/tmp/pdk ?

From: Sander Smeenk (ssmeenkat_private)
Date: Sun Aug 03 2003 - 11:16:57 PDT

  • Next message: Schrack, Robert: "RE: Pdmin / Trojaned csrss.exe"

    Hey,
    
    Has anyone ever encountered a directory 'pdk' in /tmp holding 6 .so
    files, all named after the md5sum of the contents of each file? It is
    the second time I found these files, and i'm a bit curious now. I can
    not remember putting them there, with these weird permissions etc.
    
    A little investigation:
    
    | /tmp# ls -ld pdk
    | drwxrwxrwx    2 ssmeenk  ssmeenk      1024 Jul 15 14:52 pdk
    
    | /tmp# cd pdk
    | /tmp/pdk# ls -la
    | total 137
    | drwxrwxrwx    2 ssmeenk  ssmeenk      1024 Jul 15 14:52 .
    | drwxrwxrwt    5 root     root         1024 Aug  3 20:05 ..
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     21069 Jul 15 14:52 2b474255e6f18d02414572d878982563.so
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     35870 Jul 15 14:52 31d253dcfdddd89c1e508b4a09e8ee67.so
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     20460 Jul 15 14:52 b1ade0c419de6bd306aa364daa94cf49.so
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     15400 Jul 15 14:52 b5757f9347dcf19ef7be04bcd324fb6a.so
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     21508 Jul 15 14:52 d20fad20cf5954aa58cf0023b480c5fe.so
    | -r-xr-xr-x    1 ssmeenk  ssmeenk     13779 Jul 15 14:52 e9afcd3daf9a2c3e6a3b714d9f934a90.so
     
    | /tmp/pdk# md5sum e9afcd3daf9a2c3e6a3b714d9f934a90.so
    | e9afcd3daf9a2c3e6a3b714d9f934a90  e9afcd3daf9a2c3e6a3b714d9f934a90.so
    
    | /tmp/pdk# file e9afcd3daf9a2c3e6a3b714d9f934a90.so
    | e9afcd3daf9a2c3e6a3b714d9f934a90.so: ELF 32-bit LSB shared object, Intel 
    | 80386, version 1 (SYSV), not stripped
    
