Full Disclosure mailing list archives
Re: DCOM RPC exploit (dcom.c)
From: Neeko Oni <neeko () haackey com>
Date: Sat, 26 Jul 2003 18:19:55 -0700 (PDT)
1) It's a one-shot attack. Pick the wrong SP, no go. Whatever worm comes of this will be limited by this fact. 2) It'll be another week before most of these "kiddies" figure out how to compile any exploit released. "ware is erreer.h!!!" etc. 3) Two weeks.. if that's not long enough to patch up, you can't really blame the exploit writer(s). 4) I don't like guns. People kill people with guns. Do I blame the murderers for pulling the trigger or do I blame the gun producers for making the gun? Hint: This is different than "Should people make guns or not?" 5) NAT'ing incoming requests to other hosts.. nice. First off, NAT was the wrong choice of buzzword. Next, do you really want it looking like you're attempting to exploit either of those sites? Furthermore.. what's the point? Are you trying to DoS those hosts? Nice. Whine about the actions of others while participating in a DoS attack. Good job. You must be a mental giant. I can tell you're one of those guys who spent the night at your colo trying to patch SQL while Slammer hit. .Neek
<sarcasm> I'd just like to thank FlashSky, Benjurry, and H D Moore for releasing this code. Really guys, sterling job. Now the skript kiddies and VXers have got virtually no work to do in order to write a worm that exploits this. </sarcasm> Personally, I'm tempted to set up my firewall to NAT incoming requests on port 135 to either www.metasploit.com or www.xfocus.org. I know this is the full-disclosure list, but working exploit code for an issue this huge is taking it a bit far, especially less than 2 weeks after the advisory comes out. Cheers, fellas. When the worm comes out, I'll be thinking of you. Chris
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Re: DCOM RPC exploit (dcom.c), (continued)
- Re: DCOM RPC exploit (dcom.c) Paul Schmehl (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Ron DuFresne (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Jason (Jul 28)
- Re: DCOM RPC exploit (dcom.c) Robert Wesley McGrew (Jul 28)
- Re: DCOM RPC exploit (dcom.c) Robert Wesley McGrew (Jul 28)
- Re: DCOM RPC exploit (dcom.c) Ron DuFresne (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Paul Schmehl (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Knud Erik Højgaard (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Paul Schmehl (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Nathan Seven (Jul 27)
- Re: DCOM RPC exploit (dcom.c) security snot (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Blue Boar (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Chris Paget (Jul 27)
- Re: DCOM RPC exploit (dcom.c) Valdis . Kletnieks (Jul 27)
- Re: DCOM RPC exploit (dcom.c) w g (Jul 27)
- Re: DCOM RPC exploit w g (Jul 26)