Fw: Killing NT 4.0 (HOT FIXES or NOT / SP6a)

Fw: Killing NT 4.0 (HOT FIXES or NOT / SP6a)

Post by -=]PyR0[= » Sun, 26 Nov 2000 04:00:00



maybe youll find it interesting... cos this is iirc a sec.ng
if you allready know, Im sorry for posting
----- Original Message -----
From: NtWaK0 <adon...@VIDEOTRON.CA>
To: <BUGT...@SECURITYFOCUS.COM>
Sent: Wednesday, November 22, 2000 4:13 PM
Subject: Killing NT 4.0 (HOT FIXES or NO / SP6a) Remotely using

SynAttackProtect Key Corrected version and solution FOUND :)

> ______________________________________________________________________
> NtW...@SecurHack.com
> Bug / Security / Advisory
> 21,November, 2000
> Killing NT 4.0 (HOT FIXES or NO / SP6a) Remotely using SynAttackProtect
Key
> Corrected version and solution FOUND :)

> ______________________________________________________________________
> /// * Vulnerable Systems * \\\

> Windows NT 4.0 SP6a + with or without HOT Fixes + SynAttackProtect set
> ______________________________________________________________________

> ______________________________________________________________________
> /// * RISK FACTOR * \\\

> HIGH
> ______________________________________________________________________

> ______________________________________________________________________
> /// * Vulnerability Information * \\\

> After spending many hours re-installing and ghosting and testing and
> going NUTS to find out why 2 of MY NT boxes crash .

> I noticed like a month ago or so 2 of my NT 4.0 boxes start to crash
> for unknown reason (When i was on IRC) never had a crash problem
> Registry settings for maximum protection from network attack before.
> Sure My registry is modified and to start debugging the stuff was a task.

> The following registry settings will help to increase the JOY :)
> The crash lead to ON/OFF button :(

> The testes I have done lead me to find the correct registry KEY yes
> JOY after hours I was able to repeat and found the exact setting.

> Here is some background information from Microsoft site

> http://www.microsoft.com/TechNet/security/dosrv.asp :
> Security Considerations for Network Attacks
> Registry settings for maximum protection from network attack

> The following registry settings will help to increase the resistance of
> the NT or Windows 2000 network stack to network denial of service attacks.
> SynAttackProtect
> Key: Tcpip\Parameters
> Value Type: REG_DWORD
> Valid Range: 0, 1, 2
> 0 (no synattack protection)
> 1 (reduced retransmission retries and delayed RCE (route cache entry)
> creation if the TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are
> satisfied.)
> 2 (in addition to 1 a delayed indication to Winsock is made.)

> What I found out Setting the value to 1 or 2 and sending TCP Prediction
> attack
> using cybercop module 13002 will Crash NT, and the only way to reboot is
> TURN OFF/ON :(

> To reproduce the Attach.

> 1. Install NT 4.0
> 2. Apply All the Hot fixes Suggest By Microsoft (with or without Hot
fixes)
> 3. Open Regedt32 or regedit
> 4. Go to
> [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
> 5. Add or Change the key "SynAttackProtect" make is 1 or 2
> 6. The Value Type: REG_DWORD, Valid Range: 0, 1, 2
> 7. The full syntax will be "SynAttackProtect"=dword:00000002
> 8. Close the regedt32 or regedit
> 9. Reboot
> 10. Run a TCP sequence numbers prediction attack
> 11. Hint if you have Cybercop scanner it is /// * MODULE 13002 * or code
> your own J

> I start some test like stopping BlackICE, changing My IRC client etc. hrmm
> nothing helped to stopped the daily crash :(.  It happened like 2 or 3
times
> a day / night

> I decide to scan the machine using cyberCop since I use it for work not
> because
> I am Certified  on It *CLAP* and because I like it :)

> After scanning the remote box using just /// * MODULE 13002 * \\\, the Box
> sure Crashed

> Re booted the remote box and then start to think HO HO...After thinking /
> testing stuff
> I found the module that cause the CRASH.

> /// * MODULE 13002 * \\\
> This MODULE use mod13000.dll  Here is a bit of information on it.

> Here is the Module description taken from CyberCop:

> 13002 TCP sequence numbers are predictable
> Risk Factor: High
> Complexity: Medium
> Fixease: Moderate
> Popularity: Popular
> Rootcause: Implementation
> Impact:
> Accountability: Authorization  The host generates TCP sequence numbers in
a
> pattern which
> can be guessed by an intruder to launch TCP  spoofing based attacks.

