Exploit or trojan
"Darren Young" <[email protected]>
| Newsgroups | gmane.comp.security.sun |
|---|---|
| Message-ID | <[email protected]> |
Anyone know of any exploits that create the following tree in /tmp?
The user for id 59659 is in NIS as "oracle", however we're not running
Oracle anywhere. I believe they had the Oracle account out there for a test
of some type.
How can I grab a copy of the file, cp won't work on it.:
./ / / / \ \ /.admin/.noremove/ /thx/-- 15000 ---
gsbnufac:[root]> find . -exec ls -lan {} \;
total 40
drwxr-xr-x 3 59659 10 512 Nov 19 01:10
drwxrwxrwt 4 0 3 1024 Dec 12 07:48 .
drwxr-xr-x 28 0 0 1024 Oct 20 13:58 ..
drwx------ 2 0 0 8192 Jun 13 2003 lost+found
-rw-rw-r-- 1 0 3 8872 Dec 11 15:37 ps_data
total 18
drwx------ 2 0 0 8192 Jun 13 2003 .
drwxrwxrwt 4 0 3 1024 Dec 12 07:48 ..
-rw-rw-r-- 1 0 3 8872 Dec 11 15:37 ./ps_data
total 6
drwxr-xr-x 3 59659 10 512 Nov 19 01:10
drwxr-xr-x 3 59659 10 512 Nov 19 01:10 .
drwxrwxrwt 4 0 3 1024 Dec 12 07:48 ..
total 6
drwxr-xr-x 5 59659 10 512 Nov 19 01:11
drwxr-xr-x 3 59659 10 512 Nov 19 01:10 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:10 ..
total 10
drwxr-xr-x 2 59659 10 512 Nov 19 01:11 \
drwxr-xr-x 2 59659 10 512 Nov 19 01:11 \ \
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 \ \
drwxr-xr-x 5 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:10 ..
total 4
drwxr-xr-x 2 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 5 59659 10 512 Nov 19 01:11 ..
total 4
drwxr-xr-x 2 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 5 59659 10 512 Nov 19 01:11 ..
total 6
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 5 59659 10 512 Nov 19 01:11 ..
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .admin
total 6
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 ..
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .noremove
total 6
drwxr-xr-x 3 59659 10 512 Nov 19 01:11
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 ..
total 6
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 ..
drwxr-xr-x 2 59659 10 512 Nov 19 01:14 thx
total 26516
-rw-r--r-- 1 59659 10 13565952 Nov 19 01:14 -- 15000 ---
drwxr-xr-x 2 59659 10 512 Nov 19 01:14 .
drwxr-xr-x 3 59659 10 512 Nov 19 01:11 ..
-rw-r--r-- 1 59659 10 13565952 Nov 19 01:14 ./ / / / \ \
/.admin/.noremove/ /thx/-- 15000 ---
Procs that are running on the machine right now, although I'm not sure if I
can trust the "ps" command.
UID PID PPID C STIME TTY TIME CMD
root 0 0 0 Aug 20 ? 0:18 sched
root 1 0 0 Aug 20 ? 0:06 /etc/init -
root 2 0 0 Aug 20 ? 0:01 pageout
root 3 0 0 Aug 20 ? 65:16 fsflush
root 544 1 0 Aug 20 ? 0:00 /usr/lib/saf/sac -t 300
root 9499 1 0 Nov 19 console 0:00 /usr/lib/saf/ttymon -g -h -p
gsbnufac console login: -T sun -d /dev/console -l
root 23099 1 0 Dec 05 ? 0:00 /usr/bin/dsmcad
root 293 1 0 Aug 20 ? 0:10 /usr/sbin/rpcbind
root 64 1 0 Aug 20 ? 0:00 /usr/lib/sysevent/syseventd
root 117 1 0 Aug 20 ? 0:00 /usr/lib/picl/picld
root 342 1 0 Aug 20 ? 3:14 /usr/lib/autofs/automountd
root 296 1 0 Aug 20 ? 0:00 /usr/sbin/keyserv
root 329 1 0 Aug 20 ? 0:14 /usr/sbin/inetd -s
daemon 330 1 0 Aug 20 ? 0:00 /usr/lib/nfs/statd
root 336 1 0 Aug 20 ? 0:00 /usr/lib/nfs/lockd
root 306 1 0 Aug 20 ? 0:00 /usr/lib/netsvc/yp/ypbind
root 392 1 0 Aug 20 ? 1:24 /usr/lib/inet/xntpd
root 27789 27738 0 07:48:24 pts/1 0:00 bash
root 8644 1 2 Oct 20 ? 807:44 /usr/sbin/cupsd
root 492 1 0 Aug 20 ? 0:00
/usr/lib/efcode/sparcv9/efdaemon
root 358 1 0 Aug 20 ? 1:56 /usr/sbin/syslogd
root 468 1 0 Aug 20 ? 0:00
/usr/lib/osa/bin/sparcv9/rdaemon 32 270 5
root 361 1 0 Aug 20 ? 0:05 /usr/sbin/cron
root 476 468 0 Aug 20 ? 0:01
/usr/lib/osa/bin/sparcv9/rdaemon 32 270 5
root 401 1 0 Aug 20 ? 0:00 /usr/lib/power/powerd
root 481 1 0 Aug 20 ? 0:02 /usr/sbin/vold
root 408 1 0 Aug 20 ? 0:02 /usr/lib/utmpd
root 548 544 0 Aug 20 ? 0:00 /usr/lib/saf/ttymon
root 526 1 0 Aug 20 ? 0:00 /usr/lib/nfs/mountd
root 453 1 0 Aug 20 ? 4:56 /usr/lib/osa/bin/arraymon
root 528 1 0 Aug 20 ? 0:00 /usr/lib/nfs/nfsd -a 16
root 27840 27789 1 08:18:04 pts/1 0:00 ps -eaf
lp 8661 8644 0 Oct 20 ? 20:59 cups-polld 128.135.130.121
631 30 631
root 1603 1 0 Oct 13 ? 9:06 /opt/sbin/sshd
root 27735 1603 0 07:47:16 ? 0:00 /opt/sbin/sshd
root 27738 27735 0 07:47:19 pts/1 0:00 -sh