This is a multi-part message in MIME format.
------=_NextPart_000_0033_01C04C44.A41C9E80
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
drwxrwxrwx 7 110 203 4096 Nov 4 22:45 .
drwxr-xr-x 14 110 203 4096 Sep 24 12:04 ..
-rw-r--r-- 1 armin armin 2326 Sep 25 18:25 apache_pb.gif
drwxrwxr-x 2 armin armin 4096 Sep 25 18:27 deborah
drwxrwxrwx 4 armin armin 4096 Oct 10 14:45 dev
-rw-r--r-- 1 root ftp 1431 Oct 24 20:06 index.html
drwxrwxrwx 2 armin armin 4096 Nov 11 17:01 kristen
drwxrwxrwx 3 armin armin 4096 Nov 11 16:08 lauren
drwxrwxrwx 7 110 203 4096 Aug 16 1999 manual
-rw-r--r-- 1 root ftp 66 Oct 24 20:04 old.html
[armin@gateway /www]$ =
=20
Someone hacked into my little Linux gateway box. He defaced index.html =
and saved the old one as old.html
That he appears as root/ftp, is that an indication how he got in?
I had anon. ftp running, using the default one RH 6.2 ships with =
(wu-2.6.0).
I suppose I have to completely re-setup that box, I just would like to =
know what hole to close there.
Any ideas?
If anybody wants to see the deface before I fix by box: =
http://24.221.63.194/
------=_NextPart_000_0033_01C04C44.A41C9E80
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4134.600" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2>drwxrwxrwx 7=20
110 =20
203 4096 Nov =
4 22:45=20
.<BR>drwxr-xr-x 14 110 =20
203 4096 Sep 24 =
12:04=20
..<BR>-rw-r--r-- 1 armin =20
armin 2326 Sep 25 18:25=20
apache_pb.gif<BR>drwxrwxr-x 2 armin =20
armin 4096 Sep 25 18:27=20
deborah<BR>drwxrwxrwx 4 armin =20
armin 4096 Oct 10 14:45=20
dev<BR>-rw-r--r-- 1 root =20
ftp 1431 Oct 24 =
20:06=20
index.html<BR>drwxrwxrwx 2 armin =20
armin 4096 Nov 11 17:01=20
kristen<BR>drwxrwxrwx 3 armin =20
armin 4096 Nov 11 16:08=20
lauren<BR>drwxrwxrwx 7 =
110 =20
203 4096 Aug =
16 1999=20
manual<BR>-rw-r--r-- 1 root =20
ftp 66 =
Oct 24=20
20:04 old.html<BR>[armin@gateway=20
/www]$ &=
nbsp; &n=
bsp; &nb=
sp; &nbs=
p; =20
</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Someone hacked into my little Linux =
gateway box. He=20
defaced index.html and saved the old one as old.html</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>That he appears as root/ftp, is that an =
indication=20
how he got in?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I had anon. ftp running, using the =
default one RH=20
6.2 ships with (wu-2.6.0).</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I suppose I have to completely re-setup =
that box, I=20
just would like to know what hole to close there.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Any ideas?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>If anybody wants to see the deface =
before I=20
fix by box: <A=20
href=3D"
http://24.221.63.194/">
http://24.221.63.194/</A></FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV></BODY></HTML>
------=_NextPart_000_0033_01C04C44.A41C9E80--
.%0A>%20%0A>%20I%20suppose%20I%20have%20to%20completely%20re-setup%20that%20box,%20I%20just%20would%20like%20to%20=%0A>%20know%20what%20hole%20to%20close%20there.%0A>%20%0A>%20Any%20ideas?%0A>%20%0A>%20If%20anybody%20wants%20to%20see%20the%20deface%20before%20I%20fix%20by%20box:%20=%0A>%20http://24.221.63.194/%0A>%20%0A>%20%0A>%20%0A>%20%0A>%20<!DOCTYPE%20HTML%20PUBLIC%20%22-//W3C//DTD%20HTML%204.0%20Transitional//EN%22>%0A>%20<HTML><HEAD>%0A>%20<META%20http-equiv=3DContent-Type%20content=3D%22text/html;%20=%0A>%20charset=3Diso-8859-1%22>%0A>%20<META%20content=3D%22MSHTML%205.50.4134.600%22%20name=3DGENERATOR>%0A>%20<STYLE></STYLE>%0A>%20</HEAD>%0A>%20<BODY%20bgColor=3D#ffffff>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>drwxrwxrwx %207=20%0A>%20110 =20%0A>%20203 %204096%20Nov %20=%0A>%204%2022:45=20%0A>%20.<BR>drwxr-xr-x %2014%20110 =20%0A>%20203 %204096%20Sep%2024%20=%0A>%2012:04=20%0A>%20..<BR>-rw-r--r-- %201%20armin =20%0A>%20armin %202326%20Sep%2025%2018:25=20%0A>%20apache_pb.gif<BR>drwxrwxr-x %202%20armin =20%0A>%20armin %204096%20Sep%2025%2018:27=20%0A>%20deborah<BR>drwxrwxrwx %204%20armin =20%0A>%20armin %204096%20Oct%2010%2014:45=20%0A>%20dev<BR>-rw-r--r-- %201%20root =20%0A>%20ftp %201431%20Oct%2024%20=%0A>%2020:06=20%0A>%20index.html<BR>drwxrwxrwx %202%20armin =20%0A>%20armin %204096%20Nov%2011%2017:01=20%0A>%20kristen<BR>drwxrwxrwx %203%20armin =20%0A>%20armin %204096%20Nov%2011%2016:08=20%0A>%20lauren<BR>drwxrwxrwx %207%20=%0A>%20110 =20%0A>%20203 %204096%20Aug%20=%0A>%2016 %201999=20%0A>%20manual<BR>-rw-r--r-- %201%20root =20%0A>%20ftp %2066%20=%0A>%20Oct%2024=20%0A>%2020:04%20old.html<BR>%5Barmin@gateway=20%0A>%20/www%5D%24 &=%0A>%20nbsp; &n=%0A>%20bsp; &nb=%0A>%20sp; &nbs=%0A>%20p; =20%0A>%20</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>Someone%20hacked%20into%20my%20little%20Linux%20=%0A>%20gateway%20box.%20He=20%0A>%20defaced%20index.html%20and%20saved%20the%20old%20one%20as%20old.html</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>That%20he%20appears%20as%20root/ftp,%20is%20that%20an%20=%0A>%20indication=20%0A>%20how%20he%20got%20in?</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>I%20had%20anon.%20ftp%20running,%20using%20the%20=%0A>%20default%20one%20RH=20%0A>%206.2%20ships%20with%20(wu-2.6.0).</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>I%20suppose%20I%20have%20to%20completely%20re-setup%20=%0A>%20that%20box,%20I=20%0A>%20just%20would%20like%20to know%20what%20hole%20to%20close%20there.</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>Any%20ideas?</FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2>If%20anybody%20wants%20to%20see%20the%20deface%20=%0A>%20before%20I=20%0A>%20fix by%20box:%20<A=20%0A>%20href=3D%22http://24.221.63.194/%22>http://24.221.63.194/</A></FONT></DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV></BODY></HTML>%0A>%20%0A>%20------=_NextPart_000_0033_01C04C44.A41C9E80--%0A>%20%0A>%20%0A>%20%0A>%20%0A>%20 "Reply to this message")
(text/plain)