RE: STRANGE undeletable directory

[Brenden C. Bryan]

Title: Message

Actually, doesn't require any knowledge at all. This is a simple script kiddie attack. He was probably using the exploited FTP site as storage for warez, or as an fxp site. While this attack itself is not exemplary of root attack, the fact that the server wasn't configured correctly to begin with, leads one to assume that other services were vulnerable to attack.     -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 10:41 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory   There  you go. I was afraid of that. This guy had some knowledge. He built  a sophisticated directory structure that he KNEW would be hard to get rid of. -----Original Message----- From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 8:32 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory Well i think i found it and the customer isnt going to be happy. I think someone backdoored him. So shutdown :) I'll give you an update status in a day or 2 Thanks for al the help guys. At 08:13 AM 8/16/2001 -0700, you wrote: Better question: What would make you assume he didn't? -----Original Message----- From: Bunting, Jeff [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 8:02 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory Assuming the machine was configured for anonymous logins, what would make you believe he did anything else he wasn't allowed to do? -----Original Message----- From: Martin Blackstone [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 10:54 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory Of course you still need to rebuild the box now. Who knows what else this guy did to it. -----Original Message----- From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 7:37 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory Good one didnt think of that going to try it now At 09:36 AM 8/16/2001 -0500, you wrote: can you change attributes from the command line? -----Original Message----- From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 09:17 To: NT System Admin Issues Subject: RE: STRANGE undeletable directory Jup deleting it from the command line gave the same error: The parameter is incorrect At 10:19 AM 8/16/2001 -0400, you wrote: Did you try deleting it from the command line?   -----Original Message----- From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 10:13 AM To: NT System Admin Issues Subject: RE: STRANGE undeletable directory I dunno, cant rename cant move can do shit! Very strange At 09:10 AM 8/16/2001 -0500, you wrote: Is it because "Com1"? -----Original Message----- From: Martijn Eindhoven [mailto:[EMAIL PROTECTED]] Sent: Thursday, August 16, 2001 09:03 To: NT System Admin Issues Subject: STRANGE undeletable directory Oke guys i have the following question. A customer has his own w2ks box. Now he asked me to look at his machine because he had a problem I logged in and looked at the problem. The first thing i saw that here was an ftp abuser. So i kicked him out. But when i was going to delete the directories he made I stumbled upon the strangest problem i've ever seen since a long time. He made a map in the login directory that looked like this: pub---         |         Com1--                 |                 Pub----                       |                       Aux                       Aux (yes two times an identical directory) It says "The parameter is incorrect" when i try to delete it. Looked at the settings and everything. Still undeletable. Any ideas guys. Met vriendelijke groet, M. Eindhoven NT System Administrator Bevelander Internet Services B.V. Folkstoneweg 10 1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 http://www.bevelander.nl ================================================= This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ================================================= http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm Met vriendelijke groet, M. Eindhoven NT System Administrator Bevelander Internet Services B.V. Folkstoneweg 10 1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 http://www.bevelander.nl ================================================= This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ================================================= http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm Met vriendelijke groet, M. Eindhoven NT System Administrator Bevelander Internet Services B.V. Folkstoneweg 10 1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 http://www.bevelander.nl ================================================= This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ================================================= http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm Met vriendelijke groet, M. Eindhoven NT System Administrator Bevelander Internet Services B.V. Folkstoneweg 10 1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 http://www.bevelander.nl ================================================= This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ================================================= http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm Met vriendelijke groet, M. Eindhoven NT System Administrator Bevelander Internet Services B.V. Folkstoneweg 10 1118 LM SCHIPHOL Zuidoost Tel : 020 40 53 900 Fax : 020 40 53 910 http://www.bevelander.nl ================================================= This communication contains information which is confidential and may also be privileged. It is for the exclusive use of the intended recipient(s). If you are not the intended recipient(s), please note that any distribution, copying or use of this communication or the information in it is strictly prohibited. If you have received this communication in error, please notify the sender immediately and then destroy any copies of it. ================================================= http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm http://www.sunbelt-software.com/ntsysadmin_list_charter.htm