Catching "Sasser" in a Network

05.05.2004, 10:11

Beiträge: 1095
#1 Hi,
ich hab das aus der full-disclosure MailingListe
Kanns leider nicht ausprobieren
Vielleicht hilfts aber jemand anderem ;)


For people who did have not the priviledge of getting
infected with sasser ;) because of firewall/AV/patch or they are smart
enough to use Linux (like me.... hey now no flame war on this *please*),
here is a simple way to catch sasser:

Step 1:Scanning for infected machines (from a Linux box):
Get doscan from:

compile n run:
# doscan -A 50 -b 512 -c 100 -i -p 5554 -P tcp -r "200
OK$" -v <IP

This will give you list of infected machines.

Step Two: Getting the virus
Copy the following set of commands into a file (or type them
from ftp
open <infected m/c IP> 5554
get 7584_up.exe
then from cmd prompt of your *windows* machine, run:

c:\>ftp -s:ftp_commands

This will fetch you a copy of the virus as 7584_up.exe.
The ftp_commands, actually logs into the ftp server of
sasser on port 5554 of the infected machine with username
"anonymous" and password "user", and then issues a PORT command to download the virus.

Shashank Rai
Network and Information Security Team,
Emirates Telecommunication Corporation,
Gruß paff
__________ Reverse Engineering Malware
Dieser Beitrag wurde am 05.05.2004 um 10:12 Uhr von paff editiert.
Seitenanfang Seitenende
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!

Folgende Themen könnten Dich auch interessieren: