full-disclosure - a little help needed with identifying a rootkit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1074019285.26683.66.camel@coruscant.weisserth.net>
From: tobias at weisserth.de (Tobias Weisserth)
Subject: a little help needed with identifying a rootkit

Hello everybody,

The SuSE security lists is having a little discussion about a possible
hacked SuSE 8.2 machine. The machine is running a pre-7 PHPNuke CMS
which could be the entryway for the injection. There is a rather big
chance the system has been injected a script which downloaded stuff from
here:

http://218.234.171.84/manual/.x/

The biggest file you can find on this machine in this directory is a
gzipped file which probably contains a rootkit of some sort. The SuSE
list is still trying to figure out what the rest does/is and how this
fits into the "big picture".

So, if you are in the mood to play around a little it would be really
interesting what you may have say about the stuff in this directory.

thanks a lot,
Tobias W.