[lkml]   [2002]   [Apr]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: Question about 'Hidden' Directories in ext2
    You may use tripwire after you clean your system.
    Tripwire will check your system for changes in critical files.


    Craig Knox wrote:

    >On Tue, 2002-04-02 at 23:16, Calin A. Culianu wrote:
    >>Ok, so some hackers broke into one of our boxes and set up an ftp site.
    >>They monopolized over 70gb of hard drive space with warez and porn. We
    >>aren't really that upset about it, since we thought it was kind of funny.
    >>(Of course we don't like the idea that they are using out bandwidth and
    >>disk space, but we can easily remedy that).
    >>Anyway, the weird thing is they created 2 directories, both of which were
    >>strangely hidden. You can cd into them but you can't ls them. I
    >>/usr/lib/ypx and /usr/man/ypx were the two directories that contained both
    >>the ftp software and the ftp root. When you are in /usr/man and you do an
    >>ls, you don't see the ypx directory (same when you are in /usr/lib). The
    >>ls binary we got is right off the redhat cd so it shouldn't still be
    >>compromised by whatever rootkit was installed.
    >>My question is this: can the data structures in ext2fs be somehow hacked
    >>so a directory can't appear in a listing but can be otherwise located for
    >>a stat or a chdir? I should think no.. maybe we still haven't gotten rid
    >>of the rootkit...
    >If you are using the binary "ls" of the redhat CD they are probably
    >using a kernel module to hide this directory.
    >Have you tried running -> on the box?
    >To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    >the body of a message to
    >More majordomo info at
    >Please read the FAQ at

    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 13:25    [W:0.023 / U:1.732 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site