#ASP WORML LENGTH PASSWORD#
When there is a one-byte password "suggested", the host will check only the first byte of the password. The worm programmatically "suggests" a password field with only one character length to the victim host. For a detailed description of this exploit please click the following page: To get passwords needed to gain access to victim machines, the worm uses the security breach "share level password exploit". The second file, WIN.INI, results in Opasoft gaining control of the victim computer upon system restart. \WINDOWS\win.ini - A Windows INI file which contains the auto-run command To receive the packets from the remote computer two files appear on the victim machine: \WINDOWS\scrsvr.exe - a copy of the Opasoft worm
#ASP WORML LENGTH .EXE#
if connection is successful, Opasoft transmits its EXE file - during transmission the full name of the destination file containing the code (exe file) is revealed: WINDOWS\scrsvr.exe.if the resource is password-protected the worm runs through all possible "one symbol" passwords - conducting a "brute-force" attack.sets a connection with the \\hostname\C resource, where "hostname" = the name of the victim computer which is defined when the victim computer answers Opasoft (by sending its "reply data") during the scan.If it shows that the given computer has the service "File and Print Sharing" open, Opasoft begins its infection procedure on that computer as a remote host.ĭuring infection, Opasoft sends, via port 139 (NETBIOS Session Service) special SMB - packets that transmit the following commands: When "reply data" is received, Opasoft checks the special field that it contains. If while searching (scanning) Opasoft happens upon a responding IP address (of an actual computer), the worm then scans the two nearest subnets of that IP address. * selects subnets randomly (excluding those where scanning is disabled) * the two nearest subnets of the currently infected computer
* current subnet of the infected computer (aa.bb.cc ?) IP addresses of the following networks are scanned: In order to find victim computers Opasoft scans subnets for port 137 (NETBIOS Name Service). Opasoft then deletes its original file (from where it was started). The worm installs itself to the Windows directory with the name "scrsvr.exe" and registers this file in the system registry's auto-run key: HKLM\Software\Microsoft\Windows\CurrentVersion\Run
0 kommentar(er)
