Re: [Full-Disclosure] Automated ssh scanning

From: VeNoMouS (
Date: 08/26/04

  • Next message: Charles Heselton: "Re: [Full-Disclosure] new email virus?"
    To: "Richard Verwayen" <>, "FD" <>
    Date: Thu, 26 Aug 2004 12:59:35 +1200

     kernel do_brk exploit by isec, this has had some
    extra payload added, which when runs goes to on port 80
    requesting /~telecom69/gov.php which is offline, seems to also mess with
    some binarys as so is running after reboot, cant see where yet ( kinda
    confused about that one )
    Ptrace/kmod kernel exploit by isec -
    root kit with backdoor'd ssh listens on port 26000 which replaces smbd
    binary, loggin of the ssh connections goes to /usr/include/iceconf.h , also
    has a crappy tcp sniffer which logs to /usr/lib/libice.log,

    ***** backdoor password for this is ice4budu
    emech setup for undernet to join #tty , which there are a bunch of bots in
    there atm ( maybe 10 )

    anyway hope that helps

    ----- Original Message -----
    From: "Richard Verwayen" <>
    To: "FD" <>
    Sent: Thursday, August 26, 2004 10:32 AM
    Subject: [Full-Disclosure] Automated ssh scanning

    > Hello list!
    > A few weeks ago there was a discussion about automated ssh scanning with
    > user/password combinations like guest/guest or admin/admin.
    > I set up a debian woody fully patched with both accounts activated, and
    > got rooted some days later...
    > The attackers installed some software and irc-bots and tried to use this
    > host for testing other computers, thats not the point. I would like to
    > know where's the weak point in the system? As the system was updates on
    > a daily base! The only known weakness were these two accounts!
    > Here is a list of software the attacker used, maybe someone could bring
    > a bit light into this tunnel!
    > wget
    > wget
    > wget
    > wget
    > wget
    > wget
    > Richard
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter:

    Full-Disclosure - We believe in it.

  • Next message: Charles Heselton: "Re: [Full-Disclosure] new email virus?"

    Relevant Pages