    | /tmp/pdk# objdump -x e9afcd3daf9a2c3e6a3b714d9f934a90.so
    | e9afcd3daf9a2c3e6a3b714d9f934a90.so:     file format elf32-i386
    | e9afcd3daf9a2c3e6a3b714d9f934a90.so
    | architecture: i386, flags 0x00000150:
    | HAS_SYMS, DYNAMIC, D_PAGED
    | start address 0x00000b50
    | 
    | Program Header:
    |     LOAD off    0x00000000 vaddr 0x00000000 paddr 0x00000000 align 2**12
    |          filesz 0x00002500 memsz 0x00002500 flags r-x
    |     LOAD off    0x00002500 vaddr 0x00003500 paddr 0x00003500 align 2**12
    |          filesz 0x00000148 memsz 0x00000160 flags rw-
    |  DYNAMIC off    0x00002598 vaddr 0x00003598 paddr 0x00003598 align 2**2
    |          filesz 0x000000b0 memsz 0x000000b0 flags rw-
    | 
    | Dynamic Section:
    |   NEEDED      libc.so.6
    |   RPATH       
    |   INIT        0x9a8
    |   FINI        0x1f30
    |   HASH        0x94
    |   STRTAB      0x5e0
    |   SYMTAB      0x220
    |   STRSZ       0x1da
    |   SYMENT      0x10
    |   PLTGOT      0x351c
    |   PLTRELSZ    0xb0
    |   PLTREL      0x11
    |   JMPREL      0x8f8
    |   REL         0x8c0
    |   RELSZ       0x38
    |   RELENT      0x8
    |   VERDEF      0x868
    |   VERDEFNUM   0x2
    |   VERNEED     0x8a0
    |   VERNEEDNUM  0x1
    |   VERSYM      0x7f0
    | 
    | Version definitions:
    | 1 0x01 0x09bb22df ../../lib/auto/Fcntl/Fcntl.so
    | 2 0x00 0x073d10bc GCC.INTERNAL
    | 
    | Version References:
    |   required from libc.so.6:
    |     0x0d696910 0x00 03 GLIBC_2.0
    | 
    | Sections:
    | Idx Name          Size      VMA       LMA       File off  Algn
    |   0 .hash         0000018c  00000094  00000094  00000094  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   1 .dynsym       000003c0  00000220  00000220  00000220  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   2 .dynstr       0000020f  000005e0  000005e0  000005e0  2**0
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   3 .gnu.version  00000078  000007f0  000007f0  000007f0  2**1
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   4 .gnu.version_d 00000038  00000868  00000868  00000868  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   5 .gnu.version_r 00000020  000008a0  000008a0  000008a0  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   6 .rel.data     00000008  000008c0  000008c0  000008c0  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   7 .rel.got      00000030  000008c8  000008c8  000008c8  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   8 .rel.plt      000000b0  000008f8  000008f8  000008f8  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |   9 .init         0000002f  000009a8  000009a8  000009a8  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, CODE
    |  10 .plt          00000170  000009d8  000009d8  000009d8  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, CODE
    |  11 .text         000013e0  00000b50  00000b50  00000b50  2**4
    |                   CONTENTS, ALLOC, LOAD, READONLY, CODE
    |  12 .fini         0000001a  00001f30  00001f30  00001f30  2**2
    |                   CONTENTS, ALLOC, LOAD, READONLY, CODE
    |  13 .rodata       000005a0  00001f60  00001f60  00001f60  2**5
    |                   CONTENTS, ALLOC, LOAD, READONLY, DATA
    |  14 .data         00000008  00003500  00003500  00002500  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  15 .eh_frame     00000004  00003508  00003508  00002508  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  16 .ctors        00000008  0000350c  0000350c  0000250c  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  17 .dtors        00000008  00003514  00003514  00002514  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  18 .got          0000007c  0000351c  0000351c  0000251c  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  19 .dynamic      000000b0  00003598  00003598  00002598  2**2
    |                   CONTENTS, ALLOC, LOAD, DATA
    |  20 .bss          00000018  00003648  00003648  00002648  2**2
    |                   ALLOC
    |  21 .comment      00000131  00000000  00000000  00002648  2**0
    |                   CONTENTS, READONLY
    |  22 .note         00000064  00003660  00003660  00002779  2**0
    |                   CONTENTS, READONLY
    | SYMBOL TABLE:
    | 00000094 l    d  .hash	00000000              
    | 00000220 l    d  .dynsym	00000000              
    | 000005e0 l    d  .dynstr	00000000              
    | 000007f0 l    d  .gnu.version	00000000              
    | 00000868 l    d  .gnu.version_d	00000000              
    | 000008a0 l    d  .gnu.version_r	00000000              
    | 000008c0 l    d  .rel.data	00000000              
    | 000008c8 l    d  .rel.got	00000000              
    | 000008f8 l    d  .rel.plt	00000000              
    | 000009a8 l    d  .init	00000000              
    | 000009d8 l    d  .plt	00000000              
    | 00000b50 l    d  .text	00000000              
    | 00001f30 l    d  .fini	00000000              
    | 00001f60 l    d  .rodata	00000000              
    | 00003500 l    d  .data	00000000              
    | 00003508 l    d  .eh_frame	00000000              
    | 0000350c l    d  .ctors	00000000              
    | 00003514 l    d  .dtors	00000000              
    | 0000351c l    d  .got	00000000              
    | 00003598 l    d  .dynamic	00000000              
