Full Disclosure mailing list archives
RE: DDoS on the 16th - Fail if no DNS resolution?
From: Nick FitzGerald <nick () virus-l demon co uk>
Date: Thu, 14 Aug 2003 17:40:04 +1200
"Chris Eagle" <cseagle () redshift com> wrote:
Yes I have looked at the code, no it doesn't exit. It simply directs the SYN packet at 255.255.255.255, i.e. it ignores the fact that the lookup failed and returned -1 and uses -1 as the destination IP.
Hmmmmm -- that's odd... The MSDN/SDK dox for gethostbyname says this about return values: If no error occurs, gethostbyname returns a pointer to the HOSTENT structure described above. Otherwise, it returns a NULL pointer and a specific error number can be retrieved by calling WSAGetLastError. And in my disasm the worm writer seems to have taken this into account: .text:00401EA4 call gethostbyname .text:00401EA9 mov esi, eax .text:00401EAB or esi, esi .text:00401EAD jnz short loc_401EB4 .text:00401EAF or eax, 0FFFFFFFFh .text:00401EB2 jmp short loc_401EBD .text:00401EB4 loc_401EB4: .text:00401EB4 mov eax, [esi+0Ch] .text:00401EB7 mov eax, [eax] .text:00401EB9 mov edi, [eax] .text:00401EBB .text:00401EBB loc_401EBB: .text:00401EBB mov eax, edi .text:00401EBD .text:00401EBD loc_401EBD: .text:00401EBD pop edi .text:00401EBE pop esi .text:00401EBF pop ebp .text:00401EC0 retn ...by testing for a null return and OR'ing FFFFFFFFh with EAX if it was null. Thus it is the worm's checking and post-processing of the gethostbyname result that returns "-1" (or the equivalent of 255.255.255.255) from the "get DoS victim IP" sub-routine. -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854 _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- DDoS on the 16th - Fail if no DNS resolution? Jason Witty (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? gml (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Nick FitzGerald (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)
- Re: DDoS on the 16th - Fail if no DNS resolution? Darren Reed (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Chris Eagle (Aug 13)
- RE: DDoS on the 16th - Fail if no DNS resolution? Derek Soeder (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? Laurent LEVIER (Aug 14)
- <Possible follow-ups>
- RE: DDoS on the 16th - Fail if no DNS resolution? Keith Pachulski (Aug 14)
- Re: DDoS on the 16th - Fail if no DNS resolution? northern snowfall (Aug 13)