Unmanarc Remote Control Server (URCS) Detection

critical Nessus Plugin ID 15405

Language:

Synopsis

The remote host may have been compromised.

Description

This host appears to be running Unmanarc Remote Control Server (URCS). While it does have some legitimate uses, URCS may also have been installed silently as a backdoor, which may allow an intruder to gain remote access to files on the remote system. If this program was not installed for remote management, then it means the remote host has been compromised.

An attacker may use it to steal files, passwords, or redirect ports on the remote system to launch other attacks.

Solution

Reinstall the operating system and files from backup unless URCS is intended to be installed.

Plugin Details

Severity: Critical

ID: 15405

File Name: JM_urcs.nasl

Version: 1.21

Type: remote

Family: Backdoors

Published: 10/1/2004

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

CVSS v2

Risk Factor: Critical

Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Detections

Analytics