Tachytelic.net

How To

Using packet capture to find virus infected clients

by 1 Comment

Today a customer started to get a lot of their e-mails bounced. In fact they could not even e-mail me to let me know about the problem as my own mail servers were rejecting their messages.

The reason for this was because their IP address had been listed on the CBL.

I had a poke around the server and everything seemed to be in good order; patched up to date, virus scanner had nothing interesting to report, netstat did not show any abnormal connections and Exchange queues seemed normal. So I assumed that the problem must be coming from one of the network PCs.

This customer has a dual nic SBS 2003 Standard edition server, not my preferred set-up, but the system had to be implemented in this way to fit in with existing infrastructure. It is not possible to see what traffic is passing through the NAT gateway on RRAS with the built in tools, but Microsoft Netmon 3.1 should be able to show up any strange network traffic. I installed it and ran the following filter:

Tcp.dstport == 25 and ipv4.Address != 192.168.200.1

192.168.200.1 is the IP address of the internet facing NIC on the SBS machine.

Within a couple of minutes this filter showed all the machines on the network sending SMTP based traffic except for the SBS server itself. Fortunately there was only one. I took remote control of the machine and from the command line ran:

netstat -ano |find ??????:25??????

The output of this command showed me the local processes which were attempting to communicate with other hosts on port 25 and gave me confirmation that this PC was definitely infected with some kind of mass mailing virus or worm. Killing the process listed by the netstat command stopped the mass mailer and gave some breathing space to find the cause of the problem.

Turns out the machine in question had its virus checker disabled. So I turned it back on and ran a full scan which turned up almost 6,000 files infected with W32/MyDoom.

Once the problem had been found it was easy to sort, but because I have so few customers with this set-up it had not occurred to me how little visibility you get over network traffic with the SBS 2003 standard edition tools.

The joys of travelling sales laptops 😀

How to Tunnel RDP over SSH

by 10 Comments

I regularly use SSH to connect to customer systems and tunnel various different sorts of traffic through it (Telnet, ODBC, RDP etc). In certain cases, I have no other method of remote access to systems other than SSH.

This has not been a problem until I recently upgraded to Windows Vista which includes remote desktop connection v6, which will not allow connections to 127.0.0.1 on any port, it complains with the error message:

“The client could not connect. You are already connected to the console of this computer. A new console session cannot be established”

Which of course is true, if I were trying to connect to 3389.

So today after spending significant effort in the last couple of months I have found a simple solution to the problem:

  • Instruct your SSH client to listen on all interfaces for connections. For command line this means adding “-g” to your connection. I am using putty so ticking the box that says “local ports accept connections from other hosts” under Connection/SSH/Tunnels will do the job.

Putty

  • In the remote desktop client use 127.0.0.2 as the destination host and it will then happily pass through any tunnels you have created. For example 127.0.0.2:3390

I realize there probably are not that many people out there using SSH to tunnel RDP, but if you are then RDP 6 has been a real pain until now.