Security Incidents mailing list archives
Re: Linux Kernel Exploits / ABFrag
From: "Christopher Wagner" <chrisw () pacaids com>
Date: Thu, 17 Oct 2002 11:35:49 -0700
About all I can guess with the information provided, is that this is just a copy-cat variant of the Slapper worm, how would you describe the "strange TCP behaviour?" Are you up-to-date on your patches? Are you running Apache? If you have the binary, please attach this time. Christopher Wagner <chrisw () pacaids com> Quote--> Greetings. Today I had a rather strange experiance. At about 4:30 pm GMT my IDS began reporting strange TCP behaviour on my network segment. As I was unable to verify the cause of this behaviour I was forced to remove the Linux box that I use a border gateway and traffic monitor - at no small cost to my organization - the network is yet to be reconnected. After a reboot and preliminary analysis I found the binary ABfrag sitting in /tmp. It had only been created minutes before. Setting up a small sandbox I ran the program and was presented with the following output: ---------------------------------------------------------------------------- ABfrag - Linux Kernel ( <= 2.4.20pre20 ) Remote Syncing exploit Found and coded by Ac1db1tch3z - t3kn10n, n0n3 and t3kn0h03. WARNING: Unlicensed usage and/or distribution of this program carries heavy fines and penalties under American, British, European and International copyright law. Should you find this program on any compromised system we urge you to delete this binary rather than attempt distribution or analysis. Such actions would be both unlawful and unwise. ---------------------------------------------------------------------------- password: invalid key I remembered, vaguely - I sift through a lot of security mail each day, some talk of a rumoured Linux kernel exploit circulating among members of the hacker underground. On the advice of some friends in law-enforcement I joined the EFnet channels #phrack and #darknet and tried to solicit some information regarding this alleged exploit. Most people publicly attacked me for my neivette but two individuals contacted me via private messages and informed me that the "ac1db1tch3z" were bad news, apparently a group of older (mid 20's) security guru's, and that I should delete the exploit and forget I ever knew it existed. However, somthing twigged my sense of adventure and prompted me to try and get this out to the community. Any help or information regarding this will be of great help. I have attached the binary although it appears to be encrypted and passworded. I wish any skilled programmers the best of luck in decyphering it. Yours, Daniel Roberts Head Network Manager <--Quote ---------------------------------------------------------------------------- This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com
Current thread:
- Linux Kernel Exploits / ABFrag daniel . roberts (Oct 16)
- Re: Linux Kernel Exploits / ABFrag eax (Oct 17)
- Re: Linux Kernel Exploits / ABFrag dr john halewood (Oct 17)
- <Possible follow-ups>
- Re: Linux Kernel Exploits / ABFrag Christopher Wagner (Oct 17)
- Re: Linux Kernel Exploits / ABFrag Ali Saifullah Khan (Oct 18)
- Re: Linux Kernel Exploits / ABFrag Benjamin Krueger (Oct 18)
- Re: Linux Kernel Exploits / ABFrag Curt Wilson (Oct 21)
- Re: Linux Kernel Exploits / ABFrag h2g . sec . list (Oct 21)
- Re: Linux Kernel Exploits / ABFrag Erik Sperling Johansen (Oct 21)