Has anyone seen this SSH Scanner tool?

Printable View

October 27th, 2004, 01:35 PM
MrLinus

Has anyone seen this SSH Scanner tool?

I've found a variety of references to this but haven't seen any official announcements (unless I missed it). I did find this help (?) file but was curious if anyone has actually heard/seen the tool.

For those that haven't seen it, check your SSH logs for something along the following (ips are possibly different and I just grabbed a "slice" of my auth.log):

Quote:

Oct 16 10:45:23 MsMittens sshd[3560]: password authentication failed. Login to account cyrus not allowed or account non-existent.
Oct 16 10:45:26 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:26 MsMittens sshd[3562]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:45:31 MsMittens sshd[3562]: Wrong password given for user 'www'.
Oct 16 10:45:33 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:33 MsMittens sshd[3564]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:45:37 MsMittens sshd[3564]: password authentication failed. Login to account wwwrun not allowed or account non-existent.
Oct 16 10:45:39 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:39 MsMittens sshd[3566]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:45:42 MsMittens sshd[3566]: password authentication failed. Login to account matt not allowed or account non-existent.
Oct 16 10:45:45 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:45 MsMittens sshd[3568]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:45:48 MsMittens sshd[3568]: password authentication failed. Login to account test not allowed or account non-existent.
Oct 16 10:45:51 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:51 MsMittens sshd[3570]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:45:54 MsMittens sshd[3570]: password authentication failed. Login to account test not allowed or account non-existent.
Oct 16 10:45:57 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:45:57 MsMittens sshd[3572]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:01 MsMittens sshd[3572]: password authentication failed. Login to account test not allowed or account non-existent.
Oct 16 10:46:04 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:04 MsMittens sshd[3574]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:07 MsMittens sshd[3574]: password authentication failed. Login to account test not allowed or account non-existent.
Oct 16 10:46:10 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:10 MsMittens sshd[3576]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:13 MsMittens sshd[3576]: password authentication failed. Login to account www-data not allowed or account non-existent.
Oct 16 10:46:15 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:15 MsMittens sshd[3578]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:19 MsMittens sshd[3578]: password authentication failed. Login to account mysql not allowed or account non-existent.
Oct 16 10:46:21 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:21 MsMittens sshd[3580]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:25 MsMittens sshd[3580]: Wrong password given for user 'operator'.
Oct 16 10:46:28 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:28 MsMittens sshd[3582]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:31 MsMittens sshd[3582]: password authentication failed. Login to account adm not allowed or account non-existent.
Oct 16 10:46:34 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:34 MsMittens sshd[3584]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:37 MsMittens sshd[3584]: password authentication failed. Login to account apache not allowed or account non-existent.
Oct 16 10:46:40 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:40 MsMittens sshd[3586]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:43 MsMittens sshd[3586]: password authentication failed. Login to account irc not allowed or account non-existent.
Oct 16 10:46:45 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:46 MsMittens sshd[3588]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:49 MsMittens sshd[3588]: password authentication failed. Login to account irc not allowed or account non-existent.
Oct 16 10:46:51 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:51 MsMittens sshd[3590]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:46:54 MsMittens sshd[3590]: password authentication failed. Login to account adm not allowed or account non-existent.
Oct 16 10:46:57 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:46:57 MsMittens sshd[3592]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:00 MsMittens sshd[3592]: Wrong password given for user 'root'.
Oct 16 10:47:03 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:03 MsMittens sshd[3594]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:06 MsMittens sshd[3594]: Wrong password given for user 'root'.
Oct 16 10:47:09 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:09 MsMittens sshd[3596]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:14 MsMittens sshd[3596]: Wrong password given for user 'root'.
Oct 16 10:47:17 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:17 MsMittens sshd[3598]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:20 MsMittens sshd[3598]: password authentication failed. Login to account jane not allowed or account non-existent.
Oct 16 10:47:23 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:23 MsMittens sshd[3600]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:26 MsMittens sshd[3600]: password authentication failed. Login to account pamela not allowed or account non-existent.
Oct 16 10:47:28 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:28 MsMittens sshd[3602]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:32 MsMittens sshd[3602]: Wrong password given for user 'root'.
Oct 16 10:47:34 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:34 MsMittens sshd[3604]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:37 MsMittens sshd[3604]: Wrong password given for user 'root'.
Oct 16 10:47:40 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:40 MsMittens sshd[3606]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:43 MsMittens sshd[3606]: Wrong password given for user 'root'.
Oct 16 10:47:46 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:46 MsMittens sshd[3608]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:49 MsMittens sshd[3608]: Wrong password given for user 'root'.
Oct 16 10:47:52 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:52 MsMittens sshd[3610]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:47:55 MsMittens sshd[3610]: Wrong password given for user 'root'.
Oct 16 10:47:58 MsMittens sshd[116]: connection from "222.118.5.179"
Oct 16 10:47:58 MsMittens sshd[3612]: WARNING: DNS lookup failed for "222.118.5.179".
Oct 16 10:48:01 MsMittens sshd[3612]: password authentication failed. Login to account cosmin not allowed or account non-existent.

