RE: lsof t0rn problem

["matt willson" <mwillson () sbcglobal net>]

Back in the blackhat days, I do recall toying with t0rn and another kit
very similar from some uk group I owned. Both had similar problems,
espicially the ps trojan, and lsof. Don't know if it was fixed in a
later release ( this was 4+ years ago) but it does look to be a clueless
script kid, who doesn't know his shits not working. As far as ownership
of lsof heres paste of one of the boxes I run which is FreeBSD 4.8. As a
side note, FreeBSD 5.0 requires suid to actually use the program by
default.

[(02:19 PM)] [(root@lithium)] [(/usr/local/sbin)] # ls -all | grep lsof
-rwxr-sr-x   1 root  kmem    107692 Apr 22 19:57 lsof

Hope this can be some help
As a side note, FreeBSD 5.0 requires suid to actually use the program by
default.

-----Original Message-----
From: Earnest [mailto:earnest () photoasp net] 
Sent: Sunday, June 22, 2003 7:14 AM
To: security-basics () securityfocus com
Subject: lsof t0rn problem

Hello All,

This morning I had some problems on the server, so I started to
investigate and found out that libncurses.so.4 was missing... I
recently upgraded mysql from 3.53 to 4.0.13 but that was it!

Okay, I did ln -s libncurses.so.5.2 libncurses.so.4

This quick fix resolved some problems. Then I ran chkrootkit and found
out that some of the files are (might be) infected with t0rn... Which
might be no problem, because chkrootkit checks libncurses as far as I
know.

To make sure, I ran lsof, and no was no output at all. ls -la
/usr/sbin/lsof told me that a different user (other than root) owned
lsof... I downloaded a clean version of lsof, compiled, ran but the
output seemed usual, no suspicious files or ports.

Besides, the /usr/sbin/lsof had a "sia" set of attributes (which did
not allow root to unlink the file of top of that)... I changed that,
and replaced the suspicious binary with a freshly compiled one.

The question is: is it a hacker attack? or some buggy software??
(mysql?)

has anyone come across weird things like this?

regards Earnest



------------------------------------------------------------------------
---
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top
analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access
in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
------------------------------------------------------------------------
----


---------------------------------------------------------------------------
Evaluating SSL VPNs' Consider NEOTERIS, chosen as leader by top analysts!
The Gartner Group just put Neoteris in the top of its Magic Quadrant,
while InStat has confirmed Neoteris as the leader in marketshare.
     
Find out why, and see how you can get plug-n-play secure remote access in
about an hour, with no client, server changes, or ongoing maintenance.
          
Visit us at: http://www.neoteris.com/promos/sf-6-9.htm
----------------------------------------------------------------------------