Discovered 'evesdrop.pl' in my root folder!

jgombos · 08-24-2003, 06:45 PM

I just discovered a file in my root folder called evesdrop.pl. It's pretty scary. I don't know perl, and I don't have a clue what this thing does, but it has world execute permission. It was created 10/2002, and I'm just now discovering it because I haven't had to login as root much at all, and when I do, I don't check my directory.

Here is what evesdrop.pl does:

Code:

#!/usr/local/bin/perl
 
open (OUTPUT, "|cat -v");
select(OUTPUT);
$| = 1;
 
while (<>) {
  if (/^\s/) {
    chop;
    s/\s//g;
    while ($_) {
      ($hex, $_) = /^(..)(.*)$/;
      $byte = hex($hex);
      print pack("c", $byte);
    }
  } else {
    print "\n\n";
    print;
  }
}

What could this file do? I'm the only one that uses this machine, and the only other users on the LAN are my roommates (whom I trust- and they don't have accounts). I'm figuring this is an outside attack. Any ideas?

neilcpp · 09-02-2003, 07:46 PM

...I dont know what it does, but i would check your disribution & see if it is a legitimate 'program'. Failing that, could you not do a clean re-install? If your system security has been compromised you never know what other nasty surprises might be hidden away in there...

unSpawn · 09-03-2003, 02:49 AM

What could this file do?
What this Perl script does is output the contents from an input file and if it encounters a line starting with "\s" it'll print the line to stdout and strip the chars, else it will print two EOL's to stdout. As "standalone app" I can see no harm in the script, but I can't offer any guess either whether it being there is proof of suspicious activity, outright compromise or not.

I agree with Neilcpp you should check your distro's packages to find this file as a legitimate part of some app, if not zip it up and see what happens. If you had configured and used any filesystem integrity scanner (Aide, Samhain, tripwire etc etc) you would have been alerted to this kind of files appearing and could have investigated it right away.

I disagree with Neilcpp this isolated anomaly is grounds enough to warrant a reinstall, but you should comb over your systems, pinpoint any anomalies wrt unusual system behaviour or missing/appearing files. If you have suspicions, use your distro's rescue disk/cd, tomsrtbt, knoppix or whatever instead of booting the suspected system, and run Chkrootkit(.org) in any case.

Be sure to post any anomalies (you think could be related) so we can help you in verifying the integrity of your systems.