[PLUG] my wacko email server

Michael Whitman on 2000年6月28日 09:49:10 -0400 (EDT)

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

• From: Michael Whitman <michaelw@palawnet.com>
• To: plug@lists.nothinbut.net
• Subject: [PLUG] my wacko email server
• Date: 2000年6月28日 09:48:43 -0400
• Reply-to: plug@lists.nothinbut.net
• Sender: plug-admin@lists.nothinbut.net

---

My email server went crazy last night, according to my isp, sending something lik 3000 packets every 2 seconds to ip address 216.87.212.162. Doing a grep on that address I got this response /home/squ/.bash_history:./stealth 216.87.212.162 7

Here is the content of that file... looks loke bnc (an IRC program I think) was installed - what is stealth?

Looks like i was hacked? Any help with interpreting what went on would be appreciated.

w
w
w
ftp
l
w
ls
ftp
gcc -o stealth stealth.c
./stealth 207.202.129.211 1234
./stealth 206.161.205.30 225
ls
./stealth 207.179.81.70 6668
ls
./stealth 204.156.12.50 6667
./stealth 192.114.47.10 6667
ls
./stealth 213.9.19.30 6668
./stealth 204.126.2.47 1
./stealth 216.123.178.4 1
ls
w
lynx http://ftp.loxinfo.co.th/pub/unix/irc/bnc2.6.2.tar.gz
ls
gunzip bnc2.6.2.tar.gz
tar -vxf bnc2.6.2.tar
cd bnc2.6.2
make
pico example.conf
./bnc example.conf
ls
./stealth 216.87.212.162 7

-Mike

Michael P. Whitman
Programmer
LAW.com

mailto:michaelw@palawnet.com 

______________________________________________________________________
Philadelphia Linux Users Group - http://plug.nothinbut.net
Announcements - http://lists.nothinbut.net/mail/listinfo/plug-announce
General Discussion - http://lists.nothinbut.net/mail/listinfo/plug 

---

• Follow-Ups:
  • Re: [PLUG] my wacko email server
    • From: "Michael W. Ryan" <mryan@netaxs.com>
  • Re: [PLUG] my wacko email server
    • From: "Joel A. Matz" <jmatz@bellatlantic.net>

• References:
  • [PLUG] Philadelphia Java Users Group
    • From: darxus@chaosreigns.com
  • [PLUG] how do I ...
    • From: Michael Whitman <michaelw@palawnet.com>

• Prev by Date: [PLUG] how do I ...
• Next by Date: [PLUG] Re: Linux Meeting / 4th of July
• Previous by thread: [PLUG] how do I ...
• Next by thread: Re: [PLUG] my wacko email server
• Index(es):
  • Date
  • Thread