=RMGG50-;\<4><BND\X5KB(ITF5"(FK_CJCT(T,OX(+7XDTAG=
MLXD^2T_Z_8_RB(UP`JAKAU/B5Y7D03HJS_^:.0%,25WMD\:5)X',/2\(Q$]K
M1#1.3DI4`LP=='I1L"`GM!^CP+2$7](JLIWFNTDQ(#MITD>FPO`]6Y"[XZP-
MTU==G(PH>0,'*9X<9^)#(X3(*^.G;LSD=9<ZW:6CD($WH#HI\!<:I5P2HJA-
MP+1X^)IN)*)4,2FL\+',S[1_+SW63G7\<X!_]JKXIU*FUQ(]\=<:_;/W_2AN
M7R?FO6,I9$RS$OX\UFKL>]S73ET=?!!/7V%S">K6UZD\+#4CQQ)CI$'/G-@W
MY<K;6WTT<]WX+4'D%Z%>)&#&D"9J5?$R&=9NJI5;752"])A@>?8<=>IT?E.M
MW>KT-KVIE/`$R6&0/V(0F'@K[\=OF*;)A,["0PB*-Z<8'@B3U>-WJN44D-J'
M`HK?TT!R5PI&O:9!Y%X5B'I-@TSG:E94HFL"5)G<M1+/9N)469</%5%N7S9K
M@T;_,V6H"-[`D992BW,/TR.)'9'#9\^+/L(/+:JQ1_X,3F]&TK,/V>O2WB.=
M1I&MRM,&=7C"3TV$#=._VZB<2GN%S/&PZ,OIC@J#7Z>P/CJ$V^;P@L>L6@"@
M>D9`;\-"&X4L'!U8K0"5T;B*6CZKP#60;^4Y5$JS:Z`L`955]2I<I9:%6TNL
M(I?,&L4J7&T);BVQFN0L-I]5D%\LJ:<M);2XB]E2VTY&).O)@%Q^Z?9#RRC@
M&)/LCS^R6GG'@Q>&94NXK-H5)#G^[F0),2W-8X&3'I+KL`0AHTR)D1E;9FU)
M%1)E:?1)OK)82Z,K6(FF)$(R(&$+`E*>\/"[J)<GK)P<K;5]:B!=^YX.KW@V
M>\\T#Z^1\]6F9O0^&H<%X6OR9$5K7U]<J",Q<5>P+/?M$W*OQM$ZOTG/+6TP
M/;4DL?14LLOTJ`C.V=,4;K9/A>=,G);.M@[_J<B=">'/X*\/ZNG@_@SR^G"?
M#OO9.X*72+/)D8K(N?"W]/DB3]=Z5436^&A3(1,\+$D^O6,:C[_<EK+'O6V?
M]RDBJM/!)K>>HKPGVN#%DG)T,A11'/T>SZC00H>.8C5$^;*=/8>-L82]JTN3
M>K?=:G\X9!VT3,"EPQ_B96A'MFBH^&E'7(31W,WK4DW<')*$LG=LO!Y:N27H
MI-*43C3HL8;':VDWA^SX=?CN=4A$<QL<5Z0L7G+%9L:8QDBR[#W+H_"U+$@L
M8I1P[>'[/#MD6FS0D$"E%/NN0-@Z15_R:UPA;Q%&/E]@+):4=$NUX+I+O!M^
M,Y5.O+>IS)L")%'1#]_K,"NU1'(*.I&$D$*6!06E_$1!J?<LE,H6"DJ^9X%4
M!A%`!"9'LE[PE$"75;RU)0Z=B6\V-D.$PJRT7S+MVN,?Y5&++OH5!^V+B^#3
M[K.A+TX,PX@N20\+G*5EO926;M96W73)I337GX,?=<NDNAK"F(-'X7&BIY&\
MZ^EE%37-B39#\LR(GV?2Q<.<GG042A%K@7EO,V(/GC]'E)F+ZTMRY8@M[*BP
MCB*7U5?3I6]#PJ2]HBY)M(F97H[.\:=VX"Y>KJ>%]$(7QG*'M''.*RC+3R?4
MIS`3V_1"S)B1V`K(27?+`]CSDQ5_+)3YV+'&S+RG#V`4?6="88*4+YQ2^6B1
M?>+0+6:9GH=$.?,(H)BFJ\C3+7+\"4Q>?H9X3SG4%#I%W^E,D&2Y^`J,?\XI
