Re: possible compromised host

From: Harlan Carvey (keydet89at_private)
Date: Fri Jul 11 2003 - 13:03:46 PDT

  • Next message: LiNERROR: "more info on a hopefully unsuccessful compromise"

    You've got some very interesting results...one account
    that allows you to connect with three different
    passwords.  Interesting.  And you say that this
    account doesn't exist in the UserManager?  
    
    What os is this?
    
    > open running an audit on one of my networks Retina
    > discovered a system with 
    > what appeared to be multiple administrator accounts.
    > snip ---
    > Accounts: User: Administrator Pass: rotartsinimdA -
    > Account password 
    > reverse of account
    > Accounts: User: Administrator Pass: Administrator -
    > Account password same 
    > as account
    > Accounts: User: Administrator Pass: - Account with
    > no password
    > snip ---
    > However the system shows no evidence of these
    > accounts in the user 
    > manager... BUT they EXIST!
    
    The user account listed is Administrator in all three
    cases.  
    
    > i can connect to the system using my specified
    > Account and password... AND the three above.
    
    Three?  Or one?
    
    Harlan
    
    
    __________________________________
    Do you Yahoo!?
    SBC Yahoo! DSL - Now only $29.95 per month!
    http://sbc.yahoo.com
    
    ----------------------------------------------------------------------------
    Attend the Black Hat Briefings & Training, July 28 - 31 in Las Vegas, the 
    world's premier technical IT security event! 10 tracks, 15 training sessions, 
    1,800 delegates from 30 nations including all of the top experts, from CSO's to 
    "underground" security specialists.  See for yourself what the buzz is about!  
    Early-bird registration ends July 3.  This event will sell out. www.blackhat.com
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Sun Jul 13 2003 - 10:28:10 PDT