>>creates a backdoor listening on TCP/707 or some other randomly chosen port between TCP/666 and >TCP/765 [2]
There is a slim chance that the listener may fall outside this range, but it will generally be a random port in the range 666-765. Don't count on 707. >Telnetting to this port seems to disconnected after 1-5 characters have been entered? This doesn't look like TFTP (port 65/tcp&UDP), and the windows tftp client doesn't seem to offer any means of specifying a port to connect to? >Is this some kind of password protected backdoor ? No, it is not a command shell back door. It is the connect back point for the exploit payload. When an incoming connection is received, it checks for the string "Microsoft Windows" in the first packet it receives, then waits for the string "system32>" It then does a directory listing on the exploited machine to see if Nachi is already installed there and if so it simply closes the socket. If not, it pushes itself (Nachi) to the newly exploited machine, then launches Nachi on the remote machine and closes the socket. Chris _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html