full-disclosure - Spybot and SQL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

From: papp_geza1 at axelero.hu (Geza Papp dr (Axelero))
Subject: Spybot and SQL

Hello mjcarter,

2005. febru?r 11., 4:33:26, ?rtad:

micn> Hi All,
micn> Has anyone seen a spybot variant using the target machines
micn> IP address as the password for user SA?

micn> We don't have a name for this variant yet. I might be
micn> reading my captures wrong but that's what this looks like
micn> it's doing .

This is a new SQL Spybot, but this dropped not dropped off payloads named
winlog.exe and soundblaster.exe - this dropped wm1exe.exe.

W32/Rbot-VT  is  a  network  worm  with backdoor functionality for the
Windows platform.

The  worm  copies  itself  to  a  file named wm1exe.exe in the Windows
system folder and creates the following registry entries:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\
WINDOWS MANAGEMENT SYSTEM
wm1exe.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices\
WINDOWS MANAGEMENT SYSTEM
wm1exe.exe

     W32/Rbot-VT spreads using a variety of techniques including exploiting
     weak  passwords  on  computers  and  SQL servers, exploiting operating
     system  vulnerabilities
(including  DCOM-RPC, LSASS, WebDAV and UPNP)
and using backdoors opened by other worms or Trojans.

W32/Rbot-VT  can be controlled by a remote attacker over IRC channels.
The  backdoor  component  of W32/Rbot-VT can be instructed by a remote
user to perform the following functions:

start an FTP server
start a Proxy server
start a web server
take part in distributed denial of service (DDoS) attacks
log keypresses
capture screen/webcam images
packet sniffing
port scanning
download/execute arbitrary files
start a remote shell (RLOGIN)
steal product registration information from certain software

Patches   for   the  operating  system  vulnerabilities  exploited  by
W32/Rbot-VT can be obtained from Microsoft at:

http://www.microsoft.com/technet/security/bulletin/ms04-012.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-039.mspx
http://www.microsoft.com/technet/security/bulletin/ms03-007.mspx
http://www.microsoft.com/technet/security/bulletin/ms01-059.mspx

from Sophos Plc.  10 February 2005 22:24:31 (GMT)

-- 
?dv?zlettel,
 Geza                            mailto:papp_geza1@...lero.hu