RE: Exploit for Windows RPC may be in the wild!

From: Jeff Adams (JAdams_at_NetCentrics.com)
Date: 07/29/03

  • Next message: Danny: "Re: Anyone know this tool?" 
    Date: Tue, 29 Jul 2003 13:09:33 -0400
To: "Sumit" <scorpio_chaser@yahoo.co.uk>, "James C. Slora, Jr." <Jim.Slora@phra.com>, <incidents@securityfocus.com>

    Yes, I was able to get a copy of the exploit from various newsgroups:

    http://www.derkeiler.com/Mailing-Lists/VulnWatch/2003-07/0055.html

    I was successfully able to get it work on win2k, NT, and XP. I did not
    try 2k3. Both the win32 and unix versions can be found on the above
    newsgroup. It seems as though the success rate on un-patched machines is
    not 100% On un-patched machines I was getting it to work maybe 60 to 70%
    of the time. The exploit comes in a rpc port and then allows for cmd.exe
    netcat connection to port 4444. The code can be recompiled to drop the
    command line to a different port (say something common like 80)!!

    Jeff

    -----Original Message-----
    From: Sumit [mailto:scorpio_chaser@yahoo.co.uk]
    Sent: Tuesday, July 29, 2003 7:47 AM
    To: 'James C. Slora, Jr.'; incidents@securityfocus.com
    Subject: RE: Exploit for Windows RPC may be in the wild!

    Does any one have working Exploit for "[NT] Buffer Overrun in RPC
    Interface Could Allow Code Execution"

    To be Specific Win NT 4.0

    With Regard,
    Sc0rPiO
    "Nature knows no indecencies; man invents them."

    -----Original Message-----
    From: James C. Slora, Jr. [mailto:Jim.Slora@phra.com]
    Sent: Monday, July 28, 2003 11:46 PM
    To: incidents@securityfocus.com
    Subject: RE: Exploit for Windows RPC may be in the wild!

    tEA-TiME wrote Sunday, July 27, 2003 6:34 PM
    > There could be another explanation for the flow of traffic to port
    135. Many
    > programs being released now for using the NET SEND command to
    advertise,
    > come with a built in "scanner" to see if the host is active beore
    wasting
    > the time sending the whole message. Some of these software makers also
    > suggest getting a port scanner and just scanning ports 135, 137, 138,
    139,
    > and 445 to see if a host is running and accepting NET messages.

    Yes many could be messenger spam probes. I've seen a marked increase in
    TCP 135 scanning over the past week, though. And I'm getting new scan
    combos (TCP 135 and 445 with no other ports) that strongly suggest RPC
    probing rather than messenger spam.

    ------------------------------------------------------------------------ 

    ---
------------------------------------------------------------------------
----
------------------------------------------------------------------------
---
------------------------------------------------------------------------
----
---------------------------------------------------------------------------
----------------------------------------------------------------------------
  • Next message: Danny: "Re: Anyone know this tool?"

    Relevant Pages

    • Re: AD Replication over SonicWall site-to-site VPN
      ... Active Directory replication over RPC ... takes place dynamically over an available port via the RPC Endpoint Mapper ... Global Catalog Server TCP 3269 ...
      (microsoft.public.windows.server.active_directory)
    • Re: SBS 2003 and Outlook RPC over HTTP issues
      ... the article is incorrect in stating that port 80 is needed. ... "The only ports you'll need to open on your firewall are TCP ... that port 443 and port 80 must be open to use RPC over HTTP. ...
      (microsoft.public.windows.server.sbs)
    • Re: Windows 2003 Domain Controller (Open Port 593)
      ... tcp 593 exists not due to use of rpc/http proxy and KB says how ... to plug up rpc/http proxy so that it cannot ... On the other hand, the second KB ref given does list RPC locator, ... Seeing a dynamic port coming and going in association ...
      (microsoft.public.windows.server.security)
    • Re: CAS Server in the DMZ
      ... In order to minimize exposure by opening TCP 135 and TCP 1024+ ... for RPC, we are interested in restricting our RPC traffic to a specific port, ... need to restrict FRS replication traffic to the same static port. ... cheap Linksys firewall publishing TCP 443 to your CAS from the Internet ...
      (microsoft.public.exchange.design)
    • Re: SBS 2003 and Outlook RPC over HTTP issues
      ... Look in IIS at your Exchweb, Exadmin, exchange-oma, and RPC sites' directory ... Why is it called RPC over HTTP if HTTP is not really needed to be ... As pointed out by others, port 80 does NOT need to be open, and yes, it ... I have about 20 of these SBS machines at other locations and have ...
      (microsoft.public.windows.server.sbs)