Re: anyone seen this before

[Mike Wronski <mike () CSOCSG NET>]

looks like it might be bindshell.. Its probably not inetd at all.. Try
telneting to 51l and type 'ls;' and see what you get..

-M

----- Original Message -----
From: "Keith Pachulski" <Keith.Pachulski () CORP PTD NET>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Thursday, February 22, 2001 9:24 AM
Subject: anyone seen this before


> has anyone come across this before
>
> /usr/sbin/in.inetd listening on port 511, this box is currently in a
> pre-cleanup stage after being breached
>
> Keith A. Pachulski
> Network Security Engineer
> PenTeleData/Prolog Internet Services
> Phone: (800) 281-3564 x 277
> URL: http://www.engr.ptd.net
> PGP Key: http://www.protectors.cc/Keith%20Pachulski.asc