Comments on: Hacked! Part 2 – Open source hacking

By: ez

ez — Tue, 27 Jan 2009 04:11:23 +0000

all files including src here
http://dump.no/files/2d373b7537a7/nab.zip
example: ./0-100 193
or
./run 193

output to “dava” (specified by parameters pre-set in “run”)

rdp/ssh/smtp check

By: Andrew Smith

Andrew Smith — Mon, 12 Jan 2009 21:20:56 +0000

No, I had no time to look at it thoroughly. Judging by what I have seen so far, the ftp_scanner would try to brute force login to an ftp server. The addresses of the FTP servers would be generated using the number scripts, and I expect nmap was used also to avoid trying servers not running FTP.

By: Michael Mullin

Michael Mullin — Mon, 12 Jan 2009 11:37:10 +0000

Did you audit heroina.c? What is the intended purpose of the ftp_scanner process? Do you think that this might be an automated hack (someone found a security hole to one of your web-facing processes… a script kiddy used the hole to attack everyone they could), or might this have been a hack targetted specifically at YOU?

Really interesting posts Andrew.

By: BossaNesta

BossaNesta — Mon, 12 Jan 2009 02:29:05 +0000

em.. interesting..