Detecting Conficker with Linux Tools

As Linux sysadmins, many of us still need to deal with Windows worms and how they affect our networks. Tomorrow is April 1st, and the Conficker worm will be activating on vulnerable computers everywhere. Here's a quick HOW-TO showing how you can detect compromised and/or vulnerable computers on your network:

There are 2 fairly easy methods available at this late hour.

The first is simple to use, but slow as heck. In the author's defense, it's just a proof of concept. But it works. :) It's written in Python, and has both the python script (which requires the Impacket library) and a self-contained Windows version if you're stuck on a Windows box.

This site has links to both versions, along with some instructions. The website seems to be able to keep up with the traffic it's getting, whereas some other sites are getting crumbled as admins scramble to sniff their networks.

The second method uses a brand spanking new version of NMAP to do the detecting. The advantage is it's much quicker at scanning larger networks. The disadvantage is it requires a bit of commandline fu. Fear not, it's as easy as copy/paste.

First, get the version for your operating system. NOTE: You MUST get nmap-4.85BETA5 because earlier versions won't scan for Conficker.

Once you install nmap, you'll want to run the command:

nmap -PN -d -p445 --script=smb-check-vulns --script-args=safe=1 [network_range]

Where [network_range] is something like 10.10.5.1-255 or even 10.10.0.0/16.

You'll need to look through the results for information like:

Host script results:
| smb-check-vulns:
| MS08-067: FIXED
| Conficker: Likely INFECTED
|_ regsvc DoS: VULNERABLE

And then fix/patch those hosts. I'd suggest sending the results to a text file, and grepping for the word VULNERABLE or INFECTED -- but those types of instructions are beyond the scope of this quick hack of a post. :)

UPDATE: (Thanks to Matt McMahon)
Great summary, Shawn. Couple of add’l notes. First, the author of the smb-check-vulns script (Ron Bowes) has some very recent updates on his blog and yes, that site is being hit pretty hard right now, don’t expect ninja-like-speed. To even save a visit, I’ll summarize…

*ahem*

The 4.85BETA5 version of nmap does return some false positives and will, under some circumstances, fail to even run the script on machines when it should (that one bit me). The author is keeping the code updated by the minute and has fixed these bugs, but hasn’t (yet) released a BETA6. The easiest way for you to keep up is with his SVN repository. Instructions are on the website above, but in an effort to save mouse-clicks, I’ll copy ‘n’ paste:

svn co –username=guest –password=” \
svn://svn.insecure.org/nmap
cd nmap
./configure
make
make install

This is source code and built fine in my Slackware install, YMMV…

______________________

Shawn Powers is an Associate Editor for Linux Journal. You might find him chatting on the IRC channel, or Twitter

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Thanks

skyl's picture

Nice post. I hope that .deb moves up to this soon I have jaunty and still at 4.76.

BETA6

Divakar's picture

Checked just now, Beta6 is available

White Paper
Linux Management with Red Hat Satellite: Measuring Business Impact and ROI

Linux has become a key foundation for supporting today's rapidly growing IT environments. Linux is being used to deploy business applications and databases, trading on its reputation as a low-cost operating environment. For many IT organizations, Linux is a mainstay for deploying Web servers and has evolved from handling basic file, print, and utility workloads to running mission-critical applications and databases, physically, virtually, and in the cloud. As Linux grows in importance in terms of value to the business, managing Linux environments to high standards of service quality — availability, security, and performance — becomes an essential requirement for business success.

Learn More

Sponsored by Red Hat

White Paper
Private PaaS for the Agile Enterprise

If you already use virtualized infrastructure, you are well on your way to leveraging the power of the cloud. Virtualization offers the promise of limitless resources, but how do you manage that scalability when your DevOps team doesn’t scale? In today’s hypercompetitive markets, fast results can make a difference between leading the pack vs. obsolescence. Organizations need more benefits from cloud computing than just raw resources. They need agility, flexibility, convenience, ROI, and control.

Stackato private Platform-as-a-Service technology from ActiveState extends your private cloud infrastructure by creating a private PaaS to provide on-demand availability, flexibility, control, and ultimately, faster time-to-market for your enterprise.

Learn More

Sponsored by ActiveState