| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <00a101c35920$61b67980$6e0ac80a@ptah> From: dhopper at ameritech.net (mobly99) Subject: RE: possible MS03-026 worm? I forwarded the files I found to neohapsis and securityfocus. I'm not equipped with the knowledge to disassemble the code hopefully they can shed some light. The rpctest.exe appears to determine the remote system's OS and spawns a shell, which you can then telnet to. Tftpd.exe is this tftp server : http://www.hanewin.de/e-tftp.htm Worm.exe is a SFX that has rpc.exe tftpd.exe and rpctest.exe in them, extracts and launches them.... -Dave Hopper -------------- next part -------------- A non-text attachment was scrubbed... Name: smime.p7s Type: application/x-pkcs7-signature Size: 3228 bytes Desc: not available Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20030802/0bae55b5/smime.bin
Powered by blists - more mailing lists