full-disclosure - Automated SSH login attempts?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <71C9CA4800E9FF44A8C78E1FCD602B9C0FAB38@exchange.positiveplace.org>
From: broemhild at positiveplace.org (Bill Roemhild)
Subject: Automated SSH login attempts?

After looking around a bit more (should have researched a bit before
posting), the second sshf that currently resides at frauder.us is
infected with RST-variant.  

More info at:

http://www.lockeddown.net/rst-expl.txt

Bill


-----Original Message-----
From: Bill Roemhild 
Sent: Sunday, August 15, 2004 1:58 AM
To: full-disclosure@...ts.netsys.com
Subject: RE: [Full-Disclosure] Automated SSH login attempts?


Ohh great.. two different versions floating around.  Not sure where I
got the first one, but the second was from frauder.us.  



-rwxr-xr-x    1 root     root      1365263 Jul 12 11:10 sshf1*
-rwxr-xr-x    1 root     root      1369359 Aug  1 19:24 sshf2*

root@...pcycle:/usr/local/src/ssh/show# strings sshf1 > sshf1.strings
root@...pcycle:/usr/local/src/ssh/show# strings sshf2 > sshf2.strings
root@...pcycle:/usr/local/src/ssh/show# diff sshf1.strings sshf2.strings
4402a4403,4466
> SQRVW
> _^ZY[
> SQR1
> SQRV
> H^ZY[
> SQRVW
> _^ZY[
> _^ZY[
> QSP1
> QSP1
> QSP1
> QSP1
> RQSP1
> X[YZ
> RQSP1
> X[YZ
> QSP1
> SQRV1
> ^ZY[
> /dev/hdx
> SQRVW
> ZY[=
> ZY[=
> _^ZY[
> SQRVW
> Y[_^ZY[
> ZY[=
> [SQRVW
> tBSQR
> ZY[=
> ZY[=
> [X_^ZY[
> DOM`
> /bin/sh
> xxxxyyyyzzzz
> Y[XXXXXX
> GET /~telcom69/gov.php HTTP/1.0
> ppp0
> eth0
> h/bin
> PSQRVWP
> [X_^ZY[X
> SQRVWS
> ZY[=
> ZY[f
> ZY[=
> ZY[=
> fAf;NH
> ZY[=
> YQSQR
> ZY[=
> ZY[=
> ZY[fAf;NLr
> ZY[=
> ZY[=
> F4SQR
> ZY[=
> [X_^ZY[
> ZY[=
> _WSQR
> ZY[SQR
> snortdos
> tory
> /lib/ld-linux.so.2

Bill