Vulnerability Exploits

Impact

A possible backdoor resulting from a successful attack was detected.

Background

When vulnerabilities in network services are discovered, programs which exploit the vulnerabilities are often written and posted to mailing lists, IRC channels, and web sites. Some of these exploit programs create backdoors on the vulnerable server which allow the attacker, or anyone else who detects the backdoor, to connect and gain immediate privileged access.

The Problems

ingreslock:
The ingreslock port (1524/TCP) is often used as a backdoor by programs which exploit vulnerable RPC (Remote Procedure Call) services. The backdoor is usually accompanied by a file called /tmp/bob which is the configuration file which opens a shell on the port.

9704/TCP:
This port is opened by a common program which exploits an input validation problem in rpc.statd. The exploit modifies the inetd.conf file to open a shell on the port.

77/TCP:
This port is opened by a program which exploits a vulnerability in rpc.yppasswdd on Solaris. It uses a file called z as a configuration file for inetd.

Resolution

The backdoor can be removed by restoring /etc/inetd.conf, removing any unauthorized configuration files such as /tmp/bob or z, and restarting the inetd process. Only one inetd process should be running. Any extraneous processes should be killed.

Although the backdoor can be easily removed, this does not solve the problem at its root. If the vulnerability which was exploited is not corrected, there is nothing to stop the attacker from running the exploit again. The system should be taken offline and scanned for vulnerabilities. All problems should be fixed before the system is put back online.

Also note that not all vulnerability exploits create backdoors such as the ones described above. Sometimes there is no way to tell if a vulnerability has been exploited other than intrusion detection logs. Good security practices should always be followed, and systems should be scanned for vulnerabilities periodically.

Where can I read more about this?

The exploit for the rpc.statd vulnerability is discussed in CERT Advisory 2000-17.