RE: [cobalt-security] [RaQ3i] interesting hack symptoms

[David Etheridge <DavidE@xxxxxxxxxxxx>]

Theo
I followed the advice from Peter and found no bindshells in my inetd.conf.

Hopefully a false alert.

Dave

-----Original Message-----
From: Theodore Jones [mailto:theoj@xxxxxxxxxxxxx]
Sent: 03 November 2000 09:02
To: cobalt-security@xxxxxxxxxxxxxxx
Subject: Re: [cobalt-security] [RaQ3i] interesting hack symptoms


David,

Thanks for the confirm.  I think I'll assume it's probably a false report on
the bindshell backdoor due to some special cobalt configuration, unless
anyone
can offer up suggestions how to debug a bindshell trojan.  With today's
species
of Loadable Kernal Module exploits, this would probably be the least of my
worries if I were truely compromised.

Thanks for your input,

 ~ Theo


David Etheridge wrote:

> I had the same results when running the kit. Again like yourself I also
run
> portsentry in paranoid mode and only allow the ports that I wish to be
open
> to be accessible.
>
> Dave Etheridge
>
> -----Original Message-----
> From: Theodore Jones [mailto:theoj@xxxxxxxxxxxxx]
> Sent: 02 November 2000 21:25
> To: Cobalt Security Disc.
> Subject: [cobalt-security] [RaQ3i] interesting hack symptoms
>
> Hello All,
>
> yesterday I awoke to find that the server I'm responsible for had been
> rebooted without my notification or approval.  I also found that a
> MySQL/PHP application had gone belly up and was not working any more.
> The ISP that hosts the server said that they did not order a reboot, so
> it appeared that it happened internally from some cause, and it was done
> rather abrubtly.
>
> Digging through the logs.  I found that someone had connected to the
> machine vai anon ftp about 15 to 30 minutes before the crash.  This
> crash incedentlly was what cause the MySQL/PHP connection problem I
> think.  Somehow the ownership of the files for that particular database
> had been changed I think.  They were all owned and gruoped to root.  I
> changed them to be owned and grouped to "mysql" and finally PHP could
> access the db and display content from the db again.  Oh yes, and I also
> did a restore on the database tables to clean them up from the crash.
>
> I suspect strongly that my system was compromised and so now I am trying
> to backtrack and ferret out possible trojans and root-kits, etc.  I
> tried this nice program called "chkrootkit" at
> http://www.chkrootkit.org, which is easy to install and run.  When I ran
> it I found a few items that popped out:
>
> Checking `cron'... NOT TESTED
> Checking `sshd'... NOT TESTED
> Checking `bindshell'... INFECTED
>
> First of all, I'm wondering if cron and sshd were not tested because
> one, I don't have SSH installed, and two, cron is located in a
> non-default location different from most standard linux distribs?
>
> The one that of course bugs me is "bindshell".  I can't seem to find
> where this bindshell file is located or how to look into where it's at
> and what it's doing, and if I do indeed have a compromise problem.  I've
> found some slim documentation on this backdoor hole, but most of it is
> from hacker websites wich I'd rather avoid.  I do know that rootkit IV
> for linux usually sets this bindshell backdoor to listening on port
> 31337 (eleet, i guess as they cleverly call it).  I checked this port
> and nothing seems to be active there.  In fact my portsentry utility is
> set to listen on that port and block outsiders if they connect to it.
> The attacker(s) could probably have changed the port number however, so
> this doesn't entirely eliminate that avenue...
>
> My idea was to ask if anyone wants to try this program on a pretty
> standard RaQ3i box and see if they get the same kind of results?  I'm
> trying to ascertain if I >do< have problems, or the "layout" of the
> cobalt system is somewhat different and causes these anomolies with the
> chkrootkit program?
>
> Also, I was just experimenting with this command:
>     netstat -ap | grep LISTEN
>
> and before it displays the list of listening connections, it tells me
> this:
>     [root@www admin]# netstat -ap | grep LISTEN
>     (Not all processes could be identified, non-owned process info
>      will not be shown, you would have to be root to see it all.)
>
> which I think is kind of strange, as I >am< logged in as root!
>
> Thanks much for any tips anyone can provide on ferreting out this
> bindshell problem, and you can bet I've switched of Anon FTP for the
> time being!
>
> Thanks,
>
> ~ Theo
>
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security
> _______________________________________________
> cobalt-security mailing list
> cobalt-security@xxxxxxxxxxxxxxx
> http://list.cobalt.com/mailman/listinfo/cobalt-security

_______________________________________________
cobalt-security mailing list
cobalt-security@xxxxxxxxxxxxxxx
http://list.cobalt.com/mailman/listinfo/cobalt-security