M[H$@/@B2##^O4TNBE_>S47GJ%I9L281V+&E&OJ,1TLI&:=$3]CKEPRM>'%ND
MNHG--TB)$`!,FZZW\SJ2T';B3&`L9FX%Y^)R'8Y$(`QY]4/*CN8^;\3%B598
M%&<.F>-$XG3Y.%H>7LBKZA^=<91U]#D"-'U.]@SARI\C7`'A2A)PQ!%';/Z0
M'5K0Q"815F!P(=^S/)/GY.)=/W_4LJP!5M#E;50&#$OJHJ^C(YBFH8Y@_GGZ
MV^SM^B7>4&>-!ILZQ^5EUL@A?1/S5\MA/8-BQ;]`#,_(0)XJ/"$&:1$9_Z"/
MJ?G>15K-TP'%JA?)LT<!2%!R,PHPMQID?O-DF$&6M/G91BSLW[QL?`$<(M',
M$QELN!)ITBE6T3A$X`AOP5'<![#70XHA''/J2JW'$>KW=$_!%Y:KB7B9BF"I
MCTR6+A`Y:75((]:0D.E+.`7%SVD23N*BA*[ZV`67GRHF%'1"$&II>8BZVAMY
MKB&F,'P]'9HPSGA"CX^-=*A`7+8(R#/'0T37Q/&'SK*4,NK]S6L;GUC:%$@'
M$C&M!:.LQ3O#ZR,L65B"`$E-;Q_HJ>GMMVM6I373AO6$7<%Q#>^G!3"YR77>
MQ(_=4OZ:G!S_V%\%V>VG_%2<Z&7<-*'^8_)22NM(QT>"_T/&8WVM9SPY<7R&
M^76*IL-MH41I7%RX*X$F91,<6L8"N24)SOOV5*!I^FSAS^@;0_%I,@PB70^_
M9]IB%^7UC7<+:@M/3V5'_F7)PJ.O1#87FT]_CA)_]$,=XLHW1$M)BKY/.9&G
MM@Y=^_P`@X,GDG5NE[]DB<5S-6?QI]'/%T"9Z#UY!BN#HCZS+B_7:W%1F6UY
MGP^JF2INA=)J7_A=W1L^.--P:EKJ2^8M2UX'\`_.-!K@"L-_!:C/*M#7&-]S
MZL,;['L9D5\P4&D;*SZUQM(1A49HF9*6PX>HLD=83,^_?LSK;T2A+.92;+T4
M;+UYPR09Q5YJQPHU_B"1ZDY3?2:"AN/<^"R^AD3O3RRRT$:WA:@_A%>R+:K.
MG9&\^N8;14NQ23NG#ROJO4:KI8C)WD]>RB;R\8$:Q$)2WXO,[U+B<C/GH$^*
M*U;&;YLI]U&[%F_R.T$.*CQH2YO?D3?11UP"EA_*N`G.FO,5ZF>SR$K9"?+&
M*J><3H:%E:^_W/@VL$?=5OS5Y-"^F]W?IS^?Y"-.E/Y06%0*I`6/OO>G+^QU
M^C`M?MFZF\IBA/^?N#K=G>FN[NC_J<_ITLL2AV")L)6KG&:Y*++-]YL\,HUM
M=YJX6"X1<>I;_&PU5LSK_]W>]3^W42SYG]_^%1/7'99`6EF.D[QS$J<",>!Z
MEX0BYBB*HKB5=F1MO-**W95M49?WMU]_NGMF9V4Y#F!RU#U-!6Q+\WUZ^GOW
M\/1Z_]'(:"-8)?A3C[:;S?MDM&BP.0Z:?:(`V+0<.<3J,JO'TX[_VS!GLYON
MFD,1@$<+.1*'9WU%0;$P(?HSE/'<=X2^S<;O`CU=JQ?LX6,TXWV4JLW(^/PI
M/*6Y`C<1X\G>XU:E(_9?YDK5K_I5://ADZL+-QD]N+K0O]4+T>_$+[NZ$4WT
MBOPM8'=#J\JU8FS$3;OK(`%E$$1^1;<]J!D0W(VYL]=WH^B\;;CI[HVGQ?<Z
MV=UP:'NMHPIVJ]W/3:?U&\]<?EQZLY!'8%3)7;7N[2?I%7XT">*\KWKTO?Q$
MUX<J/^@9\]5TG7IN`%\*0T"'WC`$NCC4>BL\PUNJ<LG.<F^=7Y3#EZQ2SCY[
M&_BPXI.WC1NKZ_"=_PTMW^(X>%:!3_-#>(IG:SO5)K4;3_WPAE._QY<TG,>-
