RE: [Full-Disclosure] RE: Full-Disclosure digest, Catching Sasser

["Shashank Rai" <shash@xxxxxxxxxxxxxxx>]

The number can vary from 1 to 32767. Furthermore, the way sasser ftp is 
implememented it really doesn't care what file name you provide as argument 
to the GET request. It just sends you a copy of the virus. Am sure the manual u 
r referring to read, mentions all this ;) 
The number in my script was an illustration. And may be the manual also 
mentioned that though you may get TCP SYN packets on port 445 you will not 
necessarily get the virus. Sasser first tries to determine the remote host OS 
type. If it windows 2000 or XP then only it attempts infection selecting the 
return address for the overflow. So starting a netcat listener on port 445 is 
not going to guaranty a copy of sasser.

But i'm sure THE MANUAL has it all ;)

cheers,
shashank

-----Original Message-----
From:   full-disclosure-admin@xxxxxxxxxxxxxxxx on behalf of Thomas Springer
Sent:   Wed 05-May-04 16:12
To:     full-disclosure@xxxxxxxxxxxxxxxx
Cc:     
Subject:        Re: [Full-Disclosure] RE: Full-Disclosure digest, Catching 
Sasser
RTFM - the 4digit-number mentioned is random. maybe it'll help to 
expand your script to try 9999 combinations or scan 10.000 infected 
hosts. It shouldn't be much of a problem to find them - we still 
experience >50 different sasser-ips per second hammering our firewall.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html