This message is in MIME format. Since your mail reader does not understand
this format, some or all of this message may not be legible.
------_=_NextPart_001_01C04D3C.9CDBC940
Content-Type: text/plain;
charset="iso-8859-1"
I wonder, would he really send you the patch if you emailed him for it?
Anyone know? I know almost nothing about hacking/hackers/etc...
-----Original Message-----
From: Armin Hartinger [
mailto:armin@pctechware.com]
Sent: Sunday, November 12, 2000 1:05 AM
To:
Plug-discuss@lists.PLUG.phoenix.az.us
Subject: got cracked!
drwxrwxrwx 7 110 203 4096 Nov 4 22:45 .
drwxr-xr-x 14 110 203 4096 Sep 24 12:04 ..
-rw-r--r-- 1 armin armin 2326 Sep 25 18:25 apache_pb.gif
drwxrwxr-x 2 armin armin 4096 Sep 25 18:27 deborah
drwxrwxrwx 4 armin armin 4096 Oct 10 14:45 dev
-rw-r--r-- 1 root ftp 1431 Oct 24 20:06 index.html
drwxrwxrwx 2 armin armin 4096 Nov 11 17:01 kristen
drwxrwxrwx 3 armin armin 4096 Nov 11 16:08 lauren
drwxrwxrwx 7 110 203 4096 Aug 16 1999 manual
-rw-r--r-- 1 root ftp 66 Oct 24 20:04 old.html
[armin@gateway /www]$
Someone hacked into my little Linux gateway box. He defaced index.html and
saved the old one as old.html
That he appears as root/ftp, is that an indication how he got in?
I had anon. ftp running, using the default one RH 6.2 ships with (wu-2.6.0).
I suppose I have to completely re-setup that box, I just would like to know
what hole to close there.
Any ideas?
If anybody wants to see the deface before I fix by box:
http://24.221.63.194/ <
http://24.221.63.194/>
------_=_NextPart_001_01C04D3C.9CDBC940
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 5.50.4207.2601" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><SPAN class=3D802405006-13112000><FONT face=3DArial =
color=3D#0000ff size=3D2>I=20
wonder, would he really send you the patch if you emailed him for it? =
Anyone=20
know? I know almost nothing about =
hacking/hackers/etc...</FONT></SPAN></DIV>
<BLOCKQUOTE dir=3Dltr style=3D"MARGIN-RIGHT: 0px">
<DIV class=3DOutlookMessageHeader dir=3Dltr align=3Dleft><FONT =
face=3DTahoma=20
size=3D2>-----Original Message-----<BR><B>From:</B> Armin Hartinger=20
[
mailto:armin@pctechware.com]<BR><B>Sent:</B> Sunday, November 12, =
2000 1:05=20
AM<BR><B>To:</B> =
Plug-discuss@lists.PLUG.phoenix.az.us<BR><B>Subject:</B> got=20
cracked!<BR><BR></FONT></DIV>
<DIV><FONT face=3DArial size=3D2>drwxrwxrwx 7=20
110 =20
203 4096 =
Nov 4=20
22:45 .<BR>drwxr-xr-x 14 =
110 =20
203 4096 Sep 24 =
12:04=20
..<BR>-rw-r--r-- 1 armin =20
armin 2326 Sep 25 18:25=20
apache_pb.gif<BR>drwxrwxr-x 2 =
armin =20
armin 4096 Sep 25 18:27=20
deborah<BR>drwxrwxrwx 4 armin =20
armin 4096 Oct 10 14:45=20
dev<BR>-rw-r--r-- 1 root =20
ftp 1431 Oct 24 =
20:06=20
index.html<BR>drwxrwxrwx 2 armin =20
armin 4096 Nov 11 17:01=20
kristen<BR>drwxrwxrwx 3 armin =20
armin 4096 Nov 11 16:08=20
lauren<BR>drwxrwxrwx 7 =
110 =20
203 4096 Aug =
16 =20
1999 manual<BR>-rw-r--r-- 1 =
root =20
ftp =
66 Oct=20
24 20:04 old.html<BR>[armin@gateway=20
=
/www]$ =
=
=
=
=20
</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Someone hacked into my little Linux =
gateway box.=20
He defaced index.html and saved the old one as old.html</FONT></DIV>
<DIV><FONT face=3DArial size=3D2>That he appears as root/ftp, is that =
an=20
indication how he got in?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I had anon. ftp running, using the =
default one RH=20
6.2 ships with (wu-2.6.0).</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>I suppose I have to completely =
re-setup that box,=20
I just would like to know what hole to close there.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Any ideas?</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>If anybody wants to see the deface =
before I=20
fix by box: <A=20
href=3D"
http://24.221.63.194/">
http://24.221.63.194/</A></FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial =
size=3D2></FONT> </DIV></BLOCKQUOTE></BODY></HTML>
------_=_NextPart_001_01C04D3C.9CDBC940--