[Edit]

I did visit Incidents.org and checked on Port 22. While most attacks appeared in mid-late September this one seems to still be going on (perhaps looking for a specific machine!?).
October 27th, 2004, 02:00 PM
hogfly

seen it? hah. I've seen it since june. it's progressing in to a real tool now. Suspects are romanian afaik.
mynetwatchman and isc have had some good info on the subject.
Let's not forget that suckIT & or other rootkits gets installed if successful. Apparently the people responsible have read emails, sniffed passwords, stolen pgp keys...it's ugly, and taunted people as well on the phone.
One of our attacks looked like this:
[EDIT]
I parsed out the built in accounts..oops.
here are those:nobody,root,operator,adm,apache
[/EDIT]
22:01:08 ::ffff:211.248.38.252
22:01:11 user patrick
22:01:13 ::ffff:211.248.38.252
22:01:16 user patrick
22:01:45 ::ffff:211.248.38.252
22:01:47 user rolo
22:01:49 ::ffff:211.248.38.252
22:01:52 user iceuser
22:01:54 ::ffff:211.248.38.252
22:01:56 user horde
22:01:58 ::ffff:211.248.38.252
22:02:01 user cyrus
22:02:03 ::ffff:211.248.38.252
22:02:05 user www
22:02:07 ::ffff:211.248.38.252
22:02:10 user wwwrun
22:02:12 ::ffff:211.248.38.252
22:02:15 user matt
22:02:17 ::ffff:211.248.38.252
22:02:20 user test
22:02:22 ::ffff:211.248.38.252
22:02:24 user test
22:02:26 ::ffff:211.248.38.252
22:02:29 user test
22:02:31 ::ffff:211.248.38.252
22:02:34 user test
22:02:36 ::ffff:211.248.38.252
22:02:38 user www-data
22:02:40 ::ffff:211.248.38.252
22:02:43 user mysql
22:03:00 ::ffff:211.248.38.252
22:03:02 user irc
22:03:04 ::ffff:211.248.38.252
22:03:07 user irc
22:03:28 ::ffff:211.248.38.252
22:03:31 user jane
22:03:33 ::ffff:211.248.38.252
22:03:36 user pamela
22:04:03 ::ffff:211.248.38.252
22:04:05 user cosmin
22:07:08 ::ffff:211.248.38.252
22:07:11 user cip52
22:07:13 ::ffff:211.248.38.252
22:07:15 user cip51
22:07:23 ::ffff:211.248.38.252
22:07:25 user noc
22:07:47 ::ffff:211.248.38.252
22:07:50 user webmaster
22:07:52 ::ffff:211.248.38.252
22:07:54 user data
22:07:56 ::ffff:211.248.38.252
22:07:59 user user
22:08:01 ::ffff:211.248.38.252
22:08:04 user user
22:08:06 ::ffff:211.248.38.252
22:08:08 user user
22:08:10 ::ffff:211.248.38.252
22:08:13 user web
22:08:15 ::ffff:211.248.38.252
22:08:18 user web
22:08:23 ::ffff:211.248.38.252
22:08:25 user oracle
22:08:27 ::ffff:211.248.38.252
22:08:30 user sybase
22:08:32 ::ffff:211.248.38.252
22:08:35 user master
22:08:37 ::ffff:211.248.38.252
22:08:39 user account
22:08:42 ::ffff:211.248.38.252
22:08:44 user backup
22:08:46 ::ffff:211.248.38.252
22:08:49 user server
22:08:51 ::ffff:211.248.38.252
22:08:53 user adam
22:08:55 ::ffff:211.248.38.252
22:08:58 user alan
22:09:00 ::ffff:211.248.38.252
22:09:02 user frank
22:09:04 ::ffff:211.248.38.252
22:09:07 user george
22:09:09 ::ffff:211.248.38.252
22:09:11 user henry
22:09:13 ::ffff:211.248.38.252
22:09:16 user john
22:09:43 ::ffff:211.248.38.252
22:09:45 user test
October 27th, 2004, 02:27 PM
MrLinus

