On Wed, Mar 22, 2000 at 14:02 +0100, Frank Derichsweiler wrote:

unsigned char shellcode[] =

with some rows of "\x ...\x" numbers. I assume that there is the coding of a shell command. Unfortunately I do not know how to "read" the command.

That's an array (read: data block) containing binary code (obj code in hex notation). You wouldn't like to read this as text just like the processor won't try to do :) Have a look at the toolbox on your computer's disk -- it's plenty of aiding stuff.

rpm -ql binutils

nm(1) and (more likely) objdump(1) should be your friends. And some literature on the processor's (i386?) internals. Read "man 1 objdump" and look out for the "disass" catch word. Maybe you want to consult somebody with programming skills (C and assembly).

virtually yours 82D1 9B9C 01DC 4FB4 D7B4 61BE 3F49 4F77 72DE DA76 Gerhard Sittig true | mail -s "get gpg key" Gerhard.Sittig@gmx.net

Hello Frank, I think it's not necessary to decode the Assembler-commands, because they do exactly what the name "shellcode" means: Starting a (root-) shell. So the buffer consists of two Linux system calls: (1) execve(/bin/bash) to start the shell (2) exit(0) just in case execve returns with an error

So with that source code you found, you can only say which program was used to break into your friends box, e.g. which service had the security hole. To find out what your hacker did after the break-in, you could probably start reading root's cmdline-history /root/.bash_history or /root/.sh-history.

For further information on buffer overflows read phrack magazine, issue 49 (www.phrack.com), "Smashing the stack for fun an profit".

Greetz, Soeren.

Hi list,

the box of a friend was hacked: /bin/ps /bin/login /bin/ls were replaced / trojaned. The original files were placed in /bin/bincp (which is not shown by ls, but cd into that dir works fine)

Luckyly I found some source within a log of another machine. Comments show that there is an

unsigned char shellcode[] =

with some rows of "\x ...\x" numbers. I assume that there is the coding of a shell command. Unfortunately I do not know how to "read" the command. Translating the hex numbers into decimal and using an ASCII table does not give a usefull result. Any idea? Tips who to detect which root kit was used are welcome, too.

TIA Frank

---

To unsubscribe, e-mail: suse-security-unsubscribe@suse.com For additional commands, e-mail: suse-security-help@suse.com

On Wed, 22 Mar 2000, Frank Derichsweiler wrote:

the box of a friend was hacked: /bin/ps /bin/login /bin/ls were replaced / trojaned. The original files were placed in /bin/bincp (which is not shown by ls, but cd into that dir works fine)

Tips who to detect which root kit was used are welcome, too.

Hi! We had a breakin not long ago and the part about hidden dirs sounds familiar. The intruder used a kernel-based root kit for 2.2 kernels, Knark v0.50, which would put some info about hidden dirs and some other info into (hidden) /proc/knark dir. Check for it. I could also post the README file from the root kit, maybe that could give you some more clues?

Regards, Daniel.

On Thu, Mar 23, 2000 at 08:27:52PM +0100, Gerhard Sittig wrote:

Just FYI if you don't get what you want with objdump(1) -- I don't know well this can cope with formats _not_ being produced by cc(1), ld(1) or ar(1), i.e. not being a supported executable format.

Hello Gerhard, Hello list,

I just would like to confirm the useability of nm and objdump as posted. The shell made the following things: Transform the string /BIN/SH (which is within the code) into /bin/sh, put addresses etc. into the exploited buffer, call execv and perform error checking.

Frank