Another Malaysian Government Website Bites the Dust

The screenshot above is of http://www.geocities.com/nmapx/manifesto.txt. It reads:

A special officer to Datuk Seri Abdullah Ahmad Badawi confirmed the    
          incident and said it was an "unsuccessful hacking attempt".
"What happened is that someone copied the URL (the site's address) and cloned it   
                       to make it look like the real site.


                               Special Officer? 
         There is nothing special about you just the same as the rest of those 
                                 lazy adminz 

                         UBAH GAYA HIDUP ... Lancau ahh

                        You cant stop the unstoppable!!

The attacker is obviously referring to this news on NST regarding the hack "attempts" on PMO website.

And then followed by some output from the server that was hacked. The website (read the output below to see what it is) has the same vulnerability as The Prime Minister's Office website, in that it allows remote URL inclusion. But in this case, the attacker has taken a step further - he/she was able to execute commands via the remote URL inclusion, and subsequently gained shell access to the server. Check out the output below:

[@web ~]$ w
 16:38:42 up 16:42,  2 users,  load average: 0.22, 0.15, 0.11
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT
root     pts/0    172.17.27.60     09:11    7:27m  0.03s  0.01s tail -f access_log

[@web ~]$ uname -a
Linux web 2.6.9-5.EL #1 Wed Jan 5 19:22:18 EST 2005 i686 i686 i386 GNU/Linux

[@web ~]$ cat /etc/*ease
Red Hat Enterprise Linux AS release 4 (Nahant Update 4)

[@web ~]$ cat /etc/hosts
# Do not remove the following line, or various programs
# that require network functionality will fail.
127.0.0.1               web.heritage.gov.my web localhost.localdomain localhost www www.heritage.gov.my
172.16.10.2             web web.heritage.gov.my www www.heritage.gov.my
#172.16.10.7            murad
#172.16.10.9    	zuraihan

The first command was to show list of users currently logged in. The administrator (root) was logged on, and he was monitoring the webserver's access log file (tail -f access_log).

The second and third command were to get version name of the kernel (2.6.9????) and the distribution. And finally, an output from the /etc/hosts file.

The attacker could have just defaced, deleted, or wreak any kinds of havoc but he chose to deliver another message.