______________________________________________________________________ NtWaK0@SecurHack.com Bug / Security / Advisory 21,November, 2000 Killing NT 4.0 (HOT FIXES or NO / SP6a) Remotely using SynAttackProtect Key Corrected version and solution FOUND :) ______________________________________________________________________ /// * Vulnerable Systems * \\\ Windows NT 4.0 SP6a + with or without HOT Fixes + SynAttackProtect set ______________________________________________________________________ ______________________________________________________________________ /// * RISK FACTOR * \\\ HIGH ______________________________________________________________________ ______________________________________________________________________ /// * Vulnerability Information * \\\ After spending many hours re-installing and ghosting and testing and going NUTS to find out why 2 of MY NT boxes crash . I noticed like a month ago or so 2 of my NT 4.0 boxes start to crash for unknown reason (When i was on IRC) never had a crash problem Registry settings for maximum protection from network attack before. Sure My registry is modified and to start debugging the stuff was a task. The following registry settings will help to increase the JOY :) The crash lead to ON/OFF button :( The testes I have done lead me to find the correct registry KEY yes JOY after hours I was able to repeat and found the exact setting. Here is some background information from Microsoft site http://www.microsoft.com/TechNet/security/dosrv.asp : Security Considerations for Network Attacks Registry settings for maximum protection from network attack The following registry settings will help to increase the resistance of the NT or Windows 2000 network stack to network denial of service attacks. SynAttackProtect Key: Tcpip\Parameters Value Type: REG_DWORD Valid Range: 0, 1, 2 0 (no synattack protection) 1 (reduced retransmission retries and delayed RCE (route cache entry) creation if the TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are satisfied.) 2 (in addition to 1 a delayed indication to Winsock is made.) What I found out Setting the value to 1 or 2 and sending TCP Prediction attack using cybercop module 13002 will Crash NT, and the only way to reboot is TURN OFF/ON :( To reproduce the Attach. 1. Install NT 4.0 2. Apply All the Hot fixes Suggest By Microsoft (with or without Hot fixes) 3. Open Regedt32 or regedit 4. Go to [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] 5. Add or Change the key "SynAttackProtect" make is 1 or 2 6. The Value Type: REG_DWORD, Valid Range: 0, 1, 2 7. The full syntax will be "SynAttackProtect"=dword:00000002 8. Close the regedt32 or regedit 9. Reboot 10. Run a TCP sequence numbers prediction attack 11. Hint if you have Cybercop scanner it is /// * MODULE 13002 * or code your own J I start some test like stopping BlackICE, changing My IRC client etc. hrmm nothing helped to stopped the daily crash :(. It happened like 2 or 3 times a day / night I decide to scan the machine using cyberCop since I use it for work not because I am Certified on It *CLAP* and because I like it :) After scanning the remote box using just /// * MODULE 13002 * \\\, the Box sure Crashed Re booted the remote box and then start to think HO HO...After thinking / testing stuff I found the module that cause the CRASH. /// * MODULE 13002 * \\\ This MODULE use mod13000.dll Here is a bit of information on it. Here is the Module description taken from CyberCop: 