> * The FUNNY part is cybercop will return NOT VULNERABLE
> HO HO but it just kill  the darn box :(  Here is what CyberCop report say
> while running the mentioned module

> DBG:: <Tue Nov 21 15:47:26 2000 >[REMOTEIP] HID=1 VID=13002 module_started
> DBG:: <Tue Nov 21 15:47:47 2000>[REMOTEIP] HID=1 VID=13002 module_finished
> Not Vulnerable
> DBG:: <Tue Nov 21 15:47:26 2000 >[REMOTEIP] HID=1 VID=13002 host_finished.

> Here is some WINDUMP while i was trying the KILLA module :)

> 15:50:57.716852 ATTACKER.DNS.53 > VICTIM.BOX.1037: 8* 1/2/2 (201) (DF)
> 15:50:57.899780 ATTACKER.BOX.51499 > VICTIM.BOX.139: R
> 4177042105:4177042105(0) win 4096
> 15:50:57.900739 ATTACKER.BOX.51500 > VICTIM.BOX.139: S
> 4177042104:4177042104(0) win 4096
> 15:50:57.900871 VICTIM.BOX.139 > ATTACKER.BOX.51500: S
37390524:37390524(0)
> ack 4177042105 win 8576 <mss 1460> (DF)
> 15:50:57.901413 ATTACKER.BOX.51500 > VICTIM.BOX.139: R
> 4177042105:4177042105(0) win 0
> 15:50:58.099652 ATTACKER.BOX.51500 > VICTIM.BOX.139: R
> 4177042105:4177042105(0) win 4096
> 15:50:58.100615 ATTACKER.BOX.51501 > VICTIM.BOX.139: S
> 4177043104:4177043104(0) win 4096
> 15:50:58.100748 VICTIM.BOX.139 > ATTACKER.BOX.51501: S
37493073:37493073(0)
> ack 4177043105 win 8576 <mss 1460> (DF)
> 15:50:58.101281 ATTACKER.BOX.51501 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 0
> 15:50:58.299987 ATTACKER.BOX.51501 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 4096
> 15:50:58.300944 ATTACKER.BOX.51502 > VICTIM.BOX.139: S
> 4177043104:4177043104(0) win 4096
> 15:50:58.301075 VICTIM.BOX.139 > ATTACKER.BOX.51502: S
37602428:37602428(0)
> ack 4177043105 win 8576 <mss 1460> (DF)
> 15:50:58.301611 ATTACKER.BOX.51502 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 0
> 15:50:58.500468 ATTACKER.BOX.51502 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 4096
> 15:50:58.501428 ATTACKER.BOX.51503 > VICTIM.BOX.139: S
> 4177043104:4177043104(0) win 4096
> 15:50:58.501559 VICTIM.BOX.139 > ATTACKER.BOX.51503: S
37698671:37698671(0)
> ack 4177043105 win 8576 <mss 1460> (DF)
> 15:50:58.502097 ATTACKER.BOX.51503 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 0
> 15:50:58.700496 ATTACKER.BOX.51503 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 4096
> 15:50:58.701450 ATTACKER.BOX.51504 > VICTIM.BOX.139: S
> 4177043104:4177043104(0) win 4096
> 15:50:58.701581 VICTIM.BOX.139 > ATTACKER.BOX.51504: S
37783232:37783232(0)
> ack 4177043105 win 8576 <mss 1460> (DF)
> 15:50:58.702119 ATTACKER.BOX.51504 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 0
> 15:50:58.900808 ATTACKER.BOX.51504 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 4096
> 15:50:58.901763 ATTACKER.BOX.51505 > VICTIM.BOX.139: S
> 4177043104:4177043104(0) win 4096
> 15:50:58.901895 VICTIM.BOX.139 > ATTACKER.BOX.51505: S
37867794:37867794(0)
> ack 4177043105 win 8576 <mss 1460> (DF)
> 15:50:58.902439 ATTACKER.BOX.51505 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 0
> 15:50:59.101311 ATTACKER.BOX.51505 > VICTIM.BOX.139: R
> 4177043105:4177043105(0) win 4096
> 15:50:59.102267 ATTACKER.BOX.51506 > VICTIM.BOX.139: S
> 4177044104:4177044104(0) win 4096
> 15:50:59.102398 VICTIM.BOX.139 > ATTACKER.BOX.51506: S
37955428:37955428(0)
> ack 4177044105 win 8576 <mss 1460> (DF)
> 15:50:59.102938 ATTACKER.BOX.51506 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 0
> 15:50:59.301400 ATTACKER.BOX.51506 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 4096
> 15:50:59.302356 ATTACKER.BOX.51507 > VICTIM.BOX.139: S
> 4177044104:4177044104(0) win 4096
> 15:50:59.302487 VICTIM.BOX.139 > ATTACKER.BOX.51507: S
38042905:38042905(0)
> ack 4177044105 win 8576 <mss 1460> (DF)
