Re: tftp plugin bug

From: Alan Pitts (ampat_private)
Date: Thu Sep 20 2001 - 12:59:19 PDT

  • Next message: Renaud Deraison: "[Fwd: Another Nimda scanner]"

    Renaud Deraison writes:
     > On Thu, Sep 20, 2001 at 12:35:09PM -0400, Alan Pitts wrote:
     > > 
     > > I was trying to set the default file name to grab w/ the tftp plugin
     > > and couldn't figure out how to do that. So I looked in code for a way
     > > to do that. I noticed that it doesn't seem to be adding and getting
     > > the preference for the file name correctly (I may be missing something
     > > though).
     > > 
     > > In tftp_grab_file.c I had to:
     > 
     > Actually, this was a reminisence of the pre-per-plugin preference era,
     > where 'test_file' was a valid entry in nessusd.conf (it's still is
     > though).
     > 
    
    OK. before my time.
    
     > I'm not sure this is really needed though...
     > 
    
    ??? not sure what is really needed ? The .conf entry, the preference,
    the plugin ? 
    
    I was trying trying to make this work to test for the Nimda worm. The
    worm appears to move some files around w/tftp and leaves a tftp server
    listening. We have seen recently infected machines trying to do tftp
    get Admin.dll. 
    
    Cheers,
    Alan
    
    -- 
    -----------------------------------------------------
    Alan Pitts             |    E-Mail:  ampat_private
    UUNet Technologies     |    Ph:      614.723.4954
    -----------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Thu Sep 20 2001 - 12:59:45 PDT