13002 TCP sequence numbers are predictable Risk Factor: High Complexity: Medium Fixease: Moderate Popularity: Popular Rootcause: Implementation Impact: Accountability: Authorization The host generates TCP sequence numbers in a pattern which can be guessed by an intruder to launch TCP spoofing based attacks. * The FUNNY part is cybercop will return NOT VULNERABLE HO HO but it just kill the darn box :( Here is what CyberCop report say while running the mentioned module DBG:: [REMOTEIP] HID=1 VID=13002 module_started DBG:: [REMOTEIP] HID=1 VID=13002 module_finished Not Vulnerable DBG:: [REMOTEIP] HID=1 VID=13002 host_finished. Here is some WINDUMP while i was trying the KILLA module :) 15:50:57.716852 ATTACKER.DNS.53 > VICTIM.BOX.1037: 8* 1/2/2 (201) (DF) 15:50:57.899780 ATTACKER.BOX.51499 > VICTIM.BOX.139: R 4177042105:4177042105(0) win 4096 15:50:57.900739 ATTACKER.BOX.51500 > VICTIM.BOX.139: S 4177042104:4177042104(0) win 4096 15:50:57.900871 VICTIM.BOX.139 > ATTACKER.BOX.51500: S 37390524:37390524(0) ack 4177042105 win 8576 (DF) 15:50:57.901413 ATTACKER.BOX.51500 > VICTIM.BOX.139: R 4177042105:4177042105(0) win 0 15:50:58.099652 ATTACKER.BOX.51500 > VICTIM.BOX.139: R 4177042105:4177042105(0) win 4096 15:50:58.100615 ATTACKER.BOX.51501 > VICTIM.BOX.139: S 4177043104:4177043104(0) win 4096 15:50:58.100748 VICTIM.BOX.139 > ATTACKER.BOX.51501: S 37493073:37493073(0) ack 4177043105 win 8576 (DF) 15:50:58.101281 ATTACKER.BOX.51501 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 0 15:50:58.299987 ATTACKER.BOX.51501 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 4096 15:50:58.300944 ATTACKER.BOX.51502 > VICTIM.BOX.139: S 4177043104:4177043104(0) win 4096 15:50:58.301075 VICTIM.BOX.139 > ATTACKER.BOX.51502: S 37602428:37602428(0) ack 4177043105 win 8576 (DF) 15:50:58.301611 ATTACKER.BOX.51502 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 0 15:50:58.500468 ATTACKER.BOX.51502 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 4096 15:50:58.501428 ATTACKER.BOX.51503 > VICTIM.BOX.139: S 4177043104:4177043104(0) win 4096 15:50:58.501559 VICTIM.BOX.139 > ATTACKER.BOX.51503: S 37698671:37698671(0) ack 4177043105 win 8576 (DF) 15:50:58.502097 ATTACKER.BOX.51503 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 0 15:50:58.700496 ATTACKER.BOX.51503 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 4096 15:50:58.701450 ATTACKER.BOX.51504 > VICTIM.BOX.139: S 4177043104:4177043104(0) win 4096 15:50:58.701581 VICTIM.BOX.139 > ATTACKER.BOX.51504: S 37783232:37783232(0) ack 4177043105 win 8576 (DF) 15:50:58.702119 ATTACKER.BOX.51504 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 0 15:50:58.900808 ATTACKER.BOX.51504 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 4096 15:50:58.901763 ATTACKER.BOX.51505 > VICTIM.BOX.139: S 4177043104:4177043104(0) win 4096 15:50:58.901895 VICTIM.BOX.139 > ATTACKER.BOX.51505: S 37867794:37867794(0) ack 4177043105 win 8576 (DF) 15:50:58.902439 ATTACKER.BOX.51505 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 0 15:50:59.101311 ATTACKER.BOX.51505 > VICTIM.BOX.139: R 4177043105:4177043105(0) win 4096 15:50:59.102267 ATTACKER.BOX.51506 > VICTIM.BOX.139: S 4177044104:4177044104(0) win 4096 15:50:59.102398 VICTIM.BOX.139 > ATTACKER.BOX.51506: S 37955428:37955428(0) ack 4177044105 win 8576 (DF) 15:50:59.102938 ATTACKER.BOX.51506 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 0 15:50:59.301400 ATTACKER.BOX.51506 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 