Interesting. I'm not getting as many variations on names and most of what I'm seeing is coming from Korea.
October 27th, 2004, 02:34 PM
hogfly

a lot of them are "from" korea(we've seen a fair share from there as well), but who can say if that's really where it's from.
October 27th, 2004, 02:46 PM
nebulus200

Quote:

Originally posted here by hogfly
seen it? hah. I've seen it since june. it's progressing in to a real tool now. Suspects are romanian afaik.
mynetwatchman and isc have had some good info on the subject.
Let's not forget that suckIT & or other rootkits gets installed if successful. Apparently the people responsible have read emails, sniffed passwords, stolen pgp keys...it's ugly, and taunted people as well on the phone.
One of our attacks looked like this:
[EDIT]
I parsed out the built in accounts..oops.
here are those:nobody,root,operator,adm,apache
[/EDIT]
22:01:08 ::ffff:211.248.38.252
22:01:11 user patrick
<SNIP>
22:09:43 ::ffff:211.248.38.252
22:09:45 user test

Read here, this is the best information I have seen publically released about this group and what they have been doing:

http://securecomputing.stanford.edu/...-6apr2004.html

If I was a betting man, you will hear much about this sometime in the future.

Oh and MsMittens...there are some references to SSH scans but unfortunately I could only see them saying 'we found what was causing it' but they didn't say what :rolleyes:
October 27th, 2004, 03:09 PM
hogfly

stanford..haha they have had more systems compromised by this tool than anyone else..hence all of their knowledge about the subject. :D
October 27th, 2004, 04:15 PM
kr5kernel

Ditto logs here, I made a post about this a while ago, I was told and later verified it as exploit againt ssh, make sure you are only allowing ssh2 connections and deny access to root. Thats what I was told at least. We still get invalid login attempts everday around 4 am. They come from Korea, and taiwan.
October 27th, 2004, 08:28 PM
TmBerg

Just block Korea. ( I have. ) Much "****" has dissapared since then.
October 27th, 2004, 08:38 PM
JLQ5454

i have been getting the same stuff on my bsd firewall for the past month or so most of mine are comming from china or newyork.
October 27th, 2004, 09:37 PM
Vorlin

Same here...gonna do some homework tonight on the ISP that's handling the ones I've been getting and see if something can be done. I have something like 40+ pages backdating two months of this stuff....turned off ssh on the router so I don't get hammered anymore until I figure out what's going on.
October 27th, 2004, 09:38 PM
Highlander

I hope you have reported the NY IDOT to their ISP.....
I have been getting hit from Cina and Korea as well.... Mostly Port Scans
October 27th, 2004, 09:45 PM
MrLinus

I'm actually looking for the tool itself. Has anyone actually come across the actual script or tool that's being used?
October 27th, 2004, 09:52 PM
lumpyporridge

http://www.k-otik.com/exploits/08202004.brutessh2.c.php is it i believe.
October 28th, 2004, 11:25 AM
thehorse13

MsMittens,

Along with the above link that Lumpy gave to the otik site, there is another variation of the tool that is called ssh-grinder.c which I picked up along my travels. This variation matches the bahavior you've seen and when we had the issue (late summer) we blocked all netblocks to southeast Asia, Romania and Brazil. Since then, we've had a 72% decrease in scans and grinds (of this type).