M1_9AYW'3UE_;<MUOJ3^SL_%BQ3LE7TJGK4,)>)6-2URX);X-`%8\B3_[#*N\
M]U2")VX%SG>WMWW[OH;75U]F*7[QBW_K6JSY2LB7O0=[>[V]FX[RF5NG&R8U
M/SY!PZ.?Z)>ZH!]](XX:@CQ@?2!^L&3VN`,MX!P"E+*#`="X#@_-$_GRR#S1
M0(DCZMK_&L<QQE"&FSF7#;U,C<S*8$[O[6@*"T1'G-6[?*UN[#/9U!'Z^!I]
M("2"+ECA*?JFU2VHH2X/&T9',X!7%SK17!I>UJ1=<UXUAM6]F=NV#?W"2ZB"
M>N(35J!NJ/$+U6#=:H?0-ZINFI[Q"GSB#)O%VGH<L]0S2U:BR=U5GH_UW;4M
M!^KM[SC+C=@@M9-DF==K$/1L4]UW+<Y,^276N<.+J.8L(DY+STY&=6`AF-LK
MIE:9)!9X+K\#W&=5$R;%=K'/]_'OZLK_0P,V#9@K<+J)\09@4?:+TOP2OM2@
M<W"<+JH,%;@EW)OH/HW+;"3>3U`73=LSJ^P9K#D\MU/O5GI_7]EP9^NP"0VT
MLTC.[([I')QS\'56J5F!DZXD*3N!$16VS$RQ74"6G-.G'!5&X%0[V[78#1!4
M3(QG4549N,_.++GB^*1_2K=B*?^4Q-CEHN>=LA+B`L;G<=QMF'NVHUX4Y724
MS=G/:A+*/STS%0U`X9E$H+0)#%#5K_V##6I\%_P)[T8$*3R!5P<A/HYEU,\?
M35`0B/`_\JUK?+%F1IWX;R8PC1^H/.E8\T[_`BSFU<2RLP#]]81]`5K2XJ1_
MH)(3@Q]VY?LD/Z=-*8OEV53\X.P9$E:LZ.H#GGZ&:>EG<[:TM+WS,]DPPRY^
M.=5CESF-G>+C27PTAS>2NOP-#6CPN4"A1E","P`[S7Q2F&+NXPL'4X)`EM<V
M@0.Z0FX.G&11GB7S[%?+"&:';T:UTY/;D!`4CC('+V@I$R`82:V_"5V-):BU
M5_TS8;5KTY3`(QLG-:W4^1SJO5S.SV.ZE,W-Z/2[0]/Y\DOC_G6#]G0C[)SQ
MD=QH7@S"8G([H_7T6M8[M`L->.]!#5A^0L>79[!I\N4EY-:Q5V.[J/6"`P_L
MLEF-DV6(?"Q61#->EB5LM')#><9QS.'XR:BX()Z8\U3(J+QFOD;XBH8=V[)F
ME$0'T>/S@BBX8D?+K.ZYY"/H+9OXC88]TH/!+"%YR`H^*)>Y!7%P01V.A@S8
M5@I0$3JR+"4U2^?"TD"XT5DU]9=:U"'@"2XJ<9RTY:CG0K"*\':K$$E"S?X>
M<A"<L3_EHK1B]*^+^NE>X-FX!%P'Z@M<P(O`&\-A$;;!AQ'70`F81<.%?@.\
M!2.T'*)WI/OWO=!_3EK+O&B0?H@96E5$FZ(55>4OX!^]@@_".?EYZW??F+N
M8Z+REW"UM&J@&OD('UR?_1M!_2Q2R4TY]`&O'(DL.RD_NNT^0MF0MYF]470"
M![YR,/OA@X9MO#Z7TX+`8EJ4G+!K9!5J4@65>XXJM\4JP=%+=6Y;8R!Y0@>]
M/;<,C/?94`\TE"X(FK#1]Z@9V,HQK8J[[`',G`!S2^<PGHBAK6B;VI4S)(A&
M+RUQM.&2WS&/\3>!Y-:A?0#0O+L1.H];F.H_B^+<!6,%/$G;%F_U(GA?3>^*
MLW9<)9`/H4+;=AQEL-=NI-M-1UTGN;-<C0D%E3!\,>`)W!'HXK]`+;JL"*V)
MYDENH_=-\8G0VNPJ+3L1YQ%&K,B<\_PETR;U47`90GY\S<EDWOQDGE3)#!6.
