rootkit으로 점검한 결과입니다. 어떻게 치료해야하는지요?

본문

최저가 서버호스팅 제공 : 85,000원/월

이렇게 치료를 하면되요.

정말 치료 경험이 있어 올립니다.

1. the most common thing you will see is when you run ls you will see this,

Quote:

ls: unrecognized prefix: do ls: unparsable value for LS_COLORS environment variable.

2. Next try restarting syslog

Quote:

/etc/init.d/syslog restart Shutting down kernel logger: [ OK ] Shutting down system logger: [ OK ] Starting system logger: [FAILED] Starting kernel logger: [ OK ] 3. Run CHkrootkit

Some info on what the rootkit installs/does:

Configuration files
/usr/include/file.h (for file hiding)
/usr/include/proc.h (for ps proc hiding)
/lib/lidps1.so (for pstree hiding)
/usr/include/hosts.h (for netstat and net-hiding)
/usr/include/log.h (for log hiding)
/lib/lblip.tk/ (backdoored ssh configuration files are in this directory)
/dev/sdr0 (systems md5 checksum)
/lib/ldd.so {placing tks(sniffer), tkp(parser) and tksb(log cleaner)}


Infected Binaries:
top, ps, pstree lsof, md5sum, dir, login, encrypt,ifconfig,find,ls,slocate,
tks,tksb,top,tkpnetstat,pg,syslogd,sz

Infected Librairies:
libproc.a,libproc.so.2.0.6,libproc.so

BackDoor which is located at /lib/lblip.tk:

shdc
shhk.pub
shk
shrs



Lets remove this bugger

Start by editing the /etc/rc.d/rc.sysinit, at the bottom you will see simular lines to:

Quote:

# Xntps (NTPv3 daemon) startup.. /usr/sbin/xntps -q

Remove them, this is the backdoor they installed. Addtionally run

Quote:

netstat -lntpe | grep xntps find the pid and kill -9 PIDNUMBER

Reinstall, needed binarys ( you will need to search for these you can also install from WHM ):

Quote:

procps*.rpm psmisc*.rpm findutils*.rpm fileutils*.rpm util-linux*.rpm net-tools*.rpm textutils*.rpm sysklogd*.rpm

Remove their files:

cd /lib
rm -rf lblip.tk
rm -rf /usr/include/file.h
rm -rf /usr/include/proc.h
rm -rf /lib/lidps1.so
rm -rf /usr/include/hosts.h
rm -rf /usr/include/log.h
rm -rf /dev/sdr0
rm -rf /lib/ldd.so


Recompile your kernel, make sure you do this.

Reboot the server.


Run CHkrootkit again.

국내 최저가 네이버클라우드 서버 제공 : 88,000원/월

관련자료

• 이전
  rootkit으로 점검한 결과입니다. 어떻게 치료해야하는지요?

  작성일 2003.10.18 16:43
• 다음
  ASP와 COM+를 이용한 Group Ware를 소개합니다.

  작성일 2003.10.18 10:50