[Dshield] infocon: yellow

Jonathan Rickman jonathan at xcorps.net
Mon Aug 11 21:38:12 GMT 2003


On Monday 11 August 2003 17:01, Chris Ream wrote:
> Has anyone captured the packet stream? I've got some sensors listening
> but have not yet seen it. I would like to reconstruct it and disassemble
> it to find out exactly what it's doing.
>
> If anyone has captured it and is willing to share it I would greatly
> appreciate it.

Hex dump from netcat attached.

-- 
Jonathan Rickman
X Corps Security
http://www.xcorps.net

-------------- next part --------------
00000000  05 00 0b 03 10 00 00 00  48 00 00 00 7f 00 00 00 ........ H.......
00000010  d0 16 d0 16 00 00 00 00  01 00 00 00 01 00 01 00 ........ ........
00000020  a0 01 00 00 00 00 00 00  c0 00 00 00 00 00 00 46 ........ .......F
00000030  00 00 00 00 04 5d 88 8a  eb 1c c9 11 9f e8 08 00 .....].. ........
00000040  2b 10 48 60 02 00 00 00                          +.H`.... 
00000048  05 00 00 03 10 00 00 00  a8 06 00 00 e5 00 00 00 ........ ........
00000058  90 06 00 00 01 00 04 00  05 00 06 00 01 00 00 00 ........ ........
00000068  00 00 00 00 32 24 58 fd  cc 45 64 49 b0 70 dd ae ....2$X. .EdI.p..
00000078  74 2c 96 d2 60 5e 0d 00  01 00 00 00 00 00 00 00 t,..`^.. ........
00000088  70 5e 0d 00 02 00 00 00  7c 5e 0d 00 00 00 00 00 p^...... |^......
00000098  10 00 00 00 80 96 f1 f1  2a 4d ce 11 a6 6a 00 20 ........ *M...j. 
000000A8  af 6e 72 f4 0c 00 00 00  4d 41 52 42 01 00 00 00 .nr..... MARB....
000000B8  00 00 00 00 0d f0 ad ba  00 00 00 00 a8 f4 0b 00 ........ ........
000000C8  20 06 00 00 20 06 00 00  4d 45 4f 57 04 00 00 00  ... ... MEOW....
000000D8  a2 01 00 00 00 00 00 00  c0 00 00 00 00 00 00 46 ........ .......F
000000E8  38 03 00 00 00 00 00 00  c0 00 00 00 00 00 00 46 8....... .......F
000000F8  00 00 00 00 f0 05 00 00  e8 05 00 00 00 00 00 00 ........ ........
00000108  01 10 08 00 cc cc cc cc  c8 00 00 00 4d 45 4f 57 ........ ....MEOW
00000118  e8 05 00 00 d8 00 00 00  00 00 00 00 02 00 00 00 ........ ........
00000128  07 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000138  00 00 00 00 c4 28 cd 00  64 29 cd 00 00 00 00 00 .....(.. d)......
00000148  07 00 00 00 b9 01 00 00  00 00 00 00 c0 00 00 00 ........ ........
00000158  00 00 00 46 ab 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
00000168  00 00 00 46 a5 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
00000178  00 00 00 46 a6 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
00000188  00 00 00 46 a4 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
00000198  00 00 00 46 ad 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
000001A8  00 00 00 46 aa 01 00 00  00 00 00 00 c0 00 00 00 ...F.... ........
000001B8  00 00 00 46 07 00 00 00  60 00 00 00 58 00 00 00 ...F.... `...X...
000001C8  90 00 00 00 40 00 00 00  20 00 00 00 38 03 00 00 .... at ...  ...8...
000001D8  30 00 00 00 01 00 00 00  01 10 08 00 cc cc cc cc 0....... ........
000001E8  50 00 00 00 4f b6 88 20  ff ff ff ff 00 00 00 00 P...O..  ........