The actual code I have came to me broken. At least that's what one would think. After looking it over, there was one minor thing changed in the code that made it inoperable. My guess is that it was distributed to a known audience who knew what had to be changed to make it work again.

I'm not sure if we kept the code around after handing it over to our fine friends with the three letter acronym. I'll check out our code library later today.
October 28th, 2004, 02:12 PM
kr5kernel

This must be somewhat new, as we have been getting brute force attempts against our firewall since mid june, but the logs appear different in these latest attacks. I am guessing more and more script kiddies are finding the script.
October 28th, 2004, 04:29 PM
the_JinX

scan the scanner

Yup me too..

Quote:

Oct 27 16:20:04 copycat sshd[13787]: Failed password for root from 66.79.170.220 port 40644 ssh2
Oct 27 16:20:06 copycat sshd[13790]: Failed password for root from 66.79.170.220 port 40680 ssh2
Oct 27 16:20:08 copycat sshd[13793]: Failed password for root from 66.79.170.220 port 40713 ssh2

evry two seconds

Quote:

Oct 27 16:20:58 copycat sshd[13886]: Failed password for root from 66.79.170.220 port 41805 ssh2
Oct 27 16:21:00 copycat sshd[13889]: Failed password for root from 66.79.170.220 port 41836 ssh2

H'm let's try something different hey..

Quote:

Oct 27 16:21:17 copycat sshd[13919]: Failed password for invalid user webmaster from 66.79.170.220 port 42186 ssh2
Oct 27 16:21:19 copycat sshd[13922]: Invalid user data from 66.79.170.220
Oct 27 16:21:19 copycat sshd[13922]: Failed password for invalid user data from 66.79.170.220 port 42221 ssh2
Oct 27 16:21:21 copycat sshd[13925]: Invalid user user from 66.79.170.220
Oct 27 16:21:21 copycat sshd[13925]: Failed password for invalid user user from 66.79.170.220 port 42268 ssh2
Oct 27 16:21:22 copycat sshd[13928]: Invalid user user from 66.79.170.220
Oct 27 16:21:22 copycat sshd[13928]: Failed password for invalid user user from 66.79.170.220 port 42299 ssh2
Oct 27 16:21:24 copycat sshd[13931]: Invalid user user from 66.79.170.220
Oct 27 16:21:24 copycat sshd[13931]: Failed password for invalid user user from 66.79.170.220 port 42338 ssh2
Oct 27 16:21:26 copycat sshd[13934]: Invalid user web from 66.79.170.220
Oct 27 16:21:26 copycat sshd[13934]: Failed password for invalid user web from 66.79.170.220 port 42374 ssh2
Oct 27 16:21:27 copycat sshd[13937]: Invalid user web from 66.79.170.220
Oct 27 16:21:27 copycat sshd[13937]: Failed password for invalid user web from 66.79.170.220 port 42417 ssh2
Oct 27 16:21:29 copycat sshd[13941]: Invalid user oracle from 66.79.170.220
Oct 27 16:21:29 copycat sshd[13941]: Failed password for invalid user oracle from 66.79.170.220 port 42454 ssh2
Oct 27 16:21:31 copycat sshd[13944]: Invalid user sybase from 66.79.170.220
Oct 27 16:21:31 copycat sshd[13944]: Failed password for invalid user sybase from 66.79.170.220 port 42483 ssh2
Oct 27 16:21:33 copycat sshd[13947]: Invalid user master from 66.79.170.220
Oct 27 16:21:33 copycat sshd[13947]: Failed password for invalid user master from 66.79.170.220 port 42524 ssh2
Oct 27 16:21:34 copycat sshd[13950]: Invalid user account from 66.79.170.220
Oct 27 16:21:34 copycat sshd[13950]: Failed password for invalid user account from 66.79.170.220 port 42560 ssh2
Oct 27 16:21:36 copycat sshd[13953]: Invalid user backup from 66.79.170.220
Oct 27 16:21:36 copycat sshd[13953]: Failed password for invalid user backup from 66.79.170.220 port 42596 ssh2
Oct 27 16:21:38 copycat sshd[13956]: Invalid user server from 66.79.170.220
Oct 27 16:21:38 copycat sshd[13956]: Failed password for invalid user server from 66.79.170.220 port 42633 ssh2
Oct 27 16:21:39 copycat sshd[13959]: Invalid user adam from 66.79.170.220
Oct 27 16:21:39 copycat sshd[13959]: Failed password for invalid user adam from 66.79.170.220 port 42663 ssh2
Oct 27 16:21:41 copycat sshd[13962]: Invalid user alan from 66.79.170.220
Oct 27 16:21:41 copycat sshd[13962]: Failed password for invalid user alan from 66.79.170.220 port 42699 ssh2
Oct 27 16:21:42 copycat sshd[13965]: Invalid user frank from 66.79.170.220
Oct 27 16:21:42 copycat sshd[13965]: Failed password for invalid user frank from 66.79.170.220 port 42726 ssh2
Oct 27 16:21:44 copycat sshd[13968]: Invalid user george from 66.79.170.220
Oct 27 16:21:44 copycat sshd[13968]: Failed password for invalid user george from 66.79.170.220 port 42764 ssh2
Oct 27 16:21:46 copycat sshd[13971]: Invalid user henry from 66.79.170.220
Oct 27 16:21:46 copycat sshd[13971]: Failed password for invalid user henry from 66.79.170.220 port 42794 ssh2
Oct 27 16:21:47 copycat sshd[13974]: Invalid user john from 66.79.170.220
Oct 27 16:21:47 copycat sshd[13974]: Failed password for invalid user john from 66.79.170.220 port 42825 ssh2

