[윤동만]님이 남기신 글:
>ROOTDIR is `/'
>Checking `amd'... Not vulnerable
>Checking `basename'... Not vulnerable
>Checking `biff'... Not vulnerable
>Checking `chfn'... Not vulnerable
>Checking `chsh'... Not vulnerable
>Checking `cron'... Not vulnerable
>Checking `date'... Not vulnerable
>Checking `du'... Not vulnerable
>Checking `dirname'... Not vulnerable
>Checking `echo'... Not vulnerable
>Checking `egrep'... Not vulnerable
>Checking `env'... Not vulnerable
>Checking `find'... Not vulnerable
>Checking `fingerd'... Not vulnerable
>Checking `gpm'... Not vulnerable
>Checking `grep'... Not vulnerable
>Checking `su'... Not vulnerable
>Checking `ifconfig'... Not vulnerable
>Checking `inetd'... Not vulnerable
>Checking `identd'... Not vulnerable
>Checking `killall'... Not vulnerable
>Checking `login'... Not vulnerable
>Checking `ls'... Not vulnerable
>Checking `mail'... Not vulnerable
>Checking `mingetty'... Not vulnerable
>Checking `netstat'... Not vulnerable
>Checking `named'... Not vulnerable
>Checking `passwd'... Not vulnerable
>Checking `pidof'... Not vulnerable
>Checking `pop2'... NOT TESTED
>Checking `pop3'... NOT TESTED
>Checking `ps'... Not vulnerable
>Checking `pstree'... Not vulnerable
>Checking `rpcinfo'... Not vulnerable
>Checking `rlogind'... Not vulnerable
>Checking `rshd'... Not vulnerable
>Checking `slogin'... NOT TESTED
>Checking `sendmail'... Not vulnerable
>Checking `sshd'... Not vulnerable
>Checking `syslogd'... Not vulnerable
>Checking `tar'... Not vulnerable
>Checking `tcpd'... Not vulnerable
>Checking `top'... Not vulnerable
>Checking `telnetd'... Not vulnerable
>Checking `timed'... Not vulnerable
>Checking `traceroute'... Not vulnerable
>Checking `write'... Not vulnerable
>Checking `asp'... Not vulnerable
>Checking `bindshell'... Not vulnerable
>Checking `z2'... Checking `wted'... Nothing deleted
>Checking `rexedcs'... Not vulnerable
>Checking `sniffer'...
>eth0 is not promisc
>Checking `aliens'... No suspect files
>Searching for sniffer's logs, it may take a while... Nothing found
>Searching for t0rn's default files and dirs... Nothing found
>Searching for t0rn's v8 defaults... Possible t0rn v8 (or variation) rootkit installed
>Searching for Lion Worm default files and dirs... Nothing found
>Searching for RSHA's default files and dir... Nothing found
>Searching for RH-Sharpe's default files... Nothing found
>Searching for Ambient's rootkit (ark) default files and dirs... Nothing found
>Searching for suspicious files and dirs, it may take a while...
>/usr/lib/perl5/site_perl/5.005/i386-linux/auto/Image/Magick/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/MD5/.packlist /usr/lib/perl5/site_perl/5.005/i386-linux/auto/mod_perl/.packlist /usr/lib/perl5/5.00503/i386-linux/.packlist /usr/lib/linuxconf/install/gnome/.directory /usr/lib/linuxconf/install/gnome/.order /usr/man/man1/panz/psybnc/tools/.chk /lib/modules/2.2.16-3/.rhkmvtag
>
>Searching for LPD Worm files and dirs... Nothing found
>Searching for Ramen Worm files and dirs... Nothing found
>Searching for Maniac files and dirs... Nothing found
>Searching for RK17 files and dirs... Nothing found
>Searching for Adore Worm... Nothing found
>Searching for ShitC Worm... Nothing found
>Searching for Omega Worm... Nothing found
>Searching for anomalies in shell history files... Warning: `//root/.gnome-desktop/홈 디렉토리
>//root/.gnome-desktop/cdrom
>//root/.gnome-desktop/fd0' is linked to another file
>Checking `lkm'... You have 1 process hidden for readdir command
>You have 1 process hidden for ps command
>Warning: Possible LKM Trojan installed
>
>안녕하세요
>전 레드헷6,2에 커널은 Kernel 2.2.16-3 버젼인데 아무래도 해킹당한것
>같아서 이렇게 루트킷을 돌려보았습니다.
>이렇게 돌리는게 맞는지도 잘 모르는 초보입니다.
>여하튼 돌려보니 이렇게 메세지가 나오는데 제가 무슨말인지 잘 몰라서.
>이것 해킹당한것 맞죠
>명령어도 이것저것 (예를들어 top 도 setuid) 로 되어있고 안되는명령어도
>있고 해서...
>죄송하지만 루트킷돌린결과가 이렇게 나왔고 이것이 무엇을 의미하는지 좀
>가르쳐 주십시요.
>좋은날들 되십시요...
========================================
답변이 너무 늦었군요.
일단
xxx Nothing found
xxx vulnerable
xxx NOT TESTED
xxx Nothing detected
이런 메시지는 이상없다는 의미입니다.
다만,
>Checking `lkm'... You have 1 process hidden for readdir command
>You have 1 process hidden for ps command
>Warning: Possible LKM Trojan installed
이 메시지가 의심이 나는군요..
Checking `lkm'... Nothing detected
이렇게 나와야 이상이 없다는 것인데...
시스템이 크랙킹 당했다고 생각이 조금이라도 든다면
시스템을 다시 설치하시길 바랍니다.
제가 봐서는 다시설치해야할것 같군요...
답변이 늦어서 죄송합니다. |
오늘은 대한입니다.
/board/delete.php:소스보기 
