Re: I think I have been hacked

Article View: comp.os.linux.security

Article #16

Back to comp.os.linux.security Previous Next

#16

From: RainbowHat
Date: Mon, 27 May 2002 04:25

39 lines
2613 bytes

< Zebee Johnstone
>In aus.computers.linux on Mon, 27 May 2002 06:50:40 +0800
>Graham Daniell <gdaniell@wt.com.au> wrote:
>>
>>May 26 20:49:41 torvalds network: Bringing up route unknown
>>succeeded
>>May 26 20:49:41 torvalds network: Bringing up route eth0 succeeded
>
>>It looks to me like someone managed to install a route between my
>>internal network and an unknown address (probably 195.119.1.180?)
>
>Doesn't make sense to me.  eth0 isn't a route, it's a network
>interface...

Please try the following commands. 

nslookup unknown
nslookup eth0
nslookup eth1
nslookup 195.119.1.180          # at _your_ box
nslookup open.proxy.austnet.org
nslookup localhost

egrep -in '(unknown|eth(0|1))' /etc/hosts* /etc/named*

cat /etc/host.conf /etc/resolv.conf

su
egrep -in '(route|unknown|eth(0|1))' ~/.*history
echo $HOSTALIASES $LOCALDOMAIN

Which IRC client are you using on Windoze9x or Linux? Obsolete `mIRC` 
have a vulnerability (search bugtraq). 

8< (Summary: lsof -i, netstat -rn, ps)

-- 
Regards, RainbowHat. To spoof or not to spoof, that is the IPv4 packet.
----+----1----+----2----+----3----+----4----+----5----+----6----+----7

Technical Details

Message-ID: <UG6XMJ4H7XHW1115JXAH77O1nHiATlE@blackhole.mit.edu>

Path:

arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news.uchicago.edu!yellow.newsread.com!netaxs.com!newsread.com!news-out.spamkiller.net!propagator2-maxim!propagator-maxim!news-in.spamkiller.net!newsfeed2.kddnet.ad.jp!newsfeed.mesh.ad.jp!t-newsgw1.odn.ne.jp!nwall.odn.ne.jp!blackhole.mit.edu!whitehole!not-for-mail

References: <3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au>

Show Full Headers

Complete Article Headers

X-Google-Language: ENGLISH,ASCII-7-bit
X-Google-Thread: 106e9e,12f974d98d69a93f
X-Google-Attributes: gid106e9e,public
X-Google-Thread: 102983,12f974d98d69a93f
X-Google-Attributes: gid102983,public
X-Google-ArrivalTime: 2002-05-26 21:30:02 PST
Path: arc1-ca.pugleaf.net!archiver1.google.com!news1.google.com!newsfeed.stanford.edu!news.uchicago.edu!yellow.newsread.com!netaxs.com!newsread.com!news-out.spamkiller.net!propagator2-maxim!propagator-maxim!news-in.spamkiller.net!newsfeed2.kddnet.ad.jp!newsfeed.mesh.ad.jp!t-newsgw1.odn.ne.jp!nwall.odn.ne.jp!blackhole.mit.edu!whitehole!not-for-mail
From: RainbowHat <nHiATlE@blSackholeP.mAit.edMu.invalid>
Newsgroups: comp.os.linux.security,aus.computers.linux
Subject: Re: I think I have been hacked
Date: Mon, 27 May 2002 04:25:40 +0000 (UTC)
Organization: Paradise
Lines: 40
Distribution: World
Message-ID: <UG6XMJ4H7XHW1115JXAH77O1nHiATlE@blackhole.mit.edu>
References: <3CF166C0.6C6DB09C@wt.com.au> <slrnaf33hc.c0g.zebee@zipperii.zip.com.au>
NNTP-Posting-Host: cbcnni-03s1p205.ppp12.odn.ad.jp
X-Trace: nwall1.odn.ne.jp 1022473540 44116 61.209.66.205 (27 May 2002 04:25:40 GMT)
X-Complaints-To: news@odn.ad.jp
NNTP-Posting-Date: Mon, 27 May 2002 04:25:40 +0000 (UTC)
X-Newsreader: Micro$hit 0UTL00K 3XPR355 (Multics PDP-10)
X-BigBrother: Hackers Coderpunks Debugging Tools Stego Polymorphic Worm r00t Real Virtual Intelligence PGP
Cancel-Lock: SHA1:yPmh67DXYoVco1QHtzsrTzPF7gp=

Reply to Parent Message