.%0A>%20%20%0A>%20I%20suppose%20I%20have%20to%20completely%20re-setup%20that%20box,%20I%20just%20would%20like%20to%20know%0A>%20what%20hole%20to%20close%20there.%0A>%20%20%0A>%20Any%20ideas?%0A>%20%20%0A>%20If%20anybody%20wants%20to%20see%20the%20deface%20before%20I%20fix%20by%20box:%0A>%20http://24.221.63.194/%20<http://24.221.63.194/>%20%0A>%20%20%0A>%20%20%0A>%20%0A>%20%0A>%20%0A>%20<!DOCTYPE%20HTML%20PUBLIC%20%22-//W3C//DTD%20HTML%204.0%20Transitional//EN%22>%0A>%20<HTML><HEAD>%0A>%20<META%20HTTP-EQUIV=3D%22Content-Type%22%20CONTENT=3D%22text/html;%20=%0A>%20charset=3Diso-8859-1%22>%0A>%20%0A>%20%0A>%20<META%20content=3D%22MSHTML%205.50.4207.2601%22%20name=3DGENERATOR>%0A>%20<STYLE></STYLE>%0A>%20</HEAD>%0A>%20<BODY%20bgColor=3D#ffffff>%0A>%20<DIV><SPAN%20class=3D802405006-13112000><FONT%20face=3DArial%20=%0A>%20color=3D#0000ff%20size=3D2>I=20%0A>%20wonder,%20would%20he%20really%20send%20you%20the%20patch%20if%20you%20emailed%20him%20for%20it?%20=%0A>%20Anyone=20%0A>%20know?%20I%20know%20almost%20nothing%20about%20=%0A>%20hacking/hackers/etc...</FONT></SPAN></DIV>%0A>%20<BLOCKQUOTE%20dir=3Dltr%20style=3D%22MARGIN-RIGHT:%200px%22>%0A>%20%20%20<DIV%20class=3DOutlookMessageHeader%20dir=3Dltr%20align=3Dleft><FONT%20=%0A>%20face=3DTahoma=20%0A>%20%20%20size=3D2>-----Original%20Message-----<BR><B>From:</B>%20Armin%20Hartinger=20%0A>%20%20%20%5Bmailto:armin@pctechware.com%5D<BR><B>Sent:</B>%20Sunday,%20November%2012,%20=%0A>%202000%201:05=20%0A>%20%20%20AM<BR><B>To:</B>%20=%0A>%20Plug-discuss@lists.PLUG.phoenix.az.us<BR><B>Subject:</B>%20got=20%0A>%20%20%20cracked!<BR><BR></FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>drwxrwxrwx %207=20%0A>%20%20%20110 =20%0A>%20%20%20203 %204096%20=%0A>%20Nov %204=20%0A>%20%20%2022:45%20.<BR>drwxr-xr-x %2014%20=%0A>%20110 =20%0A>%20%20%20203 %204096%20Sep%2024%20=%0A>%2012:04=20%0A>%20%20%20..<BR>-rw-r--r-- %201%20armin =20%0A>%20%20%20armin %202326%20Sep%2025%2018:25=20%0A>%20%20%20apache_pb.gif<BR>drwxrwxr-x %202%20=%0A>%20armin =20%0A>%20%20%20armin %204096%20Sep%2025%2018:27=20%0A>%20%20%20deborah<BR>drwxrwxrwx %204%20armin =20%0A>%20%20%20armin %204096%20Oct%2010%2014:45=20%0A>%20%20%20dev<BR>-rw-r--r-- %201%20root =20%0A>%20%20%20ftp %201431%20Oct%2024%20=%0A>%2020:06=20%0A>%20%20%20index.html<BR>drwxrwxrwx %202%20armin =20%0A>%20%20%20armin %204096%20Nov%2011%2017:01=20%0A>%20%20%20kristen<BR>drwxrwxrwx %203%20armin =20%0A>%20%20%20armin %204096%20Nov%2011%2016:08=20%0A>%20%20%20lauren<BR>drwxrwxrwx %207%20=%0A>%20110 =20%0A>%20%20%20203 %204096%20Aug%20=%0A>%2016 =20%0A>%20%20%201999%20manual<BR>-rw-r--r-- %201%20=%0A>%20root =20%0A>%20%20%20ftp %20=%0A>%2066%20Oct=20%0A>%20%20%2024%2020:04%20old.html<BR>%5Barmin@gateway=20%0A>%20%20%20=%0A>%20/www%5D%24 =%0A>%20 =%0A>%20 =%0A>%20 =%0A>%20 =20%0A>%20%20%20</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>Someone%20hacked%20into%20my%20little%20Linux%20=%0A>%20gateway%20box.=20%0A>%20%20%20He%20defaced%20index.html%20and%20saved%20the%20old%20one%20as%20old.html</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>That%20he%20appears%20as%20root/ftp,%20is%20that%20=%0A>%20an=20%0A>%20%20%20indication%20how%20he%20got%20in?</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>I%20had%20anon.%20ftp%20running,%20using%20the%20=%0A>%20default%20one%20RH=20%0A>%20%20%206.2%20ships%20with%20(wu-2.6.0).</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>I%20suppose%20I%20have%20to%20completely%20=%0A>%20re-setup%20that%20box,=20%0A>%20%20%20I%20just%20would%20like%20to know%20what%20hole%20to%20close%20there.</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>Any%20ideas?</FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2>If%20anybody%20wants%20to%20see%20the%20deface%20=%0A>%20before%20I=20%0A>%20%20%20fix by%20box:%20<A=20%0A>%20%20%20href=3D%22http://24.221.63.194/%22>http://24.221.63.194/</A></FONT></DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20size=3D2></FONT> </DIV>%0A>%20%20%20<DIV><FONT%20face=3DArial%20=%0A>%20size=3D2></FONT> </DIV></BLOCKQUOTE></BODY></HTML>%0A>%20%0A>%20------_=_NextPart_001_01C04D3C.9CDBC940--%0A>%20%0A>%20%0A>%20%0A>%20%0A>%20 "Reply to this message")
(text/plain)