[Full-Disclosure] How to massively remove DCOM RPC Worms

[B3r3n <B3r3n@argosnet.com>]

Hi Gentlemen,

Following the article http://www.securityfocus.com/archive/119/333927, I 
applied this principle on our IntraNet.

I used the oc192-dcom proof of concept code from securityfocus too.

I create a ms.bat script placed into the startup group (c:\documents and 
setting\all users\...\startup)

This scripts downloads via TFTP
         - stinger to remove active worms (else there are issues patching)
         - MS03-026 to the associate OS (Win2K or XP)

On XP machine the reboot is automatic when you kill the exploit (I did not 
searched yet how to reboot on Win2K)

Result: after the reboot, the ms.bat script is launched, it cleans the box 
and install the patch. Then it deletes itself and associated files.
Again, on XP, installing the patch generate XP reboots automatically.
The only problem is patch requires user action to approve.
Maybe there is a version more silent.

This trick has been included into a scanning program running on a FreeBSD 
4.8 and so this simple trick permits to patch hundreds of machines.

Might be useful to others

Brgrds

Laurent LEVIER
IT Systems & Networks Security Expert



_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html