lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
From: zorkshin at tampabay.rr.com (Justin Shin)
Subject: RE: possible MS03-026 worm?

Sounds like it was poorly written, and very bulky. Tftp server alone = 470 Kb. Where does it get Worm.exe from, meaning which server does it download from? We can see if it is downloading from some public server, then see who uploaded it ... maybe???

--Justin Shin

-----Original Message-----
From: full-disclosure-admin@...ts.netsys.com
[mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of mobly99
Sent: Saturday, August 02, 2003 2:04 PM
To: full-disclosure@...ts.netsys.com
Subject: [Full-Disclosure] RE: possible MS03-026 worm?


I forwarded the files I found to  neohapsis and securityfocus.
I'm not equipped with the knowledge to disassemble the code hopefully
they can shed some light.

The rpctest.exe appears to determine the remote system's OS and spawns a
shell, which you can then telnet to.

Tftpd.exe is this tftp server : http://www.hanewin.de/e-tftp.htm

Worm.exe is a SFX that has rpc.exe tftpd.exe and rpctest.exe in them,
extracts and launches them....



-Dave Hopper


Powered by blists - more mailing lists