M7`W3GQI?F-N;$1VEB305EN8)!CFB"L[CIM&_]\SS=)8AD4K)A(<Z4)ZSZ2!O
M1NB(7WM72#/(LGC,TP+6YV[Z6=/N!!QO,@8MI$-&6VG7H5O=S[M*#JMS/OCE
MM5DV?:9-G\=LN%Q7!3INO$.7WUC.O`>V/6K:42]UL&<`DMB\`0U4?,'!V7RE
MJX%RGE4,2PL-828:=;/>*7+R(8O"3+,7$*>A9%5C``;X=G#ITQZ\.B4ZN;YI
M!(CL=\-YL*C*EV^8N<TPXKWU$3G+U\"E^-J0"RSF3(&2X&;@LUD5I<MAY4;M
M?.%(I&;,X9`+!#@W";_6U_OJ]>GQH0^Z3<Q_'7_[`^YFGLUD0O0K[,OWT)PY
M:%K3"KE1BDM9RM_8"4WM`L@IPQ0T*<^\POM3^N,B4.,Z0NI]U=-"#N4I@@88
M)(DEY2@%RW["O4PR1-`1$$AQDV)1(]L!_<@TE$"_Q)"?XFL:-"#$.!U&M./@
M0V#CIV:G=75VFN\S^MZ[_#>M,&8Q!^;:R=)I7B\/=Z[IE,7@K"F!!#D)P>V,
MGQ)VI2XZO$/8F9YV2/C_*,PSH8K?<?.)5_T>!ELV?-R.R]9*.55R6_G8R$KW
M-E>MFZK[MU3--O?J3NJ&N2RIE=35<PGZV%1_2O4%#1.IX\04H'GMFDZD7JLX
M7*_XSE,6!P)/L>D_"N3\Y.G&/?<UI*)['EZ:S;\VCN]8CM[G!?)-6Q8</;"N
MMVW(URW+BV-!L3O](?,$@1NG,F*\UP&CN.X/<ITXT.*<?UGWT/R8A.`.6RW@
MO#<\:(FCZ);.ART1&9_=4[-[#TKJYEJZG6ZG`LC5"``69['J<.<[K3&#5`KM
M!6?!BMVVB6*^R1W3[*K*JJ*@?&;VS:%A,^*[WY965/-_:IZO/R?'Y"WY?X=[
MP_WU_+_#O4?;_)\?HSCUFF3^(AJXK`ODL!RSF\,9Y_2`:R/K"7;@@B0I*7=B
M\^(U)R0\?G%RRG+DX%-6711Y7ER"_24<15`OU&*,8#_6?9MJ-E*WD'ALN"'2
MYR'DL^V1R"%YCS?$YP=Q^4T\_F.I]^+6>-7''QK8ZBK^_,WPH:N[&![T_*\/
M@RK[![[*_M!W,_Z[_W7!P4Q<_<W+SYU?C/M24S6\M]GQS[/T`(Y(-[0*)D0C
MO#K]C6/\%9(1;\M'+XK_E:_^<\9X/_X?#H</U_._#Q\^W.9__RCE]/WIWJ,F
MDW.8WMAG"6["#30UZ6$4G;+FDV5^(A5G90)][8>FA(XBD0AIB/?(A#W8$CG)
M`_WTW]#,(HZ&"')$QRRYP7Y%@JPED82)RQF4L0B:20;5-%LLB%P-B%E,<U;;
M6!L1\P6[E\N#"O-9PN-)#AEHB$U53.I+D@F[+J>5.<]8#Q1]\6)P^OR;X\&+
MDS?_:$TOCI[/5[!D84()C#7*HR('IZ^H\?/:O5MJE(C25W7):)PL)&JC+E@'
MKP)7%>,,)(F4V_VJAH4*.5RS%%H@&':6-.[7S[_X!TP'"W&CGA>U/:0CW&9]
MWF9]_A?-^AQUJJ(LPRSQ,#6-Z#/"'ZDH?^BFCO,DF\$,6Q<%+"E1_ZZ+7F*/
M!I;(;=]*.4]8HTEU[S^-1BLQ#WI&?&$+NM\#M0`R!J_DDM^<+[\CCV1T_Q42
MY]_YV85DDU!J-E;9)]S`TIXE)8?MZDX?_JYIA$-UOF#"^J#/U/7]IT7;9S3E
M?VF)M;FPJ2<;0LE9&IPS0+"_*C3(<D901]1T-K>!1,RLP'IC.EK7`4A8I9F?
