RE: [Full-Disclosure] W32/Welchia, W32/Nachi backdoor?

From: Chris Eagle (cseagle_at_redshift.com)
Date: 08/20/03

  • Next message: vogt_at_hansenet.com: "AW: [Full-Disclosure] Filtering sobig with postfix" 
    To: "Barry Irwin" <bvi@lair.moria.org>, "'Full-Disclosure@Lists.Netsys.Com'" <full-disclosure@lists.netsys.com>
Date: Wed, 20 Aug 2003 10:14:10 -0700

    >>creates a backdoor listening on TCP/707 or some other randomly chosen port
    between TCP/666 and >TCP/765 [2]

    There is a slim chance that the listener may fall outside this range, but it
    will generally be a random port in the range 666-765. Don't count on 707.

    >Telnetting to this port seems to disconnected after 1-5 characters have
    been
    entered? This doesn't look like TFTP (port 65/tcp&UDP), and the windows
    tftp client doesn't seem to offer any means of specifying a port to connect
    to?

    >Is this some kind of password protected backdoor ?

    No, it is not a command shell back door. It is the connect back point for
    the exploit payload. When an incoming connection is received, it checks for
    the string "Microsoft Windows" in the first packet it receives, then waits
    for the string "system32>" It then does a directory listing on the exploited
    machine to see if Nachi is already installed there and if so it simply
    closes the socket. If not, it pushes itself (Nachi) to the newly exploited
    machine, then launches Nachi on the remote machine and closes the socket.

    Chris

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: vogt_at_hansenet.com: "AW: [Full-Disclosure] Filtering sobig with postfix"

    Relevant Pages