lkml.org 
[lkml]   [2011]   [Jul]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: ext3 hacked filesystem (by debian exim4 exploit) available for analysis and bugreporting
From
On Mon, Jul 25, 2011 at 2:45 PM, Matthias Schniedermeyer <ms@citd.de> wrote:
> On 25.07.2011 13:08, Luke Kenneth Casson Leighton wrote:
>> folks, hi,
>>
>> apart from anything, files which cannot be deleted (and cannot be
>> detected as "corrupted" by fsck.ext3) is pretty damn serious.
>
> You did try lsattr and checked that the files aren't 'immutable'?

i didn't! :) didn't know about (but should have guessed) ext3
attributes. they are indeed - thank you matthias.

root@quietbaby:/mnt/horsebox/tmp3# lsattr *
----ia------------- bin3/kill
----ia------------- bin3/ps
----ia------------- c.pl
----ia------------- e.conf
----ia------------- sbin3/sysctl
----ia------------- usrbin3/uptime
----ia------------- usrbin3/tload
----ia------------- usrbin3/free
----ia------------- usrbin3/top
----ia------------- usrbin3/vmstat
----ia------------- usrbin3/watch
----ia------------- usrbin3/skill
----ia------------- usrbin3/pmap
----ia------------- usrbin3/pgrep
----ia------------- usrbin3/slabtop
----ia------------- usrbin3/pwdx
----ia------------- usrbin3/snice
----ia------------- usrbin3/pkill
----ia------------- usrbin3/w

so - looks like it's not as bad as i thought.

apologies for taking up peoples' time with this.

l.


\
 
 \ /
  Last update: 2011-07-25 23:11    [W:0.187 / U:0.068 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site