RE: [Full-Disclosure] W32/Welchia, W32/Nachi backdoor?

["Chris Eagle" <cseagle@redshift.com>]

>>creates a backdoor listening on TCP/707 or some other randomly chosen port
between TCP/666 and >TCP/765 [2]

There is a slim chance that the listener may fall outside this range, but it
will generally be a random port in the range 666-765.  Don't count on 707.

>Telnetting to this port seems to disconnected after 1-5 characters have
been
entered?  This doesn't look like TFTP (port 65/tcp&UDP), and the windows
tftp client doesn't seem to offer any means of specifying a port to connect
to?

>Is this some kind of password protected backdoor ?

No, it is not a command shell back door.  It is the connect back point for
the exploit payload.  When an incoming connection is received, it checks for
the string "Microsoft Windows" in the first packet it receives, then waits
for the string "system32>" It then does a directory listing on the exploited
machine to see if Nachi is already installed there and if so it simply
closes the socket.  If not, it pushes itself (Nachi) to the newly exploited
machine, then launches Nachi on the remote machine and closes the socket.

Chris

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html