Remote Rootkit Scanner for Windows

Hacker defender is a rootkit that is being highly deployed by Hackers in
compromised box in the last months.
Due to a design Flaw its possible to remotely detect if an NT based computer
is "infected" with this rootkit.

Rkdscan was developed to check for this flaw, performing a network scan and
after sending some data to open ports is able to detect if the remote box
have been compromised.

Usage:

C:\rkdscan>rkdscan.exe xx.yy.0.0 xx.yy.10.0
 Remote hxdef Scanner $Revision: 1.0 $
 atarasco_@_sia.es http://www.siainternational.com

 [+] Targets: xx.yy.0.0-xx.yy.10.0 with 150 Threads
 + xx.yy.0.1
 + xx.yy.1.1
Checking xx.yy.1.5 port: 3389...
Checking xx.yy.1.17 port: 3389...
Checking xx.yy.1.17 port: 21...
Checking xx.yy.1.30 port: 3389...
Checking xx.yy.1.7 port: 21...
Checking xx.yy.1.20 port: 21...
Checking xx.yy.1.22 port: 1025...
 [+] IP: xx.yy.1.22 port: 1025 INFECTED with HACKER Defender v0.84 - v1.0.0
Checking xx.yy.1.66 port: 1025...
Checking xx.yy.1.25 port: 21...
 [+] IP: xx.yy.1.66 port: 1025 INFECTED with HACKER Defender v0.84 - v1.0.0
Checking xx.yy.1.65 port: 3389...
Checking xx.yy.1.47 port: 3389...
Checking xx.yy.1.52 port: 7...
 [+] IP: xx.yy.1.52 port: 7 INFECTED with HACKER DEFENDER v0.82 - 0.83
Checking xx.yy.1.90 port: 3389...
Checking xx.yy.1.101 port: 3389...
Checking xx.yy.1.96 port: 3389...
Checking xx.yy.1.97 port: 3389...
Checking xx.yy.1.94 port: 7...
Checking xx.yy.1.94 port: 80...
 [+] IP: xx.yy.1.94 port: 80 INFECTED with HACKER Defender v0.84 - v1.0.0
Checking xx.yy.1.109 port: 3389...
Checking xx.yy.1.98 port: 3389...
Checking xx.yy.1.21 port: 25...
Checking xx.yy.1.116 port: 21...

attached in this e-mail is a zip file with both source and binary files

rkdscan.c md5sum: a24c0d9f35ccaa07efa8a291476a8a4d
rkdscan.exe md5sum: 229fd4a1df6d76c799c9b059519f204a (compiled with Bc++
Builder)
rkdscan.zip md5sum: bb653a41e757b9762070bcd1ec082e5e
 

Special Thanks for Javier Olascoaga ( jolascoaga[at]sia.es ) for the
development of a nasl/nessus script.

Andrés Tarascó Acuña
Security Consultant - Tiger Team
Departamento de Consultoría

Grupo SIA
Avenida de Europa Nº 2. Alcor Plaza
Edificio B. Parque Oeste Alcorcon.
28.922. Madrid
*Tel.: +34 902 480 580 * Fax: +34 91 307 79 80
atarasco_@_sia.es
<www.sia.es>

 <<rkdscan.zip>> <<hacker_defender.nasl>>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html