|
|
RPCSS.EXE service
- Telnet to port 135 on older WinNT machines, type about 20 characters with CR, then disconnect, hangs service driving CPU to 100%. Only solution is to kill RPCSS.EXE. Fixed in SP3 and beyond.
- epdump.exe program will list all the "end-points", which lists the RPC services running an at which ports/named pipes.
- Snork: RPC datagram spoofing address of victim1, send to victim2. The two machines go into endless loop sending RPC error messages to each other. RPCSS.EXE goes to 100% utilization. Post-SP3 hotfix is "snk-fix", fixed in SP4.