> 15:50:59.303030 ATTACKER.BOX.51507 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 0
> 15:50:59.501612 ATTACKER.BOX.51507 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 4096
> 15:50:59.502563 ATTACKER.BOX.51508 > VICTIM.BOX.139: S
> 4177044104:4177044104(0) win 4096
> 15:50:59.502694 VICTIM.BOX.139 > ATTACKER.BOX.51508: S
38134827:38134827(0)
> ack 4177044105 win 8576 <mss 1460> (DF)
> 15:50:59.503250 ATTACKER.BOX.51508 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 0
> 15:50:59.702160 ATTACKER.BOX.51508 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 4096
> 15:50:59.703116 ATTACKER.BOX.51509 > VICTIM.BOX.139: S
> 4177044104:4177044104(0) win 4096
> 15:50:59.703247 VICTIM.BOX.139 > ATTACKER.BOX.51509: S
38231533:38231533(0)
> ack 4177044105 win 8576 <mss 1460> (DF)
> 15:50:59.703789 ATTACKER.BOX.51509 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 0
> 15:50:59.902233 ATTACKER.BOX.51509 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 4096
> 15:50:59.903192 ATTACKER.BOX.51510 > VICTIM.BOX.139: S
> 4177044104:4177044104(0) win 4096
> 15:50:59.903324 VICTIM.BOX.139 > ATTACKER.BOX.51510: S
38332233:38332233(0)
> ack 4177044105 win 8576 <mss 1460> (DF)
> 15:50:59.903863 ATTACKER.BOX.51510 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 0
> 15:51:00.105452 ATTACKER.BOX.51510 > VICTIM.BOX.139: R
> 4177044105:4177044105(0) win 4096
> 15:51:00.106407 ATTACKER.BOX.51511 > VICTIM.BOX.139: S
> 4177045104:4177045104(0) win 4096
> 15:51:00.106538 VICTIM.BOX.139 > ATTACKER.BOX.51511: S
38429318:38429318(0)
> ack 4177045105 win 8576 <mss 1460> (DF)
> 15:51:00.107076 ATTACKER.BOX.51511 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 0
> 15:51:00.305727 ATTACKER.BOX.51511 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 4096
> 15:51:00.306681 ATTACKER.BOX.51512 > VICTIM.BOX.139: S
> 4177045104:4177045104(0) win 4096
> 15:51:00.306814 VICTIM.BOX.139 > ATTACKER.BOX.51512: S
38540815:38540815(0)
> ack 4177045105 win 8576 <mss 1460> (DF)
> 15:51:00.307348 ATTACKER.BOX.51512 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 0
> 15:51:00.506024 ATTACKER.BOX.51512 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 4096
> 15:51:00.506983 ATTACKER.BOX.51513 > VICTIM.BOX.139: S
> 4177045104:4177045104(0) win 4096
> 15:51:00.507114 VICTIM.BOX.139 > ATTACKER.BOX.51513: S
38624113:38624113(0)
> ack 4177045105 win 8576 <mss 1460> (DF)
> 15:51:00.507650 ATTACKER.BOX.51513 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 0
> 15:51:00.703328 ATTACKER.BOX.51513 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 4096
> 15:51:00.704283 ATTACKER.BOX.51514 > VICTIM.BOX.139: S
> 4177045104:4177045104(0) win 4096
> 15:51:00.704413 VICTIM.BOX.139 > ATTACKER.BOX.51514: S
38722688:38722688(0)
> ack 4177045105 win 8576 <mss 1460> (DF)
> 15:51:00.704952 ATTACKER.BOX.51514 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 0
> 15:51:00.903634 ATTACKER.BOX.51514 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 4096
> 15:51:00.904584 ATTACKER.BOX.51515 > VICTIM.BOX.139: S
> 4177045104:4177045104(0) win 4096
> 15:51:00.904716 VICTIM.BOX.139 > ATTACKER.BOX.51515: S
38838030:38838030(0)
> ack 4177045105 win 8576 <mss 1460> (DF)
> 15:51:00.905254 ATTACKER.BOX.51515 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 0
> 15:51:01.104133 ATTACKER.BOX.51515 > VICTIM.BOX.139: R
> 4177045105:4177045105(0) win 4096
> 15:51:01.105085 ATTACKER.BOX.51516 > VICTIM.BOX.139: S
> 4177046104:4177046104(0) win 4096
> 15:51:01.105216 VICTIM.BOX.139 > ATTACKER.BOX.51516: S
38928820:38928820(0)
> ack 4177046105 win 8576 <mss 1460> (DF)
> 15:51:01.105755 ATTACKER.BOX.51516 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 0