    | 00003648 l    d  .bss	00000000              
    | 00000000 l    d  .comment	00000000              
    | 00003660 l    d  .note	00000000              
    | 00000000 l    d  *ABS*	00000000              
    | 00000000 l    d  *ABS*	00000000              
    | 00000000 l    d  *ABS*	00000000              
    | 00000000 l    df *ABS*	00000000              initfini.c
    | 00000b50 l       .text	00000000              gcc2_compiled.
    | 00000000 l    df *ABS*	00000000              crtstuff.c
    | 00000b50 l       .text	00000000              gcc2_compiled.
    | 00003500 l     O .data	00000000              p.2
    | 00003514 l     O .dtors	00000000              __DTOR_LIST__
    | 00003504 l     O .data	00000000              completed.3
    | 00000b50 l     F .text	00000000              __do_global_dtors_aux
    | 00003508 l     O .eh_frame	00000000              __EH_FRAME_BEGIN__
    | 00000bac l     F .text	00000000              fini_dummy
    | 00003648 l     O .bss	00000018              object.8
    | 00000bc4 l     F .text	00000000              frame_dummy
    | 00000bf8 l     F .text	00000000              init_dummy
    | 00003508 l     O .data	00000000              force_to_data
    | 0000350c l     O .ctors	00000000              __CTOR_LIST__
    | 00000000 l    df *ABS*	00000000              crtstuff.c
    | 00001ed0 l       .text	00000000              gcc2_compiled.
    | 00001ed0 l     F .text	00000000              __do_global_ctors_aux
    | 00003510 l     O .ctors	00000000              __CTOR_END__
    | 00001f04 l     F .text	00000000              init_dummy
    | 00003508 l     O .data	00000000              force_to_data
    | 00003518 l     O .dtors	00000000              __DTOR_END__
    | 00003508 l     O .eh_frame	00000000              __FRAME_END__
    | 00000000 l    df *ABS*	00000000              initfini.c
    | 00001f30 l       .text	00000000              gcc2_compiled.
    | 00000000 l    df *ABS*	00000000              Fcntl.c
    | 00000c10 l       .text	00000000              gcc2_compiled.
    | 00000c10 l     F .text	00000de7              constant
    | 00000000         *UND*	00000000              Perl_croak
    | 00000000       F *UND*	00000035              atexit@@GLIBC_2.0
    | 00003598 g     O *ABS*	00000000              _DYNAMIC
    | 00001f30 g     O *ABS*	00000000              _etext
    | 00000000  w    F *UND*	00000074              __register_frame_info@@GLIBC_2.0
    | 00000000         *UND*	00000000              Perl_mg_set
    | 00000000         *UND*	00000000              Perl_sv_newmortal
    | 00000000         *UND*	00000000              Perl_form
    | 00000000       F *UND*	0000001b              __errno_location@@GLIBC_2.0
    | 00000000         *UND*	00000000              Perl_Tcurpad_ptr
    | 00000000         *UND*	00000000              Perl_Isv_yes_ptr
    | 000009a8 g     F .init	00000000              _init
    | 00000000       O *UND*	00000004              ___brk_addr@@GLIBC_2.0
    | 00000000         *UND*	00000000              Perl_sv_2pv
    | 00000000  w    F *UND*	000000a2              __deregister_frame_info@@GLIBC_2.0
    | 00000000         *UND*	00000000              Perl_newXS
    | 00000000         *UND*	00000000              Perl_Top_ptr
    | 00000000         *UND*	00000000              Perl_Tna_ptr
    | 00000000         *UND*	00000000              Perl_Tmarkstack_ptr_ptr
    | 00001c28 g     F .text	000002a0              boot_Fcntl
    | 00000000         *UND*	00000000              Perl_Tstack_base_ptr
    | 00000000         *UND*	00000000              Perl_get_sv
    | 00000000       F *UND*	00000094              strncmp@@GLIBC_2.0
    | 00003648 g     O *ABS*	00000000              __bss_start
    | 00000000       O *UND*	00000004              __environ@@GLIBC_2.0
    | 00001f30 g     F .fini	00000000              _fini
    | 00000000       O *UND*	00000004              __curbrk@@GLIBC_2.0
    | 000019f8 g     F .text	0000022d              XS_Fcntl_constant
    | 00000000 g     O *ABS*	00000000              GCC.INTERNAL
    | 00003648 g     O *ABS*	00000000              _edata
    | 0000351c g     O *ABS*	00000000              _GLOBAL_OFFSET_TABLE_
    | 00003660 g     O *ABS*	00000000              _end
    | 00000000         *UND*	00000000              Perl_sv_2iv
    | 00000000         *UND*	00000000              Perl_sv_setnv
    | 00000000         *UND*	00000000              Perl_Tstack_sp_ptr
    | 00000000  w      *UND*	00000000              __gmon_start__
    
    Some relevant parts from 'strings':
    
    | /tmp/pdk# strings e9afcd3daf9a2c3e6a3b714d9f934a90.so
    |
    | [ ... ]
    |
    | SEEK_CUR
    | SEEK_END
    | SEEK_SET
    | Usage: Fcntl::constant(name, arg)
    | Fcntl.c
    | XS_VERSION
    | %s::%s
    | VERSION
    | 1.03
    | bootstrap parameter
    | %s object version %s does not match %s%s%s%s %_
    | Fcntl::constant
    | /tmp/pdk#
    
    Any ideas are welcomed!
    
    Sander.
    -- 
    | If Barbie's so popular, why do you have to buy all her friends?
    | 1024D/08CEC94D - 34B3 3314 B146 E13C 70C8  9BDB D463 7E41 08CE C94D
    
    ---------------------------------------------------------------------------
    ----------------------------------------------------------------------------
    



    This archive was generated by hypermail 2b30 : Mon Aug 04 2003 - 08:28:44 PDT