- 論壇徽章:
- 0
|
我這里有一臺(tái)RH Linux AS 2.1的Server,最近因?yàn)橐粋�(gè)家伙的粗心新增了個(gè)巨蠢的帳號(hào)(帳號(hào)密碼都是test),結(jié)果被世界各地?zé)o數(shù)人登錄過(guò),NND ,汗啊.......
在俺發(fā)現(xiàn)這個(gè)情況時(shí)已經(jīng)是一星期以后的事了,
現(xiàn)如今機(jī)器上被開(kāi)了數(shù)個(gè)服務(wù),大部分被我關(guān)了,但是又發(fā)現(xiàn)這臺(tái)機(jī)器的好多系統(tǒng)命令被替換,如/bin/login, /bin/ps等等.這些文件我都刪不掉,更別說(shuō)替換了,提示是:Operation not permitted
 哪位高手,好心人幫幫忙啊.
我查出來(lái)的被替換掉的文件如下一大堆,看屬性的話像是正常的
-rwxr-xr-x 1 root root 32756 Mar 21 19:04 /bin/ps
/dev
/dev/log
/dev/ttyop
/dev/ttyoa
/dev/ttyof
/dev/ttyos
/proc/kmsg
find: /proc/7158/fd/4: No such file or directory
/var/log/sa/sa21
/var/log/sa/sar20
/var/log/samba/server03.log
/var/log/xferlog
/var/lock/subsys/atd
/var/lock/subsys/xinetd
/var/lock/subsys/syslog
/var/run/crontab.pid
/var/run/xinetd.pid
/var/run/syslogd.pid
/var/run/klogd.pid
/var/spool/cron
/var/spool/cron/operator
/var/tmp/local/debian
/tmp/ps
/tmp/ps
/etc/bashrc
/etc/rc.d/init.d/atd
/etc/rc.d/init.d/syslog
/etc/rc.d/init.d/functions
/etc/rc.d/init.d/xinetd
/etc/rc.d/init.d/sshd
/etc/logrotate.d
/etc/ssh/ssh_host_key
/etc/psdevtab
/etc/sshd_config
/etc/ssh_host_key
/usr
/usr/bin/dir
/usr/bin/du
/usr/bin/vdir
/usr/bin/find
/usr/bin/top
/usr/bin/killall
/usr/bin/chsh
/usr/bin/clean
/usr/bin/wp
/usr/bin/shad
/usr/bin/vadim
/usr/bin/imp
/usr/bin/slice
/usr/bin/sl2
/usr/sbin/atd
/usr/sbin/in.wuftpd
/usr/sbin/wu.ftpd
/usr/include/rpcsvc
/usr/local/games
/usr/local/games/identd
/usr/local/games/banner
/usr/local/sbin
/usr/local/sbin/sshd
/usr/doc
/usr/doc/wu-ftpd-2.6.0
/usr/doc/wu-ftpd-2.6.0/HOWTO
/usr/doc/wu-ftpd-2.6.0/examples
/usr/man
/usr/man/man1
/usr/man/man5
/usr/man/man8
/bin/netstat
/bin/ls
/bin/ps
/bin/login
/bin/shad
/root/ins/netstat
/sbin/ifconfig
/sbin/syslogd |
|
免費(fèi)注冊(cè)
發(fā)表于 2005-03-26 00:24
