ttymon 1586 root 3u raw 1799 00000000:0001 - >00000000: 0000 st=07
Confirms that two back doors:
[root@victim root] # nc localhost 31338
SSH-1.5-2.0.13
Obvious, this ssh back door, estimated that reads that /etc/sh.conf to take the password. raw socket that I cannot think of us to confirm temporarily, as soon as because comes not to know he grasps any package, icmp or tcp, two come not to know he grasps package's characteristic. The overlord braces the bow hardly. Carries out first.
[root@victim root] # /sbin/ttymon
[root@victim root] # /sbin/ttymon --help
[root@victim root] # /sbin/ttymon - h
Such is not obedient? strings you. My here leaves out some useless information
[root@victim root] # strings /sbin/ttymon
Usage: %s <dst> <src> <size> <number>
Ports are set to send and receive on port 179
dst: Destination Address
src: Source Address
size: Size of packet which should be no larger than 1024 should allow for xtra header info thru routes
num: packets
Could not resolve %s fucknut
ICMP
jess
tc: unknown host
3.3.3.3
mservers
lamersucks
skillz
ttymon
./0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ
Look through his key words, is not difficult to discover that ttymon should be has revised ddos the procedure, is one hits the router the thing, looks like this brothers the heart to be very big.
Dameonic.c is a theoretical router based denial of service attack that exploits a weakness within the Border Gateway Protocol (BGP). If a malicious user sends spoofed malformed packets to a neighboring router, the peer will ignore it and possibly kill the session entirely. Written on a Ultra 5 running Linux Zoot, this has been compiled on Linux, OpenBSD, Solaris without problems.
Procedure in
http://packetstormsecurity.org/0008-exploits/daemonic.c
Stemming from to this drug addict ambition's curiosity, I got down this procedure to come back to translate
[fatb@baoz ~] $ ./a
Daemonic - BGP Killer [Theories in DoS] www.AntiOffline.com/TID/
Usage: ./a <radd> <sradd> <bgsize> <number>
Ports are set to send and receive on port 179
radd: Address of router running BGP [victim]
sradd: Source address of neighbor router running BGP [attacker]
bgsize: Size of packet which should be no larger than 1024 should allow for xtra header info thru routes
num: pulverizations per second
Contrasts two places, one is the direct execution procedure returns information, the former does not demonstrate any information, the latter demonstration help, second is the strings output, the obvious the former output content are many, I guessed that behind the part contains the control password. Also has more importantly, this ttymon had raw socket to listen to the package, this raw socket was surely uses for to receive the master instruction, and carried out a corresponding ddos operation channel, following matter everybody imagined, ha-ha.
Other pages: : <<Prev * 1 * 2 * 3 * 4 * 5 * 6 * 7 * 8 * 9 * 10 * Next>>
|
You are here: hacking technology
> invades the examination
> Content
Category: Home
> invades the examination