Re: Linux Kernel Exploits / ABFrag

From: Christopher Wagner (chrisw@pacaids.com)
Date: 10/17/02 

From: "Christopher Wagner" <chrisw@pacaids.com>
To: <incidents@securityfocus.com>
Date: Thu, 17 Oct 2002 11:35:49 -0700

About all I can guess with the information provided, is that this is just a
copy-cat variant of the Slapper worm, how would you describe the "strange
TCP behaviour?" Are you up-to-date on your patches? Are you running
Apache? If you have the binary, please attach this time.

Christopher Wagner
<chrisw@pacaids.com>

Quote-->
Greetings.
    Today I had a rather strange experiance. At about 4:30 pm GMT my
IDS began reporting strange TCP behaviour on my network segment. As I
was unable to verify the cause of this behaviour I was forced to remove
the Linux box that I use a border gateway and traffic monitor - at no small
cost to my organization - the network is yet to be reconnected.
After a reboot and preliminary analysis I found the binary ABfrag sitting
in /tmp. It had only been created minutes before.
Setting up a small sandbox I ran the program and was presented with the
following
output:

----------------------------------------------------------------------------

ABfrag - Linux Kernel ( <= 2.4.20pre20 ) Remote Syncing exploit

Found and coded by Ac1db1tch3z - t3kn10n, n0n3 and t3kn0h03.

WARNING:
Unlicensed usage and/or distribution of this program carries heavy fines
and penalties under American, British, European and International copyright
law.
Should you find this program on any compromised system we urge you to delete
this binary rather than attempt distribution or analysis. Such actions would
be both unlawful and unwise.

----------------------------------------------------------------------------
password:
invalid key

I remembered, vaguely - I sift through a lot of security mail each day, some
talk of a rumoured Linux kernel exploit circulating among members of the
hacker
underground. On the advice of some friends in law-enforcement I joined the
EFnet
channels #phrack and #darknet and tried to solicit some information
regarding this
alleged exploit. Most people publicly attacked me for my neivette but two
individuals
contacted me via private messages and informed me that the "ac1db1tch3z"
were bad news,
apparently a group of older (mid 20's) security guru's, and that I should
delete the
exploit and forget I ever knew it existed.
However, somthing twigged my sense of adventure and prompted me to try and
get this out
to the community.

Any help or information regarding this will be of great help.

I have attached the binary although it appears to be encrypted and
passworded. I wish
any skilled programmers the best of luck in decyphering it.

Yours,

Daniel Roberts
Head Network Manager
<--Quote

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management
and tracking system please see: http://aris.securityfocus.com

Relevant Pages

  • Re: PDC Not Appearing In Network Neighbourhood !!
    ... > a primary domain controller on a very small network. ... Ping the machine by IP address all okay ... > Tis very strange and any help, pointers or suggestions would be gratefully ...
    (microsoft.public.windows.server.dns)
  • hijacked security/and surf habits
    ... msn.com i have had trouble controling my security ... did not take a security update and removed the patch from ... other updates something strange happened msn.com loaded ...
    (microsoft.public.access.security)
  • Re: XP tcp ip problems pls help
    ... I'm trying to add the computer to a network. ... But this one is plain strange. ... strange with the PING from command prompt. ... Approximate round trip times in milli-seconds: ...
    (microsoft.public.windowsxp.network_web)
  • XP tcp ip problems pls help
    ... I'm trying to add the computer to a network. ... But this one is plain strange. ... strange with the PING from command prompt. ... Approximate round trip times in milli-seconds: ...
    (microsoft.public.windowsxp.network_web)
  • Still some problems with the rt2x00 driver
    ... There are two strange things that I've noticed, though and that I feel need to be fixed: ... many kernels, shown a strange behavior: after everything is working correctly, the network simply becomes unavailable, with the gnome network monitor showing that the card has no signal. ... If I issue the command "iwconfig ra0 ap any", for example, the card starts working again. ... Notice the difference in both cases: with the PCMCIA/ia32 case, no matter if there is traffic on the network or not, the the connection is interrupted. ...
    (Linux-Kernel)