Subject: BUG??? WU!

From: "Randy A. Katz" <[email-masked]>
Date: Wed, 19 Nov 1997 19:51:17 -0800

This posted before with only one response. 

 Hello,
 
 I tried to find out how this hacker is doing it on an ISP list and they 
 said I was a hacker...HELP!!!
 
 The hacker ftp's into our server as a valid user (we will cancel him as 
 soon as we know how to keep him out). Hacker copies /etc/master.passwd to 
 his home directory. Hacker modified master.passwd. Hacker copies it back 
 to /etc/master.passwd.
 
 How is he doing this? Is this a wu-ftpd bug?

Thanx,
Randy Katz

---

From: Kent Landfield <[email-masked]>
Date: Wed, 19 Nov 1997 22:13:28 -0600 (CST)

#  I tried to find out how this hacker is doing it on an ISP list and they 
#  said I was a hacker...HELP!!!
#  
#  The hacker ftp's into our server as a valid user (we will cancel him as 
#  soon as we know how to keep him out). Hacker copies /etc/master.passwd to 
#  his home directory. Hacker modified master.passwd. Hacker copies it back 
#  to /etc/master.passwd.
#  
#  How is he doing this? Is this a wu-ftpd bug?

Randy,
	Put like that I can easily see why someone mistook you for a person 
simply trolling for information. There are just too many of those types 
around today... sigh...

OK. Need more information before I or anyone here can be of help to you.
The following questions need to be answered.  I suspect that you should 
have no problem answering them here.  The more minds the better. And on
top of that it's an education for us all. You can be pretty generic and 
still give us the background we need...

    1. What type of machine are you running this on ?

    2. What version of the operating system is running on that machine ?

    3. What version of the wu-ftpd software is being used ?

    4. Are you sure that it is ftp that this person is coming 
       through (and why) ?

    5. Does the server in question allow anonymous ftp ?

    6. What steps have been taken to prevent this person that failed 
       to stop them.

    7. Have you been able to watch this happen and do you have the log
       entries ? Are you logging all commands or simply xfers ?

This should give us a basis to start helping you defeat this slimbucket...
And that's before we setup 'noretrieve passwd'.

-- 
Kent Landfield                        Phone: 1-817-545-2502             
Email: [email-masked]             http://www.landfield.com/
Email: [email-masked]                   http://www.nfr.net/
Please send comp.sources.misc related mail to [email-masked]
Search the Usenet Hypertext FAQ Archive at http://www.faqs.org/faqs/

---

From: Michael Brennen <[email-masked]>
Date: Wed, 19 Nov 1997 22:14:05 -0600 (CST)

>  his home directory. Hacker modified master.passwd. Hacker copies it back 

Your ftp site does not have a standard wuftpd login, so the version is
not known; did you modify the greeting? 

Almost certainly you have a misconfigured or compromised ftp server,
but without more information no one will be able to help you. 

You may wish to do more reading below.

wu-ftpd Resource Center:  http://www.landfield.com/wu-ftpd/
wu-ftpd list archive:     http://www.landfield.com/wu-ftpd/mail-archive/

   -- Michael

---

From: "Randy A. Katz" <[email-masked]>
Date: Wed, 19 Nov 1997 20:46:03 -0800

>    1. What type of machine are you running this on ?
	Intel Pentium.

>    2. What version of the operating system is running on that machine ?
	FreeBSD 2.2.2 Release.

>    3. What version of the wu-ftpd software is being used ?
	I've tried Beta-13,14,15 he seems to get into them all with ease.

>    4. Are you sure that it is ftp that this person is coming 
	Yes. In the logs he comes in as a certain user. Then he get's
/etc/master.passwd which he shouldn't be able to (chmod 600, root/wheel).
And /etc/ is 755.

>    5. Does the server in question allow anonymous ftp ?
	Yes. But I even wipe out the upload directory just to see what happened
and the guy still got in.

>    6. What steps have been taken to prevent this person that failed 
	I reinstalled everything. Made only root, the system users and 2 other
users (mine and his). Gave him the password to his (this guy used to be a
customer and now I just want to keep him around until I get things figured
out) account and told him to go for it...it took him 2 minutes or less.

>       entries ? Are you logging all commands or simply xfers ?
	Just transfers, When I tried to get tcp_wrappers going it didn't produce a
log on the fingerd one so I didn't go on...the docs said to test it on that.

>And that's before we setup 'noretrieve passwd'.

Ok.

