full-disclosure - How to massively remove DCOM RPC Worms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

From: B3r3n at argosnet.com (B3r3n)
Subject: How to massively remove DCOM RPC Worms

Hi Gentlemen,

Following the article http://www.securityfocus.com/archive/119/333927, I 
applied this principle on our IntraNet.

I used the oc192-dcom proof of concept code from securityfocus too.

I create a ms.bat script placed into the startup group (c:\documents and 
setting\all users\...\startup)

This scripts downloads via TFTP
         - stinger to remove active worms (else there are issues patching)
         - MS03-026 to the associate OS (Win2K or XP)

On XP machine the reboot is automatic when you kill the exploit (I did not 
searched yet how to reboot on Win2K)

Result: after the reboot, the ms.bat script is launched, it cleans the box 
and install the patch. Then it deletes itself and associated files.
Again, on XP, installing the patch generate XP reboots automatically.
The only problem is patch requires user action to approve.
Maybe there is a version more silent.

This trick has been included into a scanning program running on a FreeBSD 
4.8 and so this simple trick permits to patch hundreds of machines.

Might be useful to others

Brgrds

Laurent LEVIER
IT Systems & Networks Security Expert