Full Disclosure mailing list archives
How to massively remove DCOM RPC Worms
From: B3r3n <B3r3n () argosnet com>
Date: Sat, 30 Aug 2003 00:30:08 +0200
Hi Gentlemen,Following the article http://www.securityfocus.com/archive/119/333927, I applied this principle on our IntraNet.
I used the oc192-dcom proof of concept code from securityfocus too.I create a ms.bat script placed into the startup group (c:\documents and setting\all users\...\startup)
This scripts downloads via TFTP - stinger to remove active worms (else there are issues patching) - MS03-026 to the associate OS (Win2K or XP)On XP machine the reboot is automatic when you kill the exploit (I did not searched yet how to reboot on Win2K)
Result: after the reboot, the ms.bat script is launched, it cleans the box and install the patch. Then it deletes itself and associated files.
Again, on XP, installing the patch generate XP reboots automatically. The only problem is patch requires user action to approve. Maybe there is a version more silent.This trick has been included into a scanning program running on a FreeBSD 4.8 and so this simple trick permits to patch hundreds of machines.
Might be useful to others Brgrds Laurent LEVIER IT Systems & Networks Security Expert _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- How to massively remove DCOM RPC Worms B3r3n (Aug 29)