full-disclosure - DCOM RPC exploit (dcom.c)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200307270119.h6R1JtKg018982@haackey.com>
From: neeko at haackey.com (Neeko Oni)
Subject: DCOM RPC exploit  (dcom.c)

1) It's a one-shot attack.  Pick the wrong SP, no go.  Whatever worm comes of
this will be limited by this fact.

2) It'll be another week before most of these "kiddies" figure out how to 
compile any exploit released.  "ware is erreer.h!!!" etc.

3) Two weeks.. if that's not long enough to patch up, you can't really blame
the exploit writer(s).

4) I don't like guns.  People kill people with guns.  Do I blame the murderers
for pulling the trigger or do I blame the gun producers for making the gun?
Hint:  This is different than "Should people make guns or not?"

5) NAT'ing incoming requests to other hosts.. nice.  First off, NAT was the 
wrong choice of buzzword.  Next, do you really want it looking like you're 
attempting to exploit either of those sites?  Furthermore.. what's the point?
Are you trying to DoS those hosts?  Nice.  Whine about the actions of others
while participating in a DoS attack.  Good job.  You must be a mental giant.

I can tell you're one of those guys who spent the night at your colo trying to
patch SQL while Slammer hit.  

.Neek

> 
> 
> <sarcasm>
> 
> I'd just like to thank FlashSky, Benjurry, and H D Moore for releasing this
> code.  Really guys, sterling job.  Now the skript kiddies and VXers have got
> virtually no work to do in order to write a worm that exploits this.
> 
> </sarcasm>
> 
> Personally, I'm tempted to set up my firewall to NAT incoming requests on port
> 135 to either www.metasploit.com or www.xfocus.org.  I know this is the
> full-disclosure list, but working exploit code for an issue this huge is taking
> it a bit far, especially less than 2 weeks after the advisory comes out.
> 
> Cheers, fellas.  When the worm comes out, I'll be thinking of you.
> 
> Chris
> 
>