Re: linux hack

From: H D Moore (hdmat_private)
Date: Mon May 14 2001 - 01:20:23 PDT

  • Next message: Devdas Bhagat: "Re: a lot of spoofed traffic for port 8, does anybody recon this?"

    That would be 1ion + ramen, check out:
    http://www.whitehats.com/library/worms/lion/index.html
    
    
    On Wednesday 09 May 2001 05:34 pm, Corch wrote:
    > I was recently called out to a site run by an aquaintence of mine to have
    > a look at some machines that were causing some problems. On rebooting one
    > of the machines I saw the following messages
    >
    > INIT: entering run level 3
    > /bin/nice ./scan.sh not found
    > /bin/nice ./hack.sh not found
    >
    >
    > I'm almost certain the box has been rootkit'd, im just not sure which one,
    > anyone able to give me some clues?
    >
    > Corch
    



    This archive was generated by hypermail 2b30 : Mon May 14 2001 - 10:58:48 PDT