full-disclosure - RE: DCOM RPC exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <SRV2KW3EXCHNGgJaHAj0000003a@srv2kw3exchng.entrenchtech.com>
From: steve at entrenchtech.com (Steve W. Manzuik)
Subject: RE: DCOM RPC exploit

Hi Chris.

Funny you post this from your NGS Software account.  Does Saphire/Slapper
ring a bell?  Isn't this a bit of the pot calling the kettle black?

Do you really think for one second that HD Moore, Benjurry, and FlashSky are
the only people capable of coming up with exploit code for this?  The day it
was announced I saw two other exploits that haven't been publically
announced.  The community of people who have the skills to write such a worm
already had the exploit code, or at the very minimum enough information to
replicate it the day this was released.

A worm exploiting this might happen, but is it really that big of a deal?

> Message: 13
> Date: Sat, 26 Jul 2003 20:16:24 -0400 (Eastern Daylight Time)
> From: Chris Paget <chrisp@...software.com>
> To: "full-disclosure@...ts.netsys.com" 
> <full-disclosure@...ts.netsys.com>
> Subject: Re: [Full-Disclosure] DCOM RPC exploit  (dcom.c)
> 
> 
> <sarcasm>
> 
> I'd just like to thank FlashSky, Benjurry, and H D Moore for 
> releasing this
> code.  Really guys, sterling job.  Now the skript kiddies and 
> VXers have got
> virtually no work to do in order to write a worm that exploits this.
> 
> </sarcasm>
> 
> Personally, I'm tempted to set up my firewall to NAT incoming 
> requests on port
> 135 to either www.metasploit.com or www.xfocus.org.  I know 
> this is the
> full-disclosure list, but working exploit code for an issue 
> this huge is taking
> it a bit far, especially less than 2 weeks after the advisory 
> comes out.
> 
> Cheers, fellas.  When the worm comes out, I'll be thinking of you.
> 
> Chris