4096 15:50:59.302356 ATTACKER.BOX.51507 > VICTIM.BOX.139: S 4177044104:4177044104(0) win 4096 15:50:59.302487 VICTIM.BOX.139 > ATTACKER.BOX.51507: S 38042905:38042905(0) ack 4177044105 win 8576 (DF) 15:50:59.303030 ATTACKER.BOX.51507 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 0 15:50:59.501612 ATTACKER.BOX.51507 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 4096 15:50:59.502563 ATTACKER.BOX.51508 > VICTIM.BOX.139: S 4177044104:4177044104(0) win 4096 15:50:59.502694 VICTIM.BOX.139 > ATTACKER.BOX.51508: S 38134827:38134827(0) ack 4177044105 win 8576 (DF) 15:50:59.503250 ATTACKER.BOX.51508 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 0 15:50:59.702160 ATTACKER.BOX.51508 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 4096 15:50:59.703116 ATTACKER.BOX.51509 > VICTIM.BOX.139: S 4177044104:4177044104(0) win 4096 15:50:59.703247 VICTIM.BOX.139 > ATTACKER.BOX.51509: S 38231533:38231533(0) ack 4177044105 win 8576 (DF) 15:50:59.703789 ATTACKER.BOX.51509 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 0 15:50:59.902233 ATTACKER.BOX.51509 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 4096 15:50:59.903192 ATTACKER.BOX.51510 > VICTIM.BOX.139: S 4177044104:4177044104(0) win 4096 15:50:59.903324 VICTIM.BOX.139 > ATTACKER.BOX.51510: S 38332233:38332233(0) ack 4177044105 win 8576 (DF) 15:50:59.903863 ATTACKER.BOX.51510 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 0 15:51:00.105452 ATTACKER.BOX.51510 > VICTIM.BOX.139: R 4177044105:4177044105(0) win 4096 15:51:00.106407 ATTACKER.BOX.51511 > VICTIM.BOX.139: S 4177045104:4177045104(0) win 4096 15:51:00.106538 VICTIM.BOX.139 > ATTACKER.BOX.51511: S 38429318:38429318(0) ack 4177045105 win 8576 (DF) 15:51:00.107076 ATTACKER.BOX.51511 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 0 15:51:00.305727 ATTACKER.BOX.51511 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 4096 15:51:00.306681 ATTACKER.BOX.51512 > VICTIM.BOX.139: S 4177045104:4177045104(0) win 4096 15:51:00.306814 VICTIM.BOX.139 > ATTACKER.BOX.51512: S 38540815:38540815(0) ack 4177045105 win 8576 (DF) 15:51:00.307348 ATTACKER.BOX.51512 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 0 15:51:00.506024 ATTACKER.BOX.51512 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 4096 15:51:00.506983 ATTACKER.BOX.51513 > VICTIM.BOX.139: S 4177045104:4177045104(0) win 4096 15:51:00.507114 VICTIM.BOX.139 > ATTACKER.BOX.51513: S 38624113:38624113(0) ack 4177045105 win 8576 (DF) 15:51:00.507650 ATTACKER.BOX.51513 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 0 15:51:00.703328 ATTACKER.BOX.51513 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 4096 15:51:00.704283 ATTACKER.BOX.51514 > VICTIM.BOX.139: S 4177045104:4177045104(0) win 4096 15:51:00.704413 VICTIM.BOX.139 > ATTACKER.BOX.51514: S 38722688:38722688(0) ack 4177045105 win 8576 (DF) 15:51:00.704952 ATTACKER.BOX.51514 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 0 15:51:00.903634 ATTACKER.BOX.51514 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 4096 15:51:00.904584 ATTACKER.BOX.51515 > VICTIM.BOX.139: S 4177045104:4177045104(0) win 4096 15:51:00.904716 VICTIM.BOX.139 > ATTACKER.BOX.51515: S 38838030:38838030(0) ack 4177045105 win 8576 (DF) 15:51:00.905254 ATTACKER.BOX.51515 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 0 15:51:01.104133 ATTACKER.BOX.51515 > VICTIM.BOX.139: R 4177045105:4177045105(0) win 4096 15:51:01.105085 ATTACKER.BOX.51516 > VICTIM.BOX.139: S 