> 15:51:01.304349 ATTACKER.BOX.51516 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 4096
> 15:51:01.305304 ATTACKER.BOX.51517 > VICTIM.BOX.139: S
> 4177046104:4177046104(0) win 4096
> 15:51:01.305436 VICTIM.BOX.139 > ATTACKER.BOX.51517: S
39036618:39036618(0)
> ack 4177046105 win 8576 <mss 1460> (DF)
> 15:51:01.305972 ATTACKER.BOX.51517 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 0
> 15:51:01.504436 ATTACKER.BOX.51517 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 4096
> 15:51:01.505387 ATTACKER.BOX.51518 > VICTIM.BOX.139: S
> 4177046104:4177046104(0) win 4096
> 15:51:01.505518 VICTIM.BOX.139 > ATTACKER.BOX.51518: S
39128579:39128579(0)
> ack 4177046105 win 8576 <mss 1460> (DF)
> 15:51:01.506056 ATTACKER.BOX.51518 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 0
> 15:51:01.704985 ATTACKER.BOX.51518 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 4096
> 15:51:01.705940 ATTACKER.BOX.51519 > VICTIM.BOX.139: S
> 4177046104:4177046104(0) win 4096
> 15:51:01.706072 VICTIM.BOX.139 > ATTACKER.BOX.51519: S
39227548:39227548(0)
> ack 4177046105 win 8576 <mss 1460> (DF)
> 15:51:01.706613 ATTACKER.BOX.51519 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 0
> 15:51:01.905061 ATTACKER.BOX.51519 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 4096
> 15:51:01.906016 ATTACKER.BOX.51520 > VICTIM.BOX.139: S
> 4177046104:4177046104(0) win 4096
> 15:51:01.906147 VICTIM.BOX.139 > ATTACKER.BOX.51520: S
39336921:39336921(0)
> ack 4177046105 win 8576 <mss 1460> (DF)
> 15:51:01.906685 ATTACKER.BOX.51520 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 0
> 15:51:02.105282 ATTACKER.BOX.51520 > VICTIM.BOX.139: R
> 4177046105:4177046105(0) win 4096
> 15:51:02.106231 ATTACKER.BOX.51521 > VICTIM.BOX.139: S
> 4177047104:4177047104(0) win 4096
> 15:51:02.106363 VICTIM.BOX.139 > ATTACKER.BOX.51521: S
39437462:39437462(0)
> ack 4177047105 win 8576 <mss 1460> (DF)
> 15:51:02.106901 ATTACKER.BOX.51521 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 0
> 15:51:02.305827 ATTACKER.BOX.51521 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 4096
> 15:51:02.306777 ATTACKER.BOX.51522 > VICTIM.BOX.139: S
> 4177047104:4177047104(0) win 4096
> 15:51:02.306910 VICTIM.BOX.139 > ATTACKER.BOX.51522: S
39533863:39533863(0)
> ack 4177047105 win 8576 <mss 1460> (DF)
> 15:51:02.307448 ATTACKER.BOX.51522 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 0
> 15:51:02.505870 ATTACKER.BOX.51522 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 4096
> 15:51:02.506823 ATTACKER.BOX.51523 > VICTIM.BOX.139: S
> 4177047104:4177047104(0) win 4096
> 15:51:02.506955 VICTIM.BOX.139 > ATTACKER.BOX.51523: S
39626913:39626913(0)
> ack 4177047105 win 8576 <mss 1460> (DF)
> 15:51:02.507492 ATTACKER.BOX.51523 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 0
> 15:51:02.706132 ATTACKER.BOX.51523 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 4096
> 15:51:02.707083 ATTACKER.BOX.51524 > VICTIM.BOX.139: S
> 4177047104:4177047104(0) win 4096
> 15:51:02.707213 VICTIM.BOX.139 > ATTACKER.BOX.51524: S
39724455:39724455(0)
> ack 4177047105 win 8576 <mss 1460> (DF)
> 15:51:02.707750 ATTACKER.BOX.51524 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 0
> 15:51:02.906845 ATTACKER.BOX.51524 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 4096
> 15:51:02.907803 ATTACKER.BOX.51525 > VICTIM.BOX.139: S
> 4177047104:4177047104(0) win 4096
> 15:51:02.907935 VICTIM.BOX.139 > ATTACKER.BOX.51525: S
39809203:39809203(0)
> ack 4177047105 win 8576 <mss 1460> (DF)
> 15:51:02.908476 ATTACKER.BOX.51525 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 0
> 15:51:03.106712 ATTACKER.BOX.51525 > VICTIM.BOX.139: R
