Re: Rooted, .haos on system

[Damian Gerow <damian () sentex net>]

On Thu, 2002-12-12 at 18:50, Damian Gerow wrote:
> I've just received word that one of our customers was rooted, and he's asking about the file ".haos".  Nothing rings 
> any bells, has anyone heard of it?

Just a quick update to this...

It looks like it was an IRC bot.  I found these interesting tidbits
throughout the various source trees left on the system (definitely a
script kiddie hack):

"   /.../    /m/src/Makefile":

        #
        #   Starglider Class EnergyMech, IRC bot software
        #   Copyright (c) 1997-2000  proton
        #
        #   This program is free software; you can redistribute it and/or modify
        #   it under the terms of the GNU General Public License as published by
        #   the Free Software Foundation; either version 2 of the License, or
        #   (at your option) any later version.

"   /.../    /m/emech.users":

        handle          Silviu
        mask            *!*@Scoobyy.users.undernet.org
        prot            4
        aop
        channel         *
        access          100

        handle          Malice
        mask            *!*@malice.users.undernet.org
        prot            4
        aop
        channel         *
        access          100

        handle          Mihai
        mask            *!*@p00f.users.undernet.org
        prot            4
        aop
        channel         *
        access          100

        handle          Doggy
        mask            *!*@Catelushu.users.undernet.org
        prot            4
        aop
        channel         *
        access          100

        handle          mortu
        mask            *!*@mortux.users.undernet.org
        prot            4
        aop
        channel         #DhT
        access          100

".../[wxz].users":


        handle          dxd
        mask            *!*dxd@*.*
        pass            nI-duWuaJw
        prot            4
        aop
        channel         *
        access          100

        handle          kappy
        mask            *!*kappy@*.*
        pass            0jgmlVQspb
        prot            4
        aop
        channel         *
        access          100

        handle          essence
        mask            *!*essence@*.*
        pass            wHC0Pmbfux
        prot            4
        aop
        channel         *
        access          100

        handle          karamel
        mask            *!*KarameL@*.*
        pass            kdiF0eQFYv
        prot            4
        aop
        channel         *
        access          100

        handle          DJcontact
        mask            *!*anathema@*.*
        pass            uSfKIJhaCS
        prot            4
        aop
        channel         *
        access          100

Other notes:

- a number of 'sendmail.c', 'modutils.sh', 'efstool.c', etc. files
kicking around
- a couple of binaries called 'httpd'
- an empty file called
"????????1?1?1??F??1?Q?8eshf5VJP?eebif5JJP??QS??1?1?????.eng"
- a couple of other system binaries (i.e. bash)


I still have the original 'haos' and 'haos2' tarballs, if anyone is
interested in looking at them.  They both contain libpcap, and look to
be some sort of an automated SSH exploiter, given by the contents of the
files "targets" and 'targets.txt":

<snip>
Big - SSH-1.5-OpenSSH-1.2.2,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,1
Small -  SSH-1.5-OpenSSH-1.2.3,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,0
Small - SSH-1.5-OpenSSH-1.2.3,0x0806d000,0x080725ec,0x0000c804,0x00010004,0x00000000,0x08400000,0x7a,0x0805,0
Big - SSH-1.5-OpenSSH-1.2.3,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,1
Small - SSH-1.5-OpenSSH-2.1,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,0
Big - SSH-1.5-OpenSSH-2.1,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,1
Small - SSH-1.99-OpenSSH_2.1.1,0x08210000,0x083f99b4,0x00000004,0x0000664c,0x00000000,0x08400000,0x96,0x0805,0
Small - SSH-1.99-OpenSSH-2.1.1,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,0
Big - SSH-1.99-OpenSSH-2.1.1,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,1
Small - SSH-1.99-OpenSSH-2.2.0,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,0
Big - SSH-1.99-OpenSSH-2.2.0,0x08070000,0x08184000,0x00000004,0x00010004,0x00000000,0x08400000,0x7a,0x0805,1
</snip>


If anyone wants more info, I'm willing to pass it on.  But I'm going to
guess they got in via OpenSSH, given the nature of the scanners and the
version of the daemon running on the box.  I'm not sure where the group
came from, but here's a quick quote from one of the shell scripts
("haosx"), and I'll leave you all at that:


   echo "$rver haosx for Linuxz"
   else
   echo ""
   echo "$rver Asteapta cateva secunde sa ma linistesc.."
   echo "Ia o pauza de o laba pana scanam ceva."
   echo "www.haos2.com"
   echo "Thanks 2 friends : in #haos channel."

----------------------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com