full-disclosure - Re: Automated SSH login attempts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <41097799.3090504@stwing.org>
From: dmargoli at stwing.org (dmargoli@...ing.org)
Subject: Re: Automated SSH login attempts?

Max Valdez wrote:

> doesnt make any sense
> 
> That way you should have root on the first box to start exploiting others, 
> kind of weird.
> 
> smells like rootkit downloader to me.
> 
> Anybody willing to make a strace of this program ??
> 
> Max
> 

A previous poster mentioned that after exploiting a test/test or 
guest/guest account, an attacker downloaded SuckIt to his machine, got 
root using some unspecified local vuln (he said it was a very unpatched 
mcahine), and started from there.

The program IS linked against OpenSSL and appears to inintiate an ssh 
connection with the target(s) in a separate text file (uniq.txt). I 
can't follow the connection because of the encryption, but it seems to 
be trying a user and then disconnecting (as in, I see nothing really 
obviously out of the ordinary when I run it). Haven't got farther in 
disassembling it yet.