Thanx,
Randy Katz

---

From: Michael Brennen <[email-masked]>
Date: Wed, 19 Nov 1997 23:27:55 -0600 (CST)

> /etc/master.passwd which he shouldn't be able to (chmod 600, root/wheel).

Are you sure that the ftp login you gave him is chroot'd?  Can you
login to his account and duplicate the results? 

> out) account and told him to go for it...it took him 2 minutes or less.

Do you allow root to login by ftp to the box?  I would disallow that
in all cases. 

This is a different slant, but the best secure remote login tool I
know of, and the only one I use, is ssh: http://www.ssh.fi/

   -- Michael

---

From: Kent Landfield <[email-masked]>
Date: Wed, 19 Nov 1997 23:35:11 -0600 (CST)

So we have a PC running FreeBSD 2.2.2 and the current ftpd server on the
machine is wu-ftpd beta-15 with a modified banner message.  Is this correct ?

# >    4. Are you sure that it is ftp that this person is coming 
# >       through (and why) ?
# >
# 	Yes. In the logs he comes in as a certain user. Then he get's
# /etc/master.passwd which he shouldn't be able to (chmod 600, root/wheel).
# And /etc/ is 755.

# >    5. Does the server in question allow anonymous ftp ?
# >
# 	Yes. But I even wipe out the upload directory just to see what happened
# and the guy still got in.

Not sure what you mean here... Do you mean you disabled anonymous ftp in the
passwd file ? Or just removed the anonymous ftp directory ?  Is he comming
in as a real user or as an anonymous one ?

# >    6. What steps have been taken to prevent this person that failed 
# >       to stop them.
# >
# 	I reinstalled everything. Made only root, the system users and 2 other
# users (mine and his). Gave him the password to his (this guy used to be a
# customer and now I just want to keep him around until I get things figured
# out) account and told him to go for it...it took him 2 minutes or less.

OK... Here's a _real_ dumb question... He wasn't suspicous when you reinstalled
the system ? I take it this is not a friend who has challenged you to a test
is it ?  Sorry for the dumb questions (can only go on the words above) but if 
that's the case, ask him (and then tell us so we can correct it...:)) 

More (hopefully, not so dumb) questions:

   - Does he have simply an ftp account or does he also have telnet access ?

   - Have you found any core files that were generated by wu-ftpd or an
     associated utility ?

   - Is he using gnutar at any point ?

# >    7. Have you been able to watch this happen and do you have the log
# >       entries ? Are you logging all commands or simply xfers ?
# >
# 	Just transfers, ...

Start up your server in the inetd.conf file with a "in.ftpd -la" so you can
get more info.

Put the following entries in your syslog.conf file making sure the following
are tab separated columns.

#
# FTPD Server Log Entries
#
daemon.debug                                    /var/log/daemon.log
daemon.info                                     /var/log/daemon.log
daemon.err                                      /var/log/daemon.log
daemon.notice                                   /var/log/daemon.log
daemon.warning                                  /var/log/daemon.log
daemon.warning                                  /dev/console

Restart or SIGHUP your current syslogd process and then see what more you 
can actually see.  It will show you the commands entered. (Well most I 
think...)

---

From: Michael Brennen <[email-masked]>
Date: Wed, 19 Nov 1997 23:54:44 -0600 (CST)

I wonder if this is not either a core dump / pick the passwords out of
the dump exploit or a hole in a utility in the guest account tree that
ftp can run.  As Kent mentioned, gnu tar should not be available to a
guest account. 

   -- Michael

---

From: "Randy A. Katz" <[email-masked]>
Date: Wed, 19 Nov 1997 21:55:35 -0800

These double postings are really interesting...I get to read it twice...

---

From: Anders Thulin <[email-masked]>
Date: Thu, 20 Nov 1997 08:17:34 +0100 (MET)

> and the guy still got in.

  I'm reading this literally -- deleting the home directory of the
account. A recent post in this list noted that standard behaviour in WU-FTP
was to use / as CWD in case the home directory was inaccessible, which
seem somewhat odd.

  There's not any problem with the user's home directory that might produce
such behaviour?

> log on the fingerd one so I didn't go on...the docs said to test it on that.

  Turn on command logging -- then at least you'll see what commands are being
used. That should be information enough.

  Do you get any syslog warnings or error messages from the session? (Assuming
syslog is configured so that such messages are logged.)  

Anders Thulin       [email-masked]        013-23 55 32
Telia Engineering AB, Teknikringen 6, S-583 30 Linkoping, Sweden