4177046104:4177046104(0) win 4096 15:51:01.105216 VICTIM.BOX.139 > ATTACKER.BOX.51516: S 38928820:38928820(0) ack 4177046105 win 8576 (DF) 15:51:01.105755 ATTACKER.BOX.51516 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 0 15:51:01.304349 ATTACKER.BOX.51516 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 4096 15:51:01.305304 ATTACKER.BOX.51517 > VICTIM.BOX.139: S 4177046104:4177046104(0) win 4096 15:51:01.305436 VICTIM.BOX.139 > ATTACKER.BOX.51517: S 39036618:39036618(0) ack 4177046105 win 8576 (DF) 15:51:01.305972 ATTACKER.BOX.51517 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 0 15:51:01.504436 ATTACKER.BOX.51517 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 4096 15:51:01.505387 ATTACKER.BOX.51518 > VICTIM.BOX.139: S 4177046104:4177046104(0) win 4096 15:51:01.505518 VICTIM.BOX.139 > ATTACKER.BOX.51518: S 39128579:39128579(0) ack 4177046105 win 8576 (DF) 15:51:01.506056 ATTACKER.BOX.51518 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 0 15:51:01.704985 ATTACKER.BOX.51518 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 4096 15:51:01.705940 ATTACKER.BOX.51519 > VICTIM.BOX.139: S 4177046104:4177046104(0) win 4096 15:51:01.706072 VICTIM.BOX.139 > ATTACKER.BOX.51519: S 39227548:39227548(0) ack 4177046105 win 8576 (DF) 15:51:01.706613 ATTACKER.BOX.51519 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 0 15:51:01.905061 ATTACKER.BOX.51519 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 4096 15:51:01.906016 ATTACKER.BOX.51520 > VICTIM.BOX.139: S 4177046104:4177046104(0) win 4096 15:51:01.906147 VICTIM.BOX.139 > ATTACKER.BOX.51520: S 39336921:39336921(0) ack 4177046105 win 8576 (DF) 15:51:01.906685 ATTACKER.BOX.51520 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 0 15:51:02.105282 ATTACKER.BOX.51520 > VICTIM.BOX.139: R 4177046105:4177046105(0) win 4096 15:51:02.106231 ATTACKER.BOX.51521 > VICTIM.BOX.139: S 4177047104:4177047104(0) win 4096 15:51:02.106363 VICTIM.BOX.139 > ATTACKER.BOX.51521: S 39437462:39437462(0) ack 4177047105 win 8576 (DF) 15:51:02.106901 ATTACKER.BOX.51521 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 0 15:51:02.305827 ATTACKER.BOX.51521 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 4096 15:51:02.306777 ATTACKER.BOX.51522 > VICTIM.BOX.139: S 4177047104:4177047104(0) win 4096 15:51:02.306910 VICTIM.BOX.139 > ATTACKER.BOX.51522: S 39533863:39533863(0) ack 4177047105 win 8576 (DF) 15:51:02.307448 ATTACKER.BOX.51522 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 0 15:51:02.505870 ATTACKER.BOX.51522 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 4096 15:51:02.506823 ATTACKER.BOX.51523 > VICTIM.BOX.139: S 4177047104:4177047104(0) win 4096 15:51:02.506955 VICTIM.BOX.139 > ATTACKER.BOX.51523: S 39626913:39626913(0) ack 4177047105 win 8576 (DF) 15:51:02.507492 ATTACKER.BOX.51523 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 0 15:51:02.706132 ATTACKER.BOX.51523 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 4096 15:51:02.707083 ATTACKER.BOX.51524 > VICTIM.BOX.139: S 4177047104:4177047104(0) win 4096 15:51:02.707213 VICTIM.BOX.139 > ATTACKER.BOX.51524: S 39724455:39724455(0) ack 4177047105 win 8576 (DF) 15:51:02.707750 ATTACKER.BOX.51524 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 0 15:51:02.906845 ATTACKER.BOX.51524 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 4096 15:51:02.907803 ATTACKER.BOX.51525 > VICTIM.BOX.139: S 4177047104:4177047104(0) win 4096 15:51:02.907935 VICTIM.BOX.139 > ATTACKER.BOX.51525: S 39809203:39809203(0) ack 4177047105 win 8576 (DF) 15:51:02.908476 ATTACKER.BOX.51525 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 0 15:51:03.106712 ATTACKER.BOX.51525 > VICTIM.BOX.139: R 4177047105:4177047105(0) win 4096 15:51:03.109088 ATTACKER.BOX.51526 > VICTIM.BOX.139: S 4177048104:4177048104(0) win 4096 15:51:03.109219 VICTIM.BOX.139 > ATTACKER.BOX.51526: S 39918949:39918949(0) ack 4177048105 win 8576 (DF) 15:51:03.109753 ATTACKER.BOX.51526 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 0 15:51:03.307027 ATTACKER.BOX.51526 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 4096 15:51:03.307978 ATTACKER.BOX.51527 > VICTIM.BOX.139: S 4177048104:4177048104(0) win 4096 15:51:03.308110 VICTIM.BOX.139 > ATTACKER.BOX.51527: S 40014891:40014891(0) ack 4177048105 win 8576 (DF) 15:51:03.308645 ATTACKER.BOX.51527 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 0 15:51:03.507532 ATTACKER.BOX.51527 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 4096 15:51:03.508487 ATTACKER.BOX.51528 > VICTIM.BOX.139: S 4177048104:4177048104(0) win 4096 15:51:03.508618 VICTIM.BOX.139 > ATTACKER.BOX.51528: S 40114696:40114696(0) ack 4177048105 win 8576 (DF) 15:51:03.509154 ATTACKER.BOX.51528 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 0 15:51:03.707562 ATTACKER.BOX.51528 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 4096 15:51:03.708515 ATTACKER.BOX.51529 > VICTIM.BOX.139: S 4177048104:4177048104(0) win 4096 15:51:03.708645 VICTIM.BOX.139 > ATTACKER.BOX.51529: S 40218009:40218009(0) ack 4177048105 win 8576 (DF) 15:51:03.709185 ATTACKER.BOX.51529 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 0 15:51:03.907874 ATTACKER.BOX.51529 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 4096 15:51:03.908827 ATTACKER.BOX.51530 > VICTIM.BOX.139: S 4177048104:4177048104(0) win 4096 15:51:03.908959 VICTIM.BOX.139 > ATTACKER.BOX.51530: S 40331702:40331702(0) ack 4177048105 win 8576 (DF) 15:51:03.909494 ATTACKER.BOX.51530 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 0 15:51:04.111101 ATTACKER.BOX.51530 > VICTIM.BOX.139: R 4177048105:4177048105(0) win 4096 15:51:04.112053 ATTACKER.BOX.51531 > VICTIM.BOX.139: S 4177049104:4177049104(0) win 4096 15:51:04.112184 VICTIM.BOX.139 > ATTACKER.BOX.51531: S 40414738:40414738(0) ack 4177049105 win 8576 (DF) 15:51:04.112719 ATTACKER.BOX.51531 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 0 15:51:04.311454 ATTACKER.BOX.51531 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 4096 15:51:04.312408 ATTACKER.BOX.51532 > VICTIM.BOX.139: S 4177049104:4177049104(0) win 4096 15:51:04.312544 VICTIM.BOX.139 > ATTACKER.BOX.51532: S 40523405:40523405(0) ack 4177049105 win 8576 (DF) 15:51:04.313078 ATTACKER.BOX.51532 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 0 15:51:04.511672 ATTACKER.BOX.51532 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 4096 15:51:04.512628 ATTACKER.BOX.51533 > VICTIM.BOX.139: S 4177049104:4177049104(0) win 4096 15:51:04.512763 VICTIM.BOX.139 > ATTACKER.BOX.51533: S 40626146:40626146(0) ack 4177049105 win 8576 (DF) 15:51:04.513298 ATTACKER.BOX.51533 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 0 15:51:04.709159 ATTACKER.BOX.51533 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 4096 15:51:04.710104 ATTACKER.BOX.51534 > VICTIM.BOX.139: S 4177049104:4177049104(0) win 4096 15:51:04.710235 VICTIM.BOX.139 > ATTACKER.BOX.51534: S 40734003:40734003(0) ack 4177049105 win 8576 (DF) 15:51:04.710774 