M``("R(3I=BO=%3>G7*$0DBKQ`\QV!`]!`&J([/>#CY:5#9B$J'TCD%!*)5.F
ML%.;2!1G;,SI#34C4%O.AY,P*4UM$_C-'%";T`?G0O#*>NEFLW8K2?]#$ZR6
M<)^9K\PZR,`>P=/FH3!-.&.RS0X]%GQB)Y,6]V4D[C,56PQ=@90S#06G5$V+
M99ZB#_7)JAO>R3$8RWI:E&(YEWA3Q@AZ!+%::,8$&R-O%>?38U,0HG^621ZI
M!0<V*\>'L$5^N6#7\KE)B_&R`8M.,6<>%.RD]``S5G%!N""-&"S$V,?+I-W]
MUH;;S9N)$V_>#>%$\/[AD%FEK@Z%N*81[HDDS]"8Q^_Q!B]L.0-DIG[H9@LV
M@P0UFMGZ,!K&ICVC2O`<3X4/<$:"!I1VB?,C<,<-99Z<N+K=B,/(I`6DZM,0
M*%<\"8JC_>N#(Q2C6;P;7`#"!FSDG<U"`4%<?\*#I48#0!.SS(3D;4FWLVHV
MV)]M^_K<CX'A39(B(UP&GYJ@,7JG6L*L)W!O@'\+`X!+*.7()B;$JZ?N%WFR
M3AH)GN;%96[3,T91AZCN>&?<'2<!!'0X)2DB+Y"JZE:2&+V7B3XFMLC\\/H[
MXFS^N\4[WPWC?(=<\UVQS'?(+]\5LWPWG/(=LLEWQR/?$8/<YHXY9P%AB7EE
M-3]N@(7I?LY$)0""MEB.<M4C)Q=)EG,."?=.2%%&)(AF%^)CZ6XM8TK--#"R
M/M#+F"RV\?4JZCTULA'A,60Y<3ELB2Q;3$*P#L]QJ7/4R4<_RLUF9U9:TU>O
MOC/?\(2)X^4:\4^RVI*8T0*T;BJ>932'D44SI$RQ(?DO[1@VX/G<L@L"7#`C
MO$909G8N#F0\>3]K(29^XHR5&W+LB'S$K&-6NSIS;=FH"YB/<.ZCLF3W4(QD
ME(XV\&`),TS4PX5CH);S19*EQD[H`.L_@2OV'.M6U?S7*:K_U8<8_YPQ;K'_
M[3_<.PC>?Q7][\'6_O=12G2;`O@V;:T-GIACH<Q),<%+<NK`\_+%,=<YTY<"
MX.4$!R6GLX0<.%O`$`F$VF,-+`><[:M["Y[\4\0V\*^*'D81_0XQM<6/1;/T
M4\@LU<!K(QB1LC["M5`AQGF3@OV;U(O#P8#^'R^J5;S\17BY`1&S`:=Y*0;4
M<$!@VUF4V0P<=HL$5GAV)3KA)V=F*]Z.:QU/EG-;QY.,.V4CG?P?4M)BNAI4
M*Y)BJ<OQ@!C/P0JKT3=+^P?QWC`F@(W/?H5[NHP#PO'R1<7CO'<46`\'L[3B
MYTXC;"^KD;''']Y2WQ"#@.L.RZJTSH^4P<L,>N1&='KYXL"WXRP6^LQ411M7
M1;1IJ<UM[2BQ/,,J!FGNXE+>E#7)!/"7J1=M-C\GVB@-M&N1>.*8VEXQ"$$Q
M=V(NDK,E+`A$3RT_Q=*D4:*^-2V4HYOB8%XU8LDLW:VBD>3%)[H)CW,\MY&-
MEWDM_N97IM.\:,'M^*VT!*Y=,(%;:!\PHB6!1N)(7KX0K8=L((("7`<D-/"#