> 4177047105:4177047105(0) win 4096
> 15:51:03.109088 ATTACKER.BOX.51526 > VICTIM.BOX.139: S
> 4177048104:4177048104(0) win 4096
> 15:51:03.109219 VICTIM.BOX.139 > ATTACKER.BOX.51526: S
39918949:39918949(0)
> ack 4177048105 win 8576 <mss 1460> (DF)
> 15:51:03.109753 ATTACKER.BOX.51526 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 0
> 15:51:03.307027 ATTACKER.BOX.51526 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 4096
> 15:51:03.307978 ATTACKER.BOX.51527 > VICTIM.BOX.139: S
> 4177048104:4177048104(0) win 4096
> 15:51:03.308110 VICTIM.BOX.139 > ATTACKER.BOX.51527: S
40014891:40014891(0)
> ack 4177048105 win 8576 <mss 1460> (DF)
> 15:51:03.308645 ATTACKER.BOX.51527 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 0
> 15:51:03.507532 ATTACKER.BOX.51527 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 4096
> 15:51:03.508487 ATTACKER.BOX.51528 > VICTIM.BOX.139: S
> 4177048104:4177048104(0) win 4096
> 15:51:03.508618 VICTIM.BOX.139 > ATTACKER.BOX.51528: S
40114696:40114696(0)
> ack 4177048105 win 8576 <mss 1460> (DF)
> 15:51:03.509154 ATTACKER.BOX.51528 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 0
> 15:51:03.707562 ATTACKER.BOX.51528 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 4096
> 15:51:03.708515 ATTACKER.BOX.51529 > VICTIM.BOX.139: S
> 4177048104:4177048104(0) win 4096
> 15:51:03.708645 VICTIM.BOX.139 > ATTACKER.BOX.51529: S
40218009:40218009(0)
> ack 4177048105 win 8576 <mss 1460> (DF)
> 15:51:03.709185 ATTACKER.BOX.51529 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 0
> 15:51:03.907874 ATTACKER.BOX.51529 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 4096
> 15:51:03.908827 ATTACKER.BOX.51530 > VICTIM.BOX.139: S
> 4177048104:4177048104(0) win 4096
> 15:51:03.908959 VICTIM.BOX.139 > ATTACKER.BOX.51530: S
40331702:40331702(0)
> ack 4177048105 win 8576 <mss 1460> (DF)
> 15:51:03.909494 ATTACKER.BOX.51530 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 0
> 15:51:04.111101 ATTACKER.BOX.51530 > VICTIM.BOX.139: R
> 4177048105:4177048105(0) win 4096
> 15:51:04.112053 ATTACKER.BOX.51531 > VICTIM.BOX.139: S
> 4177049104:4177049104(0) win 4096
> 15:51:04.112184 VICTIM.BOX.139 > ATTACKER.BOX.51531: S
40414738:40414738(0)
> ack 4177049105 win 8576 <mss 1460> (DF)
> 15:51:04.112719 ATTACKER.BOX.51531 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 0
> 15:51:04.311454 ATTACKER.BOX.51531 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 4096
> 15:51:04.312408 ATTACKER.BOX.51532 > VICTIM.BOX.139: S
> 4177049104:4177049104(0) win 4096
> 15:51:04.312544 VICTIM.BOX.139 > ATTACKER.BOX.51532: S
40523405:40523405(0)
> ack 4177049105 win 8576 <mss 1460> (DF)
> 15:51:04.313078 ATTACKER.BOX.51532 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 0
> 15:51:04.511672 ATTACKER.BOX.51532 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 4096
> 15:51:04.512628 ATTACKER.BOX.51533 > VICTIM.BOX.139: S
> 4177049104:4177049104(0) win 4096
> 15:51:04.512763 VICTIM.BOX.139 > ATTACKER.BOX.51533: S
40626146:40626146(0)
> ack 4177049105 win 8576 <mss 1460> (DF)
> 15:51:04.513298 ATTACKER.BOX.51533 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 0
> 15:51:04.709159 ATTACKER.BOX.51533 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 4096
> 15:51:04.710104 ATTACKER.BOX.51534 > VICTIM.BOX.139: S
> 4177049104:4177049104(0) win 4096
> 15:51:04.710235 VICTIM.BOX.139 > ATTACKER.BOX.51534: S
40734003:40734003(0)
> ack 4177049105 win 8576 <mss 1460> (DF)
> 15:51:04.710774 ATTACKER.BOX.51534 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 0
> 15:51:04.909283 ATTACKER.BOX.51534 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 4096
> 15:51:04.910234 ATTACKER.BOX.51535 > VICTIM.BOX.139: S
> 4177049104:4177049104(0) win 4096
> 15:51:04.910366 VICTIM.BOX.139 > ATTACKER.BOX.51535: S
40843065:40843065(0)
> ack 4177049105 win 8576 <mss 1460> (DF)
> 15:51:04.910903 ATTACKER.BOX.51535 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 0
> 15:51:05.109772 ATTACKER.BOX.51535 > VICTIM.BOX.139: R
> 4177049105:4177049105(0) win 4096
> 15:51:05.110729 ATTACKER.BOX.51536 > VICTIM.BOX.139: S
> 4177050104:4177050104(0) win 4096
> 15:51:05.110861 VICTIM.BOX.139 > ATTACKER.BOX.51536: S
40957009:40957009(0)
> ack 4177050105 win 8576 <mss 1460> (DF)
> 15:51:05.111399 ATTACKER.BOX.51536 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 0
> 15:51:05.309874 ATTACKER.BOX.51536 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 4096
> 15:51:05.310830 ATTACKER.BOX.51537 > VICTIM.BOX.139: S
> 4177050104:4177050104(0) win 4096
> 15:51:05.310961 VICTIM.BOX.139 > ATTACKER.BOX.51537: S
41067901:41067901(0)
> ack 4177050105 win 8576 <mss 1460> (DF)
> 15:51:05.311501 ATTACKER.BOX.51537 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 0
> 15:51:05.510083 ATTACKER.BOX.51537 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 4096
> 15:51:05.511032 ATTACKER.BOX.51538 > VICTIM.BOX.139: S
> 4177050104:4177050104(0) win 4096
> 15:51:05.511164 VICTIM.BOX.139 > ATTACKER.BOX.51538: S
41181635:41181635(0)
> ack 4177050105 win 8576 <mss 1460> (DF)
> 15:51:05.511699 ATTACKER.BOX.51538 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 0
> 15:51:05.710614 ATTACKER.BOX.51538 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 4096
> 15:51:05.711570 ATTACKER.BOX.51539 > VICTIM.BOX.139: S
> 4177050104:4177050104(0) win 4096
> 15:51:05.711700 VICTIM.BOX.139 > ATTACKER.BOX.51539: S
41268667:41268667(0)
> ack 4177050105 win 8576 <mss 1460> (DF)
> 15:51:05.712240 ATTACKER.BOX.51539 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 0
> 15:51:05.910709 ATTACKER.BOX.51539 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 4096
> 15:51:05.911658 ATTACKER.BOX.51540 > VICTIM.BOX.139: S
> 4177050104:4177050104(0) win 4096
> 15:51:05.911789 VICTIM.BOX.139 > ATTACKER.BOX.51540: S
41357678:41357678(0)
> ack 4177050105 win 8576 <mss 1460> (DF)
> 15:51:05.912327 ATTACKER.BOX.51540 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 0
> 15:51:06.110927 ATTACKER.BOX.51540 > VICTIM.BOX.139: R
> 4177050105:4177050105(0) win 4096
> 15:51:06.111882 ATTACKER.BOX.51541 > VICTIM.BOX.139: S
> 4177051104:4177051104(0) win 4096
> 15:51:06.112013 VICTIM.BOX.139 > ATTACKER.BOX.51541: S
41461024:41461024(0)
> ack 4177051105 win 8576 <mss 1460> (DF)
> 15:51:06.112549 ATTACKER.BOX.51541 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 0
> 15:51:06.311467 ATTACKER.BOX.51541 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 4096
> 15:51:06.312427 ATTACKER.BOX.51542 > VICTIM.BOX.139: S
> 4177051104:4177051104(0) win 4096
> 15:51:06.312561 VICTIM.BOX.139 > ATTACKER.BOX.51542: S
41555949:41555949(0)
> ack 4177051105 win 8576 <mss 1460> (DF)
> 15:51:06.313098 ATTACKER.BOX.51542 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 0
> 15:51:06.511513 ATTACKER.BOX.51542 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 4096
> 15:51:06.512466 ATTACKER.BOX.51543 > VICTIM.BOX.139: S
> 4177051104:4177051104(0) win 4096
> 15:51:06.512598 VICTIM.BOX.139 > ATTACKER.BOX.51543: S
41670942:41670942(0)
> ack 4177051105 win 8576 <mss 1460> (DF)
> 15:51:06.513136 ATTACKER.BOX.51543 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 0
> 15:51:06.711775 ATTACKER.BOX.51543 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 4096
> 15:51:06.712727 ATTACKER.BOX.51544 > VICTIM.BOX.139: S
