This box has been offline (actually powered off) for several weeks and I'm just now getting around to performing some
analysis on it. When I discovred some strange behavior with some of the system utils (ps, ls, etc) I became suspious
and pulled the network connection. After saving some static html files, I powered the unit off.
>From my reading on the web regarding ShowTee, I've confirmed everything you mentioned below. I believe they got in via
a vulnerable version of wu-ftpd. This server was running 2.6.0 (I believe).
Do you think that this root kit would be able to capture passwords from other hosts on the network? For example: while
this infected box was on the network, it captured the login password from the infected box. Could it have captured
passwords when I logged into another machine on the network?
I have changed passwords for all the boxes on the network just to be safe.
Thanks,
Peter
On 23 Oct 2002 at 15:03, Gary Nichols wrote:
> On Wed, 23 Oct 2002 az_pete@cactusfamily.com wrote:
> > Does anyone know if there is a website that has info about root kits. One of my servers was infected with the ShowTee
> > root kit. I did find some info about ShowTee by searching on google, but it wasn't as helpful as I'd have hoped.
> > I'm looking for something similar to Symantec's Virus Encyclopedia, where I can type in the name of a virus and I get
> > detailed info about how it spreads, what type of files it infects, how to clean it and any variants of the virus.
> > Is there such a site for root kits?
>
> I take it the server is offline now? Did you figure out how the attacker
> got the rootkit on your box?
>
> Showtee is a nasty kit. It lets the attacker plant ssh and telnet
> backdoors into systems.
>
> What's worse? It includes an ssh binary which captures login
> credentials that mails the captured booty to the attacker.
>
> Showtee is also bi-polar. Not only does it locate exploitable services
> and vulnerabilities on your system, it fixes them so other hax0rs can't
> take over your box while the attacker controls it.
>
>
> --
> Gary Nichols RHCE
> http://www.linuxchimp.com
>
>
>
>
> -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
>
(text/plain)