Old Webmin bug still being exploited
Sometimes it isn't the latest and greatest bug that gets the most utility from the criminals on the Internet, it's the easiest and most reliable. We received some solid analysis from a large hosting provider showing that Webmin versions below 1.290 are still being actively exploited. Version 1.290 that fixes the problem was released in June 2006, so the exploit is several months old.
To give some insight, this particular bug allows the attacker to read any file from the target as the root user. So the attacker is grabbing /etc/passwd and /etc/shadow from targets and then running john the ripper against the encrypted passwords. There is a nice auto-rooter toolkit that has a .ro (Romania) e-mail address claiming authorship.
While there is nothing exotic or shocking about any of this, it's still important for us to think about *NIX security. We don't want all the *NIX folks out there feeling that Microsoft client-side bugs are getting all the attention lately.
To give some insight, this particular bug allows the attacker to read any file from the target as the root user. So the attacker is grabbing /etc/passwd and /etc/shadow from targets and then running john the ripper against the encrypted passwords. There is a nice auto-rooter toolkit that has a .ro (Romania) e-mail address claiming authorship.
While there is nothing exotic or shocking about any of this, it's still important for us to think about *NIX security. We don't want all the *NIX folks out there feeling that Microsoft client-side bugs are getting all the attention lately.
Keywords:
0 comment(s)
Sniffers in Perl?!?
Maybe this will be interesting to the coders out there or possibly inspire someone to solve a problem in a different way... Download it here: http://handlers.sans.org/khaugsness/tail-pcap.pl
A while back I needed to do some sniffing for very specific packets in Perl. And I needed to wrap some logic around the packet processing. Doing regex matching and normal byte filtering in tcpdump wasn't going to be sufficient. So I wrote a quick little script using a Perl module to interface with the libpcap library. Everything was straight-forward and well documented until I needed to tail an existing pcap file. Google failed me. So through a little trial-and-error I figured out how to solve the problem. Here is an example script on how to do this.
Lessons learned: it isn't hard to write your own customized sniffer. Perl and Python have well-documented high-level interfaces that do most of the hard work for you.
A while back I needed to do some sniffing for very specific packets in Perl. And I needed to wrap some logic around the packet processing. Doing regex matching and normal byte filtering in tcpdump wasn't going to be sufficient. So I wrote a quick little script using a Perl module to interface with the libpcap library. Everything was straight-forward and well documented until I needed to tail an existing pcap file. Google failed me. So through a little trial-and-error I figured out how to solve the problem. Here is an example script on how to do this.
Lessons learned: it isn't hard to write your own customized sniffer. Perl and Python have well-documented high-level interfaces that do most of the hard work for you.
Keywords:
0 comment(s)
×
![modal content]()
Diary Archives
Comments