lists.openwall.net   lists  /  announce  john-users  owl-users  popa3d-users  /  xvendor  oss-security  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4 
Open Source and information security mailing list archives
 
This website is powered by Openwall GNU/*/Linux security-enhanced OS
[<prev] [next>] [thread-next>] [month] [year] [list] 
From: dhopper at ameritech.net (mobly99)
Subject: RE: possible MS03-026 worm?

I forwarded the files I found to  neohapsis and securityfocus.
I'm not equipped with the knowledge to disassemble the code hopefully
they can shed some light.

The rpctest.exe appears to determine the remote system's OS and spawns a
shell, which you can then telnet to.

Tftpd.exe is this tftp server : http://www.hanewin.de/e-tftp.htm

Worm.exe is a SFX that has rpc.exe tftpd.exe and rpctest.exe in them,
extracts and launches them....



-Dave Hopper
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 3228 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030802/0bae55b5/smime.bin

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux