iExploit

Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Apply for Membership

Top Posters

Who's Online (1)

Powered by Vanilla. Made with Bootstrap.
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Stuxnet == Cyberweapon Prototype
  • Sh3llc0d3
    Posts: 1,910
    Sounds like a good time to be working in IT security ;)

    http://www.computerweekly.com/Articles/ ... curity.htm

    S-P
  • Xin
    Posts: 3,251
    The source of this was leaked also recently ;), time to be taking over some power stations
    Xin
  • Sh3llc0d3
    Posts: 1,910
    Yeah, shame they patched the vulnerabilities lol. Coding malware on that level would be awesome. They reckon it's the most advanced malware code they've seen, something like that anyway lol
  • mandi
    Posts: 207
    I would like to share some of the information i knew about the stuxnet worm

    "according to me the most interesting part was the worm is based on utilizing 4 exploits"

    And the most amazing thing is they managed to exploit one of the security patch for one of the old exploit,I never heared or seen any thing like this...

    this tells how dumb is the microsoft OS,it seems they are patching security holes poorly...

    Also see here..

    http://www.flyingpenguin.com/?p=8091&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+flyingpenguin+%28flyingpenguin%29


    @Xinapse--->

    The source of this was leaked also recently ;), time to be taking over some power stations


    if possible can you share them please?
  • Xin
    Posts: 3,251
    said:


    I would like to share some of the information i knew about the stuxnet worm

    "according to me the most interesting part was the worm is based on utilizing 4 exploits"

    And the most amazing thing is they managed to exploit one of the security patch for one of the old exploit,I never heared or seen any thing like this...

    this tells how dumb is the microsoft OS,it seems they are patching security holes poorly...

    Also see here..


    http://www.flyingpenguin.com/?p=8091&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+flyingpenguin+%28flyingpenguin%29


    @Xinapse--->

    The source of this was leaked also recently ;), time to be taking over some power stations


    if possible can you share them please?







    I myself dont have it, i read on theregister that it has been leaked into the underground forums
    Xin
  • McKittrick
    Posts: 194
    i have not read alot about the stuxxnet worm. i am curious, why do they go through port 445? is the malware initiated through RPC and needs to bind to UUIDs from the portmapper? is it using named pipes?
  • Bursihido
    Posts: 406
    [video=youtube]
  • m0rph
    Posts: 332
    said:


    i have not read alot about the stuxxnet worm. i am curious, why do they go through port 445? is the malware initiated through RPC and needs to bind to UUIDs from the portmapper? is it using named pipes?


    This might explain some parts of it, obviously not all of it though. I was playing around with this exploit in the offsec labs...pretty powerful shit.

    I mean the ingenuity that went into creating this attack vector is so astounding to me. Whether it was an individual that came up with the idea or a team of geniuses...it doesn't matter.

    From what I understand there's this kind of flow of execution:

    Attacker --> [Malicious WritePrinter Requests through port 445] --> [Deletes files that are processed automatically in Wbem\Mof] --> [Wbem\Mof automatically \"executes\" malicious WritePrinter requests]

    Target --> [Shell] --> Attacker


    In words, the attacker sends malicious WritePrinter Requests to port 445 on the target and is subsequently stored in a .mof file in the Web\Mof directory. Then it deletes all other .mof files, and leaves itself as the only file to be "executed."

    UUID's can be appended to the target from the WritePrinter requests. You can also prepend UUID's..... O.o

    And yes it uses named pipes. You can actually name the smb pipe yourself, although the default value is "spoolss."

    Port 445 can be changed to whatever smb port is sharing a printer. I'm assuming 445 is a default printer sharing port though. Could be wrong, but given the attack vector of metasploit's version, I'd say it's likely.

    Anyway, here's what I've been ranting about:
    http://www.metasploit.com/modules/exploit/windows/smb/ms10_061_spoolss
    while( !(succeed = try() ) );
  • d4rkgt4
    Posts: 5
    dangerous malware i have used it
Add a Comment