> 4177051104:4177051104(0) win 4096
> 15:51:06.712858 VICTIM.BOX.139 > ATTACKER.BOX.51544: S
41784939:41784939(0)
> ack 4177051105 win 8576 <mss 1460> (DF)
> 15:51:06.713404 ATTACKER.BOX.51544 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 0
> 15:51:06.912355 ATTACKER.BOX.51544 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 4096
> 15:51:06.913311 ATTACKER.BOX.51545 > VICTIM.BOX.139: S
> 4177051104:4177051104(0) win 4096
> 15:51:06.913443 VICTIM.BOX.139 > ATTACKER.BOX.51545: S
41885932:41885932(0)
> ack 4177051105 win 8576 <mss 1460> (DF)
> 15:51:06.913982 ATTACKER.BOX.51545 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 0
> 15:51:07.112361 ATTACKER.BOX.51545 > VICTIM.BOX.139: R
> 4177051105:4177051105(0) win 4096
> 15:51:07.113315 ATTACKER.BOX.51546 > VICTIM.BOX.139: S
> 4177052104:4177052104(0) win 4096
> 15:51:07.113447 VICTIM.BOX.139 > ATTACKER.BOX.51546: S
41993706:41993706(0)
> ack 4177052105 win 8576 <mss 1460> (DF)
> 15:51:07.113985 ATTACKER.BOX.51546 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 0
> 15:51:07.312806 ATTACKER.BOX.51546 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 4096
> 15:51:07.313756 ATTACKER.BOX.51547 > VICTIM.BOX.139: S
> 4177052104:4177052104(0) win 4096
> 15:51:07.313889 VICTIM.BOX.139 > ATTACKER.BOX.51547: S
42107365:42107365(0)
> ack 4177052105 win 8576 <mss 1460> (DF)
> 15:51:07.314426 ATTACKER.BOX.51547 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 0
> 15:51:07.513164 ATTACKER.BOX.51547 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 4096
> 15:51:07.514123 ATTACKER.BOX.51548 > VICTIM.BOX.139: S
> 4177052104:4177052104(0) win 4096
> 15:51:07.514253 VICTIM.BOX.139 > ATTACKER.BOX.51548: S
42192906:42192906(0)
> ack 4177052105 win 8576 <mss 1460> (DF)
> 15:51:07.514790 ATTACKER.BOX.51548 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 0
> 15:51:07.713212 ATTACKER.BOX.51548 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 4096
> 15:51:07.714165 ATTACKER.BOX.51549 > VICTIM.BOX.139: S
> 4177052104:4177052104(0) win 4096
> 15:51:07.714295 VICTIM.BOX.139 > ATTACKER.BOX.51549: S
42278337:42278337(0)
> ack 4177052105 win 8576 <mss 1460> (DF)
> 15:51:07.714834 ATTACKER.BOX.51549 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 0
> 15:51:07.913635 ATTACKER.BOX.51549 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 4096
> 15:51:07.914593 ATTACKER.BOX.51550 > VICTIM.BOX.139: S
> 4177052104:4177052104(0) win 4096
> 15:51:07.914724 VICTIM.BOX.139 > ATTACKER.BOX.51550: S
42385860:42385860(0)
> ack 4177052105 win 8576 <mss 1460> (DF)
> 15:51:07.915263 ATTACKER.BOX.51550 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 0
> 15:51:08.114012 ATTACKER.BOX.51550 > VICTIM.BOX.139: R
> 4177052105:4177052105(0) win 4096
> 15:51:08.114969 ATTACKER.BOX.51551 > VICTIM.BOX.139: S
> 4177053104:4177053104(0) win 4096
> 15:51:08.115100 VICTIM.BOX.139 > ATTACKER.BOX.51551: S
42494298:42494298(0)
> ack 4177053105 win 8576 <mss 1460> (DF)
> 15:51:08.115637 ATTACKER.BOX.51551 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 0
> 15:51:08.314058 ATTACKER.BOX.51551 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 4096
> 15:51:08.315008 ATTACKER.BOX.51552 > VICTIM.BOX.139: S
> 4177053104:4177053104(0) win 4096
> 15:51:08.315140 VICTIM.BOX.139 > ATTACKER.BOX.51552: S
42603841:42603841(0)
> ack 4177053105 win 8576 <mss 1460> (DF)
> 15:51:08.315670 ATTACKER.BOX.51552 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 0
> 15:51:08.514319 ATTACKER.BOX.51552 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 4096
> 15:51:08.515269 ATTACKER.BOX.51553 > VICTIM.BOX.139: S
> 4177053104:4177053104(0) win 4096
> 15:51:08.515399 VICTIM.BOX.139 > ATTACKER.BOX.51553: S