000001F8  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000208  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000218  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000228  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000238  00 00 00 00 00 00 00 00  01 10 08 00 cc cc cc cc ........ ........
00000248  48 00 00 00 07 00 66 00  06 09 02 00 00 00 00 00 H.....f. ........
00000258  c0 00 00 00 00 00 00 46  10 00 00 00 00 00 00 00 .......F ........
00000268  00 00 00 00 01 00 00 00  00 00 00 00 78 19 0c 00 ........ ....x...
00000278  58 00 00 00 05 00 06 00  01 00 00 00 70 d8 98 93 X....... ....p...
00000288  98 4f d2 11 a9 3d be 57  b2 00 00 00 32 00 31 00 .O...=.W ....2.1.
00000298  01 10 08 00 cc cc cc cc  80 00 00 00 0d f0 ad ba ........ ........
000002A8  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
000002B8  18 43 14 00 00 00 00 00  60 00 00 00 60 00 00 00 .C...... `...`...
000002C8  4d 45 4f 57 04 00 00 00  c0 01 00 00 00 00 00 00 MEOW.... ........
000002D8  c0 00 00 00 00 00 00 46  3b 03 00 00 00 00 00 00 .......F ;.......
000002E8  c0 00 00 00 00 00 00 46  00 00 00 00 30 00 00 00 .......F ....0...
000002F8  01 00 01 00 81 c5 17 03  80 0e e9 4a 99 99 f1 8a ........ ...J....
00000308  50 6f 7a 85 02 00 00 00  00 00 00 00 00 00 00 00 Poz..... ........
00000318  00 00 00 00 00 00 00 00  00 00 00 00 01 00 00 00 ........ ........
00000328  01 10 08 00 cc cc cc cc  30 00 00 00 78 00 6e 00 ........ 0...x.n.
00000338  00 00 00 00 d8 da 0d 00  00 00 00 00 00 00 00 00 ........ ........
00000348  20 2f 0c 00 00 00 00 00  00 00 00 00 03 00 00 00  /...... ........
00000358  00 00 00 00 03 00 00 00  46 00 58 00 00 00 00 00 ........ F.X.....
00000368  01 10 08 00 cc cc cc cc  10 00 00 00 30 00 2e 00 ........ ....0...
00000378  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 ........ ........
00000388  01 10 08 00 cc cc cc cc  68 00 00 00 0e 00 ff ff ........ h.......
00000398  68 8b 0b 00 02 00 00 00  00 00 00 00 00 00 00 00 h....... ........
000003A8  86 01 00 00 00 00 00 00  86 01 00 00 5c 00 5c 00 ........ ....\.\.
000003B8  46 00 58 00 4e 00 42 00  46 00 58 00 46 00 58 00 F.X.N.B. F.X.F.X.
000003C8  4e 00 42 00 46 00 58 00  46 00 58 00 46 00 58 00 N.B.F.X. F.X.F.X.
000003D8  46 00 58 00 9d 13 00 01  cc e0 fd 7f cc e0 fd 7f F.X..... ........
000003E8  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
000003F8  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000408  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000418  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000428  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000438  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000448  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000458  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000468  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000478  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90 ........ ........
00000488  90 90 90 90 90 90 90 eb  19 5e 31 c9 81 e9 89 ff ........ .^1.....
00000498  ff ff 81 36 80 bf 32 94  81 ee fc ff ff ff e2 f2 ...6..2. ........
000004A8  eb 05 e8 e2 ff ff ff 03  53 06 1f 74 57 75 95 80 ........ S..tWu..
000004B8  bf bb 92 7f 89 5a 1a ce  b1 de 7c e1 be 32 94 09 .....Z.. ..|..2..
000004C8  f9 3a 6b b6 d7 9f 4d 85  71 da c6 81 bf 32 1d c6 .:k...M. q....2..
000004D8  b3 5a f8 ec bf 32 fc b3  8d 1c f0 e8 c8 41 a6 df .Z...2.. .....A..
000004E8  eb cd c2 88 36 74 90 7f  89 5a e6 7e 0c 24 7c ad ....6t.. .Z.~.$|.
000004F8  be 32 94 09 f9 22 6b b6  d7 4c 4c 62 cc da 8a 81 .2..."k. .LLb....
00000508  bf 32 1d c6 ab cd e2 84  d7 f9 79 7c 84 da 9a 81 .2...... ..y|....
00000518  bf 32 1d c6 a7 cd e2 84  d7 eb 9d 75 12 da 6a 80 .2...... ...u..j.
00000528  bf 32 1d c6 a3 cd e2 84  d7 96 8e f0 78 da 7a 80 .2...... ....x.z.
00000538  bf 32 1d c6 9f cd e2 84  d7 96 39 ae 56 da 4a 80 .2...... ..9.V.J.
00000548  bf 32 1d c6 9b cd e2 84  d7 d7 dd 06 f6 da 5a 80 .2...... ......Z.
00000558  bf 32 1d c6 97 cd e2 84  d7 d5 ed 46 c6 da 2a 80 .2...... ...F..*.
00000568  bf 32 1d c6 93 01 6b 01  53 a2 95 80 bf 66 fc 81 .2....k. S....f..
00000578  be 32 94 7f e9 2a c4 d0  ef 62 d4 d0 ff 62 6b d6 .2...*.. .b...bk.
00000588  a3 b9 4c d7 e8 5a 96 80  ae 6e 1f 4c d5 24 c5 d3 ..L..Z.. .n.L.$..
00000598  40 64 b4 d7 ec cd c2 a4  e8 63 c7 7f e9 1a 1f 50 @d...... .c.....P
000005A8  d7 57 ec e5 bf 5a f7 ed  db 1c 1d e6 8f b1 78 d4 .W...Z.. ......x.
000005B8  32 0e b0 b3 7f 01 5d 03  7e 27 3f 62 42 f4 d0 a4 2.....]. ~'?bB...
000005C8  af 76 6a c4 9b 0f 1d d4  9b 7a 1d d4 9b 7e 1d d4 .vj..... .z...~..
000005D8  9b 62 19 c4 9b 22 c0 d0  ee 63 c5 ea be 63 c5 7f .b...".. .c...c..
000005E8  c9 02 c5 7f e9 22 1f 4c  d5 cd 6b b1 40 64 98 0b .....".L ..k. at d..
000005F8  77 65 6b d6                                      wek.
000005FC  93 cd c2 94 ea 64 f0 21  8f 32 94 80 3a f2 ec 8c .....d.! .2..:...
0000060C  34 72 98 0b cf 2e 39 0b  d7 3a 7f 89 34 72 a0 0b 4r....9. .:..4r..
0000061C  17 8a 94 80 bf b9 51 de  e2 f0 90 80 ec 67 c2 d7 ......Q. .....g..
0000062C  34 5e b0 98 34 77 a8 0b  eb 37 ec 83 6a b9 de 98 4^..4w.. .7..j...
0000063C  34 68 b4 83 62 d1 a6 c9  34 06 1f 83 4a 01 6b 7c 4h..b... 4...J.k|
0000064C  8c f2 38 ba 7b 46 93 41  70 3f 97 78 54 c0 af fc ..8.{F.A p?.xT...
0000065C  9b 26 e1 61 34 68 b0 83  62 54 1f 8c f4 b9 ce 9c .&.a4h.. bT......
0000066C  bc ef 1f 84 34 31 51 6b  bd 01 54 0b 6a 6d ca dd ....41Qk ..T.jm..
0000067C  e4 f0 90 80 2f a2 04 00  5c 00 43 00 24 00 5c 00 ..../... \.C.$.\.
0000068C  31 00 32 00 33 00 34 00  35 00 36 00 31 00 31 00 1.2.3.4. 5.6.1.1.
0000069C  31 00 31 00 31 00 31 00  31 00 31 00 31 00 31 00 1.1.1.1. 1.1.1.1.
000006AC  31 00 31 00 31 00 31 00  31 00 2e 00 64 00 6f 00 1.1.1.1. 1...d.o.
000006BC  63 00 00 00 01 10 08 00  cc cc cc cc 20 00 00 00 c....... .... ...
000006CC  30 00 2d 00 00 00 00 00  88 2a 0c 00 02 00 00 00 0.-..... .*......
000006DC  01 00 00 00 28 8c 0c 00  01 00 00 00 07 00 00 00 ....(... ........
000006EC  00 00 00 00                                      ....


More information about the list mailing list