Decompiled Source For MS RPC DCOM Blaster Worm

Originally from Robert Graham, this is the Blaster worm's decompiled source code. You can see how simple it is, and how easy it is to reconstruct a worm for an arbitrary exploit using this codebase. Just drop in a new exploit and retarget it. However, Blaster's efficiency was somewhat diminished in that it used a TFTP file transfer to move the worm executable around rather than direct injection. You'll want to compare Blaster (August, 2003) with Sasser (May, 2004) to see how well that mechanism works anymore (which is to say it's less effective than it was originally).

This file contains source code for the "msblast.exe" worm that was launched against the Internet on August 10, 2003.

This "source-code" was decompiled using "IDApro", an "interactive disassembler". IDA is the most popular tool for inspecting binary files. Note that IDA doesn't create the source itself, but just helps understand the binary so that source can be discovered.

Disclosing the source to blaster will not help blackhats. The Blaster worm is not very good. However, it is useful for whitehats to have a complete dissection of the worm.

Source: Decompiled Source For MS RPC DCOM Blaster Worm, originally from Robert Graham.