puidezmeu
29-01-14, 12:33
A aparut un xpl nou de ftp care face bypass la autentificare(nu cere user/pass)
Si mai e un backdoor pe telnet pt cutii care deschide telnet pe portul 31337 (merge folosit doar de pe un ip setat in binar)
Deja vad ca multe cutii au 31337 deschis...
Exemplu:
###############
Starting Nmap 5.21 ( http://nmap.org ) at 2014-01-29 10:24 CET
Nmap scan report for demo.46-169-95.eidsiva.net (95.169.46.demo)
Host is up (0.19s latency).
Not shown: 985 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
5060/tcp open sip
8001/tcp open unknown
8080/tcp open http-proxy
12000/tcp open cce4x
16000/tcp open unknown
16001/tcp open unknown
31337/tcp open Elite
Nmap done: 1 IP address (1 host up) scanned in 3.99 seconds
##############################
Asa ca ar fi bine sa inchideti ftp pt exterior si sa verificati portul 31337(telnet local-ip 31337)
root@crucisatorul:~/test/3/a# telnet 95.169.46.demo 31337
Trying 95.169.46.demo...
Connected to 95.169.46.demo.
Escape character is '^]'.
Connection closed by foreign host.
Daca apare asa nu e bine....trebuie sa fie conn refused
Si mai e un backdoor pe telnet pt cutii care deschide telnet pe portul 31337 (merge folosit doar de pe un ip setat in binar)
Deja vad ca multe cutii au 31337 deschis...
Exemplu:
###############
Starting Nmap 5.21 ( http://nmap.org ) at 2014-01-29 10:24 CET
Nmap scan report for demo.46-169-95.eidsiva.net (95.169.46.demo)
Host is up (0.19s latency).
Not shown: 985 closed ports
PORT STATE SERVICE
21/tcp open ftp
22/tcp open ssh
23/tcp open telnet
80/tcp open http
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
5060/tcp open sip
8001/tcp open unknown
8080/tcp open http-proxy
12000/tcp open cce4x
16000/tcp open unknown
16001/tcp open unknown
31337/tcp open Elite
Nmap done: 1 IP address (1 host up) scanned in 3.99 seconds
##############################
Asa ca ar fi bine sa inchideti ftp pt exterior si sa verificati portul 31337(telnet local-ip 31337)
root@crucisatorul:~/test/3/a# telnet 95.169.46.demo 31337
Trying 95.169.46.demo...
Connected to 95.169.46.demo.
Escape character is '^]'.
Connection closed by foreign host.
Daca apare asa nu e bine....trebuie sa fie conn refused