Recently, as almost every big loophole has been announced, there will be a worm (worm) epidemic against this vulnerability, and the recent nasty RPC DCOM vulnerability estimate is about to become a new vector for worm transmission. As if writing worm is a hot, many people also feel curious, think worm is a very deep technology, in fact, this is a very simple programming game. I've always had an idea to write a technical analysis of worm (---in order not to teach bad kids:, just have been lazy to write, I have lost interest in the preparation of worms, now in the new worm storm is coming, I am here a simple analysis of the worm related technology, and RPC DCOM Worm to make some assumptions. Everyone when I am to help "Zhou" for abuse, or deliberately show off, I think still want to write this article, more than a year has not written articles, but also had a wish of their own. You can now choose not to look down, but don't spit on me after you finish. :)
What is called a worm
First from Spark's "Internet worm definition and history" article excerpt Huanhuan 趙 orm Explanation: Worms This biological term in 1982 by Xerox PARC John F. Shoch and other people to introduce the computer field [30], and gives the two most basic features of the computer worm: "You can move from one computer to another" and "Copy yourself." Their purpose in compiling the worms is to do a model test of distributed computing, in which the destructive and difficult control of the worm has begun to reveal itself. After the outbreak of the Morris Worm in 1988, Eugene H. Spafford, in order to distinguish between worms and viruses, gave a technical definition of the worm, "the computer worm can run independently and can propagate a version of itself that contains all the features to another computer." "(Worm is-a program, can run by itself and can propagate a fully working version of itself to other machines. ）。
Since this is not to introduce the definition and history of worms is not much to say, if you are interested in these, you can read Spark's article here http://www.nsfocus.net/index.php?act=magazine&;; do=view&mid=1851
Part of the two worms
The composition of a worm is actually very simple, because I am not here to teach you to write worms, but also due to time constraints, I here simply say some.
We can think of it as a project, and we divide the project into 4 modules:
1. Attack module
First you need to have a large number of systems affected by a serious vulnerability can be easily exploited to be able to remotely control the machine. such as guessing weak password, remote overflow ah, and so on.
2. Infection Module
Consider how to get the other person attacked, perform the function you want to achieve, and complete an infection with a host. For the remote overflow is also perfect shellcode. This should be considered in the middle of an infection spread (propagation) pathway.
3. Communication module
For example, scan a network segment has related weaknesses of the machine, save as a file, and then attack the IP, or randomly generate IP and then attack the IP.
The simple thing is to scan a weak machine.
4. Function module
Functional module is actually a can not be a module, but if you want the other infected worm after the other side plus back door/ddos and other functions, you must have this.
In fact, the key to a worm's success is an attack module and an infection module. :)
The propagation (propagation) of three common worms
The specific is not in-depth, only a simple list:
1. Email
2. FTP
3. http
4. NetBIOS
5. TFTP
6. rcp
7. Other
Introduction to four RPC DCOM vulnerabilities
The RPC DCOM vulnerability is a serious vulnerability in a recent Windows system and the most widely affected Windows vulnerability in history.
Remote Procedure Call (RPC) is a protocol that is applied to the Windows operating system. RPC provides a mutual processing communication mechanism that allows the computer running the program to execute code on a remote system. The RPC protocol itself originated from the OSF (Open Software Foundation) RPC protocol, and later added some additional Microsoft private extension features. module handling TCP/IP information exchange in RPC because of malformed handling of malformed information, remote attackers can use this flaw to execute arbitrary instructions on the system with local System privileges. This flaw affects the use of RPC's DCOM interface, which justifies the DCOM object activation request (such as a UNC path) that the client machine sends to the server. An attacker who successfully exploited this flaw could execute arbitrary instructions with local System privileges. An attacker can perform arbitrary actions on the system, such as installing a program, viewing or changing, deleting data, or establishing an account with system administrator privileges.
This vulnerability affects the following versions of Windows:
Microsoft Windows XP SP1a
Microsoft Windows XP SP1
Microsoft Windows XP
Microsoft Windows NT 4.0sp6a
Microsoft Windows NT 4.0SP6
Microsoft Windows NT 4.0SP5
Microsoft Windows NT 4.0SP4
Microsoft Windows NT 4.0SP3
Microsoft Windows NT 4.0sp2
Microsoft Windows NT 4.0sp1
Microsoft Windows NT 4.0
Microsoft Windows 2003
Microsoft Windows 2000SP4
Microsoft Windows 2000SP3
Microsoft Windows 2000SP2
Microsoft Windows 2000SP1
Microsoft Windows 2000
As you can see, this vulnerability affects all other Windows systems except WinME the following version of the Windows system. At the same time, this vulnerability could be exploited remotely by attackers,
Arbitrary code can be executed remotely on a machine that does not fix the vulnerability, causing the attacker to have complete control over the vulnerable machine.
The assumption of the five RPC DCOM worms
1. The vulnerability is more likely to be exploited as a worm capable of infecting win2000/winxp machines that have RPC DCOM vulnerabilities because RPC COM already has a common attack code that attacks Win2000/winxp.
such as the Packetstorm on the Win2000 and WinXP General exploit:
/* Windows 2003 <= remote RPC DCOM exploit
* Coded by.: [Oc192.us]:. Security
*
* Features:
*
*-D destination host to attack.
*
*-P for port selection as exploit in ports other than 135 (139,445,539 etc)
*
*-R for the using a custom return address.
*
*-T to select target type (Offset), this includes universal offsets for-
* Win2K and WinXP (Regardless of Service pack)
*
*-L to select Bindshell port on remote machine (default:666)
*
*-Shellcode has been modified to call ExitThread, rather than, exitprocess
* Preventing crash of RPC service on remote machine.
*
* This is provided as proof-of-concept code only for educational
* Purposes and testing by authorized individuals with permission to
* Doing so.
*/
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.