MF[QOS59=US"(`H%?WHTT43;)-\1FX%C!`[%,92OW=EP5.WTBNY,G\VC8-2=J
MWPC>[97PDBK:A^IO?BX+\B_F8DSW3NZKX)#7)B=PY66GQ&GC]'6@0"-'=_%D
MPD!!H$Q5+VF3Y.:KIH*3KR0&$B`BK/B((W"5--==H5Z[/9.NYLE,F4T!C>8$
MQS3[7B3I=35Y@U\2T@VG!S`Z]4P;:%5\9H;+.]_+-1WCFB)5+W%SD1PH[#G0
MAN221A)8#FM@Q\D%V"D2#ZM%S#U_AZ=_ORJ*U.1+WH#_2_RO]%_<*_^D,6ZQ
M_SY\^&C=_V?X8/A@2_\_1OEH]#]\ZEL1WP`,`-U($4K6N('OW>/B2#GAWP:_
M44D>1=.:"5A>G&7SV#()FQ>#?R[F,N$!P3F[P`S0=P*W6ZA8\?/9M4Z]UKFN
M<^OUEQSE9R47HM[NB\Q>"OU8,V)$:MAESWCG+%^)7O9[$B2+R\KYRJ.*>T&9
M$60<P6:=%JSP=1'WG*00Z*/(FT=;:*.^%K-VP"WIGCF])3`NSQ!Q3D4C%<.2
M5=E\$D<G-*E4E'RM4*-$1%6$'%[UQ0M=Z9=L0J6[$$VR-,VAHV8^BM'KB`[^
M$PELS)IP-0BJ:,/I<YH)T(&LY!"(&I`0"]L`[296T:S4''/('&-PUC54DG;2
M`5!E.D#>U,%;Z/M^AM;O9R$?56,<TMSUTR2'LGIE$[R70W`-5N'UG``-7OWS
M[*J/TTC-J+C297*GHT+9+:;5*T1C-);_B/HM;35>6J['[@6F,TX'D[Q8$!MH
MZW%7J+9J`*P2^JA)WLBG_WH>@LC4'3#R7M)TZ<<)0T-/>1A)`(G3U2"VTNJ^
MT!PCESK305C/Y`6K4YNX!VW&7JIQU"G.>[(H7--D#@<#Y/IDOB+!BU1UE9A_
M0^'++,8\63<,2=G8LD&4`-.=Z1<2,Y>O5+<LK!('-)9+.CA1U]!TEU>2F3.K
MF:+RGD^3Q8(P3<@OS1VW1D>GRGV889F*(\Z74]W`(X*7U(2JJ.\^;6H+\V!E
M-D./AV"*3L&,8-NF22FLI;`]G+.69H8++I/M$WB`4?H.RC#_45$3*W3.3M%S
ML:)Y[1=QZ.;#\51F)?I:4JP6@J1[#6-#ZY#'<:G&)4Q.WU7L@>-PV-%-;_,^
MV'^TZ6U>U^"W!/GX03:$]T1'-P;VX*O?&=*#IK\MF`<M[B*,1Z>&[GY7!`\:
MWD703G3TQ^)THJ/W1NA0]Q\8E..FT`3C1$<?%(83'?VQR!O(OJ]`;G,)3*`^
M#@G>Q>W,$/Q1A3['),C^[-)'N^&#*RV/?)_L5A2^!)@2DW(8O9$@;:OID3UT
M!H-1[;?):)30+D^7-81^-_PW).806L7NM++S[H;U279!FBTFG!W&:D0;K1)_
M$0AIK3RMW$_+P'<AOP;Q+-9I!N.&YM)197,U^G'PPIR$,^I"(Z/QG+9S_I;\
MR`GKS]6(9_%XG3)+2`[,U-.%N?<B"7$'K@:OPD/["2FM@V2;S837(LFIXN#E
M<@7:Q/EXQ!C7GM[ZY&*J"H`3O[C&J(KM9-Y0P2_VFY4%FQ5<^)Y&MJ]M76?]