ATTACKER.BOX.51534 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 0 15:51:04.909283 ATTACKER.BOX.51534 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 4096 15:51:04.910234 ATTACKER.BOX.51535 > VICTIM.BOX.139: S 4177049104:4177049104(0) win 4096 15:51:04.910366 VICTIM.BOX.139 > ATTACKER.BOX.51535: S 40843065:40843065(0) ack 4177049105 win 8576 (DF) 15:51:04.910903 ATTACKER.BOX.51535 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 0 15:51:05.109772 ATTACKER.BOX.51535 > VICTIM.BOX.139: R 4177049105:4177049105(0) win 4096 15:51:05.110729 ATTACKER.BOX.51536 > VICTIM.BOX.139: S 4177050104:4177050104(0) win 4096 15:51:05.110861 VICTIM.BOX.139 > ATTACKER.BOX.51536: S 40957009:40957009(0) ack 4177050105 win 8576 (DF) 15:51:05.111399 ATTACKER.BOX.51536 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 0 15:51:05.309874 ATTACKER.BOX.51536 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 4096 15:51:05.310830 ATTACKER.BOX.51537 > VICTIM.BOX.139: S 4177050104:4177050104(0) win 4096 15:51:05.310961 VICTIM.BOX.139 > ATTACKER.BOX.51537: S 41067901:41067901(0) ack 4177050105 win 8576 (DF) 15:51:05.311501 ATTACKER.BOX.51537 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 0 15:51:05.510083 ATTACKER.BOX.51537 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 4096 15:51:05.511032 ATTACKER.BOX.51538 > VICTIM.BOX.139: S 4177050104:4177050104(0) win 4096 15:51:05.511164 VICTIM.BOX.139 > ATTACKER.BOX.51538: S 41181635:41181635(0) ack 4177050105 win 8576 (DF) 15:51:05.511699 ATTACKER.BOX.51538 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 0 15:51:05.710614 ATTACKER.BOX.51538 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 4096 15:51:05.711570 ATTACKER.BOX.51539 > VICTIM.BOX.139: S 4177050104:4177050104(0) win 4096 15:51:05.711700 VICTIM.BOX.139 > ATTACKER.BOX.51539: S 41268667:41268667(0) ack 4177050105 win 8576 (DF) 15:51:05.712240 ATTACKER.BOX.51539 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 0 15:51:05.910709 ATTACKER.BOX.51539 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 4096 15:51:05.911658 ATTACKER.BOX.51540 > VICTIM.BOX.139: S 4177050104:4177050104(0) win 4096 15:51:05.911789 VICTIM.BOX.139 > ATTACKER.BOX.51540: S 41357678:41357678(0) ack 4177050105 win 8576 (DF) 15:51:05.912327 ATTACKER.BOX.51540 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 0 15:51:06.110927 ATTACKER.BOX.51540 > VICTIM.BOX.139: R 4177050105:4177050105(0) win 4096 15:51:06.111882 ATTACKER.BOX.51541 > VICTIM.BOX.139: S 4177051104:4177051104(0) win 4096 15:51:06.112013 VICTIM.BOX.139 > ATTACKER.BOX.51541: S 41461024:41461024(0) ack 4177051105 win 8576 (DF) 15:51:06.112549 ATTACKER.BOX.51541 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 0 15:51:06.311467 ATTACKER.BOX.51541 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 4096 15:51:06.312427 ATTACKER.BOX.51542 > VICTIM.BOX.139: S 4177051104:4177051104(0) win 4096 15:51:06.312561 VICTIM.BOX.139 > ATTACKER.BOX.51542: S 41555949:41555949(0) ack 4177051105 win 8576 (DF) 15:51:06.313098 ATTACKER.BOX.51542 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 0 15:51:06.511513 ATTACKER.BOX.51542 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 4096 15:51:06.512466 ATTACKER.BOX.51543 > VICTIM.BOX.139: S 4177051104:4177051104(0) win 4096 15:51:06.512598 VICTIM.BOX.139 > ATTACKER.BOX.51543: S 41670942:41670942(0) ack 4177051105 win 8576 (DF) 15:51:06.513136 ATTACKER.BOX.51543 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 