Solved

Initial a Process over the Network in Memory

Posted on 2001-07-30
3
179 Views
Last Modified: 2010-04-06
Hi,
I read the advisory from the Code Red Worm and I wonder how could a Executeable create a Process over the Network in an other Computers Memory (in Delphi)?

Cheers Micha
0
Comment
Question by:PROGRAMMING030999
3 Comments
 
LVL 3

Accepted Solution

by:
rondi earned 300 total points
ID: 6336929
Symantec says:

>The CodeRed Worm affects Microsoft Index Server 2.0 and >the Windows 2000 Indexing service on computers running >Microsoft Windows NT 4.0 and Windows 2000 that run
>IIS 4.0 and 5.0 Web servers. The worm uses a known buffer
>overflow vulnerability contained in the file Idq.dll...

>The worm sends its code as an HTTP request. The HTTP >request exploits a known buffer-overflow vulnerability, >which allows the worm to run on your computer. The >malicious code is not saved as a file, but is inserted >into and then run directly from memory...

I have no idea how the worm gets code encoded as an
HTTP request to be loaded into memory as executable code.
It's pretty smart, though.

Without knowing the internal workings of IIS's DLLs, I think it'd be pretty difficult to create a remote process
without using some other existing 'listener' on the remote
machine to instantiate the process.

rondi
0
 
LVL 26

Expert Comment

by:Russell Libby
ID: 8734998
No comment has been added lately, so it's time to clean up this TA.
I will leave a recommendation in the Cleanup topic area that this question is:

Accept rondi's comment as answer

Please leave any comments here within the next seven days.
 
PLEASE DO NOT ACCEPT THIS COMMENT AS AN ANSWER!
 
Thank you,
Russell

EE Cleanup Volunteer
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you how to use the Windows Speech API in Delphi. I will only cover basic functions such as text to speech and controlling the speed of the speech. SAPI Installation First you need to install the SAPI type library, th…
Introduction Raise your hands if you were as upset with FireMonkey as I was when I discovered that there was no TListview.  I use TListView in almost all of my applications I've written, and I was not going to compromise by resorting to TStringGrid…
In this video I am going to show you how to back up and restore Office 365 mailboxes using CodeTwo Backup for Office 365. Learn more about the tool used in this video here: http://www.codetwo.com/backup-for-office-365/ (http://www.codetwo.com/ba…
With the power of JIRA, there's an unlimited number of ways you can customize it, use it and benefit from it. With that in mind, there's bound to be things that I wasn't able to cover in this course. With this summary we'll look at some places to go…

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now