FTP and NT Scanner by Lomax

Does anyone know the details of how this program attempts to connect to a computer? Someone was able to access my terminal services server through local account and upload this program. In reviewing security event logs, I see that they did attempt to gain access to my network but were apparently unable to do so. I ran the tool to see what information they were likely working with and notice is that it doesn't seem to attempt domain logins, only local machine logins? I want to make sure I'm understanding the tool right so that I thoroughly examine the extent of their probable access.

No one here can put this puzzle together for you without:

a) fully understanding your environment.
b) analyzing all logs
c) understanding your business process
d) understanding what the software does that has compromised your host/network.

That said, the only "Lomax" I'm familiar with is Paul Lomax, who writes books for O'Reilly.

Can you provide a link to the software in question? At very least we can tell you what the software does and you can take it from there.

--TH13

Thanks for responding TH13. I suppose I wasn't clear in my questions. I know how the attacker gained access to my terminal server so I'm not so concerned about that part. He left the scanner I mentioned, though, and I was hoping someone knew the program and could give me more indepth info on its workings.

When I ran the tool (it's a CLI from a command prompt), it showed the name of the program as "FTP and NT Scanner by Lomax (credits Inode ([email protected]))." You can go to the site and see that the author took his tools off the web because they were being used for cracking. The tool seems pretty simple in that it tries to connect to computers within a given ip range using a brute force method. There is a username file and password file that it uses for determining a working login. But it seems to only attempt to log on to a machine's local account and not the domain. I just figured someone in the antionline community would be familiar with the tool and could confirm my suspicions of the program's workings or learn more about its capabilities. No big deal if there is not, though, as I'm confident that I've plugged the weak spot that was used to compromise my system. Thanks anyways.

While I'm not familiar with this specific tool, I'm VERY familiar with others that do the same thing. It sounds by your description that this is a simple "grinder" tool. My guess is that it also uses that static PW list against the standard TCP port for FTP (21).

Any chance you can zip up the tool and attach it here? If not, the size of the PW file alone will tell me how dangerous (or not) this is. If not, I can arrange for upload out of band.

Thanks.

Here's the tool. I'd say you're right about the way it works. What I'm not sure of is if it is just checking port 21 or any other ports (by default or by command). Take a look and let me know what you think.

Well, this is possibly a start:

Antivirus Version Update Result
AntiVir 6.35.0.21 07.09.2006 no virus found
Authentium 4.93.8 07.07.2006 no virus found
Avast 4.7.844.0 07.07.2006 no virus found
AVG 386 07.07.2006 no virus found
BitDefender 7.2 07.09.2006 no virus found
CAT-QuickHeal 8.00 07.07.2006 no virus found
ClamAV devel-20060426 07.07.2006 no virus found
DrWeb 4.33 07.09.2006 no virus found
eTrust-InoculateIT 23.72.64 07.09.2006 no virus found
eTrust-Vet 12.6.2291 07.07.2006 no virus found
Ewido 3.5 07.09.2006 no virus found
Fortinet 2.77.0.0 07.09.2006 suspicious
F-Prot 3.16f 07.07.2006 no virus found
F-Prot4 4.2.1.29 07.07.2006 no virus found
Ikarus 0.2.65.0 07.07.2006 no virus found
Kaspersky 4.0.2.24 07.09.2006 no virus found
McAfee 4802 07.07.2006 Tool-LoScan
Microsoft 1.1481 07.09.2006 no virus found
NOD32v2 1.1651 07.08.2006 no virus found
Norman 5.90.23 07.07.2006 no virus found
Panda 9.0.0.4 07.09.2006 no virus found
Sophos 4.07.0 07.09.2006 no virus found
Symantec 8.0 07.09.2006 no virus found
TheHacker 5.9.8.170 07.07.2006 no virus found
UNA 1.83 07.08.2006 no virus found
VBA32 3.11.0 07.09.2006 no virus found
VirusBuster 4.3.7:9 07.08.2006 no virus foun

So Fortinet didn't like the look of it amd McAfee thinks that it is "Tool-LoScan" I would go to the McAfee site and check up what they have about that in their malware library.



:)

I will run this tool in a sandbox tomorrow when I get to the office. I will see if it does any sneaky backdoor stuff too. Stay tuned.

Thanks.

--TH13

It's probably based on the source found here (only available though google cache as the original site took it offline) modified to make it run on Windows (cygwin). Looks like a plain FTP dictionary scanner. It probably used the "users" file for usernames and "pass" for passwords.

Yep, after some testing this is a vanilla grinder app. It uses the dictionary that comes with it to grind FTP servers and windows local accounts. No backdoors, etc.


--TH13

Thanks guys, I really appreciate it!

Sorry Nihil,

Just quickly, is there a firefox extension or some tool for quickly scanning something with all those different AVs?

Nope.

Simply go to www.virustotal.com and upload a sample. They run it against a handfull of vender signatures and the output is what Nihil has posted.

--TH13

Hi there wheaty_bytes

TH13 is quite right. I use virus total (he has given you the link) and Jotti, which is here:

http://virusscan.jotti.org/

The both do as he says but use slightly different mixtures of AVs, so you get a broader cover if you use both. I tend to use them as a "first pass" just to see if something has already been discovered or if it looks like a generic malware ;)

As this has been resolved, I won't add that much other than ntscan, ipcscan, and sqlscan have been the most popular tools I have seen in windows honeynet research. They all function as TH13 has noted; by grinding against a box with a list of passwords. Typically the password that got them in to your box will be at the top of the list if you find it on your box. An attacker typically will break in to a box and start trying to spread their sphere of influence in a matter of moments.
These are pretty much a part of the standard l337 h4x0r toolkit containing things like fport, psinfo and the like(usually a kit of 8 executables).

where can I downlod this FTP & Nt Scanner by lomax :)

Your probably lucky that it was only some "young'en" that rooted you, who by the sounds of it didn't really know what he was doing - password grinding remote domain machines is the action of someone who has either tried everything else and has run out of options, or someone who doesn't really understand what they are doing. Although personally I would still change any cached domain credentials and all local credentials if I was you.

If you had been rooted by someone who had half a clue, they would have left something a tad more advanced running, such as whosthere from the Pass the Hash toolkit - as this is not a virus it won't show up as such - and if they exploited you by a method that left them with a bind shell or similar, then it is possible some actions they performed would not show up in your eventvwr.

Personally I would perform a close inspection of everything on the server/work station. Don't presume that because you have plugged the original fault that allowed you to be rooted in the first place, that you are secure...if it was me I would take for granted that you would find the original attack vector that may even result in the server beeing removed/reformatted and would have provided myself with some other method to retain the access I have to your server and/or network...chances are they did not confine themselves to one server; unless you have good security practices/policies in place..which folks rarely do.

June 2006??????????????? :rolleyes:

Thread closed............... it cannot be relevant today.

G_O_O_G_L_E ;)