Old Webmin bug still being exploited

Published: 2006-10-04
Last Updated: 2006-10-05 14:53:34 UTC
by Kyle Haugsness (Version: 1)
0 comment(s)
Sometimes it isn't the latest and greatest bug that gets the most utility from the criminals on the Internet, it's the easiest and most reliable.  We received some solid analysis from a large hosting provider showing that Webmin versions below 1.290 are still being actively exploited.  Version 1.290 that fixes the problem was released in June 2006, so the exploit is several months old.

To give some insight, this particular bug allows the attacker to read any file from the target as the root user.  So the attacker is grabbing /etc/passwd and /etc/shadow from targets and then running john the ripper against the encrypted passwords.  There is a nice auto-rooter toolkit that has a .ro (Romania) e-mail address claiming authorship.

While there is nothing exotic or shocking about any of this, it's still important for us to think about *NIX security.  We don't want all the *NIX folks out there feeling that Microsoft client-side bugs are getting all the attention lately.
Keywords:
0 comment(s)

Sniffers in Perl?!?

Published: 2006-10-04
Last Updated: 2006-10-04 21:49:58 UTC
by Kyle Haugsness (Version: 1)
0 comment(s)
Maybe this will be interesting to the coders out there or possibly inspire someone to solve a problem in a different way...  Download it here: http://handlers.sans.org/khaugsness/tail-pcap.pl

A while back I needed to do some sniffing for very specific packets in Perl.  And I needed to wrap some logic around the packet processing.  Doing regex matching and normal byte filtering in tcpdump wasn't going to be sufficient.  So I wrote a quick little script using a Perl module to interface with the libpcap library.  Everything was straight-forward and well documented until I needed to tail an existing pcap file.  Google failed me.  So through a little trial-and-error I figured out how to solve the problem.  Here is an example script on how to do this.

Lessons learned: it isn't hard to write your own customized sniffer.  Perl and Python have well-documented high-level interfaces that do most of the hard work for you.

Keywords:
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives