Re: Some details in a recent NT hack we encountered

[Gossi The Dog <gossi () OWNED LAB6 COM>]

On Sat, 24 Feb 2001, Ron Grove wrote:

> Hello,
>
> Just wanted to share some of the footprints of a hack that we had on a

<snip>

Ok, three points here.

First off, the IIS unicode exploit does not give you SYSTEM or
Administrator privs.  So how are they getting those (they'll need them to
make those dirs and set permissions etc).

Secondly, what program is generating those WinLogon logs?  Not seen that
before at all, very interesting.

Thirdly, could this be a worm?  If it is, erm, eek.

Regards,
Gossi.