full-disclosure - W32/Welchia, W32/Nachi backdoor?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <NDBBKKOCALIBPMFFNMEMOEEMEJAA.cseagle@redshift.com>
From: cseagle at redshift.com (Chris Eagle)
Subject: W32/Welchia, W32/Nachi backdoor?

>>creates a backdoor listening on TCP/707 or some other randomly chosen port
between TCP/666 and >TCP/765 [2]

There is a slim chance that the listener may fall outside this range, but it
will generally be a random port in the range 666-765.  Don't count on 707.

>Telnetting to this port seems to disconnected after 1-5 characters have
been
entered?  This doesn't look like TFTP (port 65/tcp&UDP), and the windows
tftp client doesn't seem to offer any means of specifying a port to connect
to?

>Is this some kind of password protected backdoor ?

No, it is not a command shell back door.  It is the connect back point for
the exploit payload.  When an incoming connection is received, it checks for
the string "Microsoft Windows" in the first packet it receives, then waits
for the string "system32>" It then does a directory listing on the exploited
machine to see if Nachi is already installed there and if so it simply
closes the socket.  If not, it pushes itself (Nachi) to the newly exploited
machine, then launches Nachi on the remote machine and closes the socket.

Chris