RE: [Full-Disclosure] Automated ssh scanning

From: Todd Towles (toddtowles_at_brookshires.com)
Date: 08/26/04

  • Next message: Todd Towles: "RE: Betr.: RE: [Full-Disclosure] Automated ssh scanning" 
    To: "Ron DuFresne" <dufresne@winternet.com>
Date: Thu, 26 Aug 2004 11:00:49 -0500

    Hey Ron,

    Guest isn't a admin so they let the tool get in. But the real questions
    is, how does it get root access on a fully patched server? It appears to
    use a local exploit to gain root access. This is a problem.

    Sorry about the eariler e-mail, I haven't had my coffee today. Trying to
    cut back and spend that money on IT security =P

    -----Original Message-----
    From: full-disclosure-admin@lists.netsys.com
    [mailto:full-disclosure-admin@lists.netsys.com] On Behalf Of Ron
    DuFresne
    Sent: Thursday, August 26, 2004 9:08 AM
    To: Tig
    Cc: full-disclosure@lists.netsys.com
    Subject: Re: [Full-Disclosure] Automated ssh scanning

    the real thing this user most likely suffered from was the weak account
    passwd double, guest:guest. Now, if the admin and other account were
    setup with strong passwd's and this account was either setup with a
    strong passwd or not setup at all might be a better test of the
    stability of ssh and the debain setup in question.

    Thanks,

    Ron DuFresne

    On Thu, 26 Aug 2004, Tig wrote:

    > On Wed, 25 Aug 2004 19:43:47 -0400
    > Gerry Eisenhaur <GEisenhaur@Cisco.com> wrote:
    >
    > > I am confused, you said you knew about some SSH scanning going on,
    > > then set up those accounts on a box. Now you are curious way that
    > > box got rooted?
    > >
    > > Maybe I am missing something, but it seems you already have a pretty

    > > good assumption of why it got rooted.
    > >
    > > The software, as you seem to know, is a few exploits, a backdoor and

    > > some IRC stuff(bot and proxy).
    > >
    > > /gerry
    > >
    >
    > I think you did miss the point (which was a very good one). Basically,

    > once you have unprivileged access to a currently patched Woody box,
    > you can quickly gain root access.
    >
    > I would love to see this tested against other version of Linux and
    > *BSD with default (and updated) installations. Anyone have a spare box

    > and a few hours?
    >
    > -Tig
    >
    > _______________________________________________
    > Full-Disclosure - We believe in it.
    > Charter: http://lists.netsys.com/full-disclosure-charter.html
    >

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    "Cutting the space budget really restores my faith in humanity. It
    eliminates dreams, goals, and ideals and lets us get straight to the
    business of hate, debauchery, and self-annihilation." -- Johnny Hart
            ***testing, only testing, and damn good at it too!***

    OK, so you're a Ph.D. Just don't touch anything.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Todd Towles: "RE: Betr.: RE: [Full-Disclosure] Automated ssh scanning"

    Relevant Pages

    • Re: [Full-Disclosure] Automated ssh scanning
      ... server however I have a feeling the Kernel was left out of the patching. ... > use a local exploit to gain root access. ... if the admin and other account were ... > setup with strong passwd's and this account was either setup with a ...
      (Full-Disclosure)
    • RE: [Full-Disclosure] Automated ssh scanning
      ... > It appears to use a local exploit to gain root access. ... > account passwd double, guest:guest. ... > setup with a strong passwd or not setup at all might be a better test ... Charter: http://lists.netsys.com/full-disclosure-charter.html ...
      (Full-Disclosure)
    • Re: Turn off all virus-scanning software
      ... root access. ... Not in Vista - they need to do something to get root priviledges. ... user is not set up as an admin, you need to log in differently to access ... It is not the design of the OS, but its implementation, which differs. ...
      (rec.photo.digital.slr-systems)
    • Re: Compter recommendations
      ... Linux community is a hard task, I spent way too many years fixing way to many computers from people who should have known better, the problem aways has been the user when it comes to virus and sometimes no amount of training or cajoling is ever going to fix the lowest common denominator. ... I've never had a virus on Windows, and I'm not logged in as an admin with root access. ...
      (rec.photo.digital)
    • Re: PAM help needed (need su access over ssh connection)
      ... > files specifying the setup for each PAM-savvy application. ... > something in there that checks the terminal type, ... about root access. ...
      (comp.os.linux.security)