Re: funky syslog entry

[Valdis.Kletnieks () VT EDU (Valdis Kletnieks)]

On Mon, 26 Jun 2000 17:44:25 EDT, klug <klug () KLUG CX>  said:
> While searching through syslog entries I found this little tid bit.
> Others and I, believe its some sort of scan. Any ideas are welcome.

> Jun 24 14:39:10 * portmap[27279]:
> connect from 193.40.245.45 to dump(): request from unauthorized host

Somebody did an 'rpcinfo -p' against you. ;)

This is pretty stock first-thing if you';re about to try any of the many
rpc.* exploits - you need to get the port number first, and portmap is
made for that..

Theory of operation:

1) Contact portmap, get the service->port mappings.
2) Launch rpc.cmsd, rpc.ttdbserver, rpc.frobozzz exploit at the proper port.


--
                                Valdis Kletnieks
                                Operating Systems Analyst
                                Virginia Tech


<HR NOSHADE>
<UL>
<LI>application/pgp-signature attachment: stored
</UL>