have seen this posted somewhere else:

hmm
sounds interesting, but am curious whats behind it (what exploit etc)

Would like to see some more info on it

quick search gave me this:

http://securityresponse.symantec.com/avcen...vgate.j@mm.html

old worm

http://securityresponse.symantec.com/avcen...vgate.j@mm.html

It's some worm...
more info in that URL i gave

yeah it's the lovegate worm

http://www.rz.uni-karlsruhe.de/Uni/RZ/Netz...V_LovgateI.html

LOL

well that settles it
it's a worm

an old one even.

a worm is bummer, cause AV's will propably detect it.

Although if AV does not detect Lovegate, then it will not detect my stuff *evil smile*

Did anyone try this with any luck?

Some of my "friends" playd around with this.
Scanned for open Port and tryt to connect via nc... But only some US Server seemed to be infected. So don't know if it is good.

This is NOT an exploit, cause you need no tools for this 'virus'

You scan on port 20168 and check the scans like mentioned in the start-posting.

then you simply connect to that IP with telnet...

It's NOT a new exploit, it's old (september 2003) and it's called after the virusses name --> LoveGate.

old but very interesting...

this is virus ;] to connect use netcat:

nc -vv IP 20168

yep lovesun roxxxxx.....

hax hax hax ....

very good hole

i used this a while ago and i remember rooting quite a few servers with this, but now its pretty much useless. it has very low odds

Huh, this worm is a benediction for us, very nice

looks really great thx for the info m8

i tried it and no luck i think its too old or maybe im doing it wrong


[QUOTE]Technology is dominated by two types of people: those who understand what they do not manage, and those who manage what they do not understand.

i have tested it yesterday and get 2 shells of !
I connect with telnet and it works fine

THX
t00sTr0nG

it's not new anymore, knew like 2 weeks ago. Not much results with it anymore.

Greetz, Jeroen

I've found many results with it.

And 99% of them gave shell.

here is scanline

http://www.foundstone.com/resources/freetools/scanline.zip? PHPSESSID=4a36e39e7ce238c7d58fde8f39eef5cc

yes it's works , but ... i don't think that's so possible to scan for it. i've testing this hole over one week and i got lots of results with shell but the most of them were not faster than 2-3 mbit about 80% of my results were simple ADSL lines and home PCs. if you're happy with hacking adsl lines than try it. but tell me if i'm wrong

good luck

ok M8
i will try

haha
now i don't scan ipc$,i can 20168!

I have test it but don't find 20168 open port

i found some but just adsl

what is that?

lol thats not the shell your ment to get, looks like some sort of adsl/cable router console

I DON´T think it is a shell LOL

That RPC-3 telnet console is a power management system. For controlling big UPS's like for entire racks at colocation facilities, or something else along that size.

I found a lot of these !!!! Be careful !!!

After I test several Hosts/Ports it was listening on ALL PORTS !!!!
(so port 80 110 139 8181 9191 all the same shit....)

so from my point of view it could be a honeypot too... I not check further...

may someone knows more...

C'ya
Steven

hehe shell Work but not lot of
and much script kiddies use this port

hey
now i can understand why pplz scanned my computer for this port
lol
thnkx u guys
now i'll be the one who do da scan not only the one got scanned

i scanned mah friend's computer and i got this message in file called vulnerable.txt

LOL nice question.. hmm that means (at the first line) You have started to scan one IP @ Thu Feb 19 07:08:40 2004

this line means Nothing

-------------------------------------------------------------------------------

but now a very very very important line

Scan finished at Thu Feb 19 07:08:46 2004

YES your scanner is done to scan your ONE IP

And the Scanner found nothing..

Thinking before asking because

Cya Doc.

OKOK My english is not perfect.. but i have to answer of this st... question *sorry*

lol
thnkz Dr
i asked myself if the scanner will till if this port is open or not
so
i asked u in the forum
i know what every line means but i just needed to know if the scanner have to tell me any more infos about this port like if this port is open or not
that's all
thnkx again for ur help
peace

it's very cool
but the shell is not very perfect
such as in the c:\winnt\system32 can't excute regedit
if you want you must change to c:\winnt

haven't found any server yet still exploitable on port 20168.. maybe more luck in the future but not yet..

i found most victim in our university's lan

i found very much ip in my cable :] ...
but we have slow connection so i dont hack them ...

lovesun is very good hole and easy to learn
try mayby you will success :]

This one is mostly only on Dynamic IP accounts or slow broadband accounts now. Not much use really.

Now, i have found a few good server with 10-50 Mbit.

They are rare, but all other vulns too usually give you slow servers.

edited :
my mistake the lsass just moved to another port and i can't find the lovegate.worm ... ?

edited:

kk found it it's called FixlGate.com / FixlGate.exe
(by Symantec)

the only thing i get is :

ducky, you can't do anything withit cause that one wont work.

Just keep scanning and then check them like in the first thread, you'll only get a shell if it comes up with C:\WINNT\system32 orC:\WINDOWS\system32

This virus is still working for me