Re: NT Compromise

[H C <keydet89 () yahoo com>]

> I am responding to several compromised NT boxes and
> am trying to find a
> utility that will allow you to see what program is
> bound to a particular
> port. 

I saw several references to inzider and tools
available from SysInternals, but of all the responses
that showed up in my inbox, I did not see a single
response that mentioned FoundStone's fport.exe.  

The reason I mention this tool isn't b/c it's
necessarily 'better' than than the others, but b/c I
also teach an NT/2K incident response course...and in
order to get volatile data (like network connections,
etc) off of the box, the best way to do so w/o making
a lot of changes to the victim system itself is to use
CLI tools and pipe the output through a socket to
another system.  Netcat and cryptcat are good for
this, but neither one returns when the app itself has
finished executing.  I've been working on another tool
for this purpose.

> I think I've seen one that shows what ports
> are bound to
> command.com, but need something similar for other
> programs/trojans/etc.

Eric, I have to admit...this makes no sense to me. 
But I could simply be misunderstanding...could you
elaborate on this a bit?

> Is there something available? Has anyone seen a
> compromised NT box with
> port 6667 open that does not seem to be running an
> IRCD? Check out the
> below snippit from netstat. I've tried connecting to
> the 6667 port with
> MiRC.. Nothing at all! 

Did you try telnet or netcat?  

> On this note, can anyone recommend
> a good forensics
> toolkit for Windows to be used on compromised
> machines?

Are you looking for an incident response toolkit?  Or
do you want forensics?  Making an image w/ SafeBack is
a good idea, then copy that image or make another w/
EnCase, if you want to do full forensics.  However, if
you just want to collect volatile data from the
system, plus get some other things, send me an email
and I'll compile a list of tools and procedures...I
don't want to inundate the list w/ info that no one
else wants.



__________________________________________________
Do You Yahoo!?
Check out Yahoo! Shopping and Yahoo! Auctions for all of
your unique holiday gifts! Buy at http://shopping.yahoo.com
or bid at http://auctions.yahoo.com

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com