Computer Associates, License Client Service

Help - Search - Member List - Calendar

Full Version: Computer Associates, License Client Service

GovernmentSecurity.org > System Security > Windows Systems

c°h°

Mar 6 2005, 11:33 AM

Hi all i searched whole google 4 it but cannot find

Do u know the default Port of CA License Client Service ?

maybe someone can help

tia

greets out there to all m8s

BuzzDee

Mar 6 2005, 12:38 PM

if an app has a default port it is for suer integrated somewhere in the exploit... so just look @ the code...

CODE

CA License Server "GETCONFIG" Remote Buffer Overflow Exploit
Date : 03/03/2005

----snip----

my $info =
{
'Name' => 'CA License Server GETCONFIG Overflow',
'Version' => '$Revision: 1.8 $',
'Authors' => [ 'Thor Doomen <syscall [at] hushmail.com>' ],
'Arch' => [ 'x86' ],
'OS' => [ 'win32', 'win2000', 'winxp', 'win2003' ],
'Priv' => 1,
'AutoOpts' => { 'EXITFUNC' => 'thread' },
'UserOpts' => {
'RHOST' => [1, 'ADDR', 'The target address'],
'RPORT' => [1, 'PORT', 'The target port', 10202], //<<------- HUH

should be all clear now

greetz

c°h°

Mar 6 2005, 01:05 PM

yep thx

BN Says:
THis is one of the few times when a THANKS is okay. When you get a response to your OWN question. Still, I'd like to see more than that, but I won't get my undies in a bunch over this.

Just thot I'd answer the Q before it was asked.

o0oKARo0o

Mar 7 2005, 08:48 PM

Isn´t it the 10203 port ?

int ip=htonl(inet_addr(argv[2])), port;
if (argc==4||argc==6){port=atoi(argv[3]);} else port=10203;

[eXPhase

Mar 7 2005, 09:12 PM

Server = 10202

Client Service = 10203

o0oKARo0o

Mar 8 2005, 06:31 PM

thanks for the info..

BN says:
I've already whacked you once today re: a THANKS post, so I'll let this one ride until you have a chance to see the latest PM about it.

If anyone sees this account post another THANKS, pls let me know, and we'll be done with this person once and for all.

And I totally agree with the next poster on all points....

droppunx

Mar 8 2005, 08:12 PM

QUOTE(o0oKARo0o @ Mar 8 2005, 06:31 PM)

so what are we supposed to scan then ?

You're supposed to scan your LAN to make sure you don't have a vuln version of the affected vulnerability, and that's about it. Anything else take outside the forum, christ...

QUOTE(o0oKARo0o @ Mar 8 2005, 06:31 PM)

The client, the server or both ?

And I really hate to be rude, but before making comments outside of your own network security and then making simply stupid comments could you please think for a second, you answered your own question and if you read the damn title of the exploit hopefully you can figure it out (BuzzDee and you are referring to two different exploits)

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.


Help - Search - Member List - Calendar Full Version: Computer Associates, License Client Service GovernmentSecurity.org > System Security > Windows Systems c°h° Mar 6 2005, 11:33 AM Hi all i searched whole google 4 it but cannot find Do u know the default Port of CA License Client Service ? maybe someone can help tia greets out there to all m8s BuzzDee Mar 6 2005, 12:38 PM if an app has a default port it is for suer integrated somewhere in the exploit... so just look @ the code... CODE CA License Server "GETCONFIG" Remote Buffer Overflow Exploit Date : 03/03/2005 ----snip---- my $info = { 'Name' => 'CA License Server GETCONFIG Overflow', 'Version' => '$Revision: 1.8 $', 'Authors' => [ 'Thor Doomen <syscall [at] hushmail.com>' ], 'Arch' => [ 'x86' ], 'OS' => [ 'win32', 'win2000', 'winxp', 'win2003' ], 'Priv' => 1, 'AutoOpts' => { 'EXITFUNC' => 'thread' }, 'UserOpts' => { 'RHOST' => [1, 'ADDR', 'The target address'], 'RPORT' => [1, 'PORT', 'The target port', 10202], //<<------- HUH should be all clear now greetz c°h° Mar 6 2005, 01:05 PM yep thx BN Says: THis is one of the few times when a THANKS is okay. When you get a response to your OWN question. Still, I'd like to see more than that, but I won't get my undies in a bunch over this. Just thot I'd answer the Q before it was asked. o0oKARo0o Mar 7 2005, 08:48 PM Isn´t it the 10203 port ? int ip=htonl(inet_addr(argv[2])), port; if (argc==4\|\|argc==6){port=atoi(argv[3]);} else port=10203; [eXPhase Mar 7 2005, 09:12 PM Server = 10202 Client Service = 10203 o0oKARo0o Mar 8 2005, 06:31 PM thanks for the info.. BN says: I've already whacked you once today re: a THANKS post, so I'll let this one ride until you have a chance to see the latest PM about it. If anyone sees this account post another THANKS, pls let me know, and we'll be done with this person once and for all. And I totally agree with the next poster on all points.... droppunx Mar 8 2005, 08:12 PM QUOTE(o0oKARo0o @ Mar 8 2005, 06:31 PM) so what are we supposed to scan then ? You're supposed to scan your LAN to make sure you don't have a vuln version of the affected vulnerability, and that's about it. Anything else take outside the forum, christ... QUOTE(o0oKARo0o @ Mar 8 2005, 06:31 PM) The client, the server or both ? And I really hate to be rude, but before making comments outside of your own network security and then making simply stupid comments could you please think for a second, you answered your own question and if you read the damn title of the exploit hopefully you can figure it out (BuzzDee and you are referring to two different exploits) This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.