LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Slackware (https://www.linuxquestions.org/questions/slackware-14/)
-   -   Slackware box possibly infected, how do I monitor TCP connections? (https://www.linuxquestions.org/questions/slackware-14/slackware-box-possibly-infected-how-do-i-monitor-tcp-connections-4175502655/)

genss 04-25-2014 11:35 AM

yes
looking at the code it has a full, threaded server
the code is huge (has zlib and glibc included) and the coding style is all over the place (Get_File_Size, updatesrv, MySend etc; granted some could be from zlib)
there are syn and dns flood functions, a GetRandFileName function and a million more

my novice guess is it's a cross platform botnet
bdw ht, F6->elf/image if you want to check it out

funny that it makes slackware rc files (BSD style init)

edit:to add
as written in the link metaschima posted, to quote "(But I get infected after a while again, which I have not solved yet) "

if that happens, you can use audit (from SBo) to find out what brought the files back
to do this goes something like this:
auditd
auditctl -w /path/to/dir
#to add the directory to watch

then when the files are created
ausearch -f /foo/bar/file_created
#to find out what process created it

this uses the kernel audit framework
if it isn't in the log then the file was created before the daemon started

to remove a watch use auditctl -W /path/to/dir
more on http://security.blogoverflow.com/201...ion-to-auditd/

unSpawn 04-30-2014 05:46 PM

Quote:

Originally Posted by Tachtory (Post 5158847)
The above find commands turned up 2 binaries in /boot/ and 2 basic shell scripts in /init.d/ to start them

FWIW:
files/rkhunter?revision=1.508
files/signatures/RKH_iptablex.ldb?revision=1.1

Habitual 05-01-2014 03:57 PM

Quote:

Originally Posted by Tachtory (Post 5158904)
Well it seems like I'm logged in, I don't know what the problem is.

Would it be okay to just post a drop-box link in this thread?

I believe you need to have > 50 posts to send PMs.
Contact Info visibility? I don't know about that one.


All times are GMT -5. The time now is 09:11 PM.