<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:p="urn:schemas-microsoft-com:office:powerpoint" xmlns:a="urn:schemas-microsoft-com:office:access" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:s="uuid:BDC6E3F0-6DA3-11d1-A2A3-00AA00C14882" xmlns:rs="urn:schemas-microsoft-com:rowset" xmlns:z="#RowsetSchema" xmlns:b="urn:schemas-microsoft-com:office:publisher" xmlns:ss="urn:schemas-microsoft-com:office:spreadsheet" xmlns:c="urn:schemas-microsoft-com:office:component:spreadsheet" xmlns:oa="urn:schemas-microsoft-com:office:activation" xmlns:html="http://www.w3.org/TR/REC-html40" xmlns:q="http://schemas.xmlsoap.org/soap/envelope/" xmlns:D="DAV:" xmlns:x2="http://schemas.microsoft.com/office/excel/2003/xml" xmlns:ois="http://schemas.microsoft.com/sharepoint/soap/ois/" xmlns:dir="http://schemas.microsoft.com/sharepoint/soap/directory/" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:dsp="http://schemas.microsoft.com/sharepoint/dsp" xmlns:udc="http://schemas.microsoft.com/data/udc" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:sps="http://schemas.microsoft.com/sharepoint/soap/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:udcxf="http://schemas.microsoft.com/data/udc/xmlfile" xmlns:wf="http://schemas.microsoft.com/sharepoint/soap/workflow/" xmlns:mver="http://schemas.openxmlformats.org/markup-compatibility/2006" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns:mrels="http://schemas.openxmlformats.org/package/2006/relationships" xmlns:ex12t="http://schemas.microsoft.com/exchange/services/2006/types" xmlns:ex12m="http://schemas.microsoft.com/exchange/services/2006/messages" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 12 (filtered medium)">
<style>
<!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.gmailquote
{mso-style-name:gmail_quote;}
span.e
{mso-style-name:e;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.Section1
{page:Section1;}
-->
</style>
<!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang=EN-US link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal>>Stand there and risk come confidential data being
compromised!<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>Yes. Stand there. Monitor traffic. Do nothing to stop or
impede. The moment you change ANYTHING you immediately start losing evidence.<o:p></o:p></p>
<p class=MsoNormal>Right now there is an IF involved. If I reacted to every
strange service I found running on the manifold networks I’ve audited…
You monitor, go to the machine in question and investigate the service running
that is servicing that port. If it is hacked, it is up to the customer to call
upon their Emergency Response Plan.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>I have found a service running on a Win2k3 server that the
admin wanted me to just simply clean it off. I advised against it. They agreed
and I gathered information about the intrusion (doing nothing to clean it off)
and found that it was just the tip of the iceberg, that the server had acted as
a gateway to the infection of six servers on their network, each with a different
piece of the hack and info gathering done on each server. On a separate server,
I saw where they used IPv4toIPv6 mapping tool to redirect an IPv4 to IPv4 port
mapping, so windows remote desktop admin could be accessed using port 443. The
simple removing of the initial infection would have left the rest of the breach
unnoticed. This hack also included setting up windows task
scheduler to request updates from a list of domains, to re-establish hacker
access should we cut them off.. which we did. They were good, damn good.<o:p></o:p></p>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal>-joel<span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p></o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";
color:#1F497D'><o:p> </o:p></span></p>
<div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'>
<p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span
style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Fabrizio
[mailto:staticrez@gmail.com] <br>
<b>Sent:</b> Friday, September 28, 2007 1:42 PM<br>
<b>To:</b> Joel R. Helgeson<br>
<b>Subject:</b> Re: [Full-disclosure] .NET REMOTING on port 31337<o:p></o:p></span></p>
</div>
<p class=MsoNormal><o:p> </o:p></p>
<p class=MsoNormal style='margin-bottom:12.0pt'>Yeah! Stand there and risk come
confidential data being compromised! Monitor and Capture them stealing our
customer info! Then try and get it back!<br>
<br>
Come on man. It's a pen-test, and there are NDA's in order. Don't take the
chance. <br>
<br>
Fabrizio<o:p></o:p></p>
<div>