MWF-JD(D3]T:-78.`V+P0=,3@&T(3YL!^#_PV.%O**]NG"V'GDC"BF60:3)*O
M`G.8>1&\QMUKU/[9C%F*&I=1\IV*P74-]<2NL^P&#H[-X*"]B9D0C83/!(U1
M81(=Z?>98QYC\+X`8J:JMK$,ZZ,*?RP+C/3Q.Q*_2,,_G.M%N_FMZ5VDV9UD
M=)&NUI*XR(?7\[;(YQ^:J.6))&0YNC%52^1MW;CYQ(?W[14Q5-G<A2X#9N:6
MA0RI2DMRT.)D(87":U'8JG/EP"W'KC2OP9>L[%,8$ZC0K,,=2(>:88&X)UXS
MAG-KD_LB,H`\?&!]ZG2$KOCG#W`+6`]IJAD_.DR$*V:^E&]>O7[S^+*TZ2R2
M0M02>,WH@</F)5$\^'90[TK3/-"N"495XMW"OXR!O!?!S+%`A!\_"^D^YWUQ
MKVD9L,]>1*6=/=\@^4;1\706QZCA,3>J5O29<-&[6-4H.Y,L+E'TW+C'QU2#
M5O,;7I+BAID\O).IDR<NSV4YB2[94RE-+?"&'\P3B;25&T5]]0@"2(!>1:H&
M]$0)XI5YD\Q&R9K/QVF0^-X+H5ZX%KZ;L;!B9&3II4T#4QP%WMG[HJ:C`9U#
MM&O0O'5:5<48J#3P+6J8@-?S\/)6;BQH=8$&F'/W%7HL88D\@M\TL2RQ]3@*
M`AEV+')ONW54?JXJN+!(ZOU*005TB26&X+E61M1$9L7!S3T_VU7]!/T#--+<
M--BG:BVS4F=\FC#MW9CXJ1*^5<$VR';R-:Z8AR+Q1]]4%46"#@@AYWF3NQE\
M/#+#!`_!N8=Q%;?<[P)?S%6,DB;N5'C'7\"+95DYI7_SY@/'$0>96][@&3OW
M]H-ZJ(4/03;W5Y@#!]D[Q6BRK,2[:X>F91>0:CFPLMZ5Q(;%Z"(KEL(%XR8:
M=Q7=U45M40A?%L:Q&L(QL%Y!691FQ^/H@!<.>1B\`6,$\*?W36?X4*A.EWT#
MEOJL7QT\HD>@]V71@B*?B!P'\YT#"N(4V4U6E<T(:"#N!K/RST:K[P#CS^&!
M9IB:)5?,;>8$?IK$:*;X7BH`5'^U90'/0CYQJ!D(#SI[1M>G?&7NOJ]0AR?]
MC![FHR!EK$[J^N7CO]WQ/5=]E#>:9)7Q'0<@DB.CU2/NF"GW6C?M7:=O*GEC
M0>\%EJ9J%]8G$#[J21@MFNC#Y(G10])UQ@K'<L@!0+%7K)PL3>.^IO[!X;M3
M=G.YZ:`;GGR^9*,437KA<]P4,\A>WI6O]F\)1"%>(A&)W6?DF7!1U^AC)`U.
