Need to kill midaemon with only ftp access

[Adam Noble]

I currently have a server whereby I cannot login via the console or any standard mechanisms such as telnet, rlogin etc. I am however able to ftp to the server and using our oracle crontab have been able to gather data on the system. I am very confident that the problem we have is caused by the midaemon and an know bug with the product. I can see it is hogging CPU time on the system. I therefore want to know if anyone has any ideas how I can kill this using ftp. The problem I have is that my root cron jobs do not run until 21:30 tonight. The users are experiencing no performance degredation and therefore do not want the server booting in the day. Any ideas would be appreciated.

[Pete Randall]

No ideas, but a question: How are the users connecting?

Pete

[Adam Noble]

Via some form of application GUI no ability to break to shell.

[T G Manikandan]

I dont think you can do this using ftp.

Probably you can rename some scripts which are used for cron jobs but regarding the killing of process NO.

[Dietmar Konermann · Accepted solution]

Hi!

You may try to create a trojan script like this:

#!/usr/bin/sh
kill -9 $(UNIX95=1 ps -o pid= -C midaemon)
exec /sbin/ls $@

The ftp to the system, login as root and put the file to /usr/bin/ls.

ftp> put trojanls /usr/bin/ls
200 PORT command successful.

The type "ls" and the script should be executed.

Best regards...
Dietmar.

[Robin Wakefield]

Hi,

Can you not get the co-operation of the server's administrator to set up a job that looks for a file that you can ftp across. The job could then kill the process for you.

rgds, Robin

[Adam Noble]

Cheers chaps particularly dietmar, I like the idea, however due to the nature of the server, I would be a brave man to implement. Looks like a TOC after all.

[Dietmar Konermann]

Hey, before TOCing, you could give it a try, couldn't you? :-)

[Adam Noble]

Dietmar just bit the bullet and tried it and yes it worked, many thanks, not sure my boss would be too happy if he knew the resolution, but anyway thanks!

[Michael Burbury]

If you can FTP to the system and login to the FTP server as "root" and it's not setup for restrictive FTP, then you could:

QUOTE SITE EXEC "kill -9 $(UNIX95=1 ps -o pid= -C midaemon)"

Most FTP servers allow the use of the SITE EXEC command that will allow you to run commands on the FTP server.

You need to login as root to have permission to kill the daemon otherwise the remote command will run with the permission you login as.

[Steven E. Protter]

Some truly innovative hacking techniques here. I've noted this post 'case I ever get in this kind of trouble.

Note to children: Trying this stuff on systems you don't own is a Federal crime in most countries, definitely the US.

Note to sysadmins: allowing root ftp access on any system is a REALLY BAD ideal. put root in /etc/ftpaccess and your system will take a giant leap in security just from this step.

Note to forums from grandpa: This site is visible to the public internet and I personally would have made some of those posts offline. Not being an accomplished hacker I can only say I feel some pretty dangerous toys are in this thread.

I am wondering sir, what is the plan to bring this system to the point were it can be managed via normal means?

I suppose you could ftp in secure shell and use the techniques above to swintall it?

I'm wondering why you can not telnet. Is /var maybe full? Could you have stuff stored in the /var folder hidden by the mount of /var

If /var is not mounted, and you copy files in and after you mount it you can't see them. You find this out by booting into single user mode cd /var and doing an ls -la Anything you see should not be there.

As to how to get into single user mode without console acess? Ask A. Clay or Bill Hassell about that, I have no idea.

I suppose with ftp root access you can clear /var. You should clear any Core OS systems that are to close to full like /tmp or /var /opt and /usr do not matter so much.

SEP

[Dietmar Konermann]

Steven,

>Note to forums from grandpa:
>This site is visible to the
>public internet and I personally
>would have made some of those
>posts offline. Not being an
>accomplished hacker I can only
>say I feel some pretty dangerous
>toys are in this thread.

I don't see the problem here... the "hack" only works if you can login via ftp as root. However, if your hacker is able to do that then it's too late anyway.

Grandma's conclusion... allow root access only via ssh.

Best regards...
Dietmar.

[Adam Noble]

We are migrating to SSH access as we speak, anyway cheers all, Grandma, Grandpa and whoever!