On Feb 7, 2011, at 10:14 AM, m.roth@xxxxxxxxx wrote: > Nicolas Ross wrote: >> Hi ! >> >> I think one of my machine got hacked, but I can figure out from where... >> >> I found some suspicious file in /bin and /usr/bin directories that are >> owned >> by user id 122, where this machine doesn't a userid 122. >> >> So, does anyone hav a centos 3.9 install arround that can send me the info > > One of our investigators has collaborators around the world, on old > machines, so we have this: > 2.4.21-63.ELsmp #1 SMP Tue Nov 3 18:48:49 EST 2009 i686 athlon i386 GNU/Linux > Note they may be different on your machine. >> about (filesize, md5, modification date) these file : >> >> /bin : >> ls >> netstat >> ps > > -rwxr-xr-x 1 root root 67700 Jun 12 2007 /bin/ls > -rwxr-xr-x 1 root root 83800 May 22 2007 /bin/netstat > -r-xr-xr-x 1 root root 64076 Apr 19 2006 /bin/ps > > e102f6c3dde4043908ed001e1587b1d2 /bin/ls > bdfc76a24f59cc6cd8a70f771cc5cda4 /bin/netstat > fc3369b3564e00f877387a13bf3f467a /bin/ps > >> >> /usr/bin/ >> dir >> find >> md5sum >> pstree >> slocate >> tee >> top > > -rwxr-xr-x 1 root root 67700 Jun 12 2007 /usr/bin/dir > -rwxr-xr-x 1 root root 51028 Jan 11 2006 /usr/bin/find > -rwxr-xr-x 1 root root 29184 Jun 12 2007 /usr/bin/md5sum > -rwxr-xr-x 1 root root 14048 Apr 28 2006 /usr/bin/pstree > > 0df0aafb355df40b1137355dd354f172 /usr/bin/dir > 2c5f4e789da1ad8d19ce5c68ecf8261d /usr/bin/find > 03174f884e7fc5fbc215780819679f6e /usr/bin/md5sum > 224f527255b2c8deb44f692eaadc873d /usr/bin/pstree > 0cee754c3981ba5f527bedc9a8cbea2a /usr/bin/slocate > 4ed536310a845f274f6a1611773789d8 /usr/bin/tee > 6b42bf37296861c657fcf6b8dba8f675 /usr/bin/top > > <snip> > > Hope this helps. > > mark Our internal, not internet connected fully patch Cent 3 box exactly matches what Mark posted. [dkrause@rigil bin]$ ls -lat ls netstat ps -rwxr-xr-x 1 root root 67700 Jun 12 2007 ls -rwxr-xr-x 1 root root 83800 May 22 2007 netstat -r-xr-xr-x 1 root root 64076 Apr 19 2006 ps e102f6c3dde4043908ed001e1587b1d2 /bin/ls bdfc76a24f59cc6cd8a70f771cc5cda4 /bin/netstat fc3369b3564e00f877387a13bf3f467a /bin/ps [dkrause@rigil bin]$ ls -la dir find md5sum pstree slocate tee top -rwxr-xr-x 1 root root 67700 Jun 12 2007 dir -rwxr-xr-x 1 root root 51028 Jan 11 2006 find -rwxr-xr-x 1 root root 29184 Jun 12 2007 md5sum -rwxr-xr-x 1 root root 14048 Apr 28 2006 pstree -rwxr-sr-x 1 root slocate 32480 Sep 28 2005 slocate -rwxr-xr-x 1 root root 12220 Jun 12 2007 tee -r-xr-xr-x 1 root root 48052 Apr 19 2006 top 0df0aafb355df40b1137355dd354f172 dir 2c5f4e789da1ad8d19ce5c68ecf8261d find 03174f884e7fc5fbc215780819679f6e md5sum 224f527255b2c8deb44f692eaadc873d pstree 0cee754c3981ba5f527bedc9a8cbea2a slocate 4ed536310a845f274f6a1611773789d8 tee 6b42bf37296861c657fcf6b8dba8f675 top Good luck! -- Don Krause
<<attachment: smime.p7s>>
_______________________________________________ CentOS mailing list CentOS@xxxxxxxxxx http://lists.centos.org/mailman/listinfo/centos
