Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Astalavista.com hacked, including details

astalavista.com

Post reply on HN
Print view View original

21–30 of 68 posts

Re: Astalavista.com hacked, including details

#21

Post by bdr »

duskwuff wrote: post #20
iheartmemcache wrote: post #17

Earlier quoted context omitted.

It looks like they first buffer overflowed Litespeed to spawn a shell (which was ironically running as a user 'apache'). The http headers that are being returned from Astalavista are consistent with this theory (in addition to the obvious output of the first binary run). Apparently Litespeed has a pretty dodgy security record after doing a cursory search. Far more interesting was the root escalation exploit. 2.6.18 i…

There's a nasty bug in the vmsplice() syscall in anything from 2.6.17 to 2.6.24.1. Exploits have been public since early 2008. http://www.milw0rm.com/exploits/5092 http://www.milw0rm.com/exploits/5093

One of the files on their server is an exploit for that vulnerability. If they know about it, I would guess they aren't vulnerable, but who knows.

Re: Astalavista.com hacked, including details

#23

Post by Confusion »

gmazzola wrote: post #2

Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…

Offtopic, but please, don't use 'virii'. The correct plural is 'viruses'. 'Virii' is wrong for two reaons:

1) The Latin plural of word ending in -us is not -ii. -i at best.

2) 'Virus' doesn't have a Latin plural, because its meaning is like (in the sense of not having a plural) 'sand': it already denotes a multitude.

Re: Astalavista.com hacked, including details

#25

Post by andreyf »

noodle wrote: post #7
gmazzola wrote: post #2

Page as it appeared on June 5, 2009 12:15AM EDT: http://pastebin.com/f751e9f5b The post is a little low on details concerning the actual exploit used, but there's pretty massive carnage. Let's hope the admins have offsite backups. For those who don't know of Astalavista, it was a popular website for "hackers" with relatively low-quality content. It started in 1994, and was one of the first search engines for computer…

hell, i tend to find any reasonably detailed description of the process of exploiting something to be pretty interesting. gives a fairly good idea of how to not make the same mistakes, if applicable.

Yeah, considering how last-decade astalavista.com is, I wouldn't be surprised if now is the most pageviews they've gotten in awhile ;)

Re: Astalavista.com hacked, including details

#26

Post by andreyf »

jrnkntl wrote: post #8

This somewhat concludes the whole point of the hax0rs: Quote: "plaintext passwords? yes, those so called "security professionals" who charge you $6.66 / month to register at their hack-proof portal, save your passwords in plaintext... brilliant!"

I especially liked "philip"... one of the 100 most common boy names.

dark side of me: I wonder how many of those passwords work to get into those e-mail accounts...

Re: Astalavista.com hacked, including details

#27

Post by duskwuff »

bdr wrote: post #21
duskwuff wrote: post #20

Earlier quoted context omitted.

There's a nasty bug in the vmsplice() syscall in anything from 2.6.17 to 2.6.24.1. Exploits have been public since early 2008. http://www.milw0rm.com/exploits/5092 http://www.milw0rm.com/exploits/5093

One of the files on their server is an exploit for that vulnerability. If they know about it, I would guess they aren't vulnerable, but who knows.

Good point. The kernel version in the transcript looks like the version I've got on a CentOS machine, so it's probably patched. Interestingly, the strings ("r00tr00t", "Executing shell") from the local-root tool they're using don't appear anywhere online, suggesting that it's something private and potentially unknown.

Re: Astalavista.com hacked, including details

#30

Post by oscardelben »

duskwuff wrote: post #27
bdr wrote: post #21

Earlier quoted context omitted.

One of the files on their server is an exploit for that vulnerability. If they know about it, I would guess they aren't vulnerable, but who knows.

Good point. The kernel version in the transcript looks like the version I've got on a CentOS machine, so it's probably patched. Interestingly, the strings ("r00tr00t", "Executing shell") from the local-root tool they're using don't appear anywhere online, suggesting that it's something private and potentially unknown.

maybe it's just not indexed.
Post reply on HN