Full Disclosure mailing list archives
RE: W32/Welchia, W32/Nachi backdoor?
From: "Chris Eagle" <cseagle () redshift com>
Date: Wed, 20 Aug 2003 10:14:10 -0700
creates a backdoor listening on TCP/707 or some other randomly chosen port
between TCP/666 and >TCP/765 [2] There is a slim chance that the listener may fall outside this range, but it will generally be a random port in the range 666-765. Don't count on 707.
Telnetting to this port seems to disconnected after 1-5 characters have
been entered? This doesn't look like TFTP (port 65/tcp&UDP), and the windows tftp client doesn't seem to offer any means of specifying a port to connect to?
Is this some kind of password protected backdoor ?
No, it is not a command shell back door. It is the connect back point for the exploit payload. When an incoming connection is received, it checks for the string "Microsoft Windows" in the first packet it receives, then waits for the string "system32>" It then does a directory listing on the exploited machine to see if Nachi is already installed there and if so it simply closes the socket. If not, it pushes itself (Nachi) to the newly exploited machine, then launches Nachi on the remote machine and closes the socket. Chris _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- W32/Welchia, W32/Nachi backdoor? Barry Irwin (Aug 20)
- RE: W32/Welchia, W32/Nachi backdoor? Chris Eagle (Aug 20)
- Re: W32/Welchia, W32/Nachi backdoor? Michael Mueller (Aug 20)