<p class=MsoNormal><span class=gmailquote>On 9/28/07, <b>Joel R. Helgeson</b>
<<a href="mailto:joel@helgeson.com">joel@helgeson.com</a>> wrote:</span><o:p></o:p></p>
<div>
<div>
<p><span style='font-size:11.0pt;color:#1F497D'>I disagree, don't block access
to the port. Monitor and capture it.</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'>Joel's First rule of forensics:
Don't just do something, stand there!</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'>Watch it, monitor it. If it is
a crafty backdoor, there are dozens of others to enable bad guys to regain
entry.</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'>Blocking lets the hacker know
you might be on to them. IF it is legit, then it could cause a problem.</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'>Telnet to the port, see what it
says on connection; run fport or sysinternals utilities on the box to see the
stack the program uses.</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'>-joel</span><o:p></o:p></p>
<p><span style='font-size:11.0pt;color:#1F497D'> </span><o:p></o:p></p>
<div style='border:none;border-top:solid windowtext 1.0pt;padding:3.0pt 0in 0in 0in;
border-color:-moz-use-text-color -moz-use-text-color'>
<p><b><span style='font-size:10.0pt'>From:</span></b><span style='font-size:
10.0pt'> <a href="mailto:full-disclosure-bounces@lists.grok.org.uk"
target="_blank">full-disclosure-bounces@lists.grok.org.uk </a>[mailto:<a
href="mailto:full-disclosure-bounces@lists.grok.org.uk" target="_blank">full-disclosure-bounces@lists.grok.org.uk</a>]
<b>On Behalf Of </b>Fabrizio<br>
<b>Sent:</b> Friday, September 28, 2007 1:31 PM<br>
<b>To:</b> Full-Disclosure<br>
<b>Subject:</b> Re: [Full-disclosure] .NET REMOTING on port 31337</span><o:p></o:p></p>
</div>
<div>
<p> <o:p></o:p></p>
<p style='margin-bottom:12.0pt'>If you think it's that critical, (i think it's
that critical) start by blocking any connections from anywhere to that machine/port.
See if anyone complains. Check any old firewall logs for that port while you're
at it. Then continue your investigation!! <br>
<br>
Fabrizio<o:p></o:p></p>
<div>
<p>On 9/28/07, <b>Simon Smith</b> <<a href="mailto:simon@snosoft.com"
target="_blank">simon@snosoft.com</a>> wrote:<o:p></o:p></p>
<p>-----BEGIN PGP SIGNED MESSAGE-----<br>
Hash: SHA1<br>
<br>
Got output... and it was... no idea what it was... can't paste it due to<br>
confidentiality though.<br>
<br>
Fabrizio wrote:<br>
> .NET Remoting is "a generic system for different applications to use
to <br>
> communicate with one another." It's part of the .NET framework,<br>
> obviously. (not trying to be a smart ass)<br>
><br>
> I'm gonna take a wild guess and say it's not a good thing......<br>
><br>
> Connect to it, and see if you get any output, if you haven't already<br>
> done so.<br>
><br>
> Fabrizio<br>
><br>
><br>
><br>
> On 9/28/07, * Simon Smith* <<a href="mailto:simon@snosoft.com"
target="_blank"> simon@snosoft.com</a><br>
> <mailto:<a href="mailto:simon@snosoft.com" target="_blank">simon@snosoft.com</a>>>
wrote:<br>
><br>
><br>
> Has anyone ever heard of .NET REMOTING running on port 31337? If so,<br>
> have you ever seen it "legitimate"? <br>
><br>
><br>
<br>
_______________________________________________<br>
Full-Disclosure - We believe in it.<br>
Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html"
target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html </a><br>
<<a href="http://lists.grok.org.uk/full-disclosure-charter.html"
target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a>><br>
Hosted and sponsored by Secunia - <a href="http://secunia.com/" target="_blank">http://secunia.com/
</a><br>
<br>
<br>
<br>
> ------------------------------------------------------------------------<br>
<br>
> _______________________________________________<br>
> Full-Disclosure - We believe in it.<br>
> Charter: <a href="http://lists.grok.org.uk/full-disclosure-charter.html"
target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>
> Hosted and sponsored by Secunia - <a href="http://secunia.com/"
target="_blank">http://secunia.com/</a><br>
<br>
<br>
- --<br>
<br>
- - simon<br>
<br>
- ----------------------<br>
<a href="http://www.snosoft.com" target="_blank">http://www.snosoft.com</a><br>
<br>
-----BEGIN PGP SIGNATURE-----<br>
Version: GnuPG v1.4.5 (Darwin)<br>
<br>
iD8DBQFG/UY+f3Elv1PhzXgRAs/BAJ42Vwk5+cvWfoYo4wUl74LDnUtz7wCgzW9s<br>
O/+SDoZYgZ1r1oDjKpKzZIo= <br>
=n54j<br>
-----END PGP SIGNATURE-----<o:p></o:p></p>
</div>
<p> <o:p></o:p></p>
</div>
</div>
</div>
</div>
<p class=MsoNormal><o:p> </o:p></p>
</div>
</body>
</html>