Re: Compromised...

[technot () BERGEN CX (technot)]

About this BIND exploit.
I would be greatful if someone could tell me how it works.
I have tested it on my own system, and it worked fine. but i dont really
under stand the consept.

When i tested on my system i needed 3 linux boxes.
box1: running bind 8.2 (or 8.2.1)
box2: setup some stuff in the nameserver running
box3: running the exploit

as i understand box2 sends a dnsquery to box3 which is running the
exploit. the exploit then sends a query to box1 and falls in to some sort
of loop, and all of a sudden there was the root shell.
If someone would explain how/what exactly happens. I would be very
greatful.

And i read something here about someone finding a user called "web" or
something after beeing "cracked". why does the cracker/hacker(call it what
u want;) add a user at all, why not create a simple /in/login trojan or
somthing in that manner;p

- technot
linux administrator