Do they actually exist as separate accounts (unlikely) or has password checking for this account somehow been bypassed (more likely)? You might also want to try some other accounts to see if perhaps password checking has been globally disabled. -----Original Message----- From: LiNERROR [mailto:linerrorat_private] Sent: Thursday, July 10, 2003 11:57 PM To: incidentsat_private Subject: possible compromised host open running an audit on one of my networks Retina discovered a system with what appeared to be multiple administrator accounts. snip --- Accounts: User: Administrator Pass: rotartsinimdA - Account password reverse of account Accounts: User: Administrator Pass: Administrator - Account password same as account Accounts: User: Administrator Pass: - Account with no password snip --- However the system shows no evidence of these accounts in the user manager... BUT they EXIST! i can connect to the system using my specified Account and password... AND the three above. I've never seen this before and was wondering if anyone knew anything than might help me figureout how badly this system has been compromised... ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ---------------------------------------------------------------------------- ---------------------------------------------------------------------------- Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the world's premier technical IT security event! 10 tracks, 15 training sessions, 1,800 delegates from 30 nations including all of the top experts, from CSO's to "underground" security specialists. See for yourself what the buzz is about! Early-bird registration ends July 3. This event will sell out. www.blackhat.com ----------------------------------------------------------------------------
This archive was generated by hypermail 2b30 : Sun Jul 13 2003 - 10:27:58 PDT