Re: Compromised...

[simon.britnell () PEACE COM (Simon Britnell)]

We've found a canned exploit called t666.  We can mail the source if you wish.
We got cracked too.  We interrupted some people using an account called web on
one of our systems, so we have their IP addresses from lastlog and some
interesting failures from /var/log/messages if you wish to pursue.  Another
system had the root kit in /usr/\ as described in an earlier post.

Japheth wrote:

> So this ADMROCKS must be a mainstream method/kit, but I was unable to find
> anything online via normal means.
>
> Please let me know if you come up with anything. Thank you in advance!