Security Basics mailing list archives
Re: Trojan found on Linux server
From: Bulgaria Online - Assen Totin <assen () online bg>
Date: Wed, 04 Jan 2006 14:26:29 +0200
Hi all,
http://www.jeremygaddis.com/files/ummtodkhk.
A quick test shows that the process forks, then opens an IRC session to 64.239.9.236 port 3434 (there are also two others hard-coded IP addresses inside the binary, 219.133.46.212 and 61.211.239.84) - probably a password protected server, the agent issues these commands: PASS f9dsa USER mbopaidgb NICK cmktvjopr Probably stays logged there, expecting remote commands. Seems capable of spawning a shell on the infected machine. The "crontab" solution is quite interesting, however. But even more interesting is how the infection spreads... if it came through Apache, can you suggest version and configuration (is there PHP, for example; is any file upload permitted etc.) Happy hunting, Assen Totin Development Manager -- =============================== BULGARIA ONLINE Your quality... Your price! =============================== ++ 359 2 9733000 ext. 511 http://home.online.bg --------------------------------------------------------------------------- EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE The Norwich University program offers unparalleled Infosec management education and the case study affords you unmatched consulting experience. Tailor your education to your own professional goals with degree customizations including Emergency Management, Business Continuity Planning, Computer Emergency Response Teams, and Digital Investigations. http://www.msia.norwich.edu/secfocus ----------------------------------------------------------------------------
Current thread:
- Trojan found on Linux server Gaddis, Jeremy L. (Jan 03)
- Re: Trojan found on Linux server Bulgaria Online - Assen Totin (Jan 04)
- <Possible follow-ups>
- Re: Trojan found on Linux server [at] (Jan 04)