full-disclosure - Infobot-backdoor

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

From: se_cur_ity at hotmail.com (morning_wood)
Subject: Infobot-backdoor

------------------------------------------------------------------
          - EXPL-A-2003-007 exploitlabs.com Advisory 007
------------------------------------------------------------------
                                -= infobot =-




Vunerability:
----------------
1. Remote Access


Product:
--------
infobot
http://www.infobot.org/



Description of product:
-----------------------
"The infobot connects to an Internet Relay Chat (IRC) server, joins
some channels (maybe),
and begins accumulating factoids. To run one, download the source,
uncompress it,
untar it, edit the config files, and it up."



VUNERABILITY / EXPLOIT
======================

by default there are two user names in infobot.users not commented out


quote from from the infobot.conf file...

-------------- snip --------------------

# our user list default file (in miscdir)
# you may want to change this to $ident.users

userList         infobot.users


------------ end snip -----------------

defines the user database

it seems the authors have provided themselves with a nifty backdoor...
or any one who can match these credentals in the user database
infobot.users


infobot.users
=================== snippy =============

# here's an example entry

UserEntry oznoid {
 name  "Kevin A. Lenzo";
 title "that guy";
 flags +ftrmcsSope;
 pass  rrmrxB6U4ryRk;
 mask  *!lenzo@...peech.cs.cmu.edu;
}

UserEntry plonk {
 name  "Eep Malloy"
 title "that guy II";
 flags +trmcspo;
 pass  rrmrxB6U4ryRk;
 mask  *!*@...tatic.telerama.com
}

=============== end snippy =================


Vendor Fix:
-----------
No fix on 0day


Vendor Contact:
---------------
lenzo@...cmu.edu
Concurrent with this advisory


Credits:
--------
morning_wood@...loitlabs.com
http://nothackers.org