Re: [Full-Disclosure] DCOM RPC exploit (dcom.c)
Valdis.Kletnieks_at_vt.edu
Date: 07/28/03
- Previous message: Brett Moore: "[Full-Disclosure] Shattering SEH II"
- In reply to: Robert Wesley McGrew: "RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)"
- Next in thread: Marc Maiffret: "RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
To: Robert Wesley McGrew <rwm8@CSE.MsState.EDU> Date: Mon, 28 Jul 2003 16:23:15 -0400
On Mon, 28 Jul 2003 12:10:56 CDT, Robert Wesley McGrew <rwm8@CSE.MsState.EDU> said:
> Any worm using this would need to know the return address before
> attempting to exploit If a worm were to stick to targetting one return
> address (say, English XP SP1), everytime it ran across something slightly
> different (SP0, german, win2k, etc) it would simply crash it and not
> spread. One of three things would happen in the case of this worm :
>
> 1) Sticks with one return address, makes a spectacular DoS against all
> other languages/versions/SPs. This could limit how quickly it spreads.
>
> 2) Somehow finds out ahead of time what the remote language/version/SP is.
> Could be very unreliable and slow.
>
> 3) There is some way of generalizing the return address in a way that
> would work on at least a large portion of installs. This is what would
> bring it into the league of Very Scary Worms.
4) For each target pick one of the known return addresses at random. Do something
to "close the door" once you get it. Then eventually, each machine will get infected
after several reboots... the best/worst of all worlds - a sustained DDoS *and* a hack. ;)
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
- application/pgp-signature attachment: stored
- Previous message: Brett Moore: "[Full-Disclosure] Shattering SEH II"
- In reply to: Robert Wesley McGrew: "RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)"
- Next in thread: Marc Maiffret: "RE: [Full-Disclosure] DCOM RPC exploit (dcom.c)"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
