RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)

From: gml (gml_at_phrick.net)
Date: 07/28/03

  • Next message: Brett Moore: "[Full-Disclosure] Shattering SEH II"
    To: "'Robert Wesley McGrew'" <rwm8@CSE.MsState.EDU>, <full-disclosure@lists.netsys.com>
    Date: Mon, 28 Jul 2003 16:20:43 -0400
    
    

    What if it just kept an internal list of return addresses and simply cycled
    through them each in a separate thread until it was able to gain access to
    the machine?

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Robert Wesley
    McGrew
    Sent: Monday, July 28, 2003 1:11 PM
    To: full-disclosure@lists.netsys.com
    Subject: RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)

    On Mon, 28 Jul 2003, Schmehl, Paul L wrote:

    > > 2) For this DCOM RPC problem in particular, everyone's
    > > talking about worms. How would the worm know what return
    > > address to use? Remote OS fingerprinting would mean it would
    > > be relatively large, slow, and unreliable (compared with
    > > Slammer), and sticking with one would cause more machines to
    > > just crash than to spread the worm. I haven't looked into
    > > this very closely yet to see if it can be generalized.
    >
    > What fingerprinting? If you've got 135/UDP open to the Internet, you're
    > screwed. Slammer didn't fingerprint. It simply hit every box it could
    > find on port 1434/UDP, and the exploit either worked or it didn't. Most
    > worms do the same. They attack indiscriminately, and infect those Oses
    > that are susceptible. And with Windows, that's enough boxes to cause a
    > real problem.

    Thanks for responding. I realize that having 135 open on any Windows
    machine makes you vulnerable, and that you wouldn't need to differentiate
    Windows/OtherOSes. My question is about different Windows versions. The
    version (NT/2000/XP), service pack, and language at least have to be known
    to get the return address right. If it's "guessed" wrong, the system goes
    down with no shell executed.

    Any worm using this would need to know the return address before
    attempting to exploit If a worm were to stick to targetting one return
    address (say, English XP SP1), everytime it ran across something slightly
    different (SP0, german, win2k, etc) it would simply crash it and not
    spread. One of three things would happen in the case of this worm :

    1) Sticks with one return address, makes a spectacular DoS against all
    other languages/versions/SPs. This could limit how quickly it spreads.

    2) Somehow finds out ahead of time what the remote language/version/SP is.
    Could be very unreliable and slow.

    3) There is some way of generalizing the return address in a way that
    would work on at least a large portion of installs. This is what would
    bring it into the league of Very Scary Worms.

    Has anyone seen any indication in the private exploits or in their
    research that there's a way to get it to work reliably on systems without
    having to know version/SP/etc?

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Brett Moore: "[Full-Disclosure] Shattering SEH II"