[CentOS] I appear to be attacking others
John Hinton
webmaster at ew3d.com
Sun Feb 5 10:37:29 UTC 2006
James Pifer wrote:
>On Sun, 2006-02-05 at 10:23 +0100, Ralph Angenendt wrote:
>
>
>>James Pifer wrote:
>>
>>
>>>On Sun, 2006-02-05 at 10:01 +0100, Ralph Angenendt wrote:
>>>
>>>
>>>>Can you do an "ls -lah /dev/shm/..\ /"?
>>>>
>>>>
>>>Yep, I get:
>>>
>>>
>>>drwxr-xr-x 2 hotmail hotmail 180 Feb 6 2005 nt
>>>
>>>
>>And now please the contents of this directory ...
>>
>>
>
>
>Contents are:
>
># pwd
>/dev/shm/.. /nt
># ls -l
>total 76
>-rwxr-xr-x 1 hotmail hotmail 22400 Feb 6 2005 f
>-rw-r--r-- 1 hotmail hotmail 17266 Nov 1 2004 f.c
>-rw-r--r-- 1 hotmail hotmail 2574 Feb 5 02:22 log
>-rw-r--r-- 1 hotmail hotmail 16122 Jun 9 2005 pass
>-rw-r--r-- 1 hotmail hotmail 109 Feb 6 2005 README
>-rwxr-xr-x 1 hotmail hotmail 64 Feb 6 2005 s
>-rw-r--r-- 1 hotmail hotmail 59 Jun 9 2005 users
>
>James
>
>
You might want to do a ls -al on that directory, as I've seen hackers
use hidden files or directories which don't show using just -l. Also,
you might want to take a look in the usual suspects, like /tmp..
/var/tmp.. again, ls -al to see if you can find anything perhaps left
for later use.
Gee.. ain't it fun?
John Hinton
More information about the CentOS
mailing list