Re: Use Rpcdump for Intrusion detection
Jean-Baptiste Marchand <[email protected]>
| Newsgroups | gmane.comp.security.intrusions |
|---|---|
| Message-ID | <[email protected]> |
* lee forrest <[email protected]> [01/01/70 - 01:00]: > Netstat -ao shows which PID's are opening ports on your machine however if > you really want to check the rpc end point mapper database , use > RPCDUMP.EXE. > So you can quickly check which servers are registered on your machine or a > target machine and which interfaces. rpcdump will only return RPC services that have registered with the endpoint mapper. If you really want to check if a given port is used by a dce rpc service, you must use the ifids program: http://www.hsc.fr/ressources/presentations/hivercon03/img59.html Demonstration of ifids against RPC services listening on named pipes (SMB transport): http://www.hsc.fr/ressources/presentations/sambaxp2003/slide24.html Open-source versions of rpcdump and ifids (written by Todd Sabin) are available at: http://www.bindview.com/Support/RAZOR/Utilities/Windows/rpctools1.0-readme.cfm Jean-Baptiste Marchand -- [email protected] HSC - http://www.hsc.fr/ _______________________________________________ Intrusions mailing list [email protected] http://www.dshield.org/mailman/listinfo/intrusions