Re: Sasser Worm exploiting MS04-011 vulnerabilities

Article View: be.comp.security

Article #940

#940

From: Jan Reilink
Date: Tue, 04 May 2004 05:33

37 lines
2166 bytes

Filbert wrote:
> Jan Reilink wrote:
> 
>>net3-nl-mail-02:~# grep "\:445" /var/log/kernel |wc -l
>>765
>>
> 
> 13.000 attempts vandaag tot op heden. 
> 

# grep "\:445" /var/log/kernel* |wc -l
    5845

Maar dit is natuurlijk niet geheel nauwkeurig he... :)

Ik zei ook nog:
 >> Ik zie voornamelijk veel connecties vanuit 213.x.x.x. (maar da's een
 >> flink opgedeelt block ;-))

<http://www.lurhq.com/sasser.html>
A target IP to exploit to is generated:
	50% of the time it will attempt to exploit a completely random
	IP address
	25% of the time it will attempt to exploit a random address
	within the same first octet of the local subnet
	25% of the time it will attempt to exploit a random address
	within the same first and second octets of the local subnet
If successful, the LSASS exploit will open a shell on the remote system on 
TCP port 9996

Groeten, Jan

-- 
/"\  ASCII Ribbon Campaign
\ /  No HTML in mail or news!
  X
/ \ 	Dutch Security Information Network: http://www.dsinet.org/

Technical Details

Message-ID: <40972b33$0$562$e4fe514c@news.xs4all.nl>

Path:

arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!newsgate.cistron.nl!transit.news.xs4all.nl!not-for-mail

References:

<10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com> <409562e7$0$564$e4fe514c@news.xs4all.nl> <1219281.Rte6y4QAFf@127.0.0.1>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 113446,bf061752b2fb928f
X-Google-Attributes: gid113446,public
Path: arc1-ca.pugleaf.net!controlnews3.google.com!news1.google.com!news.glorb.com!newsgate.cistron.nl!transit.news.xs4all.nl!not-for-mail
Date: Tue, 04 May 2004 07:33:39 +0200
From: Jan Reilink <digiover@dsinet.org>
Organization: Dutch Security Information Network
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.3.1) Gecko/20030425
X-Accept-Language: en
MIME-Version: 1.0
Newsgroups: be.comp.security
Subject: Re: Sasser Worm exploiting MS04-011 vulnerabilities
References: <10033547.yWgGLQC1Ax@127.0.0.1> <d6n9905lov6djfe3p5l3o6ctvumlhfg5f2@4ax.com> <409562e7$0$564$e4fe514c@news.xs4all.nl> <1219281.Rte6y4QAFf@127.0.0.1>
In-Reply-To: <1219281.Rte6y4QAFf@127.0.0.1>
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
Lines: 38
Message-ID: <40972b33$0$562$e4fe514c@news.xs4all.nl>
NNTP-Posting-Date: 04 May 2004 07:33:39 CEST
NNTP-Posting-Host: 80.126.245.197
X-Trace: 1083648819 news.xs4all.nl 562 [::ffff:80.126.245.197]:11384
X-Complaints-To: abuse@xs4all.nl

Reply to Parent Message