42694160:42694160(0)
> ack 4177053105 win 8576 <mss 1460> (DF)
> 15:51:08.515934 ATTACKER.BOX.51553 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 0
> 15:51:08.714859 ATTACKER.BOX.51553 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 4096
> 15:51:08.715814 ATTACKER.BOX.51554 > VICTIM.BOX.139: S
> 4177053104:4177053104(0) win 4096
> 15:51:08.715945 VICTIM.BOX.139 > ATTACKER.BOX.51554: S
42781944:42781944(0)
> ack 4177053105 win 8576 <mss 1460> (DF)
> 15:51:08.716482 ATTACKER.BOX.51554 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 0
> 15:51:08.914950 ATTACKER.BOX.51554 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 4096
> 15:51:08.915908 ATTACKER.BOX.51555 > VICTIM.BOX.139: S
> 4177053104:4177053104(0) win 4096
> 15:51:08.916038 VICTIM.BOX.139 > ATTACKER.BOX.51555: S
42882618:42882618(0)
> ack 4177053105 win 8576 <mss 1460> (DF)
> 15:51:08.916576 ATTACKER.BOX.51555 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 0
> 15:51:09.118769 ATTACKER.BOX.51555 > VICTIM.BOX.139: R
> 4177053105:4177053105(0) win 4096
> 15:51:09.119724 ATTACKER.BOX.51556 > VICTIM.BOX.139: S
> 4177054104:4177054104(0) win 4096
> 15:51:09.119856 VICTIM.BOX.139 > ATTACKER.BOX.51556: S
42989065:42989065(0)
> ack 4177054105 win 8576 <mss 1460> (DF)
> 15:51:09.120394 ATTACKER.BOX.51556 > VICTIM.BOX.139: R
> 4177054105:4177054105(0) win 0
> 15:51:09.319120 ATTACKER.BOX.51556 > VICTIM.BOX.139: R
> 4177054105:4177054105(0) win 4096
> 15:51:09.320073 ATTACKER.BOX.51557 > VICTIM.BOX.139: S
> 4177054104:4177054104(0) win 4096
> 15:51:09.320205 VICTIM.BOX.139 > ATTACKER.BOX.51557: S
43099333:43099333(0)
> ack 4177054105 win 8576 <mss 1460> (DF)
> 15:51:09.320743 ATTACKER.BOX.51557 > VICTIM.BOX.139: R
> 4177054105:4177054105(0) win 0
> 15:51:09.519353 ATTACKER.BOX.51557 > VICTIM.BOX.139: R
> 4177054105:4177054105(0) win 4096
> 15:51:09.520307 ATTACKER.BOX.51558 > VICTIM.BOX.139: S
> 4177054104:4177054104(0) win 4096
> 15:51:09.520438 VICTIM.BOX.139 > ATTACKER.BOX.51558: S
43206376:43206376(0)
> ack 4177054105 win 8576 <mss 1460> (DF)
> 15:51:09.520977 ATTACKER.BOX.51558 > VICTIM.BOX.139: R 41770  <<< ***
CRASH
> HERE***

> *** CRASH HERE****** CRASH HERE****** CRASH HERE****** CRASH HERE******
> Here is the Crash. To bad Dr.Watson cannot log and the other sniffers use
a
> temp file so I can only get some WINDUMP :)

> ______________________________________________________________________
> /// * Resolution * \\\

> 1 - If you follow MS paper
> http://www.microsoft.com/TechNet/security/dosrv.asp
>     and you have changed the VALUE from 0 to 1 or 2 change it to 0.
> 2 - Setting 0 will keep your NT box safe from this attack. But it does not
> go
>     with MS paper so it is a choice you have to take, hell life is
>     full of choices and stuff right :)

> ______________________________________________________________________
> /// * Credits * \\\

> The discovery and documentation of this vulnerability was conducted by
> NtWaK0.
> For more information Dalnet channel #security or NtW...@SecurHack.com
> _______________________________________________________________________

> _______________________________________________________________________
> The only secure computer is one that's unplugged, locked in a safe,
> and buried 20 feet under the ground in a secret location... and i'm
> not even too sure about that one"--Dennis Huges, FBI.
> ____________________________________________________________.__________
> Live Well Do Good                                           |
> Accept no limitations                                     \(|)/
>                                                            /`\  NtWaK0