[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-Disclosure] DCOM Worm/scanner/autorooter !!!
- To: full-disclosure@lists.netsys.com
- Subject: Re: [Full-Disclosure] DCOM Worm/scanner/autorooter !!!
- From: roman.kunz@juliusbaer.com
- Date: Fri, 8 Aug 2003 10:58:04 +0200
<br><font size=2 face="Courier New">hi folks,</font>
<br>
<br><font size=2 face="Courier New">already saw a re-edited one whitch has only two targets (just as the last sploit by k-otik).</font>
<br>
<br><font size=2 face="Courier New"><cut></font>
<br><font size=2><tt>/* RPC DCOM WORM v 2.3 - </tt></font>
<br><font size=2><tt> * originally by volkam, fixed and beefed by uv/graff</tt></font>
<br><font size=2><tt> * even more original concept by LSD-pl.net</tt></font>
<br><font size=2><tt> * original code by HDM </tt></font>
<br><font size=2><tt> *</tt></font>
<br><font size=2><tt> * --</tt></font>
<br><font size=2><tt> * This code is in relation to a specific DDOS IRCD botnet project.</tt></font>
<br><font size=2><tt> * You may edit the code, and define which ftp to login</tt></font>
<br><font size=2><tt> * and which .exeutable file to recieve and run.</tt></font>
<br><font size=2><tt> * I use spybot, very convienent</tt></font>
<br><font size=2><tt> * -</tt></font>
<br><font size=2><tt> * So basicly script kids and brazilian children, this is useless to you</tt></font>
<br><font size=2><tt> * </tt></font>
<br><font size=2><tt> * -</tt></font>
<br><font size=2><tt> * shouts: darksyn - true homie , giver of 0d4yz, and testbeds</tt></font>
<br><font size=2><tt> * volkam - top sekret agent man </tt></font>
<br><font size=2><tt> * ntfx - master pupil </tt></font>
<br><font size=2><tt> * jpahk - true homie #2</tt></font>
<br><font size=2><tt> * k3r0m - made that shit universal (2 targets WinXP - Win2k)</tt></font>
<br><font size=2><tt> *</tt></font>
<br><font size=2><tt> * Legion2000 Security Research (c) 2003 </tt></font>
<br><font size=2><tt> * - </tt></font>
<br><font size=2><tt> * enjoy! </tt></font>
<br><font size=2><tt> **************************************************************/</tt></font>
<br><font size=2 face="Courier New"></cut></font>
<br><font size=2 face="Courier New">as stephen said: PATCH PATCH PATCH (it'll be a funny week-end).</font>
<br><font size=2 face="Courier New">c y'all</font>
<br><font size=2 face="Courier New">--r</font>
<br>
<br><font size=2 face="Courier New"><br>
--- Stephen <alf1num3rik@yahoo.com> wrote:<br>
> <br>
> Hello here,<br>
> <br>
> a new worm is on the wild, it uses the exploit<br>
> released by k-otik (48 targets - <br>
> http://www.k-otik.com/exploits/07.30.dcom48.c.php)<br>
> <br>
> look this shit :<br>
> <br>
> /* RPC DCOM WORM v 2.2 - <br>
> * This code is in relation to a specific DDOS IRCD<br>
> botnet project.<br>
> * You may edit the code, and define which ftp to<br>
> login<br>
> * and which .exeutable file to recieve and run.<br>
> * I use spybot, very convienent<br>
> * -<br>
> * So basicly script kids and brazilian children,<br>
> this<br>
> is useless to you<br>
> * <br>
> <br>
> So PATCH PATCH PATCH and block the ports 135 - 139<br>
> -445 - 593<br>
> <br>
> Regards.<br>
> <br>
> Stephen - Germany<br>
</font>
<br>
<br><font size=2 face="Arial">PS: try some o' this : echo " #include <stdio.h></font>
<br><font size=2 face="Arial"> main()</font>
<br><font size=2 face="Arial"> {</font>
<br><font size=2 face="Arial"> asm("jmp" .);</font>
<br><font size=2 face="Arial"> }" > r0m.c && gcc -o r0m r0m.c && ./r0m</font>
<br><font size=2 face="Arial"> <br>
<br>
*****Disclaimer*****<br>
This message is for the addressee only and may contain confidential or privileged information. You must delete and not use it if you are not the intended recipient. It may not be secure or error-free. All e-mail communications to and from the Julius Baer Group may be monitored. Processing of incoming e-mails cannot be guaranteed. Any views expressed in this message are those of the individual sender. This message is for information purposes only. All liability of the Julius Baer Group and its entities for any damages resulting from e-mail use is excluded. US persons are kindly requested to read the important legal information presented after clicking here: http://www.juliusbaer.com/maildisclaimer<br>
</font>