Re: backdoor in freebsd found..

From: Rainer Weikusat (weikusatat_private-mainz.de)
Date: Sun Aug 19 2001 - 04:38:39 PDT

  • Next message: Jose Nazario: "Re: Flash Worms"

    Renee Teunissen <reneeat_private> writes:
    > it can be found on http://sms.pts.nl/renee/getty.gz (4KB).
    
    This is a small forking tcp-server implementing three commands
    (superficial analysis w/o much detail):
    
    - kk1753834298:<filename>
    
      Open the named file and send its contents over the net.
    
    - kk876398366:<filename>
    
      Open the named file for writing. It then starts reading lines from
      the net. If the first char is '-' (0x2d), the remains are 'somehow'
      unmangled (possibly decrypted, dunno) and written to the file. A
      line starting with a dot (0x2e) causes the file to be closed and
      the server subprocess to terminate. Anything else is silently
      ignored. 
     
    - 2iy4fv:<shell command>
    
      Duplicate 0, 1, 2 onto the TCP-connection and execute
      <shell command> via system(3).
    
    Anything else is ignored.
    
    -- 
    stone me
    
    ----------------------------------------------------------------------------
    This list is provided by the SecurityFocus ARIS analyzer service.
    For more information on this free incident handling, management 
    and tracking system please see: http://aris.securityfocus.com
    



    This archive was generated by hypermail 2b30 : Sun Aug 19 2001 - 09:48:10 PDT