and back to root..

Quote:

Oct 27 16:21:49 copycat sshd[13977]: Failed password for root from 66.79.170.220 port 42858 ssh2
Oct 27 16:21:50 copycat sshd[13980]: Failed password for root from 66.79.170.220 port 42883 ssh2
Oct 27 16:21:52 copycat sshd[13983]: Failed password for root from 66.79.170.220 port 42923 ssh2
Oct 27 16:21:54 copycat sshd[13986]: Failed password for root from 66.79.170.220 port 42950 ssh2
Oct 27 16:21:55 copycat sshd[13989]: Failed password for root from 66.79.170.220 port 42988 ssh2

I nmapped the dude..

Code:

PORT STATE SERVICE VERSION 1/tcp open tcpmux? 21/tcp open ftp? 22/tcp open ssh OpenSSH 3.6.1p2 (protocol 1.99) 25/tcp open smtp Exim smtpd 4.24 80/tcp open http Apache httpd 1.3.29 111/tcp open rpcbind? 135/tcp filtered msrpc 143/tcp open imap UW imapd 2003.338rh 443/tcp open http Apache httpd 1.3.29 445/tcp filtered microsoft-ds 465/tcp open ssl/smtp Exim smtpd 4.24 993/tcp open ssl/imap UW imapd 2003.338rh 995/tcp open pop3s? 1337/tcp open irc-proxy psyBNC 2.3.2-4 3306/tcp open mysql MySQL (unauthorized) 6667/tcp filtered irc 6668/tcp filtered irc 7000/tcp filtered afs3-fileserver 31337/tcp open irc-proxy psyBNC 2.3.1

and what do you think...

Quote:

telnet 66.79.170.220 1337
Trying 66.79.170.220...
Connected to 66.79.170.220.
Escape character is '^]'.
:[email protected] NOTICE * :psyBNC2.3.2-4

H'm an irc proxy (bot?).. but it needs a password.. if I were just as lame.. I'd just brute force it ;)