0 15:51:06.711775 ATTACKER.BOX.51543 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 4096 15:51:06.712727 ATTACKER.BOX.51544 > VICTIM.BOX.139: S 4177051104:4177051104(0) win 4096 15:51:06.712858 VICTIM.BOX.139 > ATTACKER.BOX.51544: S 41784939:41784939(0) ack 4177051105 win 8576 (DF) 15:51:06.713404 ATTACKER.BOX.51544 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 0 15:51:06.912355 ATTACKER.BOX.51544 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 4096 15:51:06.913311 ATTACKER.BOX.51545 > VICTIM.BOX.139: S 4177051104:4177051104(0) win 4096 15:51:06.913443 VICTIM.BOX.139 > ATTACKER.BOX.51545: S 41885932:41885932(0) ack 4177051105 win 8576 (DF) 15:51:06.913982 ATTACKER.BOX.51545 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 0 15:51:07.112361 ATTACKER.BOX.51545 > VICTIM.BOX.139: R 4177051105:4177051105(0) win 4096 15:51:07.113315 ATTACKER.BOX.51546 > VICTIM.BOX.139: S 4177052104:4177052104(0) win 4096 15:51:07.113447 VICTIM.BOX.139 > ATTACKER.BOX.51546: S 41993706:41993706(0) ack 4177052105 win 8576 (DF) 15:51:07.113985 ATTACKER.BOX.51546 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 0 15:51:07.312806 ATTACKER.BOX.51546 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 4096 15:51:07.313756 ATTACKER.BOX.51547 > VICTIM.BOX.139: S 4177052104:4177052104(0) win 4096 15:51:07.313889 VICTIM.BOX.139 > ATTACKER.BOX.51547: S 42107365:42107365(0) ack 4177052105 win 8576 (DF) 15:51:07.314426 ATTACKER.BOX.51547 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 0 15:51:07.513164 ATTACKER.BOX.51547 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 4096 15:51:07.514123 ATTACKER.BOX.51548 > VICTIM.BOX.139: S 4177052104:4177052104(0) win 4096 15:51:07.514253 VICTIM.BOX.139 > ATTACKER.BOX.51548: S 42192906:42192906(0) ack 4177052105 win 8576 (DF) 15:51:07.514790 ATTACKER.BOX.51548 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 0 15:51:07.713212 ATTACKER.BOX.51548 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 4096 15:51:07.714165 ATTACKER.BOX.51549 > VICTIM.BOX.139: S 4177052104:4177052104(0) win 4096 15:51:07.714295 VICTIM.BOX.139 > ATTACKER.BOX.51549: S 42278337:42278337(0) ack 4177052105 win 8576 (DF) 15:51:07.714834 ATTACKER.BOX.51549 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 0 15:51:07.913635 ATTACKER.BOX.51549 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 4096 15:51:07.914593 ATTACKER.BOX.51550 > VICTIM.BOX.139: S 4177052104:4177052104(0) win 4096 15:51:07.914724 VICTIM.BOX.139 > ATTACKER.BOX.51550: S 42385860:42385860(0) ack 4177052105 win 8576 (DF) 15:51:07.915263 ATTACKER.BOX.51550 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 0 15:51:08.114012 ATTACKER.BOX.51550 > VICTIM.BOX.139: R 4177052105:4177052105(0) win 4096 15:51:08.114969 ATTACKER.BOX.51551 > VICTIM.BOX.139: S 4177053104:4177053104(0) win 4096 15:51:08.115100 VICTIM.BOX.139 > ATTACKER.BOX.51551: S 42494298:42494298(0) ack 4177053105 win 8576 (DF) 15:51:08.115637 ATTACKER.BOX.51551 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 0 15:51:08.314058 ATTACKER.BOX.51551 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 4096 15:51:08.315008 ATTACKER.BOX.51552 > VICTIM.BOX.139: S 4177053104:4177053104(0) win 4096 15:51:08.315140 VICTIM.BOX.139 > ATTACKER.BOX.51552: S 42603841:42603841(0) ack 4177053105 win 8576 (DF) 15:51:08.315670 ATTACKER.BOX.51552 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 0 15:51:08.514319 ATTACKER.BOX.51552 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 