[Full-Disclosure] DCOM RPC exploit (dcom.c)
neeko at haackey.com
Sun Jul 27 02:19:55 BST 2003
1) It's a one-shot attack. Pick the wrong SP, no go. Whatever worm comes of
this will be limited by this fact.
2) It'll be another week before most of these "kiddies" figure out how to
compile any exploit released. "ware is erreer.h!!!" etc.
3) Two weeks.. if that's not long enough to patch up, you can't really blame
the exploit writer(s).
4) I don't like guns. People kill people with guns. Do I blame the murderers
for pulling the trigger or do I blame the gun producers for making the gun?
Hint: This is different than "Should people make guns or not?"
5) NAT'ing incoming requests to other hosts.. nice. First off, NAT was the
wrong choice of buzzword. Next, do you really want it looking like you're
attempting to exploit either of those sites? Furthermore.. what's the point?
Are you trying to DoS those hosts? Nice. Whine about the actions of others
while participating in a DoS attack. Good job. You must be a mental giant.
I can tell you're one of those guys who spent the night at your colo trying to
patch SQL while Slammer hit.
> I'd just like to thank FlashSky, Benjurry, and H D Moore for releasing this
> code. Really guys, sterling job. Now the skript kiddies and VXers have got
> virtually no work to do in order to write a worm that exploits this.
> Personally, I'm tempted to set up my firewall to NAT incoming requests on port
> 135 to either www.metasploit.com or www.xfocus.org. I know this is the
> full-disclosure list, but working exploit code for an issue this huge is taking
> it a bit far, especially less than 2 weeks after the advisory comes out.
> Cheers, fellas. When the worm comes out, I'll be thinking of you.
Full-Disclosure is hosted and sponsored by Secunia.