Re: Compromised...

[scut () NB IN-BERLIN DE (Sebastian)]

On Wed, Feb 09, 2000 at 11:09:00AM +0100, technot wrote:

> About this BIND exploit.
> I would be greatful if someone could tell me how it works.
> I have tested it on my own system, and it worked fine. but i dont really
> under stand the consept.

> When i tested on my system i needed 3 linux boxes.
> box1: running bind 8.2 (or 8.2.1)
> box2: setup some stuff in the nameserver running
> box3: running the exploit

> as i understand box2 sends a dnsquery to box3 which is running the
> exploit. the exploit then sends a query to box1 and falls in to some sort
> of loop, and all of a sudden there was the root shell.
> If someone would explain how/what exactly happens. I would be very
> greatful.

You make the remote nameserver query a host within a domain you have control
over. The nameserver tries to resolve that host by querying your pseudo-
nameserver. The pseudo-nameserver (the exploit that is) sends a packet back
with a malformed NXT record, that causes a buffer overrun on the remote
server.

> And i read something here about someone finding a user called "web" or
> something after beeing "cracked". why does the cracker/hacker(call it what
> u want;) add a user at all, why not create a simple /in/login trojan or
> somthing in that manner;p

Well, thats only a temporary thing, like it isn't very comfortable to install
backdoors from portshells and the user wants to have a fully featured telnet
daemon terminal ;-). Therefore a simple
cat /etc/passwd|sed s/:<uid>:/:0:/ > /etc/p;rm -f /etc/passwd;
mv /etc/p /etc/passwd;

(and a similar line for shadow)

Will allow you to log on as someone else through telnet. Then a backdoor will
be installed and the account reinstalled.

> - technot
> linux administrator

ciao,
scut

--
- scut () nb in-berlin de - http://nb.in-berlin.de/scut/ - sacbuctd@ircnet   --
-- you don't need a lot of people to be great, you need a few great to be  --
-- the best ------------------------------------------------------------------
http://3261000594/scut/pgp - 5453 AC95 1E02 FDA7 50D2 A42D 427E 6DEF 745A 8E07
--- aquired Talon operating system source, awaiting orders, hi echelon -------