unable to create any directory that uses numbers as the directory name

Thread Tools Search this Thread
Top Forums UNIX for Advanced & Expert Users unable to create any directory that uses numbers as the directory name
# 8  
Old 12-15-2007
Does anybody have a copy of the 'mount' binary which was on these systems? Even a copy from backup is fine. I honestly suspect a rootkit being involved in this issue as I have seen it before. Looks like a number of binaries are involved, mount being one of them (due to how early it is called during bootup).

If you do have a copy from these systems, I would recommend you examine the impacted system's from another good kernel and then look for the binaries. You should find the 'mount' binary, another mount binary with what looks like a hash string appended to the end of the name, and then another empty mount file with another hash appended to the name. This seems to be the indicator that the system truly is infected.

Please post the binary to this forum, or PM me if you can supply me with a copy for analysis. I am interested to know if this is the same exact MD5 hash I found or not. Would really like to identify this particular rootkit and get some signatures out there so other people can find it easier.
# 9  
Old 12-17-2007
our compromised system

We're having this problem as well, also on RHEL4. Does anyone have an idea of how their machines were compromised initially? We don't want to open up the same vulnerability again. I've attached the three /bin/mount* files we found on the compromised machine. There were other similarly compromised binaries as well, such as touch, basename and cat.

Moderator's note: I have just approved the attachment so it should now be available for downloading. Download it with caution! It is suspected of being malware. --- Perderabo

Last edited by Perderabo; 12-17-2007 at 08:25 PM.. Reason: Approve attachment
# 10  
Old 12-17-2007
Rootkit with infected mount binary

Our system are compromised with this rootkit. We followed the recommendation from Hookups and found the mount binary with what looks like a hash string appended to the end. We could not find any infor about this on the internet. If you have any additional information regarding this root kit please let us know. Your help is greatly appreciated.

# 11  
Old 12-18-2007
This is not certain to be the same rootkit, this is pretty much standard MO for a rootkit.

This article is helpful on the subject of cleanup and evidence gathering:
# 12  
Old 12-18-2007
The posted binary is not the exact same as md5sums do not match. However, the file size is spot on. Also the same characteristics. Namely, the binary looks to be broken, but still loadable by the linux kernel:

[badfile@host badfiles]$ readelf -a ./mount
ELF Header:
Magic: 7f 45 4c 46 00 00 00 00 00 00 00 00 00 00 00 00
Class: none
Data: none
Version: 0
OS/ABI: UNIX - System V
ABI Version: 0
Type: EXEC (Executable file)
Machine: Intel 80386
Version: 0x1
Entry point address: 0x1df26054
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x0
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 1
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0

There are no sections in this file.

There are no section groups in this file.

Program Headers:
Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align
LOAD 0x000000 0x1df26000 0x1df26000 0x8453f 0x13e000 RWE 0x1000

There is no dynamic section in this file.

There are no relocations in this file.

There are no unwind sections in this file.

No version information found in this file.
[badfile@host badfiles]$ objdump -d ./mount
objdump: ./mount: File format not recognized
[badfile@host badfiles]$ file ./mount
mount: ELF invalid class invalid byte order (SYSV)

strace as unprivileged user show one system call to 'sysinfo()' with the argument of '0'. It returns an error:

[badfile@host evil_mount]$ strace ./mount
execve("./mount", ["./mount"], [/* 22 vars */]) = 0
sysinfo(0) = -1 EFAULT (Bad address)

Going to look further into the binary from an analysis workstation I have setup and see if I can get any more information.

# 13  
Old 12-18-2007
I appreciate any additional information you find on this rootkit.

# 14  
Old 12-28-2007
Does anyone have anymore information on this one, as I seem to have it on one of my servers...

Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Create directory and sub-directory with awk and bash

In the below I am trying to create a parent directory using the R_2019 line from f1 if what above it is not empty. I then create sub-directories under each parent if there is a match between $2 of f1 and $2. Inside each sub-folder the matching paths in $3 and $4 in f2are printed. If there is no... (2 Replies)
Discussion started by: cmccabe
2 Replies

2. Shell Programming and Scripting

Shell script cannot create directory and move the file to that directory

I have a script, which is checking if file exists and move it to another directory if then mkdir -p ${LOCL_FILES_DIR}/cool_${Today}/monthly mv report_manual_alloc_rpt_A_I_ASSIGNMENT.${Today}*.csv ${LOCL_FILES_DIR}/cool_${Today}/monthly ... (9 Replies)
Discussion started by: digioleg54
9 Replies

3. Shell Programming and Scripting

Unable to cd to a directory

I am getting the below error when cd to a directory. cd /u/Mont /bin/ksh: cd: /u/Mont: ls -ltrd /u/Mont lrwxrwxrwx 1 user1 testuser 5 Dec 1 11:39 /u/Mont -> Mont uname -a SunOS mymac 5.11 11.2 sun4v sparc sun4v Can you please resolve the error and explain why is it... (1 Reply)
Discussion started by: mohtashims
1 Replies

4. Shell Programming and Scripting

How Create new directory and move files to that directory.?

Hi All, We have main directory called "head" under this we have several sub directories and under these directories we have sub directories. My requirement is I have to find the SQL files which are having the string "procedure" under "head" directory and sub directories as well. And create... (14 Replies)
Discussion started by: ROCK_PLSQL
14 Replies

5. Shell Programming and Scripting

List files with date, create directory, move to the created directory

Hi all, i have a folder, with tons of files containing as following, on /my/folder/jobs/ some_name_2016-01-17-22-38-58_some name_0_0.zip.done some_name_2016-01-17-22-40-30_some name_0_0.zip.done some_name_2016-01-17-22-48-50_some name_0_0.zip.done and these can be lots of similar files,... (6 Replies)
Discussion started by: charli1
6 Replies

6. Linux

Unable to change the permission for directory

unable to chnage the ownership as group does not exist ls -ltr drwxr-xr-x 2 1520291 remote 1024 Sep 25 2014 img root@servername#chown content:remote img chown: img: Not owner (1 Reply)
Discussion started by: raghur77
1 Replies

7. Solaris

Unable to create or delete a directory in /usr with root user

Hi All, I am trying to uninstall jdk 1.5 from my Solaris 10 64 bit but some how was not successful.so tried to delete the folder of jdk from /usr but its throughing error as: Unable to remove directory jdk: Read-only file system Even I tried to create a dir in /usr but its not allowing me... (4 Replies)
Discussion started by: Pshah
4 Replies

8. Homework & Coursework Questions

Create script to add user and create directory

first off let me introduce myself. My name is Eric and I am new to linux, I am taking an advanced linux administration class and we are tasked with creating a script to add new users that anyone can run, has to check for the existence of a directory. if the directory does not exist then it has... (12 Replies)
Discussion started by: pbhound
12 Replies

9. Solaris

unable to open directory from user

when ever i trying to give df -k from user showing permisson denied for one directory named samba.if i trying to give from root user samba directory is opening. shut@praveen#df -k df: cannot statvfs /samba/tcgt_tendering: Permission denied if i give from root user (df -k) ... (4 Replies)
Discussion started by: tv.praveenkumar
4 Replies

10. UNIX for Dummies Questions & Answers

unable to create directory in /apps

well, I'm completely stumped so I'm hopeful that someone here may have an answer...one of my development machines is running Solaris 8 and I've been trying to create a folder in /apps. it gives me this message: mkdir: Failed to make directory "*******"; Operation not applicable I've tried... (2 Replies)
Discussion started by: jkrotz
2 Replies
Login or Register to Ask a Question