4096 15:51:08.515269 ATTACKER.BOX.51553 > VICTIM.BOX.139: S 4177053104:4177053104(0) win 4096 15:51:08.515399 VICTIM.BOX.139 > ATTACKER.BOX.51553: S 42694160:42694160(0) ack 4177053105 win 8576 (DF) 15:51:08.515934 ATTACKER.BOX.51553 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 0 15:51:08.714859 ATTACKER.BOX.51553 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 4096 15:51:08.715814 ATTACKER.BOX.51554 > VICTIM.BOX.139: S 4177053104:4177053104(0) win 4096 15:51:08.715945 VICTIM.BOX.139 > ATTACKER.BOX.51554: S 42781944:42781944(0) ack 4177053105 win 8576 (DF) 15:51:08.716482 ATTACKER.BOX.51554 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 0 15:51:08.914950 ATTACKER.BOX.51554 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 4096 15:51:08.915908 ATTACKER.BOX.51555 > VICTIM.BOX.139: S 4177053104:4177053104(0) win 4096 15:51:08.916038 VICTIM.BOX.139 > ATTACKER.BOX.51555: S 42882618:42882618(0) ack 4177053105 win 8576 (DF) 15:51:08.916576 ATTACKER.BOX.51555 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 0 15:51:09.118769 ATTACKER.BOX.51555 > VICTIM.BOX.139: R 4177053105:4177053105(0) win 4096 15:51:09.119724 ATTACKER.BOX.51556 > VICTIM.BOX.139: S 4177054104:4177054104(0) win 4096 15:51:09.119856 VICTIM.BOX.139 > ATTACKER.BOX.51556: S 42989065:42989065(0) ack 4177054105 win 8576 (DF) 15:51:09.120394 ATTACKER.BOX.51556 > VICTIM.BOX.139: R 4177054105:4177054105(0) win 0 15:51:09.319120 ATTACKER.BOX.51556 > VICTIM.BOX.139: R 4177054105:4177054105(0) win 4096 15:51:09.320073 ATTACKER.BOX.51557 > VICTIM.BOX.139: S 4177054104:4177054104(0) win 4096 15:51:09.320205 VICTIM.BOX.139 > ATTACKER.BOX.51557: S 43099333:43099333(0) ack 4177054105 win 8576 (DF) 15:51:09.320743 ATTACKER.BOX.51557 > VICTIM.BOX.139: R 4177054105:4177054105(0) win 0 15:51:09.519353 ATTACKER.BOX.51557 > VICTIM.BOX.139: R 4177054105:4177054105(0) win 4096 15:51:09.520307 ATTACKER.BOX.51558 > VICTIM.BOX.139: S 4177054104:4177054104(0) win 4096 15:51:09.520438 VICTIM.BOX.139 > ATTACKER.BOX.51558: S 43206376:43206376(0) ack 4177054105 win 8576 (DF) 15:51:09.520977 ATTACKER.BOX.51558 > VICTIM.BOX.139: R 41770 <<< *** CRASH HERE*** *** CRASH HERE****** CRASH HERE****** CRASH HERE****** CRASH HERE****** Here is the Crash. To bad Dr.Watson cannot log and the other sniffers use a temp file so I can only get some WINDUMP :) ______________________________________________________________________ /// * Resolution * \\\ 1 - If you follow MS paper http://www.microsoft.com/TechNet/security/dosrv.asp and you have changed the VALUE from 0 to 1 or 2 change it to 0. 2 - Setting 0 will keep your NT box safe from this attack. But it does not go with MS paper so it is a choice you have to take, hell life is full of choices and stuff right :) ______________________________________________________________________ /// * Credits * \\\ The discovery and documentation of this vulnerability was conducted by NtWaK0. For more information Dalnet channel #security or NtWaK0@SecurHack.com _______________________________________________________________________ _______________________________________________________________________ The only secure computer is one that's unplugged, locked in a safe, and buried 20 feet under the ground in a secret location... and i'm not even too sure about that one"--Dennis Huges, FBI. ____________________________________________________________.__________ Live Well Do Good | Accept no limitations \(|)/ /`\ NtWaK0