M*A@[\J,F!/8D4JT<,^>$0$X&(V8Q/)G,&ZR/<T1<@3U*Y5CA5U@N:]LG!F%L
M^V.8<.B,UR).>HW22G(TC=G+5IBI2V=A*?(T$@T)BQBL[`%19ZE5Z)[#S=#E
M4%7@YG.29PH>`$+2I56A0]S&":=.5JVM?A;]8)-I'*LI48$&FAW&,G&L^;:@
MS?3)DB2*J$7?.NO:-^8EWF#KH-;2C%&\MA,5Y_A%T+PHS@.O5/:-PLN:4R^S
M*)+V,MB"B"81`#0Z.)<T4]5.O)X63*6U2$..N+G+#'>I3[:$>S_BV1!Z/)$<
M81F`\)CS07%_S)55+68-EV('^9EV>HWKI^:LBU2U6[4"G]H)ZMPT^&`QJ&KI
MGM=RQ^[O!UU*1K*=D(>2*<71<<,8Z0-%R)FGZ<JFM<M55I%P(ZY00?(^N5S=
MJ&[E`'-)F-B=G,]*3!9B8:XU[5:D-V]1VK%-&1V$V<N&)#4.C8S:;3#O#>G+
M^(R#+&0LT8G2T>V]IG7C2I)=+'*689:?1:6I.0VE":NNF0RWLY-%:(ZW>Q+<
MWQ'Q(E:)L:R_USSH4R6KGAY2I!+")+`2Z'J;I&Y\CR;+G``NU]-W"89P;\LL
MB<7ME?X]Y_BR>S`57X97EFT9E[8AHEX\0DHT:\^?$6?K+FVEL6["PYKOK<*U
M9N*7OL2E&U<:]"+RF@H'2T@T(>D=>?YJEU<BJ)G\%@E2X<W3R)\E6]<KAT^%
M2]8>8Z);*>T;EH#9,!A%F`/!N)FQ4_^(_\1X*UN+=CJ;B/S%KL42G>`P;Y,=
M3O8SR`\7Z4.\G/O-"'I@.!<&0':O!EWQKOF>1Q\)9XOWG:JIA>W!$1Z'3<KK
MK_EV9.YX6-`Q+4T>0I;4JH:JZ?O<C$ZCU_HM+YOWSVU?\QB</FLF#N4-ZW2B
MMA1/OMU(K/T35G.$;2;P539)H)-3X#5(:V,#N<ABQZ,1EZ*0$D8P:F^D>YO9
M7Q>#M/R\`=E\R3$IG]MQHM[F@LUIUW=8*P:F?\?9+_@3<UD6;.V0U3&IB405
M69RS6I-PL>'%,Z,K!,IKC64N_EFRQF9V-_9?M?_3A3U]_>T/=]/G>KDM_\>C
MAT/O__=@[S[L_X_V]K?V_X]1_K+V_V_M1<96*[I;-)&5H9F(I4GU"B(:,R=[
M:4?PN^.^G:K`V>$(OTM'%?%KGS8VL(?#863ZYJN"`V,*)<`[KVPMXK*:,ID/
M9&IK4TX=UFGTL<)/:DY=?2"1&W<U?T]".Z;:4Z>^)#;^/-0,@A?WSF.@4K'Q
M,BUZ'RFFR=:$*-;9U=I?1SVJ)$,K_=+G:42LW23ANS-+#[I&F5KED]0^IDQY
M1X5.$C&2,\G]/VT2)X]4$B;Z26RO\2X'>B!IEOIG%!W1RU3]#^MMEJ\ZSY#%
M"`Y6R66R<EJ]<5&6RT6M>BAGGH)R2L0^?Q@P$Q"OW(C[SJ3):LA)GIPY]8VR
ML.U]UKF4=L+X-7BV!ZK-OE&+@227$D-!5Q6$!HLB)GY!%)^-+LXP*-P8&P@(
M?BQT2:RIP</@!*!(%R62;(UX>_'#7_.;<-.800*%EC[T$W'VXW()729F^:K@
MYUR1N9/M[BL\Q-<3WB*$[`?[?S]$_2^%ODM0@YK3MK[WV[(MV[(MV[(MV[(M
MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(MV[(M_X_*_P+O
'(?S1`,@`````
`
end

More Exploits!

The master index of all exploits is available here (Very large file)
Or you can pick your favorite operating system:
All OS's Linux Solaris/SunOS Micro$oft
*BSD Macintosh AIX IRIX
ULTRIX/Digital UNIX HP/UX SCO Remote exploits

This page is part of Fyodor's exploit world. For a free program to automate scanning your network for vulnerable hosts and services, check out my network mapping tool, nmap. Or try these Insecure.Org resources: