Full Disclosure mailing list archives
Remote Rootkit Scanner for Windows
From: Andres Tarasco <atarasco () sia es>
Date: Tue, 19 Oct 2004 13:12:35 +0200
Hacker defender is a rootkit that is being highly deployed by Hackers in compromised box in the last months. Due to a design Flaw its possible to remotely detect if an NT based computer is "infected" with this rootkit. Rkdscan was developed to check for this flaw, performing a network scan and after sending some data to open ports is able to detect if the remote box have been compromised. Usage: C:\rkdscan>rkdscan.exe xx.yy.0.0 xx.yy.10.0 Remote hxdef Scanner $Revision: 1.0 $ atarasco_@_sia.es http://www.siainternational.com [+] Targets: xx.yy.0.0-xx.yy.10.0 with 150 Threads + xx.yy.0.1 + xx.yy.1.1 Checking xx.yy.1.5 port: 3389... Checking xx.yy.1.17 port: 3389... Checking xx.yy.1.17 port: 21... Checking xx.yy.1.30 port: 3389... Checking xx.yy.1.7 port: 21... Checking xx.yy.1.20 port: 21... Checking xx.yy.1.22 port: 1025... [+] IP: xx.yy.1.22 port: 1025 INFECTED with HACKER Defender v0.84 - v1.0.0 Checking xx.yy.1.66 port: 1025... Checking xx.yy.1.25 port: 21... [+] IP: xx.yy.1.66 port: 1025 INFECTED with HACKER Defender v0.84 - v1.0.0 Checking xx.yy.1.65 port: 3389... Checking xx.yy.1.47 port: 3389... Checking xx.yy.1.52 port: 7... [+] IP: xx.yy.1.52 port: 7 INFECTED with HACKER DEFENDER v0.82 - 0.83 Checking xx.yy.1.90 port: 3389... Checking xx.yy.1.101 port: 3389... Checking xx.yy.1.96 port: 3389... Checking xx.yy.1.97 port: 3389... Checking xx.yy.1.94 port: 7... Checking xx.yy.1.94 port: 80... [+] IP: xx.yy.1.94 port: 80 INFECTED with HACKER Defender v0.84 - v1.0.0 Checking xx.yy.1.109 port: 3389... Checking xx.yy.1.98 port: 3389... Checking xx.yy.1.21 port: 25... Checking xx.yy.1.116 port: 21... attached in this e-mail is a zip file with both source and binary files rkdscan.c md5sum: a24c0d9f35ccaa07efa8a291476a8a4d rkdscan.exe md5sum: 229fd4a1df6d76c799c9b059519f204a (compiled with Bc++ Builder) rkdscan.zip md5sum: bb653a41e757b9762070bcd1ec082e5e Special Thanks for Javier Olascoaga ( jolascoaga[at]sia.es ) for the development of a nasl/nessus script. Andrés Tarascó Acuña Security Consultant - Tiger Team Departamento de Consultoría Grupo SIA Avenida de Europa Nº 2. Alcor Plaza Edificio B. Parque Oeste Alcorcon. 28.922. Madrid *Tel.: +34 902 480 580 * Fax: +34 91 307 79 80 atarasco_@_sia.es <www.sia.es> <<rkdscan.zip>> <<hacker_defender.nasl>>
Attachment:
rkdscan.zip
Description:
Attachment:
hacker_defender.nasl
Description:
Current thread:
- Remote Rootkit Scanner for Windows Andres Tarasco (Oct 19)