Re: RE: possible MS03-026 worm?

["morning_wood" <se_cur_ity () hotmail com>]

funny.. i had traces and warnings about this for a while now...

http://exploit.philez.com/attack/RPC-DCOM-DD0S-attack.txt  ( relocated
www.exploitlabs.com files )


http://nothackers.org/pipermail/0day/2003-July/000140.html

http://nothackers.org/pipermail/0day/2003-July/000143.html
http://nothackers.org/pipermail/0day/2003-July/000154.html

this was when the world said.. umm

http://nothackers.org/pipermail/0day/2003-July/000146.html
 and I quote

"hi !
i did a pentest for a bank in order to verify the RPC attack consequences
!!
.. It's the biggest attack .. I broke into many servers and also crash many
others !!
I think 95% of the windows infrastructure was under control in less than 2
hours !!

so, morning_wood was RIGHT !"



guess ppl should listen to me instead of waiting for @steak (sic) to read
my postings.

etc etc

Donnie Werner
co-founder e2-labs
morning_wood () e2-labs com



----- Original Message ----- 
From: "mobly99" <dhopper () ameritech net>
To: <full-disclosure () lists netsys com>
Sent: Saturday, August 02, 2003 11:03 AM
Subject: [Full-disclosure] RE: possible MS03-026 worm?


> I forwarded the files I found to  neohapsis and securityfocus.
> I'm not equipped with the knowledge to disassemble the code hopefully
> they can shed some light.
>
> The rpctest.exe appears to determine the remote system's OS and spawns a
> shell, which you can then telnet to.
>
> Tftpd.exe is this tftp server : http://www.hanewin.de/e-tftp.htm
>
> Worm.exe is a SFX that has rpc.exe tftpd.exe and rpctest.exe in them,
> extracts and launches them....
>
>
>
> -Dave Hopper
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html